@rebasepro/server-core 0.0.1-canary.4d4fb3e → 0.0.1-canary.ca2cb6e

package/src/auth/routes.ts

@@ -1,13 +1,12 @@
 import { Hono } from "hono";
-import { ApiError } from "../api/errors";
+import { ApiError, errorHandler } from "../api/errors";
 import { randomBytes, createHash } from "crypto";
-import type { AuthRepository } from "./interfaces";
+import type { AuthRepository, OAuthProvider } from "./interfaces";
 import { generateAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry } from "./jwt";
 import { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
-import { verifyGoogleIdToken, isGoogleOAuthConfigured } from "./google-oauth";
 import { requireAuth } from "./middleware";
 import { EmailService, EmailConfig } from "../email";
-import { getPasswordResetTemplate, getEmailVerificationTemplate } from "../email/templates";
+import { getPasswordResetTemplate, getEmailVerificationTemplate, getWelcomeEmailTemplate } from "../email/templates";
 import { HonoEnv } from "../api/types";
 import { defaultAuthLimiter, strictAuthLimiter } from "./rate-limiter";
 import { z } from "zod";
@@ -19,10 +18,20 @@ export interface AuthModuleConfig {
     authRepo: AuthRepository;
     emailService?: EmailService;
     emailConfig?: EmailConfig;
-    /** Allow new user registration (default: false). First user can always register for bootstrap. */
+    /** Allow new user registration (default: false). */
     allowRegistration?: boolean;
-    /** Default role ID to assign to new users (default: none). The first user always gets "admin". */
+    /** Default role ID to assign to new users (default: none). Must NOT be "admin". */
     defaultRole?: string;
+    /** Optional array of OAuth providers */
+    oauthProviders?: OAuthProvider[];
+    /** When true, blocks all self-registration regardless of `allowRegistration`. */
+    disableSelfRegistration?: boolean;
+    /**
+     * Callback that checks if bootstrap has already been completed.
+     * Used by GET /auth/config to report `needsSetup` status.
+     * When not provided, falls back to checking if any users exist.
+     */
+    isBootstrapCompleted?: () => Promise<boolean>;
 }
 
 /**
@@ -72,7 +81,17 @@ function getPasswordResetExpiry(): Date {
 }
 
 export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
+    if (config.defaultRole === "admin") {
+        throw new Error("CRITICAL SECURITY ERROR: defaultRole cannot be 'admin'. Administrative privilege escalation via registration is strictly forbidden. Use the POST /admin/bootstrap endpoint to promote the initial administrator.");
+    }
+
     const router = new Hono<HonoEnv>();
+
+    // Attach Rebase error handler to ensure ApiError exceptions are correctly
+    // formatted instead of caught by Hono's default error handler.
+    // Hono's onError does NOT propagate from parent to child routers.
+    router.onError(errorHandler);
+
     const authRepo = config.authRepo;
     const { emailService, emailConfig, allowRegistration = false } = config;
 
@@ -86,9 +105,6 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
         email: z.string().email("Invalid email address").max(255),
         password: z.string().min(1, "Password is required").max(128)
     });
-    const googleSchema = z.object({
-        idToken: z.string().min(1, "ID token is required")
-    });
     const forgotPasswordSchema = z.object({
         email: z.string().email("Invalid email address").max(255)
     });
@@ -129,13 +145,55 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
     }
 
     /**
-     * Check if registration is allowed (always allow first user for bootstrap)
+     * Check if registration is allowed.
+     * Registration is only allowed when explicitly enabled via `allowRegistration`.
+     * First-user bootstrap must use POST /admin/bootstrap instead.
+     */
+    function isRegistrationAllowed(): boolean {
+        if (config.disableSelfRegistration) return false;
+        return !!allowRegistration;
+    }
+
+    /**
+     * Send welcome email to a newly registered user (fire-and-forget).
+     */
+    function sendWelcomeEmail(user: { email: string; displayName?: string | null }) {
+        if (!isEmailConfigured()) return;
+        const appName = emailConfig?.appName || "Rebase";
+        const loginUrl = emailConfig?.resetPasswordUrl || ""; // reuse base URL → the login / app page
+        const templateFn = emailConfig?.templates?.welcomeEmail;
+        const emailContent = templateFn
+            ? templateFn(user, appName)
+            : getWelcomeEmailTemplate(user, appName, loginUrl ? `${loginUrl}/app` : undefined);
+
+        emailService!.send({
+            to: user.email,
+            subject: emailContent.subject,
+            html: emailContent.html,
+            text: emailContent.text
+        }).catch(err => {
+            console.error("Failed to send welcome email:", err instanceof Error ? err.message : err);
+        });
+    }
+
+    /**
+     * Helper to generate and store session tokens
      */
-    async function isRegistrationAllowed(): Promise<boolean> {
-        if (allowRegistration) return true;
-        // Always allow first user registration for bootstrap
-        const allUsers = await authRepo.listUsers();
-        return allUsers.length === 0;
+    async function createSessionAndTokens(userId: string, userAgent: string, ipAddress: string) {
+        const roles = await authRepo.getUserRoles(userId);
+        const roleIds = roles.map(r => r.id);
+        const accessToken = generateAccessToken(userId, roleIds);
+        const refreshToken = generateRefreshToken();
+
+        await authRepo.createRefreshToken(
+            userId,
+            hashRefreshToken(refreshToken),
+            getRefreshTokenExpiry(),
+            userAgent,
+            ipAddress
+        );
+
+        return { roleIds, accessToken, refreshToken };
     }
 
     /**
@@ -145,9 +203,13 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
     router.post("/register", defaultAuthLimiter, async (c) => {
         const { email, password, displayName } = parseBody(registerSchema, await c.req.json());
 
-        // Check if registration is allowed
-        const registrationAllowed = await isRegistrationAllowed();
-        if (!registrationAllowed) {
+        // Hard kill switch — blocks registration regardless of allowRegistration
+        if (config.disableSelfRegistration) {
+            throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
+        }
+
+        // Check if registration is allowed (no bypass for empty databases)
+        if (!isRegistrationAllowed()) {
             throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
         }
 
@@ -168,37 +230,24 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
         const user = await authRepo.createUser({
             email: email.toLowerCase(),
             passwordHash,
-            displayName: displayName || undefined,
-            provider: "email"
+            displayName: displayName || undefined
         });
 
-        // Check if this is the first user - make them admin
-        const allUsers = await authRepo.listUsers();
-        const isFirstUser = allUsers.length === 1;
-        if (isFirstUser) {
-            await authRepo.assignDefaultRole(user.id, "admin");
-        } else if (config.defaultRole) {
+        // Assign configured default role (never auto-assign admin via registration)
+        if (config.defaultRole) {
             await authRepo.assignDefaultRole(user.id, config.defaultRole);
         }
 
-        // Generate tokens
-        const roles = await authRepo.getUserRoles(user.id);
-        const roleIds = roles.map(r => r.id);
-        const accessToken = generateAccessToken(user.id, roleIds);
-        const refreshToken = generateRefreshToken();
-
-        // Store refresh token
-        const userAgent = c.req.header("user-agent") || "unknown";
-        const ipAddress = c.req.header("x-forwarded-for") || "unknown";
-        
-        await authRepo.createRefreshToken(
+        const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(
             user.id,
-            hashRefreshToken(refreshToken),
-            getRefreshTokenExpiry(),
-            userAgent,
-            ipAddress
+            c.req.header("user-agent") || "unknown",
+            c.req.header("x-forwarded-for") || "unknown"
         );
 
+        // Send welcome email (fire-and-forget, don't block registration)
+        sendWelcomeEmail({ email: user.email,
+displayName: user.displayName });
+
         return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken), 201);
     });
 
@@ -223,100 +272,81 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
             throw ApiError.unauthorized("Invalid email or password", "INVALID_CREDENTIALS");
         }
 
-        // Generate tokens
-        const roles = await authRepo.getUserRoles(user.id);
-        const roleIds = roles.map(r => r.id);
-
-        const accessToken = generateAccessToken(user.id, roleIds);
-        const refreshToken = generateRefreshToken();
-
-        // Store refresh token
-        const userAgent = c.req.header("user-agent") || "unknown";
-        const ipAddress = c.req.header("x-forwarded-for") || "unknown";
-        
-        await authRepo.createRefreshToken(
+        const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(
             user.id,
-            hashRefreshToken(refreshToken),
-            getRefreshTokenExpiry(),
-            userAgent,
-            ipAddress
+            c.req.header("user-agent") || "unknown",
+            c.req.header("x-forwarded-for") || "unknown"
         );
 
         return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken));
     });
 
     /**
-     * POST /auth/google
-     * Login/register with Google ID token
+     * Dynamically mount OAuth provider routes
      */
-    router.post("/google", defaultAuthLimiter, async (c) => {
-        const { idToken } = parseBody(googleSchema, await c.req.json());
-
-        if (!isGoogleOAuthConfigured()) {
-            throw ApiError.serviceUnavailable("Google login not configured", "NOT_CONFIGURED");
-        }
+    if (config.oauthProviders && config.oauthProviders.length > 0) {
+        for (const provider of config.oauthProviders) {
+            router.post(`/${provider.id}`, defaultAuthLimiter, async (c) => {
+                const payload = parseBody(provider.schema, await c.req.json());
+
+                const externalUser = await provider.verify(payload);
+                if (!externalUser) {
+                    throw ApiError.unauthorized(`Invalid ${provider.id} credentials`, "INVALID_TOKEN");
+                }
 
-        const googleUser = await verifyGoogleIdToken(idToken);
-        if (!googleUser) {
-            throw ApiError.unauthorized("Invalid Google token", "INVALID_TOKEN");
-        }
+                // Find or create user
+                let user = await authRepo.getUserByIdentity(provider.id, externalUser.providerId);
+
+                if (!user) {
+                    // Check if email exists (link accounts)
+                    user = await authRepo.getUserByEmail(externalUser.email);
+
+                    if (user) {
+                        // Link Provider to existing account
+                        await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, { email: externalUser.email });
+
+                        // Optional: Update profile info from external provider if empty
+                        await authRepo.updateUser(user.id, {
+                            displayName: user.displayName || externalUser.displayName || undefined,
+                            photoUrl: user.photoUrl || externalUser.photoUrl || undefined
+                        });
+                    } else {
+                        // Create new user
+                        user = await authRepo.createUser({
+                            email: externalUser.email.toLowerCase(),
+                            displayName: externalUser.displayName || undefined,
+                            photoUrl: externalUser.photoUrl || undefined
+                        });
+
+                        await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, { email: externalUser.email });
+
+                        // Assign configured default role (never auto-assign admin via registration)
+                        if (config.defaultRole) {
+                            await authRepo.assignDefaultRole(user.id, config.defaultRole);
+                        }
+
+                        // Send welcome email for new OAuth users (fire-and-forget)
+                        sendWelcomeEmail({ email: user.email,
+displayName: user.displayName });
+                    }
+                } else {
+                    // Update profile info from external provider
+                    await authRepo.updateUser(user.id, {
+                        displayName: externalUser.displayName || user.displayName || undefined,
+                        photoUrl: externalUser.photoUrl || user.photoUrl || undefined
+                    });
+                }
 
-        // Find or create user
-        let user = await authRepo.getUserByGoogleId(googleUser.googleId);
+                const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(
+                    user.id,
+                    c.req.header("user-agent") || "unknown",
+                    c.req.header("x-forwarded-for") || "unknown"
+                );
 
-        if (!user) {
-            // Check if email exists (link accounts)
-            user = await authRepo.getUserByEmail(googleUser.email);
-
-            if (user) {
-                // Link Google to existing account
-                await authRepo.updateUser(user.id, { googleId: googleUser.googleId });
-            } else {
-                // Create new user
-                user = await authRepo.createUser({
-                    email: googleUser.email.toLowerCase(),
-                    displayName: googleUser.displayName || undefined,
-                    photoUrl: googleUser.photoUrl || undefined,
-                    provider: "google",
-                    googleId: googleUser.googleId
-                });
-                // Check if this is the first user - make them admin
-                const allUsers = await authRepo.listUsers();
-                const isFirstUser = allUsers.length === 1;
-                if (isFirstUser) {
-                    await authRepo.assignDefaultRole(user.id, "admin");
-                } else if (config.defaultRole) {
-                    await authRepo.assignDefaultRole(user.id, config.defaultRole);
-                }
-            }
-        } else {
-            // Update profile info from Google
-            await authRepo.updateUser(user.id, {
-                displayName: googleUser.displayName || user.displayName || undefined,
-                photoUrl: googleUser.photoUrl || user.photoUrl || undefined
+                return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken));
             });
         }
-
-        // Generate tokens
-        const roles = await authRepo.getUserRoles(user.id);
-        const roleIds = roles.map(r => r.id);
-        const accessToken = generateAccessToken(user.id, roleIds);
-        const refreshToken = generateRefreshToken();
-
-        // Store refresh token
-        const userAgent = c.req.header("user-agent") || "unknown";
-        const ipAddress = c.req.header("x-forwarded-for") || "unknown";
-        
-        await authRepo.createRefreshToken(
-            user.id,
-            hashRefreshToken(refreshToken),
-            getRefreshTokenExpiry(),
-            userAgent,
-            ipAddress
-        );
-
-        return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken));
-    });
+    }
 
     /**
      * POST /auth/forgot-password
@@ -350,8 +380,10 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
             const appName = emailConfig?.appName || "Rebase";
             const templateFn = emailConfig?.templates?.passwordReset;
             const emailContent = templateFn
-                ? templateFn(resetUrl, { email: user.email, displayName: user.displayName })
-                : getPasswordResetTemplate(resetUrl, { email: user.email, displayName: user.displayName }, appName);
+                ? templateFn(resetUrl, { email: user.email,
+displayName: user.displayName })
+                : getPasswordResetTemplate(resetUrl, { email: user.email,
+displayName: user.displayName }, appName);
 
             // Send email
             try {
@@ -405,7 +437,8 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
         // Invalidate all refresh tokens (security: log out all sessions)
         await authRepo.deleteAllRefreshTokensForUser(storedToken.userId);
 
-        return c.json({ success: true, message: "Password has been reset successfully" });
+        return c.json({ success: true,
+message: "Password has been reset successfully" });
     });
 
     /**
@@ -445,7 +478,8 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
         // Invalidate all refresh tokens (security: log out all sessions)
         await authRepo.deleteAllRefreshTokensForUser(user.id);
 
-        return c.json({ success: true, message: "Password has been changed successfully" });
+        return c.json({ success: true,
+message: "Password has been changed successfully" });
     });
 
     /**
@@ -486,8 +520,10 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
         const appName = emailConfig?.appName || "Rebase";
         const templateFn = emailConfig?.templates?.emailVerification;
         const emailContent = templateFn
-            ? templateFn(verifyUrl, { email: user.email, displayName: user.displayName })
-            : getEmailVerificationTemplate(verifyUrl, { email: user.email, displayName: user.displayName }, appName);
+            ? templateFn(verifyUrl, { email: user.email,
+displayName: user.displayName })
+            : getEmailVerificationTemplate(verifyUrl, { email: user.email,
+displayName: user.displayName }, appName);
 
         // Send email
         await emailService!.send({
@@ -497,7 +533,8 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
             text: emailContent.text
         });
 
-        return c.json({ success: true, message: "Verification email sent" });
+        return c.json({ success: true,
+message: "Verification email sent" });
     });
 
     /**
@@ -520,7 +557,8 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
         // Mark email as verified
         await authRepo.setEmailVerified(user.id, true);
 
-        return c.json({ success: true, message: "Email verified successfully" });
+        return c.json({ success: true,
+message: "Email verified successfully" });
     });
 
     /**
@@ -552,7 +590,7 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
         // Rotate refresh token (delete old, create new)
         const userAgent = c.req.header("user-agent") || "unknown";
         const ipAddress = c.req.header("x-forwarded-for") || "unknown";
-        
+
         await authRepo.deleteRefreshToken(tokenHash);
         await authRepo.createRefreshToken(
             storedToken.userId,
@@ -623,7 +661,8 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
         }
 
         await authRepo.deleteAllRefreshTokensForUser(userCtx.userId);
-        return c.json({ success: true, message: "All sessions revoked successfully" });
+        return c.json({ success: true,
+message: "All sessions revoked successfully" });
     });
 
     /**
@@ -642,7 +681,8 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
         }
 
         await authRepo.deleteRefreshTokenById(id, userCtx.userId);
-        return c.json({ success: true, message: "Session revoked successfully" });
+        return c.json({ success: true,
+message: "Session revoked successfully" });
     });
 
     /**
@@ -686,7 +726,7 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
 
         const updatedUser = await authRepo.updateUser(userCtx.userId, {
             displayName: displayName !== undefined ? displayName : undefined,
-            photoUrl: photoURL !== undefined ? photoURL : undefined,
+            photoUrl: photoURL !== undefined ? photoURL : undefined
         });
 
         if (!updatedUser) {
@@ -715,14 +755,32 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
      * Get public auth configuration (for frontend to know what's available)
      */
     router.get("/config", defaultAuthLimiter, async (c) => {
-        const allUsers = await authRepo.listUsers();
-        const needsSetup = allUsers.length === 0;
-        const registrationAllowed = needsSetup || allowRegistration;
+        // Determine if setup is needed using the persistent bootstrap flag
+        // when available, falling back to user-count check for backward compat.
+        let needsSetup: boolean;
+        if (config.isBootstrapCompleted) {
+            needsSetup = !(await config.isBootstrapCompleted());
+        } else {
+            const allUsers = await authRepo.listUsers();
+            needsSetup = allUsers.length === 0;
+        }
+
+        // Registration is allowed when explicitly enabled OR during initial setup
+        const registrationAllowed = needsSetup || !!allowRegistration;
+
+        // Build a dynamic map of enabled providers for frontend discovery.
+        // Also maintain legacy boolean fields for backward compatibility.
+        const enabledProviders = (config.oauthProviders || []).map(p => p.id);
+
         return c.json({
             needsSetup,
             registrationEnabled: registrationAllowed,
-            googleEnabled: isGoogleOAuthConfigured(),
-            emailServiceEnabled: isEmailConfigured()
+            // Legacy fields (kept for backward compat)
+            googleEnabled: enabledProviders.includes("google"),
+            linkedinEnabled: enabledProviders.includes("linkedin"),
+            emailServiceEnabled: isEmailConfigured(),
+            // New: complete list of available OAuth providers
+            enabledProviders
         });
     });
 

package/src/auth/slack-oauth.ts

@@ -0,0 +1,71 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+/**
+ * Creates a Slack OAuth Provider integration (OAuth 2.0 / "Sign in with Slack").
+ * Uses the OpenID Connect flow with the "openid,email,profile" scopes.
+ */
+export function createSlackProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
+    return {
+        id: "slack",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required")
+        }),
+        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                const tokenResponse = await fetch("https://slack.com/api/openid.connect.token", {
+                    method: "POST",
+                    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                    body: new URLSearchParams({
+                        client_id: config.clientId,
+                        client_secret: config.clientSecret,
+                        code: payload.code,
+                        redirect_uri: payload.redirectUri,
+                        grant_type: "authorization_code"
+                    })
+                });
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get Slack access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { ok: boolean; access_token?: string; error?: string };
+                if (!tokenData.ok || !tokenData.access_token) {
+                    console.error("Slack token exchange failed:", tokenData.error);
+                    return null;
+                }
+
+                const profileResponse = await fetch("https://slack.com/api/openid.connect.userInfo", {
+                    headers: { "Authorization": `Bearer ${tokenData.access_token}` }
+                });
+
+                if (!profileResponse.ok) {
+                    console.error("Failed to get Slack user info:", await profileResponse.text());
+                    return null;
+                }
+
+                const p = await profileResponse.json() as {
+                    ok: boolean; sub: string; name?: string;
+                    email?: string; picture?: string; email_verified?: boolean;
+                };
+
+                if (!p.ok || !p.email) {
+                    console.error("Slack user has no email");
+                    return null;
+                }
+
+                return {
+                    providerId: p.sub,
+                    email: p.email,
+                    displayName: p.name || null,
+                    photoUrl: p.picture || null
+                };
+            } catch (error) {
+                console.error("Slack OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}

package/src/auth/spotify-oauth.ts

@@ -0,0 +1,67 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+/**
+ * Creates a Spotify OAuth Provider integration.
+ * Uses the authorization code flow with the "user-read-email" scope.
+ */
+export function createSpotifyProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
+    return {
+        id: "spotify",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required")
+        }),
+        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
+
+                const tokenResponse = await fetch("https://accounts.spotify.com/api/token", {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/x-www-form-urlencoded",
+                        "Authorization": `Basic ${basicAuth}`
+                    },
+                    body: new URLSearchParams({
+                        grant_type: "authorization_code",
+                        code: payload.code,
+                        redirect_uri: payload.redirectUri
+                    })
+                });
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get Spotify access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { access_token: string };
+
+                const profileResponse = await fetch("https://api.spotify.com/v1/me", {
+                    headers: { "Authorization": `Bearer ${tokenData.access_token}` }
+                });
+
+                if (!profileResponse.ok) {
+                    console.error("Failed to get Spotify user info:", await profileResponse.text());
+                    return null;
+                }
+
+                const p = await profileResponse.json() as {
+                    id: string; display_name?: string | null;
+                    email?: string; images?: Array<{ url: string }>;
+                };
+
+                if (!p.email) { console.error("Spotify user has no email"); return null; }
+
+                return {
+                    providerId: p.id,
+                    email: p.email,
+                    displayName: p.display_name || null,
+                    photoUrl: p.images?.[0]?.url || null
+                };
+            } catch (error) {
+                console.error("Spotify OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}