@rebasepro/server-core 0.4.0 → 0.6.0

package/src/auth/index.ts

@@ -7,9 +7,12 @@ export type { JwtConfig, AccessTokenPayload } from "./jwt";
 export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
 export type { PasswordValidationResult } from "./password";
 
-export type { AuthHooks, AuthMethod, ResolvedAuthOperations } from "./auth-hooks";
+export type { AuthHooks, AuthMethod, ResolvedAuthHooks } from "./auth-hooks";
 export { resolveAuthHooks } from "./auth-hooks";
 
+export { generateSecurePassword, generateSecureToken, hashToken, prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops";
+export type { AdminUserContext, AdminUserPrepareResult } from "./admin-user-ops";
+
 // OAuth Providers
 export { createGoogleProvider } from "./google-oauth";
 export type { GoogleProviderConfig } from "./google-oauth";
@@ -32,7 +35,8 @@ export type { AuthMiddlewareOptions, AuthResult } from "./middleware";
 export { createAuthRoutes } from "./routes";
 export type { AuthModuleConfig } from "./routes";
 
-export { createAdminRoutes } from "./admin-routes";
+export { createResetPasswordRoute } from "./reset-password-admin";
+export type { ResetPasswordRouteConfig } from "./reset-password-admin";
 
 
 export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createApiKeyRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";

package/src/auth/jwt.ts

@@ -1,5 +1,6 @@
 import jwt from "jsonwebtoken";
 import { createHash, randomBytes } from "crypto";
+import { logger } from "../utils/logger";
 
 export interface JwtConfig {
     secret: string;
@@ -13,6 +14,16 @@ export interface AccessTokenPayload {
     uid?: string;
     /** Authentication Assurance Level: aal1 = password/oauth, aal2 = MFA verified */
     aal?: "aal1" | "aal2";
+    /** Email claim from the JWT, if present */
+    email?: string;
+    /** Display name claim from the JWT, if present */
+    displayName?: string;
+    /** Photo URL claim from the JWT, if present */
+    photoURL?: string;
+    /** Whether MFA has been verified for this session */
+    mfa_verified?: boolean;
+    /** Authentication Methods Reference — list of methods used (e.g. 'pwd', 'otp') */
+    amr?: string[];
 }
 
 let jwtConfig: JwtConfig = {
@@ -52,14 +63,14 @@ export function configureJwt(config: JwtConfig): void {
     if (!config.secret || config.secret.length < 32) {
         throw new Error(
             "JWT secret is too short. Must be at least 32 characters. " +
-            "Generate one with: node -e \"console.log(require('crypto').randomBytes(48).toString('base64'))\""
+            "Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\""
         );
     }
 
     if (weakSecrets.has(config.secret.toLowerCase())) {
         throw new Error(
             "JWT secret is a known default/weak value. Please use a strong, randomly generated secret. " +
-            "Generate one with: node -e \"console.log(require('crypto').randomBytes(48).toString('base64'))\""
+            "Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\""
         );
     }
 
@@ -138,7 +149,7 @@ export function verifyAccessToken(token: string): AccessTokenPayload | null {
         const decoded = jwt.verify(token, jwtConfig.secret, { algorithms: ["HS256"] }) as { userId?: string; uid?: string; sub?: string; roles?: string[]; aal?: string };
         const id = decoded.userId || decoded.uid || decoded.sub;
         if (!id) {
-            console.error("[JWT] Verification failed: missing id in payload", decoded);
+            logger.error("[JWT] Verification failed: missing id in payload", { detail: decoded });
             return null;
         }
 
@@ -150,7 +161,7 @@ export function verifyAccessToken(token: string): AccessTokenPayload | null {
             aal
         };
     } catch (error) {
-        console.error("[JWT] Verification failed:", error, "Token start:", token.substring(0, 15));
+        logger.error("[JWT] Verification failed", { error: error, detail: token.substring(0, 15) });
         return null;
     }
 }

package/src/auth/linkedin-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 export interface LinkedinUserInfo {
     linkedinId: string;
@@ -38,7 +39,7 @@ export function createLinkedinProvider(config: { clientId: string, clientSecret:
 
                 if (!tokenResponse.ok) {
                     const errBody = await tokenResponse.text();
-                    console.error("Failed to get LinkedIn access token:", errBody);
+                    logger.error("Failed to get LinkedIn access token", { detail: errBody });
                     return null;
                 }
 
@@ -54,7 +55,7 @@ export function createLinkedinProvider(config: { clientId: string, clientSecret:
 
                 if (!profileResponse.ok) {
                     const errBody = await profileResponse.text();
-                    console.error("Failed to get LinkedIn user info:", errBody);
+                    logger.error("Failed to get LinkedIn user info", { detail: errBody });
                     return null;
                 }
 
@@ -73,7 +74,7 @@ export function createLinkedinProvider(config: { clientId: string, clientSecret:
                     photoUrl: profileData.picture || null
                 };
             } catch (error) {
-                console.error("LinkedIn OAuth error:", error);
+                logger.error("LinkedIn OAuth error", { error: error });
                 return null;
             }
         }

package/src/auth/mfa-routes.ts

@@ -0,0 +1,299 @@
+import { Hono } from "hono";
+import { z } from "zod";
+import { ApiError } from "../api/errors";
+import { HonoEnv } from "../api/types";
+import { requireAuth } from "./middleware";
+import { logger } from "../utils/logger";
+import {
+    generateTotpSecret,
+    verifyTotp,
+    base32Decode,
+    generateRecoveryCodes,
+    hashRecoveryCode
+} from "./mfa";
+import {
+    generateAccessToken,
+    generateRefreshToken,
+    hashRefreshToken,
+    getRefreshTokenExpiry,
+    getAccessTokenExpiry
+} from "./jwt";
+import type { AuthModuleConfig } from "./routes";
+import { resolveAuthHooks } from "./auth-hooks";
+
+export function mountMfaRoutes(
+    router: Hono<HonoEnv>,
+    config: AuthModuleConfig,
+    ops: ReturnType<typeof resolveAuthHooks>,
+    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T
+): void {
+    const authRepo = config.authRepo;
+    const emailConfig = config.emailConfig;
+
+    /**
+     * POST /auth/mfa/enroll
+     * Start MFA enrollment: generate TOTP secret and recovery codes
+     */
+    router.post("/mfa/enroll", requireAuth, async (c) => {
+        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        if (!userCtx) {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;
+        const friendlyName = typeof body.friendlyName === "string" ? body.friendlyName : undefined;
+        const issuer = typeof body.issuer === "string" ? body.issuer : emailConfig?.appName || "Rebase";
+
+        // Get user for account name
+        const user = await authRepo.getUserById(userCtx.userId);
+        if (!user) {
+            throw ApiError.notFound("User not found");
+        }
+
+        // Generate TOTP secret
+        const { secret, uri } = generateTotpSecret(issuer, user.email);
+
+        // Store the factor (unverified until user confirms with a valid code)
+        const factor = await authRepo.createMfaFactor(
+            user.id,
+            "totp",
+            secret, // In production, encrypt this before storage
+            friendlyName
+        );
+
+        // Generate recovery codes
+        const codes = generateRecoveryCodes(10);
+        const codeHashes = codes.map(hashRecoveryCode);
+        await authRepo.createRecoveryCodes(user.id, codeHashes);
+
+        return c.json(
+            {
+                factor: {
+                    id: factor.id,
+                    factorType: factor.factorType,
+                    friendlyName: factor.friendlyName
+                },
+                totp: {
+                    secret,
+                    uri,
+                    qrUri: uri
+                },
+                recoveryCodes: codes
+            },
+            201
+        );
+    });
+
+    /**
+     * POST /auth/mfa/verify
+     * Verify TOTP code to complete MFA enrollment
+     */
+    router.post("/mfa/verify", requireAuth, async (c) => {
+        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        if (!userCtx) {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        const verifySchema = z.object({
+            factorId: z.string().min(1, "Factor ID is required"),
+            code: z.string().length(6, "Code must be 6 digits")
+        });
+        const { factorId, code } = parseBody(verifySchema, await c.req.json());
+
+        // Get the factor
+        const factor = await authRepo.getMfaFactorById(factorId);
+        if (!factor || factor.userId !== userCtx.userId) {
+            throw ApiError.notFound("MFA factor not found");
+        }
+
+        if (factor.verified) {
+            throw ApiError.badRequest("Factor is already verified", "ALREADY_VERIFIED");
+        }
+
+        // Verify the TOTP code
+        const secretBuffer = base32Decode(factor.secretEncrypted);
+        const isValid = verifyTotp(secretBuffer, code);
+
+        if (!isValid) {
+            throw ApiError.unauthorized("Invalid TOTP code", "INVALID_CODE");
+        }
+
+        // Mark factor as verified
+        await authRepo.verifyMfaFactor(factorId);
+
+        return c.json({
+            success: true,
+            message: "MFA factor verified and enrolled"
+        });
+    });
+
+    /**
+     * POST /auth/mfa/challenge
+     * Create an MFA challenge during login (user has MFA enrolled)
+     */
+    router.post("/mfa/challenge", requireAuth, async (c) => {
+        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        if (!userCtx) {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        const challengeSchema = z.object({
+            factorId: z.string().min(1, "Factor ID is required")
+        });
+        const { factorId } = parseBody(challengeSchema, await c.req.json());
+
+        // Verify the factor belongs to this user and is verified
+        const factor = await authRepo.getMfaFactorById(factorId);
+        if (!factor || factor.userId !== userCtx.userId) {
+            throw ApiError.notFound("MFA factor not found");
+        }
+
+        if (!factor.verified) {
+            throw ApiError.badRequest("MFA factor is not yet verified", "FACTOR_NOT_VERIFIED");
+        }
+
+        const ipAddress = c.req.header("x-forwarded-for") || "unknown";
+        const challenge = await authRepo.createMfaChallenge(factorId, ipAddress);
+
+        return c.json({
+            challengeId: challenge.id,
+            factorId: challenge.factorId,
+            expiresAt: new Date(Date.now() + 5 * 60 * 1000).toISOString()
+        });
+    });
+
+    /**
+     * POST /auth/mfa/challenge/verify
+     * Verify a TOTP code for an active challenge, upgrade aal1 → aal2
+     */
+    router.post("/mfa/challenge/verify", requireAuth, async (c) => {
+        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        if (!userCtx) {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        const challengeVerifySchema = z.object({
+            challengeId: z.string().min(1, "Challenge ID is required"),
+            code: z.string().min(1, "Code is required")
+        });
+        const { challengeId, code } = parseBody(challengeVerifySchema, await c.req.json());
+
+        // Find the challenge
+        const challenge = await authRepo.getMfaChallengeById(challengeId);
+        if (!challenge) {
+            throw ApiError.badRequest("Invalid or expired challenge", "INVALID_CHALLENGE");
+        }
+
+        // Get the factor and verify ownership
+        const factor = await authRepo.getMfaFactorById(challenge.factorId);
+        if (!factor || factor.userId !== userCtx.userId) {
+            throw ApiError.notFound("MFA factor not found");
+        }
+
+        // Try TOTP verification first (standard 6-digit codes)
+        const secretBuffer = base32Decode(factor.secretEncrypted);
+        let isValid = verifyTotp(secretBuffer, code);
+
+        // Fall back to recovery code verification if TOTP didn't match
+        if (!isValid) {
+            const codeHash = hashRecoveryCode(code);
+            isValid = await authRepo.useRecoveryCode(userCtx.userId, codeHash);
+        }
+
+        if (!isValid) {
+            throw ApiError.unauthorized("Invalid verification code", "INVALID_CODE");
+        }
+
+        // Mark challenge as verified
+        await authRepo.verifyMfaChallenge(challengeId);
+
+        // Generate new access token with aal2
+        const roles = await authRepo.getUserRoles(userCtx.userId);
+        const roleIds = roles.map((r) => r.id);
+        const accessToken = generateAccessToken(userCtx.userId, roleIds, "aal2");
+        const refreshToken = generateRefreshToken();
+
+        // Create new refresh token
+        await authRepo.createRefreshToken(
+            userCtx.userId,
+            hashRefreshToken(refreshToken),
+            getRefreshTokenExpiry(),
+            c.req.header("user-agent") || "unknown",
+            c.req.header("x-forwarded-for") || "unknown"
+        );
+
+        // Fire onMfaVerified hook
+        if (ops.onMfaVerified) {
+            ops.onMfaVerified(userCtx.userId, factor.id).catch((err) => {
+                logger.error("[AuthHooks] onMfaVerified error", {
+                    error: err instanceof Error ? err.message : err
+                });
+            });
+        }
+
+        return c.json({
+            tokens: {
+                accessToken,
+                refreshToken,
+                accessTokenExpiresAt: getAccessTokenExpiry()
+            }
+        });
+    });
+
+    /**
+     * GET /auth/mfa/factors
+     * List enrolled MFA factors for the current user
+     */
+    router.get("/mfa/factors", requireAuth, async (c) => {
+        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        if (!userCtx) {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        const factors = await authRepo.getMfaFactors(userCtx.userId);
+        return c.json({
+            factors: factors.map((f) => ({
+                id: f.id,
+                factorType: f.factorType,
+                friendlyName: f.friendlyName,
+                verified: f.verified,
+                createdAt: f.createdAt
+            }))
+        });
+    });
+
+    /**
+     * DELETE /auth/mfa/unenroll
+     * Remove an MFA factor
+     */
+    router.delete("/mfa/unenroll", requireAuth, async (c) => {
+        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        if (!userCtx) {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        const unenrollSchema = z.object({
+            factorId: z.string().min(1, "Factor ID is required")
+        });
+        const { factorId } = parseBody(unenrollSchema, await c.req.json());
+
+        // Verify ownership
+        const factor = await authRepo.getMfaFactorById(factorId);
+        if (!factor || factor.userId !== userCtx.userId) {
+            throw ApiError.notFound("MFA factor not found");
+        }
+
+        await authRepo.deleteMfaFactor(factorId, userCtx.userId);
+
+        // If no more verified factors, clean up recovery codes
+        const hasFactors = await authRepo.hasVerifiedMfaFactors(userCtx.userId);
+        if (!hasFactors) {
+            await authRepo.deleteAllRecoveryCodes(userCtx.userId);
+        }
+
+        return c.json({
+            success: true,
+            message: "MFA factor removed"
+        });
+    });
+}

package/src/auth/mfa.ts

@@ -133,7 +133,8 @@ export function generateTotpSecret(issuer: string, accountName: string): {
     const encodedAccount = encodeURIComponent(accountName);
     const uri = `otpauth://totp/${encodedIssuer}:${encodedAccount}?secret=${secret}&issuer=${encodedIssuer}&algorithm=SHA1&digits=6&period=30`;
 
-    return { secret, uri };
+    return { secret,
+uri };
 }
 
 // ─── Recovery Codes ──────────────────────────────────────────────────────────

package/src/auth/microsoft-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 /**
  * Creates a Microsoft / Entra ID (Azure AD) OAuth Provider integration.
@@ -41,7 +42,7 @@ export function createMicrosoftProvider(config: {
                 );
 
                 if (!tokenResponse.ok) {
-                    console.error("Failed to get Microsoft access token:", await tokenResponse.text());
+                    logger.error("Failed to get Microsoft access token", { detail: await tokenResponse.text() });
                     return null;
                 }
 
@@ -54,7 +55,7 @@ export function createMicrosoftProvider(config: {
                 });
 
                 if (!profileResponse.ok) {
-                    console.error("Failed to get Microsoft user info:", await profileResponse.text());
+                    logger.error("Failed to get Microsoft user info", { detail: await profileResponse.text() });
                     return null;
                 }
 
@@ -67,7 +68,7 @@ export function createMicrosoftProvider(config: {
 
                 const email = profileData.mail || profileData.userPrincipalName;
                 if (!email) {
-                    console.error("Microsoft user has no email");
+                    logger.error("Microsoft user has no email");
                     return null;
                 }
 
@@ -80,7 +81,7 @@ export function createMicrosoftProvider(config: {
                     photoUrl: null
                 };
             } catch (error) {
-                console.error("Microsoft OAuth error:", error);
+                logger.error("Microsoft OAuth error", { error: error });
                 return null;
             }
         }

package/src/auth/middleware.ts

@@ -6,6 +6,7 @@ import { scopeDataDriver } from "./rls-scope";
 import { safeCompare } from "./crypto-utils";
 import { isApiKeyToken, validateApiKey } from "./api-keys/api-key-middleware";
 import type { ApiKeyStore } from "./api-keys/api-key-store";
+import { logger } from "../utils/logger";
 
 /**
  * Result from a custom auth validator.
@@ -295,7 +296,7 @@ code: "UNAUTHORIZED" } }, 401);
                             roles: ["admin"]
                         }));
                     } catch (error) {
-                        console.error("[AUTH] RLS scoping failed for service key:", error);
+                        logger.error("[AUTH] RLS scoping failed for service key", { error: error });
                         return c.json({ error: { message: "Internal authentication error",
 code: "INTERNAL_ERROR" } }, 500);
                     }
@@ -305,7 +306,7 @@ code: "INTERNAL_ERROR" } }, 500);
                     // api_keys table instead of JWT verification.
                     const result = await validateApiKey(c, token, {
                         store: apiKeyStore,
-                        driver,
+                        driver
                     });
                     if (result !== true) {
                         return result;
@@ -322,7 +323,7 @@ roles: payload.roles };
                             c.set("driver", await scopeDataDriver(driver, user));
                         } catch (error) {
                             // withAuth() failed for a valid token — reject (fail closed)
-                            console.error("[AUTH] RLS scoping failed for authenticated user:", error);
+                            logger.error("[AUTH] RLS scoping failed for authenticated user", { error: error });
                             return c.json({ error: { message: "Internal authentication error",
 code: "INTERNAL_ERROR" } }, 500);
                         }
@@ -342,7 +343,7 @@ code: "UNAUTHORIZED" } }, 401);
                     c.set("driver", await scopeDataDriver(driver, { uid: "anon",
 roles: ["anon"] }));
                 } catch (error) {
-                    console.error("[AUTH] Failed to create anon-scoped driver:", error);
+                    logger.error("[AUTH] Failed to create anon-scoped driver", { error: error });
                     return c.json({ error: { message: "Server configuration error",
 code: "INTERNAL_ERROR" } }, 500);
                 }

package/src/auth/rate-limiter.ts

@@ -159,7 +159,7 @@ export function apiKeyKeyGenerator(c: Parameters<MiddlewareHandler<HonoEnv>>[0])
  */
 export function createApiKeyRateLimiter(
     defaultLimit = 1000,
-    windowMs = 15 * 60 * 1000,
+    windowMs = 15 * 60 * 1000
 ): MiddlewareHandler<HonoEnv> {
     // We maintain a single shared store keyed by API key ID.
     // The actual limit is resolved per-request from the key's metadata.

package/src/auth/reset-password-admin.ts

@@ -0,0 +1,144 @@
+/**
+ * Standalone admin endpoint for resetting a user's password.
+ *
+ * Hook resolution order:
+ * 1. Collection-level hook (`auth.onResetPassword` on the collection)
+ * 2. Backend-level hook (`AuthHooks.onAdminResetPassword`)
+ * 3. Built-in default (send reset email, or generate temp password)
+ */
+
+import { Hono } from "hono";
+import { ApiError, errorHandler } from "../api/errors";
+import type { AuthRepository } from "./interfaces";
+import { createRequireAuth, requireAdmin } from "./middleware";
+import type { AuthHooks } from "./auth-hooks";
+import { resolveAuthHooks } from "./auth-hooks";
+import { generateSecurePassword, generateSecureToken, hashToken } from "./admin-user-ops";
+import { getPasswordResetTemplate } from "../email/templates";
+import type { EmailService, EmailConfig } from "../email";
+import type { HonoEnv } from "../api/types";
+import type { AuthCollectionConfig } from "@rebasepro/types";
+import { logger } from "../utils/logger";
+
+export interface ResetPasswordRouteConfig {
+    authRepo: AuthRepository;
+    emailService?: EmailService;
+    emailConfig?: EmailConfig;
+    serviceKey?: string;
+    authHooks?: AuthHooks;
+    /** The parsed auth config from the collection, if available. */
+    collectionAuthConfig?: AuthCollectionConfig;
+}
+
+/**
+ * Create a standalone admin route for resetting user passwords.
+ *
+ * Mounts: POST /users/:userId/reset-password
+ */
+export function createResetPasswordRoute(config: ResetPasswordRouteConfig): Hono<HonoEnv> {
+    const router = new Hono<HonoEnv>();
+    const authRepo = config.authRepo;
+    const { emailService, emailConfig, collectionAuthConfig } = config;
+    const ops = resolveAuthHooks(config.authHooks);
+
+    router.onError(errorHandler);
+    router.use("/*", createRequireAuth({ serviceKey: config.serviceKey }));
+
+    router.post("/users/:userId/reset-password", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const existing = await authRepo.getUserById(userId);
+        if (!existing) {
+            throw ApiError.notFound("User not found");
+        }
+
+        let invitationSent = false;
+        let temporaryPassword: string | undefined;
+
+        // 1. Collection-level hook (closest to the data)
+        if (collectionAuthConfig?.onResetPassword) {
+            const isEmailConfigured = !!(emailService && emailService.isConfigured());
+            const hookResult = await collectionAuthConfig.onResetPassword(existing.id, {
+                hashPassword: (password: string) => ops.hashPassword(password),
+                sendEmail: isEmailConfigured
+                    ? (options) => emailService!.send(options)
+                    : undefined,
+                emailConfigured: isEmailConfigured,
+                appName: emailConfig?.appName || "Rebase",
+                resetPasswordUrl: emailConfig?.resetPasswordUrl || ""
+            });
+            temporaryPassword = hookResult.temporaryPassword;
+            invitationSent = hookResult.invitationSent ?? false;
+        }
+        // 2. Backend-level hook (global override)
+        else if (ops.onAdminResetPassword) {
+            const hookResult = await ops.onAdminResetPassword(existing.id, {
+                authRepo,
+                emailService,
+                emailConfig
+            });
+            temporaryPassword = hookResult.temporaryPassword;
+            invitationSent = hookResult.invitationSent ?? false;
+        }
+        // 3. Built-in default
+        else {
+            const isEmailConfigured = !!(emailService && emailService.isConfigured());
+
+            if (isEmailConfigured) {
+                try {
+                    const token = generateSecureToken();
+                    const tokenHash = hashToken(token);
+                    const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
+
+                    await authRepo.createPasswordResetToken(existing.id, tokenHash, expiresAt);
+
+                    const baseUrl = emailConfig?.resetPasswordUrl || "";
+                    const setPasswordUrl = `${baseUrl}/reset-password?token=${token}`;
+
+                    const appName = emailConfig?.appName || "Rebase";
+                    const templateFn = emailConfig?.templates?.passwordReset;
+                    const emailContent = templateFn
+                        ? templateFn(setPasswordUrl, { email: existing.email,
+displayName: existing.displayName })
+                        : getPasswordResetTemplate(setPasswordUrl, { email: existing.email,
+displayName: existing.displayName }, appName);
+
+                    await emailService!.send({
+                        to: existing.email,
+                        subject: emailContent.subject,
+                        html: emailContent.html,
+                        text: emailContent.text
+                    });
+                    invitationSent = true;
+                } catch (emailError: unknown) {
+                    logger.error("Failed to send reset email", { error: emailError instanceof Error ? emailError.message : emailError });
+                    // Fall back to returning the temporary password
+                    const clearPassword = generateSecurePassword();
+                    const passwordHash = await ops.hashPassword(clearPassword);
+                    await authRepo.updatePassword(existing.id, passwordHash);
+                    temporaryPassword = clearPassword;
+                }
+            } else {
+                // No email service — generate password, set it, and return one-time
+                const clearPassword = generateSecurePassword();
+                const passwordHash = await ops.hashPassword(clearPassword);
+                await authRepo.updatePassword(existing.id, passwordHash);
+                temporaryPassword = clearPassword;
+            }
+        }
+
+        const userRoles = await authRepo.getUserRoleIds(existing.id);
+
+        return c.json({
+            user: {
+                uid: existing.id,
+                email: existing.email,
+                displayName: existing.displayName,
+                roles: userRoles
+            },
+            invitationSent,
+            ...(temporaryPassword ? { temporaryPassword } : {})
+        }, 200);
+    });
+
+    return router;
+}

package/src/auth/rls-scope.ts

@@ -47,7 +47,7 @@ function isRLSScopedDriver(driver: DataDriver): driver is RLSScopedDriver {
  */
 export async function scopeDataDriver(
     driver: DataDriver,
-    user: { uid: string; roles?: string[] },
+    user: { uid: string; roles?: string[] }
 ): Promise<DataDriver> {
     if (isRLSScopedDriver(driver)) {
         // Fail closed — do NOT catch and swallow errors here.