@rebasepro/server-core 0.6.1 → 0.8.0

package/src/auth/mfa-routes.ts

@@ -11,21 +11,30 @@ import {
     generateRecoveryCodes,
     hashRecoveryCode
 } from "./mfa";
+import { encryptTotpSecret, decryptTotpSecret } from "./mfa-crypto";
 import {
     generateAccessToken,
     generateRefreshToken,
     hashRefreshToken,
     getRefreshTokenExpiry,
-    getAccessTokenExpiry
+    getAccessTokenExpiry,
+    type AccessTokenPayload
 } from "./jwt";
 import type { AuthModuleConfig } from "./routes";
 import { resolveAuthHooks } from "./auth-hooks";
+import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 
 export function mountMfaRoutes(
     router: Hono<HonoEnv>,
     config: AuthModuleConfig,
     ops: ReturnType<typeof resolveAuthHooks>,
-    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T
+    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T,
+    applyTransformHook?: (
+        response: AuthResponsePayload,
+        method: TransformAuthResponseContext["method"],
+        request: Request,
+        userId: string
+    ) => Promise<AuthResponsePayload>
 ): void {
     const authRepo = config.authRepo;
     const emailConfig = config.emailConfig;
@@ -53,11 +62,12 @@ export function mountMfaRoutes(
         // Generate TOTP secret
         const { secret, uri } = generateTotpSecret(issuer, user.email);
 
-        // Store the factor (unverified until user confirms with a valid code)
+        // Encrypt the TOTP secret before storage (AES-256-GCM envelope encryption)
+        const encryptedSecret = encryptTotpSecret(secret);
         const factor = await authRepo.createMfaFactor(
             user.id,
             "totp",
-            secret, // In production, encrypt this before storage
+            encryptedSecret,
             friendlyName
         );
 
@@ -110,8 +120,9 @@ export function mountMfaRoutes(
             throw ApiError.badRequest("Factor is already verified", "ALREADY_VERIFIED");
         }
 
-        // Verify the TOTP code
-        const secretBuffer = base32Decode(factor.secretEncrypted);
+        // Decrypt and verify the TOTP code
+        const decryptedSecret = decryptTotpSecret(factor.secretEncrypted);
+        const secretBuffer = base32Decode(decryptedSecret);
         const isValid = verifyTotp(secretBuffer, code);
 
         if (!isValid) {
@@ -191,7 +202,8 @@ export function mountMfaRoutes(
         }
 
         // Try TOTP verification first (standard 6-digit codes)
-        const secretBuffer = base32Decode(factor.secretEncrypted);
+        const decryptedSecret = decryptTotpSecret(factor.secretEncrypted);
+        const secretBuffer = base32Decode(decryptedSecret);
         let isValid = verifyTotp(secretBuffer, code);
 
         // Fall back to recovery code verification if TOTP didn't match
@@ -231,13 +243,17 @@ export function mountMfaRoutes(
             });
         }
 
-        return c.json({
+        let mfaResponse: AuthResponsePayload = {
             tokens: {
                 accessToken,
                 refreshToken,
                 accessTokenExpiresAt: getAccessTokenExpiry()
             }
-        });
+        };
+        if (applyTransformHook) {
+            mfaResponse = await applyTransformHook(mfaResponse, "mfa", c.req.raw, userCtx.userId);
+        }
+        return c.json(mfaResponse);
     });
 
     /**
@@ -267,11 +283,19 @@ export function mountMfaRoutes(
      * Remove an MFA factor
      */
     router.delete("/mfa/unenroll", requireAuth, async (c) => {
-        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        const userCtx = c.get("user") as AccessTokenPayload | undefined;
         if (!userCtx) {
             throw ApiError.unauthorized("Not authenticated");
         }
 
+        // Require aal2 (MFA-verified session) to unenroll MFA factors
+        if (userCtx.aal !== "aal2") {
+            throw ApiError.forbidden(
+                "MFA verification required to unenroll. Please re-authenticate with your second factor.",
+                "AAL2_REQUIRED"
+            );
+        }
+
         const unenrollSchema = z.object({
             factorId: z.string().min(1, "Factor ID is required")
         });

package/src/auth/microsoft-oauth.ts

@@ -78,7 +78,8 @@ export function createMicrosoftProvider(config: {
                     providerId: profileData.id,
                     email,
                     displayName: profileData.displayName || null,
-                    photoUrl: null
+                    photoUrl: null,
+                    emailVerified: true
                 };
             } catch (error) {
                 logger.error("Microsoft OAuth error", { error: error });

package/src/auth/middleware.ts

@@ -22,6 +22,13 @@ export type AuthResult = boolean | null | undefined | { userId?: string; uid?: s
 export interface AuthMiddlewareOptions {
     /** DataDriver to scope via withAuth() for RLS */
     driver: DataDriver;
+    /**
+     * Optional per-request driver resolver for multi-data-source backends.
+     * Given the request context, returns the unscoped delegate to use (e.g.
+     * Postgres vs Mongo, picked by the request's collection data source).
+     * When omitted, `driver` is used for every request.
+     */
+    resolveDriver?: (c: Context<HonoEnv>) => DataDriver;
     /**
      * If true, return 401 when no valid token is present.
      *
@@ -30,7 +37,7 @@ export interface AuthMiddlewareOptions {
      * to Postgres Row-Level Security policies.
      */
     requireAuth?: boolean;
-    /** Optional custom validator (for non-JWT auth, e.g. Firebase Auth) */
+    /** Optional custom validator (for non-JWT auth, e.g. external auth providers) */
     validator?: (c: Context<HonoEnv>) => Promise<AuthResult>;
     /**
      * A static secret key for server-to-server / script authentication.
@@ -40,7 +47,7 @@ export interface AuthMiddlewareOptions {
      * roles: `["admin"]`) **without** JWT verification. The driver is scoped
      * via `withAuth()` with the service identity.
      *
-     * This is the Rebase equivalent of a Firebase Service Account key.
+     * This is the Rebase equivalent of a Service Account key.
      * Set via `REBASE_SERVICE_KEY` in `.env` and pass through the backend config.
      *
      * **Security:** The comparison uses constant-time equality to prevent
@@ -232,11 +239,13 @@ export function extractUserFromToken(token: string): AccessTokenPayload | null {
  */
 
 export function createAuthMiddleware(options: AuthMiddlewareOptions): MiddlewareHandler<HonoEnv> {
-    const { driver, requireAuth: enforceAuth = true, validator, serviceKey, apiKeyStore } = options;
+    const { driver: baseDriver, resolveDriver, requireAuth: enforceAuth = true, validator, serviceKey, apiKeyStore } = options;
 
     return async (c, next) => {
+        // Pick the per-request delegate (multi-data-source) before scoping.
+        const driver = resolveDriver ? resolveDriver(c) : baseDriver;
         if (validator) {
-            // Custom validator path (e.g., Firebase Auth, API keys)
+            // Custom validator path (e.g., API keys, external auth)
             try {
                 const authResult = await validator(c);
                 if (authResult && typeof authResult === "object") {
@@ -282,7 +291,7 @@ code: "UNAUTHORIZED" } }, 401);
 
                 // ── Service Key check ──────────────────────────────────
                 // Check BEFORE JWT verification. Service keys are static
-                // secrets (like Firebase SA keys) that grant admin access
+                // secrets (like Service Account keys) that grant admin access
                 // for scripts, cron jobs, and server-to-server calls.
                 if (serviceKey && safeCompare(token, serviceKey)) {
                     const serviceUser: AccessTokenPayload = {

package/src/auth/reset-password-admin.ts

@@ -54,8 +54,24 @@ export function createResetPasswordRoute(config: ResetPasswordRouteConfig): Hono
         let invitationSent = false;
         let temporaryPassword: string | undefined;
 
+        // Parse optional body — if a password is provided, set it directly
+        const body = await c.req.json().catch(() => ({}));
+
+        if (body.password) {
+            const password = body.password as string;
+            const validation = ops.validatePasswordStrength(password);
+            if (!validation.valid) {
+                throw ApiError.badRequest(
+                    `Password too weak: ${validation.errors.join(", ")}`
+                );
+            }
+            const passwordHash = await ops.hashPassword(password);
+            await authRepo.updatePassword(existing.id, passwordHash);
+            temporaryPassword = undefined;
+            invitationSent = false;
+        }
         // 1. Collection-level hook (closest to the data)
-        if (collectionAuthConfig?.onResetPassword) {
+        else if (collectionAuthConfig?.onResetPassword) {
             const isEmailConfigured = !!(emailService && emailService.isConfigured());
             const hookResult = await collectionAuthConfig.onResetPassword(existing.id, {
                 hashPassword: (password: string) => ops.hashPassword(password),

package/src/auth/routes.ts

@@ -15,6 +15,8 @@ import { z } from "zod";
 import { logger } from "../utils/logger";
 import { mountMfaRoutes } from "./mfa-routes";
 import { mountSessionRoutes } from "./session-routes";
+import { mountMagicLinkRoutes } from "./magic-link-routes";
+import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 
 /**
  * Shared configuration for auth and admin route factories.
@@ -28,8 +30,7 @@ export interface AuthModuleConfig {
     /** Default role ID to assign to new users (default: none). Must NOT be "admin". */
     defaultRole?: string;
     /** Optional array of OAuth providers */
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    oauthProviders?: OAuthProvider<any>[];
+    oauthProviders?: OAuthProvider<unknown>[];
     /** When true, blocks all self-registration regardless of `allowRegistration`. */
     disableSelfRegistration?: boolean;
     /**
@@ -43,6 +44,8 @@ export interface AuthModuleConfig {
      * When not provided, falls back to checking if any users exist.
      */
     isBootstrapCompleted?: () => Promise<boolean>;
+    /** Enable magic link (passwordless email) login. Requires email service. */
+    enableMagicLink?: boolean;
 }
 
 /**
@@ -53,7 +56,7 @@ function buildAuthResponse(
     roleIds: string[],
     accessToken: string,
     refreshToken: string
-) {
+): AuthResponsePayload {
     return {
         user: {
             uid: user.id,
@@ -95,6 +98,29 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
     const { emailService, emailConfig, allowRegistration = false } = config;
     const ops = resolveAuthHooks(config.authHooks);
 
+    /**
+     * Apply the `transformAuthResponse` hook if provided.
+     *
+     * Errors are caught and logged — the untransformed response is returned
+     * as a graceful fallback so auth never breaks due to a hook failure.
+     */
+    async function applyTransformHook(
+        response: AuthResponsePayload,
+        method: TransformAuthResponseContext["method"],
+        request: Request,
+        userId: string
+    ): Promise<AuthResponsePayload> {
+        if (!ops.transformAuthResponse) return response;
+        try {
+            return await ops.transformAuthResponse(response, { userId, method, request });
+        } catch (err) {
+            logger.error("[AuthHooks] transformAuthResponse error", {
+                error: err instanceof Error ? err.message : err
+            });
+            return response;
+        }
+    }
+
     // ── Zod input schemas ──────────────────────────────────────────────
     const registerSchema = z.object({
         email: z.string().email("Invalid email address").max(255),
@@ -291,7 +317,9 @@ displayName: user.displayName });
             });
         }
 
-        return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken), 201);
+        const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken);
+        const finalResponse = await applyTransformHook(authResponse, "register", c.req.raw, user.id);
+        return c.json(finalResponse, 201);
     });
 
     /**
@@ -327,6 +355,11 @@ displayName: user.displayName });
 
             const isValidPassword = await ops.verifyPassword(password, user.passwordHash);
             if (!isValidPassword) {
+                logger.warn("[Security Audit] Auth login failure", {
+                    eventType: "auth.login.failure",
+                    email,
+                    userId: user.id
+                });
                 throw ApiError.unauthorized("Invalid email or password", "INVALID_CREDENTIALS");
             }
         }
@@ -344,7 +377,15 @@ displayName: user.displayName });
             });
         }
 
-        return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken));
+        logger.info("[Security Audit] Auth login success", {
+            eventType: "auth.login.success",
+            userId: user.id,
+            email
+        });
+
+        const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken);
+        const finalResponse = await applyTransformHook(authResponse, "login", c.req.raw, user.id);
+        return c.json(finalResponse);
     });
 
     /**
@@ -374,6 +415,13 @@ displayName: user.displayName });
                     user = await authRepo.getUserByEmail(externalUser.email);
 
                     if (user) {
+                        // Only auto-link if the OAuth provider confirmed the email is verified
+                        if (!externalUser.emailVerified) {
+                            throw ApiError.forbidden(
+                                "Cannot auto-link account: email not verified by the OAuth provider. Please log in with your password first and link the provider from your profile.",
+                                "EMAIL_NOT_VERIFIED"
+                            );
+                        }
                         // Link Provider to existing account
                         await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, { email: externalUser.email });
 
@@ -430,7 +478,9 @@ displayName: user.displayName });
                     c.req.header("x-forwarded-for") || "unknown"
                 );
 
-                return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken));
+                const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken);
+                const finalResponse = await applyTransformHook(authResponse, "oauth", c.req.raw, user.id);
+                return c.json(finalResponse);
             });
         }
     }
@@ -706,13 +756,15 @@ aal: "aal1" };
             ipAddress
         );
 
-        return c.json({
+        const refreshResponse: AuthResponsePayload = {
             tokens: {
                 accessToken: newAccessToken,
                 refreshToken: newRefreshToken,
                 accessTokenExpiresAt: getAccessTokenExpiry()
             }
-        });
+        };
+        const finalResponse = await applyTransformHook(refreshResponse, "refresh", c.req.raw, storedToken.userId);
+        return c.json(finalResponse);
     });
 
     mountSessionRoutes({
@@ -721,13 +773,29 @@ aal: "aal1" };
         ops,
         parseBody,
         buildAuthResponse,
-        createSessionAndTokens
+        createSessionAndTokens,
+        applyTransformHook
     });
 
     // ═══════════════════════════════════════════════════════════════════════
     // MFA / TOTP
     // ═══════════════════════════════════════════════════════════════════════
-    mountMfaRoutes(router, config, ops, parseBody);
+    mountMfaRoutes(router, config, ops, parseBody, applyTransformHook);
+
+    // ═══════════════════════════════════════════════════════════════════════
+    // Magic Link (passwordless email login)
+    // ═══════════════════════════════════════════════════════════════════════
+    if (config.enableMagicLink) {
+        mountMagicLinkRoutes({
+            router,
+            config,
+            ops,
+            parseBody,
+            buildAuthResponse,
+            createSessionAndTokens,
+            applyTransformHook
+        });
+    }
 
     return router;
 }

package/src/auth/session-routes.ts

@@ -10,6 +10,7 @@ import { hashRefreshToken } from "./jwt";
 import type { AuthModuleConfig } from "./routes";
 import { resolveAuthHooks } from "./auth-hooks";
 import type { CreateUserData } from "./interfaces";
+import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 
 interface SessionRoutesConfig {
     router: Hono<HonoEnv>;
@@ -27,10 +28,16 @@ interface SessionRoutesConfig {
         accessToken: string;
         refreshToken: string;
     }>;
+    applyTransformHook: (
+        response: AuthResponsePayload,
+        method: TransformAuthResponseContext["method"],
+        request: Request,
+        userId: string
+    ) => Promise<AuthResponsePayload>;
 }
 
 export function mountSessionRoutes(opts: SessionRoutesConfig): void {
-    const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens } = opts;
+    const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook } = opts;
     const authRepo = config.authRepo;
 
     const logoutSchema = z.object({
@@ -230,6 +237,7 @@ export function mountSessionRoutes(opts: SessionRoutesConfig): void {
             needsSetup,
             registrationEnabled: registrationAllowed,
             emailServiceEnabled: isEmailConfigured(),
+            magicLinkEnabled: !!config.enableMagicLink && isEmailConfigured(),
             enabledProviders
         });
     });
@@ -283,7 +291,9 @@ export function mountSessionRoutes(opts: SessionRoutesConfig): void {
             });
         }
 
-        return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken), 201);
+        const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken) as AuthResponsePayload;
+        const finalResponse = await applyTransformHook(authResponse, "anonymous", c.req.raw, user.id);
+        return c.json(finalResponse, 201);
     });
 
     /**
@@ -336,6 +346,8 @@ export function mountSessionRoutes(opts: SessionRoutesConfig): void {
             c.req.header("x-forwarded-for") || "unknown"
         );
 
-        return c.json(buildAuthResponse(updatedUser, roleIds, accessToken, refreshToken));
+        const authResponse = buildAuthResponse(updatedUser, roleIds, accessToken, refreshToken) as AuthResponsePayload;
+        const finalResponse = await applyTransformHook(authResponse, "anonymous", c.req.raw, user.id);
+        return c.json(finalResponse);
     });
 }

package/src/auth/slack-oauth.ts

@@ -61,7 +61,8 @@ export function createSlackProvider(config: { clientId: string; clientSecret: st
                     providerId: p.sub,
                     email: p.email,
                     displayName: p.name || null,
-                    photoUrl: p.picture || null
+                    photoUrl: p.picture || null,
+                    emailVerified: p.email_verified === true
                 };
             } catch (error) {
                 logger.error("Slack OAuth error", { error: error });

package/src/auth/spotify-oauth.ts

@@ -57,7 +57,8 @@ export function createSpotifyProvider(config: { clientId: string; clientSecret:
                     providerId: p.id,
                     email: p.email,
                     displayName: p.display_name || null,
-                    photoUrl: p.images?.[0]?.url || null
+                    photoUrl: p.images?.[0]?.url || null,
+                    emailVerified: true
                 };
             } catch (error) {
                 logger.error("Spotify OAuth error", { error: error });

package/src/auth/twitter-oauth.ts

@@ -84,6 +84,7 @@ export function createTwitterProvider(config: { clientId: string; clientSecret:
                 // generate a placeholder email — the user can update it later.
                 // For apps with elevated access, fetch from v1.1 endpoint.
                 let email: string | null = null;
+                let emailVerified = false;
                 try {
                     const emailResponse = await fetch(
                         "https://api.twitter.com/1.1/account/verify_credentials.json?include_email=true",
@@ -94,6 +95,9 @@ export function createTwitterProvider(config: { clientId: string; clientSecret:
                     if (emailResponse.ok) {
                         const emailData = await emailResponse.json() as { email?: string };
                         email = emailData.email || null;
+                        if (email) {
+                            emailVerified = true;
+                        }
                     }
                 } catch {
                     // Elevated access not available — fall through
@@ -104,13 +108,16 @@ export function createTwitterProvider(config: { clientId: string; clientSecret:
                     // This allows the account to be created and linked; the user should
                     // update their email through the profile settings.
                     email = `${profileData.id}@twitter.placeholder.rebase`;
+                    // Placeholder emails are NOT verified — prevents auto-linking to existing accounts
+                    emailVerified = false;
                 }
 
                 return {
                     providerId: profileData.id,
                     email,
                     displayName: profileData.name || profileData.username || null,
-                    photoUrl: profileData.profile_image_url?.replace("_normal", "_400x400") || null
+                    photoUrl: profileData.profile_image_url?.replace("_normal", "_400x400") || null,
+                    emailVerified
                 };
             } catch (error) {
                 logger.error("Twitter OAuth error", { error: error });

package/src/cron/cron-store.ts

@@ -43,7 +43,8 @@ export function createCronStore(driver: DataDriver): CronStore | undefined {
         return undefined;
     }
 
-    const exec = admin.executeSql.bind(admin);
+    const exec = (sqlText: string, options?: { params?: unknown[] }) =>
+        admin.executeSql(sqlText, options?.params ? { params: options.params } : undefined);
 
     return {
         async ensureTable(): Promise<void> {
@@ -80,22 +81,22 @@ export function createCronStore(driver: DataDriver): CronStore | undefined {
             try {
                 const resultJson = entry.result !== undefined ? JSON.stringify(entry.result) : null;
                 const logsJson = entry.logs.length > 0 ? JSON.stringify(entry.logs) : null;
-                const errorEscaped = entry.error ? entry.error.replace(/'/g, "''") : null;
 
-                await exec(`
-                    INSERT INTO ${TABLE} (job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual)
-                    VALUES (
-                        '${entry.jobId}',
-                        '${entry.startedAt}',
-                        '${entry.finishedAt}',
-                        ${entry.durationMs},
-                        ${entry.success},
-                        ${errorEscaped ? `'${errorEscaped}'` : "NULL"},
-                        ${resultJson ? `'${resultJson.replace(/'/g, "''")}'::jsonb` : "NULL"},
-                        ${logsJson ? `'${logsJson.replace(/'/g, "''")}'::jsonb` : "NULL"},
-                        ${entry.manual}
-                    )
-                `);
+                await exec(
+                    `INSERT INTO ${TABLE} (job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual)
+                     VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8::jsonb, $9)`,
+                    { params: [
+                        entry.jobId,
+                        entry.startedAt,
+                        entry.finishedAt,
+                        entry.durationMs,
+                        entry.success,
+                        entry.error || null,
+                        resultJson,
+                        logsJson,
+                        entry.manual
+                    ]}
+                );
             } catch (err) {
                 // Non-blocking — log persistence should never crash the scheduler
                 logger.error(`[cron-store] Failed to persist log for "${entry.jobId}"`, { error: err });
@@ -104,13 +105,14 @@ export function createCronStore(driver: DataDriver): CronStore | undefined {
 
         async fetchLogs(jobId: string, limit = 50): Promise<CronJobLogEntry[]> {
             try {
-                const rows = await exec(`
-                    SELECT job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual
-                    FROM ${TABLE}
-                    WHERE job_id = '${jobId}'
-                    ORDER BY started_at DESC
-                    LIMIT ${limit}
-                `);
+                const rows = await exec(
+                    `SELECT job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual
+                     FROM ${TABLE}
+                     WHERE job_id = $1
+                     ORDER BY started_at DESC
+                     LIMIT $2`,
+                    { params: [jobId, limit] }
+                );
 
                 return rows.map(rowToLogEntry);
             } catch (err) {

package/src/email/index.ts

@@ -10,9 +10,10 @@ export type {
     PasswordResetTemplateFunction,
     EmailVerificationTemplateFunction,
     UserInvitationTemplateFunction,
-    WelcomeEmailTemplateFunction
+    WelcomeEmailTemplateFunction,
+    MagicLinkTemplateFunction
 } from "./types";
 
 export { SMTPEmailService, createEmailService } from "./smtp-email-service";
 
-export { getPasswordResetTemplate, getEmailVerificationTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate } from "./templates";
+export { getPasswordResetTemplate, getEmailVerificationTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, getMagicLinkTemplate } from "./templates";

package/src/email/templates.ts

@@ -386,3 +386,85 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
 html,
 text };
 }
+
+/**
+ * Default magic link email template
+ */
+export function getMagicLinkTemplate(
+    magicLinkUrl: string,
+    user: TemplateUser,
+    appName = "Rebase"
+): { subject: string; html: string; text: string } {
+    const greeting = getGreeting(user);
+
+    const subject = `Sign in to ${appName}`;
+
+    const html = `
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>${subject}</title>
+</head>
+<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+    <div style="${styles.container}">
+        <div style="${styles.card}">
+            <h1 style="${styles.heading}">Sign In to ${appName}</h1>
+            
+            <p style="${styles.paragraph}">
+                Hi ${greeting},
+            </p>
+            
+            <p style="${styles.paragraph}">
+                We received a request to sign in to your ${appName} account. 
+                Click the button below to log in:
+            </p>
+            
+            <div style="text-align: center;">
+                <a href="${magicLinkUrl}" style="${styles.button}">Sign In</a>
+            </div>
+            
+            <p style="${styles.paragraph}">
+                Or copy and paste this link into your browser:
+            </p>
+            <p style="color: #3b82f6; word-break: break-all; font-size: 14px;">
+                ${magicLinkUrl}
+            </p>
+            
+            <div style="${styles.warning}">
+                ⏰ This link will expire in 15 minutes for security reasons and can only be used once.
+            </div>
+            
+            <div style="${styles.footer}">
+                <p style="margin: 0;">
+                    If you didn't request this sign-in link, you can safely ignore this email. 
+                    No action is needed.
+                </p>
+            </div>
+        </div>
+    </div>
+</body>
+</html>
+    `.trim();
+
+    const text = `
+Sign In to ${appName}
+
+Hi ${greeting},
+
+We received a request to sign in to your ${appName} account.
+
+Click this link to log in:
+${magicLinkUrl}
+
+This link will expire in 15 minutes for security reasons and can only be used once.
+
+If you didn't request this sign-in link, you can safely ignore this email.
+No action is needed.
+    `.trim();
+
+    return { subject,
+html,
+text };
+}