feat: add reusable password hashing utilities

apps/api/package.json

@@ -57,6 +57,7 @@
     "@nestjs/cli": "^11.0.0",
     "@nestjs/schematics": "^11.0.0",
     "@nestjs/testing": "^11.0.1",
+    "@types/bcrypt": "^5.0.2",
     "@types/bip32": "^2.0.4",
     "@types/cron": "^2.4.3",
     "@types/express": "^5.0.0",

apps/api/src/auth/auth.service.ts

@@ -1,9 +1,9 @@
 import { Injectable, BadRequestException, UnauthorizedException } from '@nestjs/common';
-import * as bcrypt from 'bcrypt';
 import { JwtService } from '@nestjs/jwt';
 import { PrismaService } from '../prisma/prisma.service';
 import { RegisterMerchantDto } from './dto/register-merchant.dto';
 import { LoginMerchantDto } from './dto/login-merchant.dto';
+import { comparePassword, hashPassword } from './password.util';
 
 @Injectable()
 export class AuthService {
@@ -26,7 +26,7 @@ export class AuthService {
     const existing = await this.prisma.merchant.findUnique({ where: { email: dto.email } });
     if (existing) throw new BadRequestException('Email already in use');
 
-    const hash = await bcrypt.hash(dto.password, 12);
+    const hash = await hashPassword(dto.password);
 
     const merchant = await this.prisma.merchant.create({
       data: { email: dto.email, passwordHash: hash },
@@ -39,7 +39,7 @@ export class AuthService {
     const merchant = await this.prisma.merchant.findUnique({ where: { email: dto.email } });
     if (!merchant) throw new UnauthorizedException('Invalid credentials');
 
-    const ok = await bcrypt.compare(dto.password, merchant.passwordHash);
+    const ok = await comparePassword(dto.password, merchant.passwordHash);
     if (!ok) throw new UnauthorizedException('Invalid credentials');
 
     const payload = { merchant_id: merchant.id };

apps/api/src/auth/password.util.ts

@@ -0,0 +1,11 @@
+import * as bcrypt from 'bcrypt';
+
+const SALT_ROUNDS = 12;
+
+export function hashPassword(password: string): Promise<string> {
+  return bcrypt.hash(password, SALT_ROUNDS);
+}
+
+export function comparePassword(password: string, hash: string): Promise<boolean> {
+  return bcrypt.compare(password, hash);
+}