@rebasepro/server-core 0.4.0 → 0.6.0

package/src/auth/auth-hooks.ts

@@ -44,6 +44,7 @@ import {
 } from "./password";
 import type { PasswordValidationResult } from "./password";
 import type { AuthRepository, UserData, CreateUserData } from "./interfaces";
+import type { EmailService, EmailConfig } from "../email";
 
 /**
  * Authentication method identifier for lifecycle hooks.
@@ -205,28 +206,67 @@ export interface AuthHooks {
      * This is fire-and-forget — errors are logged but do not fail the request.
      */
     afterUserDelete?(userId: string): Promise<void>;
+
+    /**
+     * Optional hook to customize or override the default user creation flow via the admin panel/REST API.
+     * When provided, this replaces the built-in password generation, hashing, and invitation email logic.
+     */
+    onAdminCreateUser?(
+        values: Record<string, unknown>,
+        ctx: {
+            authRepo: AuthRepository;
+            emailService?: EmailService;
+            emailConfig?: EmailConfig;
+            hashPassword: (password: string) => Promise<string>;
+        }
+    ): Promise<{
+        values: Record<string, unknown>;
+        temporaryPassword?: string;
+        invitationSent?: boolean;
+    }>;
+
+    /**
+     * Optional hook to customize or override the default password reset flow via the admin panel.
+     * When provided, this replaces the built-in password reset token generation, hashing, and email logic.
+     */
+    onAdminResetPassword?(
+        userId: string,
+        ctx: {
+            authRepo: AuthRepository;
+            emailService?: EmailService;
+            emailConfig?: EmailConfig;
+        }
+    ): Promise<{
+        temporaryPassword?: string;
+        invitationSent?: boolean;
+    }>;
 }
 
 /**
- * Resolved auth operations — every method is guaranteed to exist.
+ * Resolved auth hooks — password operations are guaranteed to exist,
+ * all other hooks are passed through as-is (optional).
+ *
  * Created by `resolveAuthHooks()` which merges user hooks
  * with built-in defaults.
+ *
+ * Consumers should use the resolved object exclusively —
+ * never access the raw `AuthHooks` directly.
  */
-export interface ResolvedAuthOperations {
-    hashPassword(password: string): Promise<string>;
-    verifyPassword(password: string, storedHash: string): Promise<boolean>;
-    validatePasswordStrength(password: string): PasswordValidationResult;
-}
+export type ResolvedAuthHooks =
+    Required<Pick<AuthHooks, "hashPassword" | "verifyPassword" | "validatePasswordStrength">>
+    & Omit<AuthHooks, "hashPassword" | "verifyPassword" | "validatePasswordStrength">;
 
 /**
  * Merge user-provided hooks with the built-in defaults to produce
- * a complete set of resolved operations.
+ * a complete set of resolved hooks.
  *
  * This is the single point where defaults are applied — all consumers
- * call this once and use the resolved operations throughout.
+ * call this once and use the resolved hooks throughout.
  */
-export function resolveAuthHooks(hooks?: AuthHooks): ResolvedAuthOperations {
+export function resolveAuthHooks(hooks?: AuthHooks): ResolvedAuthHooks {
     return {
+        ...hooks,
+
         hashPassword: hooks?.hashPassword
             ?? defaultHashPassword,
 
@@ -234,6 +274,6 @@ export function resolveAuthHooks(hooks?: AuthHooks): ResolvedAuthOperations {
             ?? defaultVerifyPassword,
 
         validatePasswordStrength: hooks?.validatePasswordStrength
-            ?? defaultValidatePasswordStrength,
+            ?? defaultValidatePasswordStrength
     };
 }

package/src/auth/bitbucket-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 /**
  * Creates a Bitbucket OAuth Provider integration (OAuth 2.0 consumer).
@@ -29,7 +30,7 @@ export function createBitbucketProvider(config: { clientId: string; clientSecret
                 });
 
                 if (!tokenResponse.ok) {
-                    console.error("Failed to get Bitbucket access token:", await tokenResponse.text());
+                    logger.error("Failed to get Bitbucket access token", { detail: await tokenResponse.text() });
                     return null;
                 }
 
@@ -41,7 +42,7 @@ export function createBitbucketProvider(config: { clientId: string; clientSecret
                 });
 
                 if (!profileResponse.ok) {
-                    console.error("Failed to get Bitbucket user info:", await profileResponse.text());
+                    logger.error("Failed to get Bitbucket user info", { detail: await profileResponse.text() });
                     return null;
                 }
 
@@ -65,7 +66,7 @@ export function createBitbucketProvider(config: { clientId: string; clientSecret
                     email = primary?.email || null;
                 }
 
-                if (!email) { console.error("Bitbucket user has no verified email"); return null; }
+                if (!email) { logger.error("Bitbucket user has no verified email"); return null; }
 
                 return {
                     providerId: p.uuid,
@@ -74,7 +75,7 @@ export function createBitbucketProvider(config: { clientId: string; clientSecret
                     photoUrl: p.links?.avatar?.href || null
                 };
             } catch (error) {
-                console.error("Bitbucket OAuth error:", error);
+                logger.error("Bitbucket OAuth error", { error: error });
                 return null;
             }
         }

package/src/auth/builtin-auth-adapter.ts

@@ -6,7 +6,7 @@
  * when the user passes a plain `RebaseAuthConfig` object.
  *
  * This is NOT a rewrite — it delegates to the existing `createAuthRoutes()`,
- * `createAdminRoutes()`, and `verifyAccessToken()` functions. The goal is to
+ * `createResetPasswordRoute()`, and `verifyAccessToken()` functions. The goal is to
  * present the same functionality through the pluggable `AuthAdapter` contract.
  */
 
@@ -19,21 +19,22 @@ import type {
     AuthUserListResult,
     AuthUserData,
     AuthCreateUserData,
-    BootstrappedAuth,
-    BackendHooks,
+    BootstrappedAuth
 } from "@rebasepro/types";
 
 import type { Hono } from "hono";
 import { verifyAccessToken } from "./jwt";
 import type { AccessTokenPayload } from "./jwt";
 import { createAuthRoutes } from "./routes";
-import { createAdminRoutes } from "./admin-routes";
+import { createResetPasswordRoute } from "./reset-password-admin";
+import { prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops";
 import type { AuthRepository, OAuthProvider } from "./interfaces";
-import type { AuthHooks, ResolvedAuthOperations } from "./auth-hooks";
+import type { AuthHooks, ResolvedAuthHooks } from "./auth-hooks";
 import { resolveAuthHooks } from "./auth-hooks";
 import type { EmailService, EmailConfig } from "../email";
 import type { HonoEnv } from "../api/types";
 import { safeCompare } from "./crypto-utils";
+import { logger } from "../utils/logger";
 
 /**
  * Configuration for the built-in Rebase auth adapter.
@@ -57,10 +58,10 @@ export interface BuiltinAuthAdapterConfig {
     oauthProviders?: OAuthProvider<any>[];
     /** Static service key for server-to-server auth. */
     serviceKey?: string;
-    /** Backend hooks for intercepting admin data. */
-    hooks?: BackendHooks;
     /** Auth hooks for customizing password, credentials, lifecycle, etc. */
     authHooks?: AuthHooks;
+    /** The parsed auth config from the collection (if `auth` is an object, not just `true`). */
+    collectionAuthConfig?: import("@rebasepro/types").AuthCollectionConfig;
 }
 
 /**
@@ -79,8 +80,8 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
         defaultRole,
         oauthProviders = [],
         serviceKey,
-        hooks,
         authHooks,
+        collectionAuthConfig
     } = config;
 
     const resolvedOps = resolveAuthHooks(authHooks);
@@ -109,7 +110,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                     email: "service@rebase.internal",
                     roles: ["admin"],
                     isAdmin: true,
-                    rawToken: token,
+                    rawToken: token
                 };
             }
 
@@ -119,29 +120,23 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 return null;
             }
 
-            // The decoded JWT may contain additional claims beyond the typed payload
-            const extendedPayload = payload as AccessTokenPayload & {
-                email?: string;
-                displayName?: string;
-            };
-
             // Resolve roles from the repository
             let roles: string[] = payload.roles || [];
             try {
                 roles = await authRepository.getUserRoleIds(payload.userId);
-            } catch {
-                // Fall back to token roles if repository lookup fails
+            } catch (err: unknown) {
+                logger.warn("Role lookup from repository failed, using token roles as fallback", { userId: payload.userId, error: err });
             }
 
             const isAdmin = roles.some((r) => r === "admin" || r === "schema-admin");
 
             return {
                 uid: payload.userId,
-                email: extendedPayload.email ?? "",
-                displayName: extendedPayload.displayName ?? null,
+                email: payload.email ?? "",
+                displayName: payload.displayName ?? null,
                 roles,
                 isAdmin,
-                rawToken: token,
+                rawToken: token
             };
         },
 
@@ -153,7 +148,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                     email: "service@rebase.internal",
                     roles: ["admin"],
                     isAdmin: true,
-                    rawToken: token,
+                    rawToken: token
                 };
             }
 
@@ -163,32 +158,26 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 return null;
             }
 
-            const extendedPayload = payload as AccessTokenPayload & {
-                email?: string;
-                displayName?: string;
-            };
-
             let roles: string[] = payload.roles || [];
             try {
                 roles = await authRepository.getUserRoleIds(payload.userId);
-            } catch {
-                // Fall back to token roles if repository lookup fails
+            } catch (err: unknown) {
+                logger.warn("Role lookup from repository failed, using token roles as fallback", { userId: payload.userId, error: err });
             }
 
             const isAdmin = roles.some((r) => r === "admin" || r === "schema-admin");
 
             return {
                 uid: payload.userId,
-                email: extendedPayload.email ?? "",
-                displayName: extendedPayload.displayName ?? null,
+                email: payload.email ?? "",
+                displayName: payload.displayName ?? null,
                 roles,
                 isAdmin,
-                rawToken: token,
+                rawToken: token
             };
         },
 
-        userManagement: createUserManagementFromRepo(authRepository, resolvedOps, authHooks),
-
+        userManagement: createUserManagementFromRepo(authRepository, resolvedOps),
 
 
         createAuthRoutes(): Hono<HonoEnv> | undefined {
@@ -199,18 +188,39 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 allowRegistration,
                 defaultRole,
                 oauthProviders,
-                authHooks,
+                authHooks
             });
         },
 
         createAdminRoutes(): Hono<HonoEnv> | undefined {
-            return createAdminRoutes({
+            return createResetPasswordRoute({
                 authRepo: authRepository,
                 emailService,
                 emailConfig,
                 serviceKey,
-                hooks,
                 authHooks,
+                collectionAuthConfig
+            });
+        },
+
+        async prepareUserCreation(values, collectionAuth) {
+            const parsedCollectionAuth = collectionAuth as import("@rebasepro/types").AuthCollectionConfig | undefined;
+            return prepareAdminUserValues(values, {
+                authRepo: authRepository,
+                emailService,
+                emailConfig,
+                resolvedHooks: resolvedOps,
+                collectionAuthConfig: parsedCollectionAuth ?? collectionAuthConfig
+            });
+        },
+
+        async finalizeUserCreation(entity, clearPassword) {
+            return finalizeAdminUserCreation(entity, clearPassword, {
+                authRepo: authRepository,
+                emailService,
+                emailConfig,
+                resolvedHooks: resolvedOps,
+                collectionAuthConfig
             });
         },
 
@@ -236,9 +246,9 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 profileUpdate: true,
                 emailVerification: !!emailService?.isConfigured(),
                 enabledProviders,
-                needsSetup,
+                needsSetup
             };
-        },
+        }
     };
 
     return adapter;
@@ -246,7 +256,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
 
 // ─── Internal Helpers ────────────────────────────────────────────────────────
 
-function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: ResolvedAuthOperations, authHooks?: AuthHooks): UserManagementAdapter {
+function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: ResolvedAuthHooks): UserManagementAdapter {
     return {
         async listUsers(options?: AuthUserListOptions): Promise<AuthUserListResult> {
             const result = await repo.listUsersPaginated({
@@ -255,13 +265,13 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
                 search: options?.search,
                 orderBy: options?.orderBy,
                 orderDir: options?.orderDir,
-                roleId: options?.roleId,
+                roleId: options?.roleId
             });
             return {
                 users: result.users.map(toAuthUserData),
                 total: result.total,
                 limit: result.limit,
-                offset: result.offset,
+                offset: result.offset
             };
         },
 
@@ -277,17 +287,17 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
                 passwordHash,
                 displayName: data.displayName,
                 photoUrl: data.photoUrl,
-                metadata: data.metadata,
+                metadata: data.metadata
             };
-            if (authHooks?.beforeUserCreate) {
-                createData = await authHooks.beforeUserCreate(createData);
+            if (resolvedOps.beforeUserCreate) {
+                createData = await resolvedOps.beforeUserCreate(createData);
             }
             const user = await repo.createUser(createData);
-            if (authHooks?.afterUserCreate) {
+            if (resolvedOps.afterUserCreate) {
                 try {
-                    await authHooks.afterUserCreate(user);
+                    await resolvedOps.afterUserCreate(user);
                 } catch (err) {
-                    console.error("[AuthHooks] afterUserCreate error:", err instanceof Error ? err.message : err);
+                    logger.error("[AuthHooks] afterUserCreate error", { error: err instanceof Error ? err.message : err });
                 }
             }
             return toAuthUserData(user);
@@ -308,16 +318,16 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
 
         async deleteUser(id: string): Promise<void> {
             // Call beforeUserDelete hook (throw to prevent deletion)
-            if (authHooks?.beforeUserDelete) {
-                await authHooks.beforeUserDelete(id);
+            if (resolvedOps.beforeUserDelete) {
+                await resolvedOps.beforeUserDelete(id);
             }
 
             await repo.deleteUser(id);
 
             // Fire afterUserDelete hook (fire-and-forget)
-            if (authHooks?.afterUserDelete) {
-                authHooks.afterUserDelete(id).catch(err => {
-                    console.error("[AuthHooks] afterUserDelete error:", err instanceof Error ? err.message : err);
+            if (resolvedOps.afterUserDelete) {
+                resolvedOps.afterUserDelete(id).catch(err => {
+                    logger.error("[AuthHooks] afterUserDelete error", { error: err instanceof Error ? err.message : err });
                 });
             }
         },
@@ -328,7 +338,7 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
 
         async setUserRoles(userId: string, roleIds: string[]): Promise<void> {
             await repo.setUserRoles(userId, roleIds);
-        },
+        }
     };
 }
 
@@ -341,6 +351,6 @@ function toAuthUserData(user: { id: string; email: string; displayName?: string
         emailVerified: user.emailVerified,
         metadata: user.metadata,
         createdAt: user.createdAt,
-        updatedAt: user.updatedAt,
+        updatedAt: user.updatedAt
     };
 }

package/src/auth/custom-auth-adapter.ts

@@ -29,7 +29,7 @@
 import type {
     AuthAdapter,
     AuthAdapterCapabilities,
-    CustomAuthAdapterOptions,
+    CustomAuthAdapterOptions
 } from "@rebasepro/types";
 
 /**
@@ -52,7 +52,7 @@ export function createCustomAuthAdapter(options: CustomAuthAdapterOptions): Auth
         profileUpdate: false,
         emailVerification: false,
         enabledProviders: [],
-        ...options.capabilities,
+        ...options.capabilities
     };
 
     const resolvedVerifyToken = options.verifyToken
@@ -60,7 +60,7 @@ export function createCustomAuthAdapter(options: CustomAuthAdapterOptions): Auth
             // Synthesize a minimal Request so adapters that only implement
             // verifyRequest still work for WebSocket token verification.
             const syntheticRequest = new Request("http://localhost/_ws_auth", {
-                headers: { Authorization: `Bearer ${token}` },
+                headers: { Authorization: `Bearer ${token}` }
             });
             return options.verifyRequest(syntheticRequest);
         });
@@ -77,9 +77,8 @@ export function createCustomAuthAdapter(options: CustomAuthAdapterOptions): Auth
         userManagement: options.userManagement,
 
 
-
         getCapabilities() {
             return defaultCapabilities;
-        },
+        }
     };
 }

package/src/auth/discord-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 /**
  * Creates a Discord OAuth2 Provider integration.
@@ -30,7 +31,7 @@ export function createDiscordProvider(config: { clientId: string; clientSecret:
                 });
 
                 if (!tokenResponse.ok) {
-                    console.error("Failed to get Discord access token:", await tokenResponse.text());
+                    logger.error("Failed to get Discord access token", { detail: await tokenResponse.text() });
                     return null;
                 }
 
@@ -43,7 +44,7 @@ export function createDiscordProvider(config: { clientId: string; clientSecret:
                 });
 
                 if (!profileResponse.ok) {
-                    console.error("Failed to get Discord user info:", await profileResponse.text());
+                    logger.error("Failed to get Discord user info", { detail: await profileResponse.text() });
                     return null;
                 }
 
@@ -57,7 +58,7 @@ export function createDiscordProvider(config: { clientId: string; clientSecret:
                 };
 
                 if (!profileData.email) {
-                    console.error("Discord user has no email (email scope may not have been granted)");
+                    logger.error("Discord user has no email (email scope may not have been granted)");
                     return null;
                 }
 
@@ -75,7 +76,7 @@ export function createDiscordProvider(config: { clientId: string; clientSecret:
                     photoUrl
                 };
             } catch (error) {
-                console.error("Discord OAuth error:", error);
+                logger.error("Discord OAuth error", { error: error });
                 return null;
             }
         }

package/src/auth/facebook-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 /**
  * Creates a Facebook / Meta OAuth Provider integration.
@@ -26,7 +27,7 @@ export function createFacebookProvider(config: { clientId: string; clientSecret:
                 const tokenResponse = await fetch(tokenUrl.toString());
 
                 if (!tokenResponse.ok) {
-                    console.error("Failed to get Facebook access token:", await tokenResponse.text());
+                    logger.error("Failed to get Facebook access token", { detail: await tokenResponse.text() });
                     return null;
                 }
 
@@ -41,7 +42,7 @@ export function createFacebookProvider(config: { clientId: string; clientSecret:
                 const profileResponse = await fetch(profileUrl.toString());
 
                 if (!profileResponse.ok) {
-                    console.error("Failed to get Facebook user info:", await profileResponse.text());
+                    logger.error("Failed to get Facebook user info", { detail: await profileResponse.text() });
                     return null;
                 }
 
@@ -53,7 +54,7 @@ export function createFacebookProvider(config: { clientId: string; clientSecret:
                 };
 
                 if (!profileData.email) {
-                    console.error("Facebook user has no email (email permission may not have been granted)");
+                    logger.error("Facebook user has no email (email permission may not have been granted)");
                     return null;
                 }
 
@@ -64,7 +65,7 @@ export function createFacebookProvider(config: { clientId: string; clientSecret:
                     photoUrl: profileData.picture?.data?.url || null
                 };
             } catch (error) {
-                console.error("Facebook OAuth error:", error);
+                logger.error("Facebook OAuth error", { error: error });
                 return null;
             }
         }

package/src/auth/github-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 /**
  * Creates a GitHub OAuth Provider integration.
@@ -33,13 +34,13 @@ export function createGitHubProvider(config: { clientId: string; clientSecret: s
                 });
 
                 if (!tokenResponse.ok) {
-                    console.error("Failed to get GitHub access token:", await tokenResponse.text());
+                    logger.error("Failed to get GitHub access token", { detail: await tokenResponse.text() });
                     return null;
                 }
 
                 const tokenData = await tokenResponse.json() as { access_token?: string; error?: string };
                 if (tokenData.error || !tokenData.access_token) {
-                    console.error("GitHub token exchange error:", tokenData.error);
+                    logger.error("GitHub token exchange error", { detail: tokenData.error });
                     return null;
                 }
 
@@ -55,7 +56,7 @@ export function createGitHubProvider(config: { clientId: string; clientSecret: s
                 });
 
                 if (!profileResponse.ok) {
-                    console.error("Failed to get GitHub user info:", await profileResponse.text());
+                    logger.error("Failed to get GitHub user info", { detail: await profileResponse.text() });
                     return null;
                 }
 
@@ -91,7 +92,7 @@ export function createGitHubProvider(config: { clientId: string; clientSecret: s
                 }
 
                 if (!email) {
-                    console.error("GitHub user has no verified email");
+                    logger.error("GitHub user has no verified email");
                     return null;
                 }
 
@@ -102,7 +103,7 @@ export function createGitHubProvider(config: { clientId: string; clientSecret: s
                     photoUrl: profileData.avatar_url || null
                 };
             } catch (error) {
-                console.error("GitHub OAuth error:", error);
+                logger.error("GitHub OAuth error", { error: error });
                 return null;
             }
         }

package/src/auth/gitlab-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 /**
  * Creates a GitLab OAuth Provider integration.
@@ -33,7 +34,7 @@ export function createGitLabProvider(config: {
                 });
 
                 if (!tokenResponse.ok) {
-                    console.error("Failed to get GitLab access token:", await tokenResponse.text());
+                    logger.error("Failed to get GitLab access token", { detail: await tokenResponse.text() });
                     return null;
                 }
 
@@ -44,7 +45,7 @@ export function createGitLabProvider(config: {
                 });
 
                 if (!profileResponse.ok) {
-                    console.error("Failed to get GitLab user info:", await profileResponse.text());
+                    logger.error("Failed to get GitLab user info", { detail: await profileResponse.text() });
                     return null;
                 }
 
@@ -53,7 +54,7 @@ export function createGitLabProvider(config: {
                     email: string; avatar_url?: string | null;
                 };
 
-                if (!p.email) { console.error("GitLab user has no email"); return null; }
+                if (!p.email) { logger.error("GitLab user has no email"); return null; }
 
                 return {
                     providerId: String(p.id),
@@ -62,7 +63,7 @@ export function createGitLabProvider(config: {
                     photoUrl: p.avatar_url || null
                 };
             } catch (error) {
-                console.error("GitLab OAuth error:", error);
+                logger.error("GitLab OAuth error", { error: error });
                 return null;
             }
         }

package/src/auth/google-oauth.ts

@@ -1,6 +1,7 @@
 import { OAuth2Client } from "google-auth-library/build/src/index.js";
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 export interface GoogleUserInfo {
     googleId: string;
@@ -210,7 +211,7 @@ export function createGoogleProvider(config: GoogleProviderConfig | string): OAu
 
                 throw new Error("No valid Google credential provided (expected idToken, accessToken, or code+redirectUri)");
             } catch (error) {
-                console.error("Google OAuth verification failed:", error);
+                logger.error("Google OAuth verification failed", { error: error });
                 throw error;
             }
         }