authenticateWithPassword = async (email, password) => {
  // We reproduce the usual password auth strategy
  // Code taken from the loginHandler defined by accounts-password
  // @see https://github.com/meteor/meteor/blob/devel/packages/accounts-password/password_server.js#L282
  // To be done in the resolver
  //check(options, {
  //  user: userQueryValidator,
  //  password: passwordValidator
  //});
  const user = Accounts.findUserByEmail(email);
  if (!user) {
    // TODO: handle errors
    throw new Error('User not found');
  }
  if (!user.services || !user.services.password || !(user.services.password.bcrypt || user.services.password.srp)) {
    throw new Error('User has no password set');
  }
  const passwordCheck = Accounts._checkPassword(user, password);
  if (!passwordCheck) throw new Error('Password check failed');
  if (passwordCheck.error) throw new Error(passwordCheck.error);
  if (!passwordCheck.userId) throw new Error('No password check userId');
  const { userId } = passwordCheck;

  // TODO: meteor has some logic to check login validation (prevent brute force attacks for example)
  // @see https://github.com/meteor/meteor/blob/d612d7546fa446cd574b51c0ea7953253f5e4bb7/packages/accounts-base/accounts_server.js#L303
  //const { userId } = passwordCheck
  //checkedUser = Users.findOne(userId);
  //const attempt = {
  //  type: passwordCheck.type || "unknown",
  //  allowed: true,
  //  methodName: 'password',
  //  //methodArguments: Array.from(methodArgs)
  //};
  // _validateLogin may mutate `attempt` by adding an error and changing allowed
  // to false, but that's the only change it can make (and the user's callbacks
  // only get a clone of `attempt`).
  //this._validateLogin(methodInvocation.connection, attempt);
  //if (!attempt.allowed) {
  //  throw attempt.error;
  //}

  // generate and store the token in the db
  // code taken from _loginUser
  // @see https://github.com/meteor/meteor/blob/d612d7546fa446cd574b51c0ea7953253f5e4bb7/packages/accounts-base/accounts_server.js#L267
  const stampedLoginToken = Accounts._generateStampedLoginToken();
  Accounts._insertLoginToken(userId, stampedLoginToken);
  return {
    userId,
    token: stampedLoginToken.token,
  };
}
Authentication handler

This code reproduces meteor/accounts-password authentication system

NOTE: we CAN'T reuse Meteor login method because it expects a DDP connection to be defined
const res = Meteor.call('login', { user: usernameOrEmail, password }); // WON'T WORK this.connection is not defined
@see https://github.com/meteor/meteor/issues/10937

Inspiration
@see https://github.com/stubailo/meteor-rest/blob/master/packages/rest-accounts-password/rest-login.js

NOTE: this won't work with DDP. If you want to use usual DDP features (eg you develop an actual Meteor client),
use the usual Meteor connection pattern instead (see Meteor doc)

@param {*} usernameOrEmail
@param {*} password