@rebasepro/server-core 0.6.1 → 0.7.0

package/src/auth/magic-link-routes.ts

@@ -0,0 +1,167 @@
+import { Hono } from "hono";
+import type { AuthModuleConfig } from "./routes";
+import type { ResolvedAuthHooks } from "./auth-hooks";
+import type { HonoEnv } from "../api/types";
+import { ApiError } from "../api/errors";
+import { generateSecureToken, hashToken } from "./admin-user-ops";
+import { getMagicLinkTemplate } from "../email/templates";
+import { strictAuthLimiter } from "./rate-limiter";
+import { z } from "zod";
+import { logger } from "../utils/logger";
+import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
+
+/**
+ * Magic link token expiry (15 minutes from now)
+ */
+function getMagicLinkExpiry(): Date {
+    return new Date(Date.now() + 15 * 60 * 1000);
+}
+
+/**
+ * Mount magic link routes onto the auth router.
+ *
+ * Follows the same delegation pattern as `mountMfaRoutes()` and `mountSessionRoutes()`.
+ */
+export function mountMagicLinkRoutes(deps: {
+    router: Hono<HonoEnv>;
+    config: AuthModuleConfig;
+    ops: ResolvedAuthHooks;
+    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T;
+    buildAuthResponse: (
+        user: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; metadata?: Record<string, unknown> | null },
+        roleIds: string[],
+        accessToken: string,
+        refreshToken: string
+    ) => unknown;
+    createSessionAndTokens: (userId: string, userAgent: string, ipAddress: string) => Promise<{ roleIds: string[]; accessToken: string; refreshToken: string }>;
+    applyTransformHook: (
+        response: AuthResponsePayload,
+        method: TransformAuthResponseContext["method"],
+        request: Request,
+        userId: string
+    ) => Promise<AuthResponsePayload>;
+}) {
+    const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook } = deps;
+    const { authRepo, emailService, emailConfig } = config;
+
+    const magicLinkSchema = z.object({
+        email: z.string().email("Invalid email address").max(255)
+    });
+
+    const verifyMagicLinkSchema = z.object({
+        token: z.string().min(1, "Token is required")
+    });
+
+    function isEmailConfigured(): boolean {
+        return !!(emailService && emailService.isConfigured());
+    }
+
+    /**
+     * POST /auth/magic-link
+     * Request a magic link email
+     */
+    router.post("/magic-link", strictAuthLimiter, async (c) => {
+        const { email } = parseBody(magicLinkSchema, await c.req.json());
+
+        // Require email service
+        if (!isEmailConfigured()) {
+            throw ApiError.serviceUnavailable("Email service not configured. Magic link login is not available.", "EMAIL_NOT_CONFIGURED");
+        }
+
+        // Always return success (security: don't reveal if email exists)
+        const user = await authRepo.getUserByEmail(email);
+
+        if (user) {
+            // Call beforeLogin hook if provided (throw to reject)
+            if (ops.beforeLogin) {
+                await ops.beforeLogin(email, "magic-link");
+            }
+
+            // Generate magic link token
+            const token = generateSecureToken();
+            const tokenHash = hashToken(token);
+            const expiresAt = getMagicLinkExpiry();
+
+            await authRepo.createMagicLinkToken(user.id, tokenHash, expiresAt);
+
+            // Build magic link URL
+            const baseUrl = emailConfig?.magicLinkUrl || emailConfig?.resetPasswordUrl || "";
+            const magicLinkUrl = `${baseUrl}/auth/magic-link?token=${token}`;
+
+            // Get email template
+            const appName = emailConfig?.appName || "Rebase";
+            const templateFn = emailConfig?.templates?.magicLink;
+            const emailContent = templateFn
+                ? templateFn(magicLinkUrl, { email: user.email, displayName: user.displayName })
+                : getMagicLinkTemplate(magicLinkUrl, { email: user.email, displayName: user.displayName }, appName);
+
+            // Send email
+            try {
+                await emailService!.send({
+                    to: user.email,
+                    subject: emailContent.subject,
+                    html: emailContent.html,
+                    text: emailContent.text
+                });
+            } catch (emailError: unknown) {
+                logger.error("Failed to send magic link email", { error: emailError instanceof Error ? emailError.message : emailError });
+                // Don't reveal email sending failure to client
+            }
+        }
+
+        // Always return success
+        return c.json({
+            success: true,
+            message: "If an account with that email exists, a magic link has been sent."
+        });
+    });
+
+    /**
+     * POST /auth/magic-link/verify
+     * Verify magic link token and create session
+     */
+    router.post("/magic-link/verify", strictAuthLimiter, async (c) => {
+        const { token } = parseBody(verifyMagicLinkSchema, await c.req.json());
+
+        // Find valid token
+        const tokenHash = hashToken(token);
+        const storedToken = await authRepo.findValidMagicLinkToken(tokenHash);
+
+        if (!storedToken) {
+            throw ApiError.badRequest("Invalid or expired magic link", "INVALID_TOKEN");
+        }
+
+        // Mark token as used (one-time use)
+        await authRepo.markMagicLinkTokenUsed(tokenHash);
+
+        // Get user
+        const user = await authRepo.getUserById(storedToken.userId);
+        if (!user) {
+            throw ApiError.badRequest("Invalid or expired magic link", "INVALID_TOKEN");
+        }
+
+        // Clicking a magic link proves email ownership — auto-verify
+        if (!user.emailVerified) {
+            await authRepo.setEmailVerified(user.id, true);
+            user.emailVerified = true;
+        }
+
+        // Create session
+        const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(
+            user.id,
+            c.req.header("user-agent") || "unknown",
+            c.req.header("x-forwarded-for") || "unknown"
+        );
+
+        // Fire onAuthenticated hook (fire-and-forget)
+        if (ops.onAuthenticated) {
+            ops.onAuthenticated(user, "magic-link").catch(err => {
+                logger.error("[AuthHooks] onAuthenticated error", { error: err instanceof Error ? err.message : err });
+            });
+        }
+
+        const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken) as AuthResponsePayload;
+        const finalResponse = await applyTransformHook(authResponse, "magic-link", c.req.raw, user.id);
+        return c.json(finalResponse);
+    });
+}

package/src/auth/mfa-crypto.ts

@@ -0,0 +1,91 @@
+/**
+ * Envelope encryption for TOTP secrets using AES-256-GCM.
+ *
+ * - Derives a 32-byte key via SHA-256 from `MFA_ENCRYPTION_KEY` or `JWT_SECRET`.
+ * - Generates a random 12-byte IV per encryption call.
+ * - Returns ciphertexts in the format `iv_hex:authTag_hex:ciphertext_hex`.
+ *
+ * @module
+ */
+
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "crypto";
+import { logger } from "../utils/logger";
+
+const ALGORITHM = "aes-256-gcm";
+const IV_BYTES = 12;
+const AUTH_TAG_LENGTH = 16;
+
+/**
+ * Resolve the raw key string from environment variables.
+ *
+ * Prefers `MFA_ENCRYPTION_KEY`; falls back to `JWT_SECRET` with a warning.
+ * Throws if neither is set.
+ */
+function resolveKeyString(): string {
+    const explicit = process.env.MFA_ENCRYPTION_KEY;
+    if (explicit) {
+        return explicit;
+    }
+
+    const fallback = process.env.JWT_SECRET;
+    if (fallback) {
+        logger.warn(
+            "[MFA-Crypto] MFA_ENCRYPTION_KEY is not set — falling back to JWT_SECRET. " +
+                "Set a dedicated MFA_ENCRYPTION_KEY for production."
+        );
+        return fallback;
+    }
+
+    throw new Error(
+        "Cannot encrypt TOTP secret: neither MFA_ENCRYPTION_KEY nor JWT_SECRET is configured."
+    );
+}
+
+/**
+ * Derive a deterministic 32-byte AES-256 key from the raw secret string.
+ */
+function deriveKey(raw: string): Buffer {
+    return createHash("sha256").update(raw).digest();
+}
+
+/**
+ * Encrypt a plaintext TOTP secret.
+ *
+ * @param plaintext - The Base32 TOTP secret to encrypt.
+ * @returns A string in the format `iv_hex:authTag_hex:ciphertext_hex`.
+ */
+export function encryptTotpSecret(plaintext: string): string {
+    const key = deriveKey(resolveKeyString());
+    const iv = randomBytes(IV_BYTES);
+
+    const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+    const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+
+    return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted.toString("hex")}`;
+}
+
+/**
+ * Decrypt a previously encrypted TOTP secret.
+ *
+ * @param ciphertext - A string in the format `iv_hex:authTag_hex:ciphertext_hex`.
+ * @returns The original Base32 TOTP secret.
+ */
+export function decryptTotpSecret(ciphertext: string): string {
+    const parts = ciphertext.split(":");
+    if (parts.length !== 3) {
+        throw new Error("Invalid encrypted TOTP secret format — expected iv:authTag:ciphertext");
+    }
+
+    const [ivHex, authTagHex, encryptedHex] = parts;
+    const key = deriveKey(resolveKeyString());
+    const iv = Buffer.from(ivHex, "hex");
+    const authTag = Buffer.from(authTagHex, "hex");
+    const encrypted = Buffer.from(encryptedHex, "hex");
+
+    const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+    decipher.setAuthTag(authTag);
+
+    const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+    return decrypted.toString("utf8");
+}

package/src/auth/mfa-routes.ts

@@ -11,21 +11,30 @@ import {
     generateRecoveryCodes,
     hashRecoveryCode
 } from "./mfa";
+import { encryptTotpSecret, decryptTotpSecret } from "./mfa-crypto";
 import {
     generateAccessToken,
     generateRefreshToken,
     hashRefreshToken,
     getRefreshTokenExpiry,
-    getAccessTokenExpiry
+    getAccessTokenExpiry,
+    type AccessTokenPayload
 } from "./jwt";
 import type { AuthModuleConfig } from "./routes";
 import { resolveAuthHooks } from "./auth-hooks";
+import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 
 export function mountMfaRoutes(
     router: Hono<HonoEnv>,
     config: AuthModuleConfig,
     ops: ReturnType<typeof resolveAuthHooks>,
-    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T
+    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T,
+    applyTransformHook?: (
+        response: AuthResponsePayload,
+        method: TransformAuthResponseContext["method"],
+        request: Request,
+        userId: string
+    ) => Promise<AuthResponsePayload>
 ): void {
     const authRepo = config.authRepo;
     const emailConfig = config.emailConfig;
@@ -53,11 +62,12 @@ export function mountMfaRoutes(
         // Generate TOTP secret
         const { secret, uri } = generateTotpSecret(issuer, user.email);
 
-        // Store the factor (unverified until user confirms with a valid code)
+        // Encrypt the TOTP secret before storage (AES-256-GCM envelope encryption)
+        const encryptedSecret = encryptTotpSecret(secret);
         const factor = await authRepo.createMfaFactor(
             user.id,
             "totp",
-            secret, // In production, encrypt this before storage
+            encryptedSecret,
             friendlyName
         );
 
@@ -110,8 +120,9 @@ export function mountMfaRoutes(
             throw ApiError.badRequest("Factor is already verified", "ALREADY_VERIFIED");
         }
 
-        // Verify the TOTP code
-        const secretBuffer = base32Decode(factor.secretEncrypted);
+        // Decrypt and verify the TOTP code
+        const decryptedSecret = decryptTotpSecret(factor.secretEncrypted);
+        const secretBuffer = base32Decode(decryptedSecret);
         const isValid = verifyTotp(secretBuffer, code);
 
         if (!isValid) {
@@ -191,7 +202,8 @@ export function mountMfaRoutes(
         }
 
         // Try TOTP verification first (standard 6-digit codes)
-        const secretBuffer = base32Decode(factor.secretEncrypted);
+        const decryptedSecret = decryptTotpSecret(factor.secretEncrypted);
+        const secretBuffer = base32Decode(decryptedSecret);
         let isValid = verifyTotp(secretBuffer, code);
 
         // Fall back to recovery code verification if TOTP didn't match
@@ -231,13 +243,17 @@ export function mountMfaRoutes(
             });
         }
 
-        return c.json({
+        let mfaResponse: AuthResponsePayload = {
             tokens: {
                 accessToken,
                 refreshToken,
                 accessTokenExpiresAt: getAccessTokenExpiry()
             }
-        });
+        };
+        if (applyTransformHook) {
+            mfaResponse = await applyTransformHook(mfaResponse, "mfa", c.req.raw, userCtx.userId);
+        }
+        return c.json(mfaResponse);
     });
 
     /**
@@ -267,11 +283,19 @@ export function mountMfaRoutes(
      * Remove an MFA factor
      */
     router.delete("/mfa/unenroll", requireAuth, async (c) => {
-        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        const userCtx = c.get("user") as AccessTokenPayload | undefined;
         if (!userCtx) {
             throw ApiError.unauthorized("Not authenticated");
         }
 
+        // Require aal2 (MFA-verified session) to unenroll MFA factors
+        if (userCtx.aal !== "aal2") {
+            throw ApiError.forbidden(
+                "MFA verification required to unenroll. Please re-authenticate with your second factor.",
+                "AAL2_REQUIRED"
+            );
+        }
+
         const unenrollSchema = z.object({
             factorId: z.string().min(1, "Factor ID is required")
         });

package/src/auth/microsoft-oauth.ts

@@ -78,7 +78,8 @@ export function createMicrosoftProvider(config: {
                     providerId: profileData.id,
                     email,
                     displayName: profileData.displayName || null,
-                    photoUrl: null
+                    photoUrl: null,
+                    emailVerified: true
                 };
             } catch (error) {
                 logger.error("Microsoft OAuth error", { error: error });

package/src/auth/middleware.ts

@@ -22,6 +22,13 @@ export type AuthResult = boolean | null | undefined | { userId?: string; uid?: s
 export interface AuthMiddlewareOptions {
     /** DataDriver to scope via withAuth() for RLS */
     driver: DataDriver;
+    /**
+     * Optional per-request driver resolver for multi-data-source backends.
+     * Given the request context, returns the unscoped delegate to use (e.g.
+     * Postgres vs Mongo, picked by the request's collection data source).
+     * When omitted, `driver` is used for every request.
+     */
+    resolveDriver?: (c: Context<HonoEnv>) => DataDriver;
     /**
      * If true, return 401 when no valid token is present.
      *
@@ -232,9 +239,11 @@ export function extractUserFromToken(token: string): AccessTokenPayload | null {
  */
 
 export function createAuthMiddleware(options: AuthMiddlewareOptions): MiddlewareHandler<HonoEnv> {
-    const { driver, requireAuth: enforceAuth = true, validator, serviceKey, apiKeyStore } = options;
+    const { driver: baseDriver, resolveDriver, requireAuth: enforceAuth = true, validator, serviceKey, apiKeyStore } = options;
 
     return async (c, next) => {
+        // Pick the per-request delegate (multi-data-source) before scoping.
+        const driver = resolveDriver ? resolveDriver(c) : baseDriver;
         if (validator) {
             // Custom validator path (e.g., Firebase Auth, API keys)
             try {

package/src/auth/reset-password-admin.ts

@@ -54,8 +54,24 @@ export function createResetPasswordRoute(config: ResetPasswordRouteConfig): Hono
         let invitationSent = false;
         let temporaryPassword: string | undefined;
 
+        // Parse optional body — if a password is provided, set it directly
+        const body = await c.req.json().catch(() => ({}));
+
+        if (body.password) {
+            const password = body.password as string;
+            const validation = ops.validatePasswordStrength(password);
+            if (!validation.valid) {
+                throw ApiError.badRequest(
+                    `Password too weak: ${validation.errors.join(", ")}`
+                );
+            }
+            const passwordHash = await ops.hashPassword(password);
+            await authRepo.updatePassword(existing.id, passwordHash);
+            temporaryPassword = undefined;
+            invitationSent = false;
+        }
         // 1. Collection-level hook (closest to the data)
-        if (collectionAuthConfig?.onResetPassword) {
+        else if (collectionAuthConfig?.onResetPassword) {
             const isEmailConfigured = !!(emailService && emailService.isConfigured());
             const hookResult = await collectionAuthConfig.onResetPassword(existing.id, {
                 hashPassword: (password: string) => ops.hashPassword(password),

package/src/auth/routes.ts

@@ -15,6 +15,8 @@ import { z } from "zod";
 import { logger } from "../utils/logger";
 import { mountMfaRoutes } from "./mfa-routes";
 import { mountSessionRoutes } from "./session-routes";
+import { mountMagicLinkRoutes } from "./magic-link-routes";
+import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 
 /**
  * Shared configuration for auth and admin route factories.
@@ -43,6 +45,8 @@ export interface AuthModuleConfig {
      * When not provided, falls back to checking if any users exist.
      */
     isBootstrapCompleted?: () => Promise<boolean>;
+    /** Enable magic link (passwordless email) login. Requires email service. */
+    enableMagicLink?: boolean;
 }
 
 /**
@@ -53,7 +57,7 @@ function buildAuthResponse(
     roleIds: string[],
     accessToken: string,
     refreshToken: string
-) {
+): AuthResponsePayload {
     return {
         user: {
             uid: user.id,
@@ -95,6 +99,29 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
     const { emailService, emailConfig, allowRegistration = false } = config;
     const ops = resolveAuthHooks(config.authHooks);
 
+    /**
+     * Apply the `transformAuthResponse` hook if provided.
+     *
+     * Errors are caught and logged — the untransformed response is returned
+     * as a graceful fallback so auth never breaks due to a hook failure.
+     */
+    async function applyTransformHook(
+        response: AuthResponsePayload,
+        method: TransformAuthResponseContext["method"],
+        request: Request,
+        userId: string
+    ): Promise<AuthResponsePayload> {
+        if (!ops.transformAuthResponse) return response;
+        try {
+            return await ops.transformAuthResponse(response, { userId, method, request });
+        } catch (err) {
+            logger.error("[AuthHooks] transformAuthResponse error", {
+                error: err instanceof Error ? err.message : err
+            });
+            return response;
+        }
+    }
+
     // ── Zod input schemas ──────────────────────────────────────────────
     const registerSchema = z.object({
         email: z.string().email("Invalid email address").max(255),
@@ -291,7 +318,9 @@ displayName: user.displayName });
             });
         }
 
-        return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken), 201);
+        const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken);
+        const finalResponse = await applyTransformHook(authResponse, "register", c.req.raw, user.id);
+        return c.json(finalResponse, 201);
     });
 
     /**
@@ -327,6 +356,11 @@ displayName: user.displayName });
 
             const isValidPassword = await ops.verifyPassword(password, user.passwordHash);
             if (!isValidPassword) {
+                logger.warn("[Security Audit] Auth login failure", {
+                    eventType: "auth.login.failure",
+                    email,
+                    userId: user.id
+                });
                 throw ApiError.unauthorized("Invalid email or password", "INVALID_CREDENTIALS");
             }
         }
@@ -344,7 +378,15 @@ displayName: user.displayName });
             });
         }
 
-        return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken));
+        logger.info("[Security Audit] Auth login success", {
+            eventType: "auth.login.success",
+            userId: user.id,
+            email
+        });
+
+        const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken);
+        const finalResponse = await applyTransformHook(authResponse, "login", c.req.raw, user.id);
+        return c.json(finalResponse);
     });
 
     /**
@@ -374,6 +416,13 @@ displayName: user.displayName });
                     user = await authRepo.getUserByEmail(externalUser.email);
 
                     if (user) {
+                        // Only auto-link if the OAuth provider confirmed the email is verified
+                        if (!externalUser.emailVerified) {
+                            throw ApiError.forbidden(
+                                "Cannot auto-link account: email not verified by the OAuth provider. Please log in with your password first and link the provider from your profile.",
+                                "EMAIL_NOT_VERIFIED"
+                            );
+                        }
                         // Link Provider to existing account
                         await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, { email: externalUser.email });
 
@@ -430,7 +479,9 @@ displayName: user.displayName });
                     c.req.header("x-forwarded-for") || "unknown"
                 );
 
-                return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken));
+                const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken);
+                const finalResponse = await applyTransformHook(authResponse, "oauth", c.req.raw, user.id);
+                return c.json(finalResponse);
             });
         }
     }
@@ -706,13 +757,15 @@ aal: "aal1" };
             ipAddress
         );
 
-        return c.json({
+        const refreshResponse: AuthResponsePayload = {
             tokens: {
                 accessToken: newAccessToken,
                 refreshToken: newRefreshToken,
                 accessTokenExpiresAt: getAccessTokenExpiry()
             }
-        });
+        };
+        const finalResponse = await applyTransformHook(refreshResponse, "refresh", c.req.raw, storedToken.userId);
+        return c.json(finalResponse);
     });
 
     mountSessionRoutes({
@@ -721,13 +774,29 @@ aal: "aal1" };
         ops,
         parseBody,
         buildAuthResponse,
-        createSessionAndTokens
+        createSessionAndTokens,
+        applyTransformHook
     });
 
     // ═══════════════════════════════════════════════════════════════════════
     // MFA / TOTP
     // ═══════════════════════════════════════════════════════════════════════
-    mountMfaRoutes(router, config, ops, parseBody);
+    mountMfaRoutes(router, config, ops, parseBody, applyTransformHook);
+
+    // ═══════════════════════════════════════════════════════════════════════
+    // Magic Link (passwordless email login)
+    // ═══════════════════════════════════════════════════════════════════════
+    if (config.enableMagicLink) {
+        mountMagicLinkRoutes({
+            router,
+            config,
+            ops,
+            parseBody,
+            buildAuthResponse,
+            createSessionAndTokens,
+            applyTransformHook
+        });
+    }
 
     return router;
 }

package/src/auth/session-routes.ts

@@ -10,6 +10,7 @@ import { hashRefreshToken } from "./jwt";
 import type { AuthModuleConfig } from "./routes";
 import { resolveAuthHooks } from "./auth-hooks";
 import type { CreateUserData } from "./interfaces";
+import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 
 interface SessionRoutesConfig {
     router: Hono<HonoEnv>;
@@ -27,10 +28,16 @@ interface SessionRoutesConfig {
         accessToken: string;
         refreshToken: string;
     }>;
+    applyTransformHook: (
+        response: AuthResponsePayload,
+        method: TransformAuthResponseContext["method"],
+        request: Request,
+        userId: string
+    ) => Promise<AuthResponsePayload>;
 }
 
 export function mountSessionRoutes(opts: SessionRoutesConfig): void {
-    const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens } = opts;
+    const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook } = opts;
     const authRepo = config.authRepo;
 
     const logoutSchema = z.object({
@@ -230,6 +237,7 @@ export function mountSessionRoutes(opts: SessionRoutesConfig): void {
             needsSetup,
             registrationEnabled: registrationAllowed,
             emailServiceEnabled: isEmailConfigured(),
+            magicLinkEnabled: !!config.enableMagicLink && isEmailConfigured(),
             enabledProviders
         });
     });
@@ -283,7 +291,9 @@ export function mountSessionRoutes(opts: SessionRoutesConfig): void {
             });
         }
 
-        return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken), 201);
+        const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken) as AuthResponsePayload;
+        const finalResponse = await applyTransformHook(authResponse, "anonymous", c.req.raw, user.id);
+        return c.json(finalResponse, 201);
     });
 
     /**
@@ -336,6 +346,8 @@ export function mountSessionRoutes(opts: SessionRoutesConfig): void {
             c.req.header("x-forwarded-for") || "unknown"
         );
 
-        return c.json(buildAuthResponse(updatedUser, roleIds, accessToken, refreshToken));
+        const authResponse = buildAuthResponse(updatedUser, roleIds, accessToken, refreshToken) as AuthResponsePayload;
+        const finalResponse = await applyTransformHook(authResponse, "anonymous", c.req.raw, user.id);
+        return c.json(finalResponse);
     });
 }

package/src/auth/slack-oauth.ts

@@ -61,7 +61,8 @@ export function createSlackProvider(config: { clientId: string; clientSecret: st
                     providerId: p.sub,
                     email: p.email,
                     displayName: p.name || null,
-                    photoUrl: p.picture || null
+                    photoUrl: p.picture || null,
+                    emailVerified: p.email_verified === true
                 };
             } catch (error) {
                 logger.error("Slack OAuth error", { error: error });

package/src/auth/spotify-oauth.ts

@@ -57,7 +57,8 @@ export function createSpotifyProvider(config: { clientId: string; clientSecret:
                     providerId: p.id,
                     email: p.email,
                     displayName: p.display_name || null,
-                    photoUrl: p.images?.[0]?.url || null
+                    photoUrl: p.images?.[0]?.url || null,
+                    emailVerified: true
                 };
             } catch (error) {
                 logger.error("Spotify OAuth error", { error: error });