Add local authentication option (#37)

Co-authored-by: Shaun Campbell <shaun@campbellwireless.net>
Reviewed-on: #37
Co-authored-by: AI Agent <ai-agent@campbellwireless.net>
Co-committed-by: AI Agent <ai-agent@campbellwireless.net>

src/auth.ts

@@ -1,6 +1,8 @@
 import { SvelteKitAuth } from '@auth/sveltekit';
+import Credentials from '@auth/core/providers/credentials';
 import { env } from '$env/dynamic/private';
 import { upsertUserFromAuth } from '$lib/server/users.js';
+import { verifyLocalCredentials } from '$lib/server/local-auth.js';
 
 export const { handle, signIn, signOut } = SvelteKitAuth({
 	providers: [
@@ -19,11 +21,34 @@ export const { handle, signIn, signOut } = SvelteKitAuth({
 					email: profile.email as string | undefined
 				};
 			}
-		}
+		},
+		Credentials({
+			id: 'local',
+			name: 'Local',
+			credentials: {
+				identifier: { label: 'Username or email', type: 'text' },
+				password: { label: 'Password', type: 'password' }
+			},
+			async authorize(credentials, request) {
+				const identifier = String(credentials?.identifier ?? '').trim();
+				const password = String(credentials?.password ?? '').trim();
+				const ip =
+					request?.headers?.get?.('x-forwarded-for') ??
+					request?.headers?.get?.('x-real-ip') ??
+					undefined;
+				const result = await verifyLocalCredentials(identifier, password, ip);
+				if (result.status !== 'success') return null;
+				return {
+					id: result.user.id,
+					name: result.user.name,
+					email: result.user.email ?? undefined
+				};
+			}
+		})
 	],
 	trustHost: true,
 	callbacks: {
-		jwt({ token, profile }) {
+		jwt({ token, profile, user }) {
 			const details = profile as
 				| {
 						sub?: string;
@@ -43,6 +68,9 @@ export const { handle, signIn, signOut } = SvelteKitAuth({
 					authSource: 'OIDC - Synology'
 				});
 			}
+			if (user?.id) {
+				token.sub = user.id as string;
+			}
 			return token;
 		},
 		session({ session, token }) {