feat: add local auth billing and usage management

lib/server/auth/password.ts

@@ -1,4 +1,26 @@
-import { createCipheriv } from "node:crypto";
+import { createCipheriv, randomBytes, scrypt as nodeScrypt, timingSafeEqual } from "node:crypto";
+import { promisify } from "node:util";
+
+const scrypt = promisify(nodeScrypt);
+
+const LOCAL_PASSWORD_KEY_LENGTH = 64;
+
+export type LocalPasswordHash = {
+  hash: string;
+  salt: string;
+};
+
+export async function hashLocalPassword(password: string, salt = randomBytes(16).toString("hex")): Promise<LocalPasswordHash> {
+  const derived = await scrypt(password, salt, LOCAL_PASSWORD_KEY_LENGTH) as Buffer;
+  return { hash: derived.toString("hex"), salt };
+}
+
+export async function verifyLocalPassword(password: string, hash: string, salt: string): Promise<boolean> {
+  if (!password || !hash || !salt) return false;
+  const derived = await scrypt(password, salt, LOCAL_PASSWORD_KEY_LENGTH) as Buffer;
+  const expected = Buffer.from(hash, "hex");
+  return expected.length === derived.length && timingSafeEqual(expected, derived);
+}
 
 export function prepareAuthPassword(password: string, input: {
   passwordEncrypted?: boolean;