@rebasepro/server-core 0.6.1 → 0.7.0

package/src/auth/api-keys/api-key-routes.ts

@@ -59,7 +59,7 @@ export function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv> {
     // POST / — Create a new API key
     router.post("/", async (c) => {
         const body = await c.req.json() as Record<string, unknown>;
-        const { name, permissions, rate_limit, expires_at } = body;
+        const { name, permissions, admin, rate_limit, expires_at } = body;
 
         if (!name || typeof name !== "string" || name.trim().length === 0) {
             throw ApiError.badRequest("Name is required", "INVALID_INPUT");
@@ -72,6 +72,10 @@ export function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv> {
             );
         }
 
+        if (admin !== undefined && typeof admin !== "boolean") {
+            throw ApiError.badRequest("admin must be a boolean", "INVALID_INPUT");
+        }
+
         if (rate_limit !== undefined && rate_limit !== null) {
             if (typeof rate_limit !== "number" || rate_limit < 1 || !Number.isInteger(rate_limit)) {
                 throw ApiError.badRequest("rate_limit must be a positive integer or null", "INVALID_INPUT");
@@ -96,6 +100,7 @@ export function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv> {
         const request: CreateApiKeyRequest = {
             name: name.trim(),
             permissions: permissions as ApiKeyPermission[],
+            admin: (admin as boolean) ?? false,
             rate_limit: (rate_limit as number | null) ?? null,
             expires_at: (expires_at as string | null) ?? null
         };
@@ -121,7 +126,7 @@ export function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv> {
     router.put("/:id", async (c) => {
         const id = c.req.param("id");
         const body = await c.req.json() as Record<string, unknown>;
-        const { name, permissions, rate_limit, expires_at } = body;
+        const { name, permissions, admin, rate_limit, expires_at } = body;
 
         // Validate fields if provided
         if (name !== undefined) {
@@ -139,6 +144,10 @@ export function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv> {
             }
         }
 
+        if (admin !== undefined && typeof admin !== "boolean") {
+            throw ApiError.badRequest("admin must be a boolean", "INVALID_INPUT");
+        }
+
         if (rate_limit !== undefined && rate_limit !== null) {
             if (typeof rate_limit !== "number" || rate_limit < 1 || !Number.isInteger(rate_limit)) {
                 throw ApiError.badRequest("rate_limit must be a positive integer or null", "INVALID_INPUT");
@@ -155,6 +164,7 @@ export function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv> {
         const updates: UpdateApiKeyRequest = {};
         if (name !== undefined) updates.name = (name as string).trim();
         if (permissions !== undefined) updates.permissions = permissions as ApiKeyPermission[];
+        if (admin !== undefined) updates.admin = admin as boolean;
         if (rate_limit !== undefined) updates.rate_limit = rate_limit as number | null;
         if (expires_at !== undefined) updates.expires_at = expires_at as string | null;
 

package/src/auth/api-keys/api-key-store.ts

@@ -59,6 +59,7 @@ function toMasked(row: ApiKey): ApiKeyMasked {
         name: row.name,
         key_prefix: row.key_prefix,
         permissions: row.permissions,
+        admin: row.admin,
         rate_limit: row.rate_limit,
         created_by: row.created_by,
         created_at: row.created_at,
@@ -88,6 +89,7 @@ function rowToApiKey(row: Record<string, unknown>): ApiKey {
         key_prefix: row.key_prefix as string,
         key_hash: row.key_hash as string,
         permissions,
+        admin: Boolean(row.admin),
         rate_limit: row.rate_limit !== null && row.rate_limit !== undefined
             ? Number(row.rate_limit)
             : null,
@@ -100,13 +102,6 @@ function rowToApiKey(row: Record<string, unknown>): ApiKey {
     };
 }
 
-/**
- * Escape a string for safe inline SQL usage.
- */
-function esc(value: string): string {
-    return value.replace(/'/g, "''");
-}
-
 // ─── Public API ──────────────────────────────────────────────────────
 
 export interface ApiKeyStore {
@@ -147,7 +142,8 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
         return undefined;
     }
 
-    const exec = admin.executeSql.bind(admin);
+    const exec = (sqlText: string, options?: { params?: unknown[] }) =>
+        admin.executeSql(sqlText, options?.params ? { params: options.params } : undefined);
 
     return {
         // ── Schema bootstrap ────────────────────────────────────────
@@ -161,6 +157,7 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
                         key_prefix TEXT NOT NULL,
                         key_hash TEXT NOT NULL UNIQUE,
                         permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
+                        admin BOOLEAN NOT NULL DEFAULT FALSE,
                         rate_limit INTEGER,
                         created_by TEXT NOT NULL,
                         created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
@@ -181,6 +178,12 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
                     ON ${TABLE}(key_prefix)
                 `);
 
+                // Migration: add admin column to existing tables
+                await exec(`
+                    ALTER TABLE ${TABLE}
+                    ADD COLUMN IF NOT EXISTS admin BOOLEAN NOT NULL DEFAULT FALSE
+                `);
+
                 logger.info("✅ API keys table ready");
             } catch (err) {
                 logger.error("❌ Failed to create API keys table", { error: err });
@@ -194,26 +197,22 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
             const hash = hashKey(plaintext);
             const prefix = keyPrefix(plaintext);
             const permissionsJson = JSON.stringify(request.permissions);
-            const rateLimitSql = request.rate_limit !== null && request.rate_limit !== undefined
-                ? String(request.rate_limit)
-                : "NULL";
-            const expiresAtSql = request.expires_at
-                ? `'${esc(request.expires_at)}'`
-                : "NULL";
 
-            const rows = await exec(`
-                INSERT INTO ${TABLE} (name, key_prefix, key_hash, permissions, rate_limit, created_by, expires_at)
-                VALUES (
-                    '${esc(request.name)}',
-                    '${esc(prefix)}',
-                    '${esc(hash)}',
-                    '${esc(permissionsJson)}'::jsonb,
-                    ${rateLimitSql},
-                    '${esc(createdBy)}',
-                    ${expiresAtSql}
-                )
-                RETURNING *
-            `);
+            const rows = await exec(
+                `INSERT INTO ${TABLE} (name, key_prefix, key_hash, permissions, admin, rate_limit, created_by, expires_at)
+                 VALUES ($1, $2, $3, $4::jsonb, $5, $6, $7, $8)
+                 RETURNING *`,
+                { params: [
+                    request.name,
+                    prefix,
+                    hash,
+                    permissionsJson,
+                    request.admin ?? false,
+                    request.rate_limit ?? null,
+                    createdBy,
+                    request.expires_at ?? null
+                ]}
+            );
 
             const apiKey = rowToApiKey(rows[0]);
             return {
@@ -224,11 +223,12 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
 
         // ── Lookup by hash ──────────────────────────────────────────
         async findByKeyHash(hash: string): Promise<ApiKey | null> {
-            const rows = await exec(`
-                SELECT * FROM ${TABLE}
-                WHERE key_hash = '${esc(hash)}'
-                LIMIT 1
-            `);
+            const rows = await exec(
+                `SELECT * FROM ${TABLE}
+                 WHERE key_hash = $1
+                 LIMIT 1`,
+                { params: [hash] }
+            );
             if (rows.length === 0) return null;
             return rowToApiKey(rows[0]);
         },
@@ -244,11 +244,12 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
 
         // ── Get by ID (masked) ──────────────────────────────────────
         async getApiKeyById(id: string): Promise<ApiKeyMasked | null> {
-            const rows = await exec(`
-                SELECT * FROM ${TABLE}
-                WHERE id = '${esc(id)}'
-                LIMIT 1
-            `);
+            const rows = await exec(
+                `SELECT * FROM ${TABLE}
+                 WHERE id = $1
+                 LIMIT 1`,
+                { params: [id] }
+            );
             if (rows.length === 0) return null;
             return toMasked(rowToApiKey(rows[0]));
         },
@@ -256,26 +257,36 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
         // ── Update ──────────────────────────────────────────────────
         async updateApiKey(id: string, updates: UpdateApiKeyRequest): Promise<ApiKeyMasked | null> {
             const setClauses: string[] = [];
+            const params: unknown[] = [];
+            let paramIdx = 1;
 
             if (updates.name !== undefined) {
-                setClauses.push(`name = '${esc(updates.name)}'`);
+                setClauses.push(`name = $${paramIdx++}`);
+                params.push(updates.name);
             }
             if (updates.permissions !== undefined) {
-                setClauses.push(`permissions = '${esc(JSON.stringify(updates.permissions))}'::jsonb`);
+                setClauses.push(`permissions = $${paramIdx++}::jsonb`);
+                params.push(JSON.stringify(updates.permissions));
+            }
+            if (updates.admin !== undefined) {
+                setClauses.push(`admin = $${paramIdx++}`);
+                params.push(updates.admin);
             }
             if (updates.rate_limit !== undefined) {
-                setClauses.push(
-                    updates.rate_limit !== null
-                        ? `rate_limit = ${updates.rate_limit}`
-                        : "rate_limit = NULL"
-                );
+                if (updates.rate_limit !== null) {
+                    setClauses.push(`rate_limit = $${paramIdx++}`);
+                    params.push(updates.rate_limit);
+                } else {
+                    setClauses.push("rate_limit = NULL");
+                }
             }
             if (updates.expires_at !== undefined) {
-                setClauses.push(
-                    updates.expires_at !== null
-                        ? `expires_at = '${esc(updates.expires_at)}'`
-                        : "expires_at = NULL"
-                );
+                if (updates.expires_at !== null) {
+                    setClauses.push(`expires_at = $${paramIdx++}`);
+                    params.push(updates.expires_at);
+                } else {
+                    setClauses.push("expires_at = NULL");
+                }
             }
 
             if (setClauses.length === 0) {
@@ -284,12 +295,16 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
 
             setClauses.push("updated_at = NOW()");
 
-            const rows = await exec(`
-                UPDATE ${TABLE}
-                SET ${setClauses.join(", ")}
-                WHERE id = '${esc(id)}'
-                RETURNING *
-            `);
+            // The WHERE id = $N uses the next available param index
+            params.push(id);
+
+            const rows = await exec(
+                `UPDATE ${TABLE}
+                 SET ${setClauses.join(", ")}
+                 WHERE id = $${paramIdx}
+                 RETURNING *`,
+                { params }
+            );
 
             if (rows.length === 0) return null;
             return toMasked(rowToApiKey(rows[0]));
@@ -297,23 +312,25 @@ export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
 
         // ── Revoke (soft-delete) ────────────────────────────────────
         async revokeApiKey(id: string): Promise<boolean> {
-            const rows = await exec(`
-                UPDATE ${TABLE}
-                SET revoked_at = NOW(), updated_at = NOW()
-                WHERE id = '${esc(id)}' AND revoked_at IS NULL
-                RETURNING id
-            `);
+            const rows = await exec(
+                `UPDATE ${TABLE}
+                 SET revoked_at = NOW(), updated_at = NOW()
+                 WHERE id = $1 AND revoked_at IS NULL
+                 RETURNING id`,
+                { params: [id] }
+            );
             return rows.length > 0;
         },
 
         // ── Touch last_used_at ──────────────────────────────────────
         async updateLastUsed(id: string): Promise<void> {
             try {
-                await exec(`
-                    UPDATE ${TABLE}
-                    SET last_used_at = NOW()
-                    WHERE id = '${esc(id)}'
-                `);
+                await exec(
+                    `UPDATE ${TABLE}
+                     SET last_used_at = NOW()
+                     WHERE id = $1`,
+                    { params: [id] }
+                );
             } catch (err) {
                 // Non-blocking — don't fail requests because of a usage timestamp update
                 logger.error("[api-key-store] Failed to update last_used_at", { error: err });

package/src/auth/api-keys/api-key-types.ts

@@ -32,6 +32,8 @@ export interface ApiKey {
     /** SHA-256 hash of the full plaintext key. */
     key_hash: string;
     permissions: ApiKeyPermission[];
+    /** When true, the key is granted the `admin` role (access to admin routes). */
+    admin: boolean;
     /** Requests per 15-minute window. `null` means unlimited. */
     rate_limit: number | null;
     created_by: string;
@@ -51,6 +53,8 @@ export interface ApiKeyMasked {
     name: string;
     key_prefix: string;
     permissions: ApiKeyPermission[];
+    /** When true, the key is granted the `admin` role (access to admin routes). */
+    admin: boolean;
     rate_limit: number | null;
     created_by: string;
     created_at: string;
@@ -66,6 +70,8 @@ export interface ApiKeyMasked {
 export interface CreateApiKeyRequest {
     name: string;
     permissions: ApiKeyPermission[];
+    /** When true, grants the `admin` role — allows access to admin routes. */
+    admin?: boolean;
     /** Requests per 15-minute window. Omit or `null` for unlimited. */
     rate_limit?: number | null;
     /** ISO-8601 expiration timestamp. Omit for no expiration. */
@@ -79,6 +85,8 @@ export interface CreateApiKeyRequest {
 export interface UpdateApiKeyRequest {
     name?: string;
     permissions?: ApiKeyPermission[];
+    /** When true, grants the `admin` role — allows access to admin routes. */
+    admin?: boolean;
     rate_limit?: number | null;
     expires_at?: string | null;
 }

package/src/auth/apple-oauth.ts

@@ -110,7 +110,8 @@ export function createAppleProvider(config: {
                     providerId: decoded.sub,
                     email,
                     displayName,
-                    photoUrl: null // Apple does not provide a profile photo
+                    photoUrl: null, // Apple does not provide a profile photo
+                    emailVerified: decoded.email_verified === true || decoded.email_verified === "true"
                 };
             } catch (error) {
                 logger.error("Apple OAuth error", { error: error });

package/src/auth/auth-hooks.ts

@@ -45,6 +45,7 @@ import {
 import type { PasswordValidationResult } from "./password";
 import type { AuthRepository, UserData, CreateUserData } from "./interfaces";
 import type { EmailService, EmailConfig } from "../email";
+import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 
 /**
  * Authentication method identifier for lifecycle hooks.
@@ -181,6 +182,26 @@ export interface AuthHooks {
      */
     customizeAccessToken?(claims: Record<string, unknown>, user: UserData): Promise<Record<string, unknown>>;
 
+    /**
+     * Transform the auth response before sending it to the client.
+     *
+     * Called after successful login, register, refresh, OAuth, anonymous,
+     * magic-link, and MFA flows. The hook receives the fully-formed
+     * response and returns a (potentially enriched) response.
+     *
+     * Use cases:
+     * - Inject tokens from external auth systems (Firebase Custom Tokens, etc.)
+     * - Add project-specific metadata to the response
+     * - Enrich the user object with data from external sources
+     *
+     * The hook runs in the request path — keep it fast.
+     * Heavy work should be offloaded to `onAuthenticated` (fire-and-forget).
+     */
+    transformAuthResponse?(
+        response: AuthResponsePayload,
+        context: TransformAuthResponseContext
+    ): Promise<AuthResponsePayload>;
+
     /**
      * Called after a successful password reset.
      *

package/src/auth/bitbucket-oauth.ts

@@ -72,7 +72,8 @@ export function createBitbucketProvider(config: { clientId: string; clientSecret
                     providerId: p.uuid,
                     email,
                     displayName: p.display_name || p.username || null,
-                    photoUrl: p.links?.avatar?.href || null
+                    photoUrl: p.links?.avatar?.href || null,
+                    emailVerified: true
                 };
             } catch (error) {
                 logger.error("Bitbucket OAuth error", { error: error });

package/src/auth/builtin-auth-adapter.ts

@@ -22,11 +22,13 @@ import type {
     BootstrappedAuth
 } from "@rebasepro/types";
 
-import type { Hono } from "hono";
+import { Hono } from "hono";
 import { verifyAccessToken } from "./jwt";
 import type { AccessTokenPayload } from "./jwt";
 import { createAuthRoutes } from "./routes";
 import { createResetPasswordRoute } from "./reset-password-admin";
+import { createAdminRolesRoute } from "./admin-roles-route";
+import { createAdminUsersRoute } from "./admin-users-route";
 import { prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops";
 import type { AuthRepository, OAuthProvider } from "./interfaces";
 import type { AuthHooks, ResolvedAuthHooks } from "./auth-hooks";
@@ -62,6 +64,8 @@ export interface BuiltinAuthAdapterConfig {
     authHooks?: AuthHooks;
     /** The parsed auth config from the collection (if `auth` is an object, not just `true`). */
     collectionAuthConfig?: import("@rebasepro/types").AuthCollectionConfig;
+    /** Enable magic link (passwordless email) login. Requires email service. */
+    enableMagicLink?: boolean;
 }
 
 /**
@@ -81,7 +85,8 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
         oauthProviders = [],
         serviceKey,
         authHooks,
-        collectionAuthConfig
+        collectionAuthConfig,
+        enableMagicLink = false
     } = config;
 
     const resolvedOps = resolveAuthHooks(authHooks);
@@ -188,12 +193,26 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 allowRegistration,
                 defaultRole,
                 oauthProviders,
-                authHooks
+                authHooks,
+                enableMagicLink
             });
         },
 
         createAdminRoutes(): Hono<HonoEnv> | undefined {
-            return createResetPasswordRoute({
+            const router = new Hono<HonoEnv>();
+            const resetPasswordRoute = createResetPasswordRoute({
+                authRepo: authRepository,
+                emailService,
+                emailConfig,
+                serviceKey,
+                authHooks,
+                collectionAuthConfig
+            });
+            const rolesRoute = createAdminRolesRoute({
+                authRepo: authRepository,
+                serviceKey
+            });
+            const adminUsersRoute = createAdminUsersRoute({
                 authRepo: authRepository,
                 emailService,
                 emailConfig,
@@ -201,6 +220,10 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 authHooks,
                 collectionAuthConfig
             });
+            router.route("/", resetPasswordRoute);
+            router.route("/", rolesRoute);
+            router.route("/", adminUsersRoute);
+            return router;
         },
 
         async prepareUserCreation(values, collectionAuth) {
@@ -245,6 +268,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
                 sessionManagement: true,
                 profileUpdate: true,
                 emailVerification: !!emailService?.isConfigured(),
+                magicLink: enableMagicLink && !!emailService?.isConfigured(),
                 enabledProviders,
                 needsSetup
             };

package/src/auth/custom-auth-adapter.ts

@@ -51,6 +51,7 @@ export function createCustomAuthAdapter(options: CustomAuthAdapterOptions): Auth
         sessionManagement: false,
         profileUpdate: false,
         emailVerification: false,
+        magicLink: false,
         enabledProviders: [],
         ...options.capabilities
     };
@@ -76,6 +77,7 @@ export function createCustomAuthAdapter(options: CustomAuthAdapterOptions): Auth
 
         userManagement: options.userManagement,
 
+        transformAuthResponse: options.transformAuthResponse,
 
         getCapabilities() {
             return defaultCapabilities;

package/src/auth/discord-oauth.ts

@@ -73,7 +73,8 @@ export function createDiscordProvider(config: { clientId: string; clientSecret:
                     providerId: profileData.id,
                     email: profileData.email,
                     displayName: profileData.global_name || profileData.username || null,
-                    photoUrl
+                    photoUrl,
+                    emailVerified: profileData.verified === true
                 };
             } catch (error) {
                 logger.error("Discord OAuth error", { error: error });

package/src/auth/facebook-oauth.ts

@@ -62,7 +62,8 @@ export function createFacebookProvider(config: { clientId: string; clientSecret:
                     providerId: profileData.id,
                     email: profileData.email,
                     displayName: profileData.name || null,
-                    photoUrl: profileData.picture?.data?.url || null
+                    photoUrl: profileData.picture?.data?.url || null,
+                    emailVerified: true
                 };
             } catch (error) {
                 logger.error("Facebook OAuth error", { error: error });

package/src/auth/github-oauth.ts

@@ -100,7 +100,8 @@ export function createGitHubProvider(config: { clientId: string; clientSecret: s
                     providerId: String(profileData.id),
                     email,
                     displayName: profileData.name || profileData.login || null,
-                    photoUrl: profileData.avatar_url || null
+                    photoUrl: profileData.avatar_url || null,
+                    emailVerified: true
                 };
             } catch (error) {
                 logger.error("GitHub OAuth error", { error: error });

package/src/auth/gitlab-oauth.ts

@@ -60,7 +60,8 @@ export function createGitLabProvider(config: {
                     providerId: String(p.id),
                     email: p.email,
                     displayName: p.name || p.username || null,
-                    photoUrl: p.avatar_url || null
+                    photoUrl: p.avatar_url || null,
+                    emailVerified: true
                 };
             } catch (error) {
                 logger.error("GitLab OAuth error", { error: error });

package/src/auth/google-oauth.ts

@@ -89,7 +89,8 @@ export function createGoogleProvider(config: GoogleProviderConfig | string): OAu
                         providerId: content.sub,
                         email: content.email || "",
                         displayName: content.name || null,
-                        photoUrl: content.picture || null
+                        photoUrl: content.picture || null,
+                        emailVerified: true
                     };
                 }
 
@@ -115,7 +116,8 @@ export function createGoogleProvider(config: GoogleProviderConfig | string): OAu
                         providerId: info.sub,
                         email: info.email,
                         displayName: info.name || null,
-                        photoUrl: info.picture || null
+                        photoUrl: info.picture || null,
+                        emailVerified: true
                     };
                 }
 
@@ -176,7 +178,8 @@ export function createGoogleProvider(config: GoogleProviderConfig | string): OAu
                             providerId: content.sub,
                             email: content.email || "",
                             displayName: content.name || null,
-                            photoUrl: content.picture || null
+                            photoUrl: content.picture || null,
+                            emailVerified: true
                         };
                     }
 
@@ -202,7 +205,8 @@ export function createGoogleProvider(config: GoogleProviderConfig | string): OAu
                             providerId: info.sub,
                             email: info.email,
                             displayName: info.name || null,
-                            photoUrl: info.picture || null
+                            photoUrl: info.picture || null,
+                            emailVerified: true
                         };
                     }
 

package/src/auth/index.ts

@@ -35,6 +35,8 @@ export type { AuthMiddlewareOptions, AuthResult } from "./middleware";
 export { createAuthRoutes } from "./routes";
 export type { AuthModuleConfig } from "./routes";
 
+export { mountMagicLinkRoutes } from "./magic-link-routes";
+
 export { createResetPasswordRoute } from "./reset-password-admin";
 export type { ResetPasswordRouteConfig } from "./reset-password-admin";
 

package/src/auth/interfaces.ts

@@ -60,6 +60,8 @@ export interface OAuthProviderProfile {
     email: string;
     displayName?: string | null;
     photoUrl?: string | null;
+    /** Whether the OAuth provider has verified the user's email address */
+    emailVerified?: boolean;
 }
 
 /**
@@ -129,6 +131,14 @@ export interface PasswordResetTokenInfo {
     expiresAt: Date;
 }
 
+/**
+ * Magic link token info
+ */
+export interface MagicLinkTokenInfo {
+    userId: string;
+    expiresAt: Date;
+}
+
 // =============================================================================
 // AUTH REPOSITORY INTERFACES
 // =============================================================================
@@ -357,6 +367,23 @@ export interface TokenRepository {
      * Clean up expired tokens
      */
     deleteExpiredTokens(): Promise<void>;
+
+    // Magic link tokens
+
+    /**
+     * Create a magic link token
+     */
+    createMagicLinkToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+
+    /**
+     * Find a valid (not expired, not used) magic link token by hash
+     */
+    findValidMagicLinkToken(tokenHash: string): Promise<MagicLinkTokenInfo | null>;
+
+    /**
+     * Mark a magic link token as used
+     */
+    markMagicLinkTokenUsed(tokenHash: string): Promise<void>;
 }
 
 // =============================================================================

package/src/auth/linkedin-oauth.ts

@@ -71,7 +71,8 @@ export function createLinkedinProvider(config: { clientId: string, clientSecret:
                     providerId: profileData.sub,
                     email: profileData.email,
                     displayName: profileData.name || null,
-                    photoUrl: profileData.picture || null
+                    photoUrl: profileData.picture || null,
+                    emailVerified: profileData.email_verified === true
                 };
             } catch (error) {
                 logger.error("LinkedIn OAuth error", { error: error });