feat: improve account security

Support TOTP 2fa, allow for changing password, add session management
and account removal.

server/api/account/sessions/index.get.ts

@@ -0,0 +1,38 @@
+import { auth } from '~~/lib/auth';
+import { db } from '~~/server/lib/db';
+
+/**
+ * Lists the signed in devices for the current user. Session tokens are left
+ * out on purpose: the client only ever needs the id to sign a device out.
+ */
+export default defineEventHandler(async (event) => {
+    const sessionData = await auth.api.getSession({ headers: event.headers });
+
+    if (sessionData === null) {
+        throw createError({
+            statusCode: 401,
+            statusMessage: 'Unauthorized',
+        });
+    }
+
+    const result = await db.query.sessions.findMany({
+        where: {
+            userId: sessionData.user.id,
+            expiresAt: {
+                gt: new Date(),
+            },
+        },
+        orderBy: {
+            updatedAt: 'desc',
+        },
+    });
+
+    return result.map(session => ({
+        id: session.id,
+        createdAt: session.createdAt,
+        updatedAt: session.updatedAt,
+        ipAddress: session.ipAddress,
+        userAgent: session.userAgent,
+        current: session.id === sessionData.session.id,
+    }));
+});