feat(auth) : let Google-only users add a password

app/api/profile/password/route.ts

@@ -0,0 +1,28 @@
+import { APIError } from "better-auth/api";
+import * as z from "zod";
+import { getAuth, getCustomerSession } from "@/lib/auth/server";
+import { errorResponse, HttpError, readJson, requireSameOrigin } from "@/lib/security/http";
+import { limitRequest } from "@/lib/security/rate-limit";
+
+export async function POST(request: Request) {
+  try {
+    requireSameOrigin(request);
+    const session = await getCustomerSession();
+    if (!session) throw new HttpError(401, "unauthorized");
+    await limitRequest("password-set", session.user.id, 5, 3600);
+    const parsed = z.object({ newPassword: z.string().min(6).max(128) })
+      .safeParse(await readJson(request, 1024));
+    if (!parsed.success) throw new HttpError(400, "invalid-password");
+    await getAuth().api.setPassword({ headers: request.headers, body: parsed.data });
+    return new Response(null, { status: 204, headers: { "Cache-Control": "no-store" } });
+  } catch (cause) {
+    if (cause instanceof APIError) {
+      const error = typeof cause.body?.code === "string" ? cause.body.code : "password-setting-failed";
+      return Response.json({ error }, {
+        status: cause.statusCode || 400,
+        headers: { "Cache-Control": "no-store" },
+      });
+    }
+    return errorResponse(cause);
+  }
+}