@rebasepro/server-core 0.5.0 → 0.6.1

package/src/auth/builtin-auth-adapter.ts

@@ -6,7 +6,7 @@
  * when the user passes a plain `RebaseAuthConfig` object.
  *
  * This is NOT a rewrite — it delegates to the existing `createAuthRoutes()`,
- * `createAdminRoutes()`, and `verifyAccessToken()` functions. The goal is to
+ * `createResetPasswordRoute()`, and `verifyAccessToken()` functions. The goal is to
  * present the same functionality through the pluggable `AuthAdapter` contract.
  */
 
@@ -19,21 +19,22 @@ import type {
     AuthUserListResult,
     AuthUserData,
     AuthCreateUserData,
-    BootstrappedAuth,
-    BackendHooks,
+    BootstrappedAuth
 } from "@rebasepro/types";
 
 import type { Hono } from "hono";
 import { verifyAccessToken } from "./jwt";
 import type { AccessTokenPayload } from "./jwt";
 import { createAuthRoutes } from "./routes";
-import { createAdminRoutes } from "./admin-routes";
+import { createResetPasswordRoute } from "./reset-password-admin";
+import { prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops";
 import type { AuthRepository, OAuthProvider } from "./interfaces";
-import type { AuthHooks, ResolvedAuthOperations } from "./auth-hooks";
+import type { AuthHooks, ResolvedAuthHooks } from "./auth-hooks";
 import { resolveAuthHooks } from "./auth-hooks";
 import type { EmailService, EmailConfig } from "../email";
 import type { HonoEnv } from "../api/types";
 import { safeCompare } from "./crypto-utils";
+import { logger } from "../utils/logger";
 
 /**
  * Configuration for the built-in Rebase auth adapter.
@@ -57,10 +58,10 @@ export interface BuiltinAuthAdapterConfig {
     oauthProviders?: OAuthProvider<any>[];
     /** Static service key for server-to-server auth. */
     serviceKey?: string;
-    /** Backend hooks for intercepting admin data. */
-    hooks?: BackendHooks;
     /** Auth hooks for customizing password, credentials, lifecycle, etc. */
     authHooks?: AuthHooks;
+    /** The parsed auth config from the collection (if `auth` is an object, not just `true`). */
+    collectionAuthConfig?: import("@rebasepro/types").AuthCollectionConfig;
 }
 
 /**
@@ -79,8 +80,8 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
         defaultRole,
         oauthProviders = [],
         serviceKey,
-        hooks,
         authHooks,
+        collectionAuthConfig
     } = config;
 
     const resolvedOps = resolveAuthHooks(authHooks);
@@ -109,7 +110,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                     email: "service@rebase.internal",
                     roles: ["admin"],
                     isAdmin: true,
-                    rawToken: token,
+                    rawToken: token
                 };
             }
 
@@ -123,8 +124,8 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
             let roles: string[] = payload.roles || [];
             try {
                 roles = await authRepository.getUserRoleIds(payload.userId);
-            } catch {
-                // Fall back to token roles if repository lookup fails
+            } catch (err: unknown) {
+                logger.warn("Role lookup from repository failed, using token roles as fallback", { userId: payload.userId, error: err });
             }
 
             const isAdmin = roles.some((r) => r === "admin" || r === "schema-admin");
@@ -135,7 +136,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 displayName: payload.displayName ?? null,
                 roles,
                 isAdmin,
-                rawToken: token,
+                rawToken: token
             };
         },
 
@@ -147,7 +148,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                     email: "service@rebase.internal",
                     roles: ["admin"],
                     isAdmin: true,
-                    rawToken: token,
+                    rawToken: token
                 };
             }
 
@@ -160,8 +161,8 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
             let roles: string[] = payload.roles || [];
             try {
                 roles = await authRepository.getUserRoleIds(payload.userId);
-            } catch {
-                // Fall back to token roles if repository lookup fails
+            } catch (err: unknown) {
+                logger.warn("Role lookup from repository failed, using token roles as fallback", { userId: payload.userId, error: err });
             }
 
             const isAdmin = roles.some((r) => r === "admin" || r === "schema-admin");
@@ -172,12 +173,11 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 displayName: payload.displayName ?? null,
                 roles,
                 isAdmin,
-                rawToken: token,
+                rawToken: token
             };
         },
 
-        userManagement: createUserManagementFromRepo(authRepository, resolvedOps, authHooks),
-
+        userManagement: createUserManagementFromRepo(authRepository, resolvedOps),
 
 
         createAuthRoutes(): Hono<HonoEnv> | undefined {
@@ -188,18 +188,39 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 allowRegistration,
                 defaultRole,
                 oauthProviders,
-                authHooks,
+                authHooks
             });
         },
 
         createAdminRoutes(): Hono<HonoEnv> | undefined {
-            return createAdminRoutes({
+            return createResetPasswordRoute({
                 authRepo: authRepository,
                 emailService,
                 emailConfig,
                 serviceKey,
-                hooks,
                 authHooks,
+                collectionAuthConfig
+            });
+        },
+
+        async prepareUserCreation(values, collectionAuth) {
+            const parsedCollectionAuth = collectionAuth as import("@rebasepro/types").AuthCollectionConfig | undefined;
+            return prepareAdminUserValues(values, {
+                authRepo: authRepository,
+                emailService,
+                emailConfig,
+                resolvedHooks: resolvedOps,
+                collectionAuthConfig: parsedCollectionAuth ?? collectionAuthConfig
+            });
+        },
+
+        async finalizeUserCreation(entity, clearPassword) {
+            return finalizeAdminUserCreation(entity, clearPassword, {
+                authRepo: authRepository,
+                emailService,
+                emailConfig,
+                resolvedHooks: resolvedOps,
+                collectionAuthConfig
             });
         },
 
@@ -225,9 +246,9 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 profileUpdate: true,
                 emailVerification: !!emailService?.isConfigured(),
                 enabledProviders,
-                needsSetup,
+                needsSetup
             };
-        },
+        }
     };
 
     return adapter;
@@ -235,7 +256,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
 
 // ─── Internal Helpers ────────────────────────────────────────────────────────
 
-function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: ResolvedAuthOperations, authHooks?: AuthHooks): UserManagementAdapter {
+function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: ResolvedAuthHooks): UserManagementAdapter {
     return {
         async listUsers(options?: AuthUserListOptions): Promise<AuthUserListResult> {
             const result = await repo.listUsersPaginated({
@@ -244,13 +265,13 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
                 search: options?.search,
                 orderBy: options?.orderBy,
                 orderDir: options?.orderDir,
-                roleId: options?.roleId,
+                roleId: options?.roleId
             });
             return {
                 users: result.users.map(toAuthUserData),
                 total: result.total,
                 limit: result.limit,
-                offset: result.offset,
+                offset: result.offset
             };
         },
 
@@ -266,17 +287,17 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
                 passwordHash,
                 displayName: data.displayName,
                 photoUrl: data.photoUrl,
-                metadata: data.metadata,
+                metadata: data.metadata
             };
-            if (authHooks?.beforeUserCreate) {
-                createData = await authHooks.beforeUserCreate(createData);
+            if (resolvedOps.beforeUserCreate) {
+                createData = await resolvedOps.beforeUserCreate(createData);
             }
             const user = await repo.createUser(createData);
-            if (authHooks?.afterUserCreate) {
+            if (resolvedOps.afterUserCreate) {
                 try {
-                    await authHooks.afterUserCreate(user);
+                    await resolvedOps.afterUserCreate(user);
                 } catch (err) {
-                    console.error("[AuthHooks] afterUserCreate error:", err instanceof Error ? err.message : err);
+                    logger.error("[AuthHooks] afterUserCreate error", { error: err instanceof Error ? err.message : err });
                 }
             }
             return toAuthUserData(user);
@@ -297,16 +318,16 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
 
         async deleteUser(id: string): Promise<void> {
             // Call beforeUserDelete hook (throw to prevent deletion)
-            if (authHooks?.beforeUserDelete) {
-                await authHooks.beforeUserDelete(id);
+            if (resolvedOps.beforeUserDelete) {
+                await resolvedOps.beforeUserDelete(id);
             }
 
             await repo.deleteUser(id);
 
             // Fire afterUserDelete hook (fire-and-forget)
-            if (authHooks?.afterUserDelete) {
-                authHooks.afterUserDelete(id).catch(err => {
-                    console.error("[AuthHooks] afterUserDelete error:", err instanceof Error ? err.message : err);
+            if (resolvedOps.afterUserDelete) {
+                resolvedOps.afterUserDelete(id).catch(err => {
+                    logger.error("[AuthHooks] afterUserDelete error", { error: err instanceof Error ? err.message : err });
                 });
             }
         },
@@ -317,7 +338,7 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
 
         async setUserRoles(userId: string, roleIds: string[]): Promise<void> {
             await repo.setUserRoles(userId, roleIds);
-        },
+        }
     };
 }
 
@@ -330,6 +351,6 @@ function toAuthUserData(user: { id: string; email: string; displayName?: string
         emailVerified: user.emailVerified,
         metadata: user.metadata,
         createdAt: user.createdAt,
-        updatedAt: user.updatedAt,
+        updatedAt: user.updatedAt
     };
 }

package/src/auth/custom-auth-adapter.ts

@@ -29,7 +29,7 @@
 import type {
     AuthAdapter,
     AuthAdapterCapabilities,
-    CustomAuthAdapterOptions,
+    CustomAuthAdapterOptions
 } from "@rebasepro/types";
 
 /**
@@ -52,7 +52,7 @@ export function createCustomAuthAdapter(options: CustomAuthAdapterOptions): Auth
         profileUpdate: false,
         emailVerification: false,
         enabledProviders: [],
-        ...options.capabilities,
+        ...options.capabilities
     };
 
     const resolvedVerifyToken = options.verifyToken
@@ -60,7 +60,7 @@ export function createCustomAuthAdapter(options: CustomAuthAdapterOptions): Auth
             // Synthesize a minimal Request so adapters that only implement
             // verifyRequest still work for WebSocket token verification.
             const syntheticRequest = new Request("http://localhost/_ws_auth", {
-                headers: { Authorization: `Bearer ${token}` },
+                headers: { Authorization: `Bearer ${token}` }
             });
             return options.verifyRequest(syntheticRequest);
         });
@@ -77,9 +77,8 @@ export function createCustomAuthAdapter(options: CustomAuthAdapterOptions): Auth
         userManagement: options.userManagement,
 
 
-
         getCapabilities() {
             return defaultCapabilities;
-        },
+        }
     };
 }

package/src/auth/discord-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 /**
  * Creates a Discord OAuth2 Provider integration.
@@ -30,7 +31,7 @@ export function createDiscordProvider(config: { clientId: string; clientSecret:
                 });
 
                 if (!tokenResponse.ok) {
-                    console.error("Failed to get Discord access token:", await tokenResponse.text());
+                    logger.error("Failed to get Discord access token", { detail: await tokenResponse.text() });
                     return null;
                 }
 
@@ -43,7 +44,7 @@ export function createDiscordProvider(config: { clientId: string; clientSecret:
                 });
 
                 if (!profileResponse.ok) {
-                    console.error("Failed to get Discord user info:", await profileResponse.text());
+                    logger.error("Failed to get Discord user info", { detail: await profileResponse.text() });
                     return null;
                 }
 
@@ -57,7 +58,7 @@ export function createDiscordProvider(config: { clientId: string; clientSecret:
                 };
 
                 if (!profileData.email) {
-                    console.error("Discord user has no email (email scope may not have been granted)");
+                    logger.error("Discord user has no email (email scope may not have been granted)");
                     return null;
                 }
 
@@ -75,7 +76,7 @@ export function createDiscordProvider(config: { clientId: string; clientSecret:
                     photoUrl
                 };
             } catch (error) {
-                console.error("Discord OAuth error:", error);
+                logger.error("Discord OAuth error", { error: error });
                 return null;
             }
         }

package/src/auth/facebook-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 /**
  * Creates a Facebook / Meta OAuth Provider integration.
@@ -26,7 +27,7 @@ export function createFacebookProvider(config: { clientId: string; clientSecret:
                 const tokenResponse = await fetch(tokenUrl.toString());
 
                 if (!tokenResponse.ok) {
-                    console.error("Failed to get Facebook access token:", await tokenResponse.text());
+                    logger.error("Failed to get Facebook access token", { detail: await tokenResponse.text() });
                     return null;
                 }
 
@@ -41,7 +42,7 @@ export function createFacebookProvider(config: { clientId: string; clientSecret:
                 const profileResponse = await fetch(profileUrl.toString());
 
                 if (!profileResponse.ok) {
-                    console.error("Failed to get Facebook user info:", await profileResponse.text());
+                    logger.error("Failed to get Facebook user info", { detail: await profileResponse.text() });
                     return null;
                 }
 
@@ -53,7 +54,7 @@ export function createFacebookProvider(config: { clientId: string; clientSecret:
                 };
 
                 if (!profileData.email) {
-                    console.error("Facebook user has no email (email permission may not have been granted)");
+                    logger.error("Facebook user has no email (email permission may not have been granted)");
                     return null;
                 }
 
@@ -64,7 +65,7 @@ export function createFacebookProvider(config: { clientId: string; clientSecret:
                     photoUrl: profileData.picture?.data?.url || null
                 };
             } catch (error) {
-                console.error("Facebook OAuth error:", error);
+                logger.error("Facebook OAuth error", { error: error });
                 return null;
             }
         }

package/src/auth/github-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 /**
  * Creates a GitHub OAuth Provider integration.
@@ -33,13 +34,13 @@ export function createGitHubProvider(config: { clientId: string; clientSecret: s
                 });
 
                 if (!tokenResponse.ok) {
-                    console.error("Failed to get GitHub access token:", await tokenResponse.text());
+                    logger.error("Failed to get GitHub access token", { detail: await tokenResponse.text() });
                     return null;
                 }
 
                 const tokenData = await tokenResponse.json() as { access_token?: string; error?: string };
                 if (tokenData.error || !tokenData.access_token) {
-                    console.error("GitHub token exchange error:", tokenData.error);
+                    logger.error("GitHub token exchange error", { detail: tokenData.error });
                     return null;
                 }
 
@@ -55,7 +56,7 @@ export function createGitHubProvider(config: { clientId: string; clientSecret: s
                 });
 
                 if (!profileResponse.ok) {
-                    console.error("Failed to get GitHub user info:", await profileResponse.text());
+                    logger.error("Failed to get GitHub user info", { detail: await profileResponse.text() });
                     return null;
                 }
 
@@ -91,7 +92,7 @@ export function createGitHubProvider(config: { clientId: string; clientSecret: s
                 }
 
                 if (!email) {
-                    console.error("GitHub user has no verified email");
+                    logger.error("GitHub user has no verified email");
                     return null;
                 }
 
@@ -102,7 +103,7 @@ export function createGitHubProvider(config: { clientId: string; clientSecret: s
                     photoUrl: profileData.avatar_url || null
                 };
             } catch (error) {
-                console.error("GitHub OAuth error:", error);
+                logger.error("GitHub OAuth error", { error: error });
                 return null;
             }
         }

package/src/auth/gitlab-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 /**
  * Creates a GitLab OAuth Provider integration.
@@ -33,7 +34,7 @@ export function createGitLabProvider(config: {
                 });
 
                 if (!tokenResponse.ok) {
-                    console.error("Failed to get GitLab access token:", await tokenResponse.text());
+                    logger.error("Failed to get GitLab access token", { detail: await tokenResponse.text() });
                     return null;
                 }
 
@@ -44,7 +45,7 @@ export function createGitLabProvider(config: {
                 });
 
                 if (!profileResponse.ok) {
-                    console.error("Failed to get GitLab user info:", await profileResponse.text());
+                    logger.error("Failed to get GitLab user info", { detail: await profileResponse.text() });
                     return null;
                 }
 
@@ -53,7 +54,7 @@ export function createGitLabProvider(config: {
                     email: string; avatar_url?: string | null;
                 };
 
-                if (!p.email) { console.error("GitLab user has no email"); return null; }
+                if (!p.email) { logger.error("GitLab user has no email"); return null; }
 
                 return {
                     providerId: String(p.id),
@@ -62,7 +63,7 @@ export function createGitLabProvider(config: {
                     photoUrl: p.avatar_url || null
                 };
             } catch (error) {
-                console.error("GitLab OAuth error:", error);
+                logger.error("GitLab OAuth error", { error: error });
                 return null;
             }
         }

package/src/auth/google-oauth.ts

@@ -1,6 +1,7 @@
 import { OAuth2Client } from "google-auth-library/build/src/index.js";
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 export interface GoogleUserInfo {
     googleId: string;
@@ -210,7 +211,7 @@ export function createGoogleProvider(config: GoogleProviderConfig | string): OAu
 
                 throw new Error("No valid Google credential provided (expected idToken, accessToken, or code+redirectUri)");
             } catch (error) {
-                console.error("Google OAuth verification failed:", error);
+                logger.error("Google OAuth verification failed", { error: error });
                 throw error;
             }
         }

package/src/auth/index.ts

@@ -7,9 +7,12 @@ export type { JwtConfig, AccessTokenPayload } from "./jwt";
 export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
 export type { PasswordValidationResult } from "./password";
 
-export type { AuthHooks, AuthMethod, ResolvedAuthOperations } from "./auth-hooks";
+export type { AuthHooks, AuthMethod, ResolvedAuthHooks } from "./auth-hooks";
 export { resolveAuthHooks } from "./auth-hooks";
 
+export { generateSecurePassword, generateSecureToken, hashToken, prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops";
+export type { AdminUserContext, AdminUserPrepareResult } from "./admin-user-ops";
+
 // OAuth Providers
 export { createGoogleProvider } from "./google-oauth";
 export type { GoogleProviderConfig } from "./google-oauth";
@@ -32,7 +35,8 @@ export type { AuthMiddlewareOptions, AuthResult } from "./middleware";
 export { createAuthRoutes } from "./routes";
 export type { AuthModuleConfig } from "./routes";
 
-export { createAdminRoutes } from "./admin-routes";
+export { createResetPasswordRoute } from "./reset-password-admin";
+export type { ResetPasswordRouteConfig } from "./reset-password-admin";
 
 
 export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createApiKeyRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";

package/src/auth/jwt.ts

@@ -1,5 +1,6 @@
 import jwt from "jsonwebtoken";
 import { createHash, randomBytes } from "crypto";
+import { logger } from "../utils/logger";
 
 export interface JwtConfig {
     secret: string;
@@ -62,14 +63,14 @@ export function configureJwt(config: JwtConfig): void {
     if (!config.secret || config.secret.length < 32) {
         throw new Error(
             "JWT secret is too short. Must be at least 32 characters. " +
-            "Generate one with: node -e \"console.log(require('crypto').randomBytes(48).toString('base64'))\""
+            "Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\""
         );
     }
 
     if (weakSecrets.has(config.secret.toLowerCase())) {
         throw new Error(
             "JWT secret is a known default/weak value. Please use a strong, randomly generated secret. " +
-            "Generate one with: node -e \"console.log(require('crypto').randomBytes(48).toString('base64'))\""
+            "Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\""
         );
     }
 
@@ -148,7 +149,7 @@ export function verifyAccessToken(token: string): AccessTokenPayload | null {
         const decoded = jwt.verify(token, jwtConfig.secret, { algorithms: ["HS256"] }) as { userId?: string; uid?: string; sub?: string; roles?: string[]; aal?: string };
         const id = decoded.userId || decoded.uid || decoded.sub;
         if (!id) {
-            console.error("[JWT] Verification failed: missing id in payload", decoded);
+            logger.error("[JWT] Verification failed: missing id in payload", { detail: decoded });
             return null;
         }
 
@@ -160,7 +161,7 @@ export function verifyAccessToken(token: string): AccessTokenPayload | null {
             aal
         };
     } catch (error) {
-        console.error("[JWT] Verification failed:", error, "Token start:", token.substring(0, 15));
+        logger.error("[JWT] Verification failed", { error: error, detail: token.substring(0, 15) });
         return null;
     }
 }

package/src/auth/linkedin-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 export interface LinkedinUserInfo {
     linkedinId: string;
@@ -38,7 +39,7 @@ export function createLinkedinProvider(config: { clientId: string, clientSecret:
 
                 if (!tokenResponse.ok) {
                     const errBody = await tokenResponse.text();
-                    console.error("Failed to get LinkedIn access token:", errBody);
+                    logger.error("Failed to get LinkedIn access token", { detail: errBody });
                     return null;
                 }
 
@@ -54,7 +55,7 @@ export function createLinkedinProvider(config: { clientId: string, clientSecret:
 
                 if (!profileResponse.ok) {
                     const errBody = await profileResponse.text();
-                    console.error("Failed to get LinkedIn user info:", errBody);
+                    logger.error("Failed to get LinkedIn user info", { detail: errBody });
                     return null;
                 }
 
@@ -73,7 +74,7 @@ export function createLinkedinProvider(config: { clientId: string, clientSecret:
                     photoUrl: profileData.picture || null
                 };
             } catch (error) {
-                console.error("LinkedIn OAuth error:", error);
+                logger.error("LinkedIn OAuth error", { error: error });
                 return null;
             }
         }