gistfile1.js

User.verifyPassword = function (password, hash, callback) { //You need a callback because bcrypt.compare is async
  bcrypt.compare(password, hash, function(err, isMatch) {
    callback(err, isMatch);
  });
}

//Usage:
exports.User.verifyPassword(password, user.password, function(err, isMatch) {
  if(err) {
    console.log("Error!");
    throw err;
  }
  else {
    if(isMatch) {
      done(err,user);
    }
    else {
      done(err,false);
    }
  }
});