@rebasepro/server-core 0.3.0 → 0.5.0

package/src/api/rest/query-parser.ts

@@ -1,4 +1,4 @@
-import type { VectorSearchParams } from "@rebasepro/types";
+import type { VectorSearchParams, LogicalCondition, FilterCondition } from "@rebasepro/types";
 import { QueryOptions } from "../types";
 
 /**
@@ -20,6 +20,86 @@ export function mapOperator(op: string): string | null {
     }
 }
 
+function getLastValue(val: unknown): unknown {
+    if (Array.isArray(val)) {
+        return val[val.length - 1];
+    }
+    return val;
+}
+
+export function parseLogicalString(str: string): FilterCondition | LogicalCondition {
+    str = str.trim();
+    if (str.startsWith("or(") && str.endsWith(")")) {
+        const inner = str.slice(3, -1);
+        return { type: "or", conditions: parseLogicalList(inner) };
+    }
+    if (str.startsWith("and(") && str.endsWith(")")) {
+        const inner = str.slice(4, -1);
+        return { type: "and", conditions: parseLogicalList(inner) };
+    }
+    
+    // It's a leaf condition: field.op.val
+    const firstDot = str.indexOf(".");
+    if (firstDot === -1) {
+        return { column: str, operator: "==", value: true };
+    }
+    const field = str.substring(0, firstDot);
+    const rest = str.substring(firstDot + 1);
+    const secondDot = rest.indexOf(".");
+    let op = "eq";
+    let valStr = rest;
+    if (secondDot !== -1) {
+        op = rest.substring(0, secondDot);
+        valStr = rest.substring(secondDot + 1);
+    } else {
+        op = "eq";
+        valStr = rest;
+    }
+    
+    const rebaseOp = (mapOperator(op) || "==") as FilterCondition["operator"];
+    let parsedVal: unknown = valStr;
+    if (valStr === "true") parsedVal = true;
+    else if (valStr === "false") parsedVal = false;
+    else if (valStr === "null") parsedVal = null;
+    else if (!isNaN(Number(valStr)) && valStr.trim() !== "") parsedVal = Number(valStr);
+    else if (valStr.startsWith("(")) {
+        const arrayContent = valStr.endsWith(")") ? valStr.slice(1, -1) : valStr.slice(1);
+        parsedVal = arrayContent.split(",").map(v => {
+            const trimmed = v.trim();
+            if (!isNaN(Number(trimmed)) && trimmed !== "") return Number(trimmed);
+            if (trimmed === "true") return true;
+            if (trimmed === "false") return false;
+            if (trimmed === "null") return null;
+            return trimmed;
+        });
+    }
+    
+    return { column: field, operator: rebaseOp, value: parsedVal };
+}
+
+function parseLogicalList(str: string): (FilterCondition | LogicalCondition)[] {
+    const list: (FilterCondition | LogicalCondition)[] = [];
+    let depth = 0;
+    let current = "";
+    
+    for (let i = 0; i < str.length; i++) {
+        const char = str[i];
+        if (char === "(") depth++;
+        if (char === ")") depth--;
+        
+        if (char === "," && depth === 0) {
+            list.push(parseLogicalString(current));
+            current = "";
+        } else {
+            current += char;
+        }
+    }
+    if (current) {
+        list.push(parseLogicalString(current));
+    }
+    return list;
+}
+
 /**
  * Parse query parameters into QueryOptions
  */
@@ -27,10 +107,15 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
     const options: QueryOptions = {};
 
     // Pagination
-    if (query.limit) options.limit = parseInt(String(query.limit));
-    if (query.offset) options.offset = parseInt(String(query.offset));
-    if (query.page) {
-        const page = parseInt(String(query.page));
+    const limitVal = getLastValue(query.limit);
+    if (limitVal) options.limit = parseInt(String(limitVal));
+    
+    const offsetVal = getLastValue(query.offset);
+    if (offsetVal) options.offset = parseInt(String(offsetVal));
+    
+    const pageVal = getLastValue(query.page);
+    if (pageVal) {
+        const page = parseInt(String(pageVal));
         const limit = options.limit || 20;
         options.offset = (page - 1) * limit;
     }
@@ -38,59 +123,88 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
     // Filtering
     options.where = {};
 
+    // Handle logical conditions
+    const orVal = getLastValue(query.or);
+    const andVal = getLastValue(query.and);
+    if (orVal) {
+        let orStr = String(orVal).trim();
+        if (orStr.startsWith("(") && orStr.endsWith(")")) {
+            orStr = orStr.slice(1, -1);
+        }
+        options.logical = {
+            type: "or",
+            conditions: parseLogicalList(orStr)
+        };
+    } else if (andVal) {
+        let andStr = String(andVal).trim();
+        if (andStr.startsWith("(") && andStr.endsWith(")")) {
+            andStr = andStr.slice(1, -1);
+        }
+        options.logical = {
+            type: "and",
+            conditions: parseLogicalList(andStr)
+        };
+    }
 
     // PostgREST-style filtering: ?field=op.value
-    const reservedQueryKeys = ["limit", "offset", "page", "orderBy", "include", "fields", "searchString", "vector_search", "vector", "vector_distance", "vector_threshold"];
+    const reservedQueryKeys = ["limit", "offset", "page", "orderBy", "include", "fields", "searchString", "vector_search", "vector", "vector_distance", "vector_threshold", "or", "and"];
     for (const [key, rawValue] of Object.entries(query)) {
         if (reservedQueryKeys.includes(key)) continue;
 
-        const value = Array.isArray(rawValue) ? rawValue[rawValue.length - 1] : rawValue;
-
-        if (typeof value === "string") {
-            const parts = value.split(".");
-            if (parts.length >= 2) {
-                const op = parts[0];
-                const val = parts.slice(1).join(".");
-                const rebaseOp = mapOperator(op);
-
-                if (rebaseOp) {
-                    let parsedVal: string | number | boolean | null | (string | number | boolean | null)[] = val;
-                    // Attempt to parse primitive types or arrays
-                    if (val === "true") parsedVal = true;
-                    else if (val === "false") parsedVal = false;
-                    else if (val === "null") parsedVal = null;
-                    else if (!isNaN(Number(val)) && val.trim() !== "") parsedVal = Number(val);
-                    else if (val.startsWith("(")) {
-                        // Array for 'in' or 'not-in' ops (e.g. (1,2,3) or (a,b,c))
-                        const arrayContent = val.endsWith(")") ? val.slice(1, -1) : val.slice(1);
-                        parsedVal = arrayContent.split(",").map(v => {
-                            const trimmed = v.trim();
-                            if (!isNaN(Number(trimmed)) && trimmed !== "") return Number(trimmed);
-                            if (trimmed === "true") return true;
-                            if (trimmed === "false") return false;
-                            if (trimmed === "null") return null;
-                            return trimmed;
-                        });
-                    }
+        const rawValues = Array.isArray(rawValue) ? rawValue : [rawValue];
+        const conditions: [string, unknown][] = [];
+
+        for (const value of rawValues) {
+            if (typeof value === "string") {
+                const parts = value.split(".");
+                if (parts.length >= 2) {
+                    const op = parts[0];
+                    const val = parts.slice(1).join(".");
+                    const rebaseOp = mapOperator(op);
 
-                    options.where[key] = [rebaseOp, parsedVal];
+                    if (rebaseOp) {
+                        let parsedVal: string | number | boolean | null | (string | number | boolean | null)[] = val;
+                        // Attempt to parse primitive types or arrays
+                        if (val === "true") parsedVal = true;
+                        else if (val === "false") parsedVal = false;
+                        else if (val === "null") parsedVal = null;
+                        else if (!isNaN(Number(val)) && val.trim() !== "") parsedVal = Number(val);
+                        else if (val.startsWith("(")) {
+                            // Array for 'in' or 'not-in' ops (e.g. (1,2,3) or (a,b,c))
+                            const arrayContent = val.endsWith(")") ? val.slice(1, -1) : val.slice(1);
+                            parsedVal = arrayContent.split(",").map(v => {
+                                const trimmed = v.trim();
+                                if (!isNaN(Number(trimmed)) && trimmed !== "") return Number(trimmed);
+                                if (trimmed === "true") return true;
+                                if (trimmed === "false") return false;
+                                if (trimmed === "null") return null;
+                                return trimmed;
+                            });
+                        }
+
+                        conditions.push([rebaseOp, parsedVal]);
+                    } else {
+                        // Fallback: assume implicit eq if the dot wasn't an operator (e.g. email or float)
+                        let parsedVal: string | number | boolean | null = value;
+                        if (!isNaN(Number(value)) && value.trim() !== "") parsedVal = Number(value);
+                        conditions.push(["==", parsedVal]);
+                    }
                 } else {
-                    // Fallback: assume implicit eq if the dot wasn't an operator (e.g. email or float)
+                    // Implicit eq
                     let parsedVal: string | number | boolean | null = value;
-                    if (!isNaN(Number(value)) && value.trim() !== "") parsedVal = Number(value);
-                    options.where[key] = ["==", parsedVal];
+                    if (value === "true") parsedVal = true;
+                    else if (value === "false") parsedVal = false;
+                    else if (value === "null") parsedVal = null;
+                    else if (!isNaN(Number(value)) && value.trim() !== "") parsedVal = Number(value);
+
+                    conditions.push(["==", parsedVal]);
                 }
-            } else {
-                // Implicit eq
-                let parsedVal: string | number | boolean | null = value;
-                if (value === "true") parsedVal = true;
-                else if (value === "false") parsedVal = false;
-                else if (value === "null") parsedVal = null;
-                else if (!isNaN(Number(value)) && value.trim() !== "") parsedVal = Number(value);
-
-                options.where[key] = ["==", parsedVal];
             }
         }
+
+        if (conditions.length > 0) {
+            options.where[key] = conditions.length === 1 ? conditions[0] : conditions;
+        }
     }
 
     if (Object.keys(options.where).length === 0) {
@@ -98,15 +212,16 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
     }
 
     // Sorting
-    if (query.orderBy) {
+    const orderByVal = getLastValue(query.orderBy);
+    if (orderByVal) {
         try {
-            options.orderBy = typeof query.orderBy === "string"
-                ? JSON.parse(query.orderBy)
-                : query.orderBy;
+            options.orderBy = typeof orderByVal === "string"
+                ? JSON.parse(orderByVal)
+                : orderByVal;
         } catch {
             // Try simple format: "field:direction"
-            if (typeof query.orderBy === "string") {
-                const [field, direction] = query.orderBy.split(":");
+            if (typeof orderByVal === "string") {
+                const [field, direction] = orderByVal.split(":");
                 const dir = (direction === "desc" ? "desc" : "asc") as "asc" | "desc";
                 options.orderBy = [
                     {
@@ -119,8 +234,9 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
     }
 
     // Relation includes
-    if (query.include) {
-        const includeStr = String(query.include).trim();
+    const includeVal = getLastValue(query.include);
+    if (includeVal) {
+        const includeStr = String(includeVal).trim();
         if (includeStr === "*") {
             options.include = ["*"];
         } else {
@@ -129,14 +245,17 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
     }
 
     // Field selection
-    if (query.fields) {
-        const fieldsStr = String(query.fields).trim();
+    const fieldsVal = getLastValue(query.fields);
+    if (fieldsVal) {
+        const fieldsStr = String(fieldsVal).trim();
         options.fields = fieldsStr.split(",").map(s => s.trim()).filter(Boolean);
     }
 
     // Vector similarity search
-    if (query.vector_search && query.vector) {
-        const vectorStr = String(query.vector);
+    const vectorSearchVal = getLastValue(query.vector_search);
+    const vectorVal = getLastValue(query.vector);
+    if (vectorSearchVal && vectorVal) {
+        const vectorStr = String(vectorVal);
         let queryVector: number[];
         try {
             queryVector = JSON.parse(vectorStr) as number[];
@@ -147,19 +266,21 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
             throw new Error("Invalid vector format. Expected JSON array of numbers, e.g. [0.1,0.2,0.3]");
         }
 
-        const distanceParam = query.vector_distance ? String(query.vector_distance) : "cosine";
+        const distanceParamVal = getLastValue(query.vector_distance);
+        const distanceParam = distanceParamVal ? String(distanceParamVal) : "cosine";
         if (distanceParam !== "cosine" && distanceParam !== "l2" && distanceParam !== "inner_product") {
             throw new Error(`Invalid vector_distance: ${distanceParam}. Expected: cosine, l2, or inner_product`);
         }
 
         const vectorSearch: VectorSearchParams = {
-            property: String(query.vector_search),
+            property: String(vectorSearchVal),
             vector: queryVector,
             distance: distanceParam,
         };
 
-        if (query.vector_threshold) {
-            const threshold = parseFloat(String(query.vector_threshold));
+        const thresholdVal = getLastValue(query.vector_threshold);
+        if (thresholdVal) {
+            const threshold = parseFloat(String(thresholdVal));
             if (isNaN(threshold)) {
                 throw new Error("Invalid vector_threshold. Expected a number.");
             }

package/src/api/server.ts

@@ -120,7 +120,7 @@ export class RebaseApiServer {
                 singularName: col.singularName,
                 description: col.description,
                 properties: Object.keys(col.properties),
-                relations: (col as EntityCollection & { relations?: Relation[] }).relations?.map((r: Relation) => ({
+                relations: col.relations?.map((r: Relation) => ({
                     relationName: r.relationName,
                     target: typeof r.target === "function" ? r.target().slug : r.target,
                     cardinality: r.cardinality,

package/src/api/types.ts

@@ -1,4 +1,4 @@
-import { EntityCollection, VectorSearchParams } from "@rebasepro/types";
+import { EntityCollection, VectorSearchParams, LogicalCondition } from "@rebasepro/types";
 import { AuthResult } from "../auth/middleware";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { DataDriver } from "@rebasepro/types";
@@ -77,6 +77,7 @@ export interface QueryOptions {
     limit?: number;
     offset?: number;
     where?: Record<string, unknown>;
+    logical?: LogicalCondition;
     orderBy?: Array<{ field: string; direction: "asc" | "desc" }>;
     include?: string[];
     /** Columns to return in the response (field-level selection) */

package/src/auth/admin-routes.ts

@@ -5,7 +5,7 @@ import { requireAuth, requireAdmin, createRequireAuth } from "./middleware";
 import type { AuthHooks } from "./auth-hooks";
 import { resolveAuthHooks } from "./auth-hooks";
 import { AuthModuleConfig } from "./routes";
-import type { BackendHooks, AdminUser, AdminRole, BackendHookContext } from "@rebasepro/types";
+import type { BackendHooks, AdminUser, BackendHookContext } from "@rebasepro/types";
 
 interface AdminRouteOptions extends AuthModuleConfig {
     serviceKey?: string;
@@ -99,12 +99,7 @@ export function createAdminRoutes(config: AdminRouteOptions): Hono<HonoEnv> {
         return results.filter((u): u is AdminUser => u !== null);
     }
 
-    /** Apply roles.afterRead hook to an array and filter nulls */
-    async function applyRoleAfterReadBatch(roles: AdminRole[], ctx: BackendHookContext): Promise<AdminRole[]> {
-        if (!hooks?.roles?.afterRead) return roles;
-        const results = await Promise.all(roles.map(r => hooks!.roles!.afterRead!(r, ctx)));
-        return results.filter((r): r is AdminRole => r !== null);
-    }
+
 
     /** Convert a DB user record + role IDs into the AdminUser API shape */
     function toAdminUser(u: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; createdAt?: Date | string; updatedAt?: Date | string }, roles: string[]): AdminUser {
@@ -533,91 +528,7 @@ displayName: existing.displayName }, appName);
         return c.json({ success: true });
     });
 
-    router.get("/roles", requireAdmin, async (c) => {
-        const roles = await authRepo.listRoles();
-        const hookCtx = buildHookContext(c, "GET");
-
-        let adminRoles: AdminRole[] = roles.map(r => ({
-            id: r.id,
-            name: r.name,
-            isAdmin: r.isAdmin,
-            defaultPermissions: r.defaultPermissions
-        }));
-
-        adminRoles = await applyRoleAfterReadBatch(adminRoles, hookCtx);
-
-        return c.json({ roles: adminRoles });
-    });
-
-    router.get("/roles/:roleId", requireAdmin, async (c) => {
-        const roleId = c.req.param("roleId");
-        const role = await authRepo.getRoleById(roleId);
-
-        if (!role) {
-            throw ApiError.notFound("Role not found");
-        }
-
-        return c.json({ role });
-    });
-
-    router.post("/roles", requireAdmin, async (c) => {
-        const body = await c.req.json();
-        const { id, name, isAdmin, defaultPermissions } = body;
-
-        if (!id || !name) {
-            throw ApiError.badRequest("Role ID and name are required", "INVALID_INPUT");
-        }
-
-        const existing = await authRepo.getRoleById(id);
-        if (existing) {
-            throw ApiError.conflict("Role already exists", "ROLE_EXISTS");
-        }
-
-        const role = await authRepo.createRole({
-            id,
-            name,
-            isAdmin: isAdmin ?? false,
-            defaultPermissions: defaultPermissions ?? null
-        });
 
-        return c.json({ role }, 201);
-    });
-
-    router.put("/roles/:roleId", requireAdmin, async (c) => {
-        const roleId = c.req.param("roleId");
-        const body = await c.req.json();
-        const { name, isAdmin, defaultPermissions } = body;
-
-        const existing = await authRepo.getRoleById(roleId);
-        if (!existing) {
-            throw ApiError.notFound("Role not found");
-        }
-
-        const role = await authRepo.updateRole(roleId, {
-            name,
-            isAdmin,
-            defaultPermissions
-        });
-
-        return c.json({ role });
-    });
-
-    router.delete("/roles/:roleId", requireAdmin, async (c) => {
-        const roleId = c.req.param("roleId");
-
-        if (["admin", "editor", "viewer"].includes(roleId)) {
-            throw ApiError.badRequest("Cannot delete built-in roles", "BUILTIN_ROLE");
-        }
-
-        const existing = await authRepo.getRoleById(roleId);
-        if (!existing) {
-            throw ApiError.notFound("Role not found");
-        }
-
-        await authRepo.deleteRole(roleId);
-
-        return c.json({ success: true });
-    });
 
     return router;
 }

package/src/auth/builtin-auth-adapter.ts

@@ -15,13 +15,10 @@ import type {
     AuthenticatedUser,
     AuthAdapterCapabilities,
     UserManagementAdapter,
-    RoleManagementAdapter,
     AuthUserListOptions,
     AuthUserListResult,
     AuthUserData,
     AuthCreateUserData,
-    AuthRoleData,
-    AuthCreateRoleData,
     BootstrappedAuth,
     BackendHooks,
 } from "@rebasepro/types";
@@ -122,17 +119,10 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 return null;
             }
 
-            // The decoded JWT may contain additional claims beyond the typed payload
-            const extendedPayload = payload as AccessTokenPayload & {
-                email?: string;
-                displayName?: string;
-            };
-
             // Resolve roles from the repository
             let roles: string[] = payload.roles || [];
             try {
-                const userRoles = await authRepository.getUserRoles(payload.userId);
-                roles = userRoles.map((r) => r.id);
+                roles = await authRepository.getUserRoleIds(payload.userId);
             } catch {
                 // Fall back to token roles if repository lookup fails
             }
@@ -141,8 +131,8 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
 
             return {
                 uid: payload.userId,
-                email: extendedPayload.email ?? "",
-                displayName: extendedPayload.displayName ?? null,
+                email: payload.email ?? "",
+                displayName: payload.displayName ?? null,
                 roles,
                 isAdmin,
                 rawToken: token,
@@ -167,15 +157,9 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 return null;
             }
 
-            const extendedPayload = payload as AccessTokenPayload & {
-                email?: string;
-                displayName?: string;
-            };
-
             let roles: string[] = payload.roles || [];
             try {
-                const userRoles = await authRepository.getUserRoles(payload.userId);
-                roles = userRoles.map((r) => r.id);
+                roles = await authRepository.getUserRoleIds(payload.userId);
             } catch {
                 // Fall back to token roles if repository lookup fails
             }
@@ -184,8 +168,8 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
 
             return {
                 uid: payload.userId,
-                email: extendedPayload.email ?? "",
-                displayName: extendedPayload.displayName ?? null,
+                email: payload.email ?? "",
+                displayName: payload.displayName ?? null,
                 roles,
                 isAdmin,
                 rawToken: token,
@@ -194,7 +178,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
 
         userManagement: createUserManagementFromRepo(authRepository, resolvedOps, authHooks),
 
-        roleManagement: createRoleManagementFromRepo(authRepository),
+
 
         createAuthRoutes(): Hono<HonoEnv> | undefined {
             return createAuthRoutes({
@@ -327,9 +311,8 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
             }
         },
 
-        async getUserRoles(userId: string): Promise<AuthRoleData[]> {
-            const roles = await repo.getUserRoles(userId);
-            return roles.map(toAuthRoleData);
+        async getUserRoles(userId: string): Promise<string[]> {
+            return repo.getUserRoleIds(userId);
         },
 
         async setUserRoles(userId: string, roleIds: string[]): Promise<void> {
@@ -338,40 +321,6 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
     };
 }
 
-function createRoleManagementFromRepo(repo: AuthRepository): RoleManagementAdapter {
-    return {
-        async listRoles(): Promise<AuthRoleData[]> {
-            const roles = await repo.listRoles();
-            return roles.map(toAuthRoleData);
-        },
-
-        async getRoleById(id: string): Promise<AuthRoleData | null> {
-            const role = await repo.getRoleById(id);
-            return role ? toAuthRoleData(role) : null;
-        },
-
-        async createRole(data: AuthCreateRoleData): Promise<AuthRoleData> {
-            const role = await repo.createRole({
-                id: data.id,
-                name: data.name,
-                isAdmin: data.isAdmin,
-                defaultPermissions: data.defaultPermissions,
-                collectionPermissions: data.collectionPermissions,
-            });
-            return toAuthRoleData(role);
-        },
-
-        async updateRole(id: string, data: Partial<AuthRoleData>): Promise<AuthRoleData | null> {
-            const role = await repo.updateRole(id, data);
-            return role ? toAuthRoleData(role) : null;
-        },
-
-        async deleteRole(id: string): Promise<void> {
-            await repo.deleteRole(id);
-        },
-    };
-}
-
 function toAuthUserData(user: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; emailVerified?: boolean; metadata?: Record<string, unknown>; createdAt?: Date; updatedAt?: Date }): AuthUserData {
     return {
         id: user.id,
@@ -384,13 +333,3 @@ function toAuthUserData(user: { id: string; email: string; displayName?: string
         updatedAt: user.updatedAt,
     };
 }
-
-function toAuthRoleData(role: { id: string; name: string; isAdmin: boolean; defaultPermissions?: unknown; collectionPermissions?: unknown }): AuthRoleData {
-    return {
-        id: role.id,
-        name: role.name,
-        isAdmin: role.isAdmin,
-        defaultPermissions: role.defaultPermissions as AuthRoleData["defaultPermissions"],
-        collectionPermissions: role.collectionPermissions as AuthRoleData["collectionPermissions"],
-    };
-}

package/src/auth/custom-auth-adapter.ts

@@ -76,7 +76,7 @@ export function createCustomAuthAdapter(options: CustomAuthAdapterOptions): Auth
 
         userManagement: options.userManagement,
 
-        roleManagement: options.roleManagement,
+
 
         getCapabilities() {
             return defaultCapabilities;

package/src/auth/jwt.ts

@@ -13,6 +13,16 @@ export interface AccessTokenPayload {
     uid?: string;
     /** Authentication Assurance Level: aal1 = password/oauth, aal2 = MFA verified */
     aal?: "aal1" | "aal2";
+    /** Email claim from the JWT, if present */
+    email?: string;
+    /** Display name claim from the JWT, if present */
+    displayName?: string;
+    /** Photo URL claim from the JWT, if present */
+    photoURL?: string;
+    /** Whether MFA has been verified for this session */
+    mfa_verified?: boolean;
+    /** Authentication Methods Reference — list of methods used (e.g. 'pwd', 'otp') */
+    amr?: string[];
 }
 
 let jwtConfig: JwtConfig = {

package/src/auth/routes.ts

@@ -1171,18 +1171,14 @@ message: "Session revoked successfully" });
             throw ApiError.notFound("MFA factor not found");
         }
 
-        // Check if this is a recovery code (10 chars with hyphen) or TOTP (6 digits)
-        const isRecoveryCode = code.length > 6;
-        let isValid = false;
+        // Try TOTP verification first (standard 6-digit codes)
+        const secretBuffer = base32Decode(factor.secretEncrypted);
+        let isValid = verifyTotp(secretBuffer, code);
 
-        if (isRecoveryCode) {
-            // Try recovery code
+        // Fall back to recovery code verification if TOTP didn't match
+        if (!isValid) {
             const codeHash = hashRecoveryCode(code);
             isValid = await authRepo.useRecoveryCode(userCtx.userId, codeHash);
-        } else {
-            // Verify TOTP
-            const secretBuffer = base32Decode(factor.secretEncrypted);
-            isValid = verifyTotp(secretBuffer, code);
         }
 
         if (!isValid) {