@rebasepro/server-core 0.2.3 → 0.2.5

package/src/auth/api-keys/api-key-types.ts

@@ -0,0 +1,94 @@
+/**
+ * Type definitions for Service API Keys.
+ *
+ * API keys provide machine-to-machine authentication for scripts, cron jobs,
+ * and third-party integrations. Each key is scoped to specific collections
+ * and operations via the `ApiKeyPermission` model.
+ *
+ * @module
+ */
+
+/**
+ * A single permission entry scoping an API key to a collection and set of operations.
+ *
+ * Use `"*"` as the collection value to grant access to all collections.
+ */
+export interface ApiKeyPermission {
+    /** Collection slug, or `"*"` for all collections. */
+    collection: string;
+    /** Allowed operations on the collection. */
+    operations: ("read" | "write" | "delete")[];
+}
+
+/**
+ * Full database row for an API key.
+ * The `key_hash` is never exposed via the API — only stored for lookup.
+ */
+export interface ApiKey {
+    id: string;
+    name: string;
+    /** First 12 characters of the plaintext key, for display only. */
+    key_prefix: string;
+    /** SHA-256 hash of the full plaintext key. */
+    key_hash: string;
+    permissions: ApiKeyPermission[];
+    /** Requests per 15-minute window. `null` means unlimited. */
+    rate_limit: number | null;
+    created_by: string;
+    created_at: string;
+    updated_at: string;
+    last_used_at: string | null;
+    expires_at: string | null;
+    revoked_at: string | null;
+}
+
+/**
+ * Masked version of an API key, safe for API responses.
+ * Omits `key_hash` and shows only the prefix.
+ */
+export interface ApiKeyMasked {
+    id: string;
+    name: string;
+    key_prefix: string;
+    permissions: ApiKeyPermission[];
+    rate_limit: number | null;
+    created_by: string;
+    created_at: string;
+    updated_at: string;
+    last_used_at: string | null;
+    expires_at: string | null;
+    revoked_at: string | null;
+}
+
+/**
+ * Request body for creating a new API key.
+ */
+export interface CreateApiKeyRequest {
+    name: string;
+    permissions: ApiKeyPermission[];
+    /** Requests per 15-minute window. Omit or `null` for unlimited. */
+    rate_limit?: number | null;
+    /** ISO-8601 expiration timestamp. Omit for no expiration. */
+    expires_at?: string | null;
+}
+
+/**
+ * Request body for updating an existing API key.
+ * All fields are optional — only provided fields are updated.
+ */
+export interface UpdateApiKeyRequest {
+    name?: string;
+    permissions?: ApiKeyPermission[];
+    rate_limit?: number | null;
+    expires_at?: string | null;
+}
+
+/**
+ * Returned exactly once when a key is created.
+ * The `key` field contains the full plaintext key — it is never stored
+ * or returned again after creation.
+ */
+export interface ApiKeyWithSecret extends ApiKeyMasked {
+    /** Full plaintext API key (e.g. `rk_live_abc123...`). */
+    key: string;
+}

package/src/auth/api-keys/index.ts

@@ -0,0 +1,37 @@
+/**
+ * Service API Keys module.
+ *
+ * Re-exports types, store, middleware, permission guard, and routes
+ * for the API key authentication system.
+ *
+ * @module
+ */
+
+// Types
+export type {
+    ApiKey,
+    ApiKeyMasked,
+    ApiKeyPermission,
+    ApiKeyWithSecret,
+    CreateApiKeyRequest,
+    UpdateApiKeyRequest,
+} from "./api-key-types";
+
+// Store
+export { createApiKeyStore } from "./api-key-store";
+export type { ApiKeyStore } from "./api-key-store";
+
+// Middleware
+export { isApiKeyToken, validateApiKey } from "./api-key-middleware";
+export type { ApiKeyAuthOptions } from "./api-key-middleware";
+
+// Permission guard
+export {
+    httpMethodToOperation,
+    isOperationAllowed,
+} from "./api-key-permission-guard";
+export type { ApiKeyOperation } from "./api-key-permission-guard";
+
+// Routes
+export { createApiKeyRoutes } from "./api-key-routes";
+export type { ApiKeyRouteOptions } from "./api-key-routes";

package/src/auth/{auth-overrides.ts → auth-hooks.ts}

@@ -1,20 +1,20 @@
 /**
- * AuthOverrides
+ * AuthHooks
  *
- * Override specific behaviors of the built-in Rebase auth system.
+ * Customize specific behaviors of the built-in Rebase auth system.
  *
  * Each method replaces one piece of the default implementation.
  * Unset methods fall through to the built-in defaults (scrypt passwords,
  * standard validation rules, etc.).
  *
- * This interface is intentionally open for extension — new overrides
+ * This interface is intentionally open for extension — new hooks
  * can be added as optional methods without breaking existing configurations.
  *
  * @example bcrypt password support
  * ```ts
  * import bcrypt from "bcrypt";
  *
- * const overrides: AuthOverrides = {
+ * const hooks: AuthHooks = {
  *     hashPassword: (pw) => bcrypt.hash(pw, 12),
  *     verifyPassword: (pw, hash) => bcrypt.compare(pw, hash),
  *     validatePasswordStrength: (pw) => ({
@@ -26,7 +26,7 @@
  *
  * @example Override the entire login credential check
  * ```ts
- * const overrides: AuthOverrides = {
+ * const hooks: AuthHooks = {
  *     verifyCredentials: async (email, password, repo) => {
  *         const user = await repo.getUserByEmail(email);
  *         if (!user || !user.passwordHash) return null;
@@ -48,15 +48,15 @@ import type { AuthRepository, UserData, CreateUserData } from "./interfaces";
 /**
  * Authentication method identifier for lifecycle hooks.
  */
-export type AuthMethod = "login" | "register" | "oauth" | "refresh" | "password-reset";
+export type AuthMethod = "login" | "register" | "oauth" | "refresh" | "password-reset" | "anonymous" | "magic-link" | "mfa";
 
 /**
- * Override specific parts of the built-in Rebase auth implementation.
+ * Hook specific parts of the built-in Rebase auth implementation.
  *
  * Every method is optional. The built-in defaults apply for any method
  * that is not provided.
  */
-export interface AuthOverrides {
+export interface AuthHooks {
     // ─── Password Operations ──────────────────────────────────────────────
 
     /**
@@ -138,11 +138,78 @@ export interface AuthOverrides {
      * This is fire-and-forget — errors are logged but do not fail the request.
      */
     afterUserCreate?(user: UserData): Promise<void>;
+
+    // ─── Extended Lifecycle Hooks ─────────────────────────────────────────
+
+    /**
+     * Pre-login validation. Called before credential verification.
+     *
+     * Throw an error to reject the login attempt (e.g. for account lockout,
+     * IP-based restrictions, etc.).
+     */
+    beforeLogin?(email: string, method: AuthMethod): Promise<void>;
+
+    /**
+     * Post-logout cleanup.
+     *
+     * Called after a user's session has been invalidated.
+     * Use for audit logging, cleanup of temporary resources, etc.
+     *
+     * This is fire-and-forget — errors are logged but do not fail the request.
+     */
+    afterLogout?(userId: string): Promise<void>;
+
+    /**
+     * Called after successful MFA verification.
+     *
+     * Use for audit logging, notifying external systems, etc.
+     *
+     * This is fire-and-forget — errors are logged but do not fail the request.
+     */
+    onMfaVerified?(userId: string, factorId: string): Promise<void>;
+
+    /**
+     * Customize JWT access token claims before signing.
+     *
+     * Return the modified claims object. The returned claims are merged
+     * into the JWT payload alongside standard claims (userId, roles).
+     *
+     * @param claims - The default claims that would be included.
+     * @param user - The authenticated user data.
+     * @returns Modified claims to include in the JWT.
+     */
+    customizeAccessToken?(claims: Record<string, unknown>, user: UserData): Promise<Record<string, unknown>>;
+
+    /**
+     * Called after a successful password reset.
+     *
+     * Use for audit logging, sending confirmation notifications, etc.
+     *
+     * This is fire-and-forget — errors are logged but do not fail the request.
+     */
+    onPasswordReset?(userId: string): Promise<void>;
+
+    /**
+     * Called before a user is deleted.
+     *
+     * Throw an error to prevent deletion (e.g. for users with active
+     * subscriptions, pending transactions, etc.).
+     */
+    beforeUserDelete?(userId: string): Promise<void>;
+
+    /**
+     * Called after a user is deleted.
+     *
+     * Use for cleaning up external resources, audit logging, etc.
+     *
+     * This is fire-and-forget — errors are logged but do not fail the request.
+     */
+    afterUserDelete?(userId: string): Promise<void>;
 }
 
 /**
  * Resolved auth operations — every method is guaranteed to exist.
- * Created by `resolveAuthOverrides()` which merges user overrides
+ * Created by `resolveAuthHooks()` which merges user hooks
  * with built-in defaults.
  */
 export interface ResolvedAuthOperations {
@@ -152,21 +219,21 @@ export interface ResolvedAuthOperations {
 }
 
 /**
- * Merge user-provided overrides with the built-in defaults to produce
+ * Merge user-provided hooks with the built-in defaults to produce
  * a complete set of resolved operations.
  *
  * This is the single point where defaults are applied — all consumers
  * call this once and use the resolved operations throughout.
  */
-export function resolveAuthOverrides(overrides?: AuthOverrides): ResolvedAuthOperations {
+export function resolveAuthHooks(hooks?: AuthHooks): ResolvedAuthOperations {
     return {
-        hashPassword: overrides?.hashPassword
+        hashPassword: hooks?.hashPassword
             ?? defaultHashPassword,
 
-        verifyPassword: overrides?.verifyPassword
+        verifyPassword: hooks?.verifyPassword
             ?? defaultVerifyPassword,
 
-        validatePasswordStrength: overrides?.validatePasswordStrength
+        validatePasswordStrength: hooks?.validatePasswordStrength
             ?? defaultValidatePasswordStrength,
     };
 }

package/src/auth/builtin-auth-adapter.ts

@@ -15,13 +15,10 @@ import type {
     AuthenticatedUser,
     AuthAdapterCapabilities,
     UserManagementAdapter,
-    RoleManagementAdapter,
     AuthUserListOptions,
     AuthUserListResult,
     AuthUserData,
     AuthCreateUserData,
-    AuthRoleData,
-    AuthCreateRoleData,
     BootstrappedAuth,
     BackendHooks,
 } from "@rebasepro/types";
@@ -32,8 +29,8 @@ import type { AccessTokenPayload } from "./jwt";
 import { createAuthRoutes } from "./routes";
 import { createAdminRoutes } from "./admin-routes";
 import type { AuthRepository, OAuthProvider } from "./interfaces";
-import type { AuthOverrides, ResolvedAuthOperations } from "./auth-overrides";
-import { resolveAuthOverrides } from "./auth-overrides";
+import type { AuthHooks, ResolvedAuthOperations } from "./auth-hooks";
+import { resolveAuthHooks } from "./auth-hooks";
 import type { EmailService, EmailConfig } from "../email";
 import type { HonoEnv } from "../api/types";
 import { safeCompare } from "./crypto-utils";
@@ -62,8 +59,8 @@ export interface BuiltinAuthAdapterConfig {
     serviceKey?: string;
     /** Backend hooks for intercepting admin data. */
     hooks?: BackendHooks;
-    /** Auth overrides for customizing password, credentials, lifecycle, etc. */
-    overrides?: AuthOverrides;
+    /** Auth hooks for customizing password, credentials, lifecycle, etc. */
+    authHooks?: AuthHooks;
 }
 
 /**
@@ -83,10 +80,10 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
         oauthProviders = [],
         serviceKey,
         hooks,
-        overrides,
+        authHooks,
     } = config;
 
-    const resolvedOps = resolveAuthOverrides(overrides);
+    const resolvedOps = resolveAuthHooks(authHooks);
 
     const adapter: AuthAdapter = {
         id: "rebase-builtin",
@@ -131,8 +128,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
             // Resolve roles from the repository
             let roles: string[] = payload.roles || [];
             try {
-                const userRoles = await authRepository.getUserRoles(payload.userId);
-                roles = userRoles.map((r) => r.id);
+                roles = await authRepository.getUserRoleIds(payload.userId);
             } catch {
                 // Fall back to token roles if repository lookup fails
             }
@@ -174,8 +170,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
 
             let roles: string[] = payload.roles || [];
             try {
-                const userRoles = await authRepository.getUserRoles(payload.userId);
-                roles = userRoles.map((r) => r.id);
+                roles = await authRepository.getUserRoleIds(payload.userId);
             } catch {
                 // Fall back to token roles if repository lookup fails
             }
@@ -192,9 +187,9 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
             };
         },
 
-        userManagement: createUserManagementFromRepo(authRepository, resolvedOps, overrides),
+        userManagement: createUserManagementFromRepo(authRepository, resolvedOps, authHooks),
+
 
-        roleManagement: createRoleManagementFromRepo(authRepository),
 
         createAuthRoutes(): Hono<HonoEnv> | undefined {
             return createAuthRoutes({
@@ -204,7 +199,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 allowRegistration,
                 defaultRole,
                 oauthProviders,
-                overrides,
+                authHooks,
             });
         },
 
@@ -215,7 +210,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 emailConfig,
                 serviceKey,
                 hooks,
-                overrides,
+                authHooks,
             });
         },
 
@@ -251,7 +246,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
 
 // ─── Internal Helpers ────────────────────────────────────────────────────────
 
-function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: ResolvedAuthOperations, overrides?: AuthOverrides): UserManagementAdapter {
+function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: ResolvedAuthOperations, authHooks?: AuthHooks): UserManagementAdapter {
     return {
         async listUsers(options?: AuthUserListOptions): Promise<AuthUserListResult> {
             const result = await repo.listUsersPaginated({
@@ -284,14 +279,16 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
                 photoUrl: data.photoUrl,
                 metadata: data.metadata,
             };
-            if (overrides?.beforeUserCreate) {
-                createData = await overrides.beforeUserCreate(createData);
+            if (authHooks?.beforeUserCreate) {
+                createData = await authHooks.beforeUserCreate(createData);
             }
             const user = await repo.createUser(createData);
-            if (overrides?.afterUserCreate) {
-                overrides.afterUserCreate(user).catch(err => {
-                    console.error("[AuthOverrides] afterUserCreate error:", err instanceof Error ? err.message : err);
-                });
+            if (authHooks?.afterUserCreate) {
+                try {
+                    await authHooks.afterUserCreate(user);
+                } catch (err) {
+                    console.error("[AuthHooks] afterUserCreate error:", err instanceof Error ? err.message : err);
+                }
             }
             return toAuthUserData(user);
         },
@@ -310,12 +307,23 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
         },
 
         async deleteUser(id: string): Promise<void> {
+            // Call beforeUserDelete hook (throw to prevent deletion)
+            if (authHooks?.beforeUserDelete) {
+                await authHooks.beforeUserDelete(id);
+            }
+
             await repo.deleteUser(id);
+
+            // Fire afterUserDelete hook (fire-and-forget)
+            if (authHooks?.afterUserDelete) {
+                authHooks.afterUserDelete(id).catch(err => {
+                    console.error("[AuthHooks] afterUserDelete error:", err instanceof Error ? err.message : err);
+                });
+            }
         },
 
-        async getUserRoles(userId: string): Promise<AuthRoleData[]> {
-            const roles = await repo.getUserRoles(userId);
-            return roles.map(toAuthRoleData);
+        async getUserRoles(userId: string): Promise<string[]> {
+            return repo.getUserRoleIds(userId);
         },
 
         async setUserRoles(userId: string, roleIds: string[]): Promise<void> {
@@ -324,41 +332,6 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
     };
 }
 
-function createRoleManagementFromRepo(repo: AuthRepository): RoleManagementAdapter {
-    return {
-        async listRoles(): Promise<AuthRoleData[]> {
-            const roles = await repo.listRoles();
-            return roles.map(toAuthRoleData);
-        },
-
-        async getRoleById(id: string): Promise<AuthRoleData | null> {
-            const role = await repo.getRoleById(id);
-            return role ? toAuthRoleData(role) : null;
-        },
-
-        async createRole(data: AuthCreateRoleData): Promise<AuthRoleData> {
-            const role = await repo.createRole({
-                id: data.id,
-                name: data.name,
-                isAdmin: data.isAdmin,
-                defaultPermissions: data.defaultPermissions,
-                collectionPermissions: data.collectionPermissions,
-                config: data.config,
-            });
-            return toAuthRoleData(role);
-        },
-
-        async updateRole(id: string, data: Partial<AuthRoleData>): Promise<AuthRoleData | null> {
-            const role = await repo.updateRole(id, data);
-            return role ? toAuthRoleData(role) : null;
-        },
-
-        async deleteRole(id: string): Promise<void> {
-            await repo.deleteRole(id);
-        },
-    };
-}
-
 function toAuthUserData(user: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; emailVerified?: boolean; metadata?: Record<string, unknown>; createdAt?: Date; updatedAt?: Date }): AuthUserData {
     return {
         id: user.id,
@@ -371,14 +344,3 @@ function toAuthUserData(user: { id: string; email: string; displayName?: string
         updatedAt: user.updatedAt,
     };
 }
-
-function toAuthRoleData(role: { id: string; name: string; isAdmin: boolean; defaultPermissions?: unknown; collectionPermissions?: unknown; config?: unknown }): AuthRoleData {
-    return {
-        id: role.id,
-        name: role.name,
-        isAdmin: role.isAdmin,
-        defaultPermissions: role.defaultPermissions as AuthRoleData["defaultPermissions"],
-        collectionPermissions: role.collectionPermissions as AuthRoleData["collectionPermissions"],
-        config: role.config as AuthRoleData["config"],
-    };
-}

package/src/auth/custom-auth-adapter.ts

@@ -76,7 +76,7 @@ export function createCustomAuthAdapter(options: CustomAuthAdapterOptions): Auth
 
         userManagement: options.userManagement,
 
-        roleManagement: options.roleManagement,
+
 
         getCapabilities() {
             return defaultCapabilities;

package/src/auth/index.ts

@@ -7,8 +7,8 @@ export type { JwtConfig, AccessTokenPayload } from "./jwt";
 export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
 export type { PasswordValidationResult } from "./password";
 
-export type { AuthOverrides, AuthMethod, ResolvedAuthOperations } from "./auth-overrides";
-export { resolveAuthOverrides } from "./auth-overrides";
+export type { AuthHooks, AuthMethod, ResolvedAuthOperations } from "./auth-hooks";
+export { resolveAuthHooks } from "./auth-hooks";
 
 // OAuth Providers
 export { createGoogleProvider } from "./google-oauth";
@@ -35,7 +35,11 @@ export type { AuthModuleConfig } from "./routes";
 export { createAdminRoutes } from "./admin-routes";
 
 
-export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter } from "./rate-limiter";
+export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createApiKeyRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
+
+// API Keys
+export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys";
+export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys";
 
 // Auth Adapters
 export { createBuiltinAuthAdapter } from "./builtin-auth-adapter";

package/src/auth/interfaces.ts

@@ -20,6 +20,7 @@ export interface UserData {
     emailVerified: boolean;
     emailVerificationToken?: string | null;
     emailVerificationSentAt?: Date | null;
+    isAnonymous?: boolean;
     metadata?: Record<string, unknown>;
     createdAt: Date;
     updatedAt: Date;
@@ -34,6 +35,7 @@ export interface CreateUserData {
     displayName?: string;
     photoUrl?: string;
     emailVerified?: boolean;
+    isAnonymous?: boolean;
     metadata?: Record<string, unknown>;
 }
 
@@ -93,7 +95,6 @@ export interface RoleData {
         edit?: boolean;
         delete?: boolean;
     }> | null;
-    config: Record<string, unknown> | null;
 }
 
 /**
@@ -105,7 +106,6 @@ export interface CreateRoleData {
     isAdmin?: boolean;
     defaultPermissions?: RoleData["defaultPermissions"];
     collectionPermissions?: RoleData["collectionPermissions"];
-    config?: RoleData["config"];
 }
 
 /**
@@ -359,7 +359,115 @@ export interface TokenRepository {
     deleteExpiredTokens(): Promise<void>;
 }
 
+// =============================================================================
+// MFA INTERFACES
+// =============================================================================
+
+/**
+ * MFA factor data structure
+ */
+export interface MfaFactor {
+    id: string;
+    userId: string;
+    factorType: "totp";
+    friendlyName?: string;
+    verified: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}
+
+/**
+ * MFA challenge information
+ */
+export interface MfaChallengeInfo {
+    id: string;
+    factorId: string;
+    createdAt: Date;
+    verifiedAt?: Date;
+    ipAddress?: string;
+}
+
+/**
+ * Recovery code data structure
+ */
+export interface RecoveryCode {
+    id: string;
+    userId: string;
+    usedAt?: Date;
+}
+
+/**
+ * Abstract MFA repository interface.
+ * Handles all MFA-related database operations.
+ */
+export interface MfaRepository {
+    /**
+     * Create a new MFA factor for a user
+     */
+    createMfaFactor(userId: string, factorType: "totp", secretEncrypted: string, friendlyName?: string): Promise<MfaFactor>;
+
+    /**
+     * Get all MFA factors for a user
+     */
+    getMfaFactors(userId: string): Promise<MfaFactor[]>;
+
+    /**
+     * Get a specific MFA factor by ID
+     */
+    getMfaFactorById(factorId: string): Promise<(MfaFactor & { secretEncrypted: string }) | null>;
+
+    /**
+     * Mark an MFA factor as verified
+     */
+    verifyMfaFactor(factorId: string): Promise<void>;
+
+    /**
+     * Delete an MFA factor
+     */
+    deleteMfaFactor(factorId: string, userId: string): Promise<void>;
+
+    /**
+     * Create an MFA challenge
+     */
+    createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
+
+    /**
+     * Get an MFA challenge by ID
+     */
+    getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;
+
+    /**
+     * Mark an MFA challenge as verified
+     */
+    verifyMfaChallenge(challengeId: string): Promise<void>;
+
+    /**
+     * Create recovery codes for a user
+     */
+    createRecoveryCodes(userId: string, codeHashes: string[]): Promise<void>;
+
+    /**
+     * Use a recovery code (mark as used)
+     */
+    useRecoveryCode(userId: string, codeHash: string): Promise<boolean>;
+
+    /**
+     * Get unused recovery code count for a user
+     */
+    getUnusedRecoveryCodeCount(userId: string): Promise<number>;
+
+    /**
+     * Delete all recovery codes for a user
+     */
+    deleteAllRecoveryCodes(userId: string): Promise<void>;
+
+    /**
+     * Check if a user has any verified MFA factors
+     */
+    hasVerifiedMfaFactors(userId: string): Promise<boolean>;
+}
+
 /**
  * Combined auth repository interface for convenience
  */
-export interface AuthRepository extends UserRepository, RoleRepository, TokenRepository { }
+export interface AuthRepository extends UserRepository, RoleRepository, TokenRepository, MfaRepository { }