@rebasepro/server-core 0.7.0 → 0.8.0

package/dist/auth/github-oauth.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates a GitHub OAuth Provider integration.
+ *
+ * Flow: Frontend receives an authorization `code` via the GitHub OAuth redirect.
+ * This provider exchanges the code for an access token, then fetches the user's
+ * profile and primary email from the GitHub API.
+ */
+export declare function createGitHubProvider(config: {
+    clientId: string;
+    clientSecret: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+}>;

package/dist/auth/gitlab-oauth.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates a GitLab OAuth Provider integration.
+ * Works with both GitLab.com and self-hosted instances.
+ */
+export declare function createGitLabProvider(config: {
+    clientId: string;
+    clientSecret: string;
+    baseUrl?: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+}>;

package/dist/auth/google-oauth.d.ts

@@ -0,0 +1,47 @@
+import type { OAuthProvider } from "./interfaces";
+export interface GoogleUserInfo {
+    googleId: string;
+    email: string;
+    displayName: string | null;
+    photoUrl: string | null;
+    emailVerified: boolean;
+}
+export interface GoogleProviderConfig {
+    clientId: string;
+    /**
+     * The OAuth 2.0 client secret from Google Cloud Console.
+     *
+     * Required for the **authorization code flow** (Path 3), where the
+     * frontend sends an authorization `code` and the backend exchanges it
+     * server-side for tokens. This is the most secure flow because tokens
+     * never touch the browser.
+     *
+     * When omitted, only ID-token and access-token verification are available
+     * (Paths 1 & 2), which rely on the frontend obtaining tokens directly.
+     */
+    clientSecret?: string;
+}
+/**
+ * Creates a Google OAuth Provider integration.
+ *
+ * Supports three verification paths:
+ *
+ * **Path 1 – ID Token** (One Tap / Sign In With Google button):
+ *   Frontend sends `idToken`. Backend verifies cryptographically using
+ *   Google's public keys. No secret required.
+ *
+ * **Path 2 – Access Token** (popup via `initTokenClient`):
+ *   Frontend sends `accessToken`. Backend validates by calling Google's
+ *   userinfo endpoint. No secret required.
+ *
+ * **Path 3 – Authorization Code** (most secure, requires `clientSecret`):
+ *   Frontend sends `code` + `redirectUri`. Backend exchanges the code
+ *   server-side for an ID token using `clientId` + `clientSecret`, then
+ *   verifies the ID token. Tokens never touch the browser.
+ */
+export declare function createGoogleProvider(config: GoogleProviderConfig | string): OAuthProvider<{
+    idToken?: string;
+    accessToken?: string;
+    code?: string;
+    redirectUri?: string;
+}>;

package/dist/auth/index.d.ts

@@ -0,0 +1,37 @@
+export * from "./interfaces";
+export { configureJwt, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry } from "./jwt";
+export type { JwtConfig, AccessTokenPayload } from "./jwt";
+export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
+export type { PasswordValidationResult } from "./password";
+export type { AuthHooks, AuthMethod, ResolvedAuthHooks } from "./auth-hooks";
+export { resolveAuthHooks } from "./auth-hooks";
+export { generateSecurePassword, generateSecureToken, hashToken, prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops";
+export type { AdminUserContext, AdminUserPrepareResult } from "./admin-user-ops";
+export { createGoogleProvider } from "./google-oauth";
+export type { GoogleProviderConfig } from "./google-oauth";
+export { createLinkedinProvider } from "./linkedin-oauth";
+export { createGitHubProvider } from "./github-oauth";
+export { createMicrosoftProvider } from "./microsoft-oauth";
+export { createAppleProvider } from "./apple-oauth";
+export { createFacebookProvider } from "./facebook-oauth";
+export { createTwitterProvider } from "./twitter-oauth";
+export { createDiscordProvider } from "./discord-oauth";
+export { createGitLabProvider } from "./gitlab-oauth";
+export { createBitbucketProvider } from "./bitbucket-oauth";
+export { createSlackProvider } from "./slack-oauth";
+export { createSpotifyProvider } from "./spotify-oauth";
+export { requireAuth, requireAdmin, optionalAuth, extractUserFromToken, createAuthMiddleware } from "./middleware";
+export type { AuthMiddlewareOptions, AuthResult } from "./middleware";
+export { createAuthRoutes } from "./routes";
+export type { AuthModuleConfig } from "./routes";
+export { mountMagicLinkRoutes } from "./magic-link-routes";
+export { createResetPasswordRoute } from "./reset-password-admin";
+export type { ResetPasswordRouteConfig } from "./reset-password-admin";
+export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createApiKeyRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
+export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys";
+export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys";
+export { createBuiltinAuthAdapter } from "./builtin-auth-adapter";
+export type { BuiltinAuthAdapterConfig } from "./builtin-auth-adapter";
+export { createCustomAuthAdapter } from "./custom-auth-adapter";
+export { createAdapterAuthMiddleware } from "./adapter-middleware";
+export type { AdapterAuthMiddlewareOptions } from "./adapter-middleware";

package/dist/auth/interfaces.d.ts

@@ -0,0 +1,431 @@
+import { z } from "zod";
+/**
+ * Authentication Abstraction Interfaces
+ *
+ * These interfaces define the contracts for authentication-related operations.
+ * Implementations can use different databases (PostgreSQL, MongoDB, etc.) to
+ * store user, role, and token data.
+ */
+/**
+ * User data structure
+ */
+export interface UserData {
+    id: string;
+    email: string;
+    passwordHash?: string | null;
+    displayName?: string | null;
+    photoUrl?: string | null;
+    emailVerified: boolean;
+    emailVerificationToken?: string | null;
+    emailVerificationSentAt?: Date | null;
+    isAnonymous?: boolean;
+    metadata?: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/**
+ * Data for creating a new user
+ */
+export interface CreateUserData {
+    email: string;
+    passwordHash?: string;
+    displayName?: string;
+    photoUrl?: string;
+    emailVerified?: boolean;
+    isAnonymous?: boolean;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * User Identity Data (OAuth accounts linked to user)
+ */
+export interface UserIdentityData {
+    id: string;
+    userId: string;
+    provider: string;
+    providerId: string;
+    profileData?: Record<string, unknown> | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/**
+ * Standardized profile data returned by an OAuth provider verification payload
+ */
+export interface OAuthProviderProfile {
+    providerId: string;
+    email: string;
+    displayName?: string | null;
+    photoUrl?: string | null;
+    /** Whether the OAuth provider has verified the user's email address */
+    emailVerified?: boolean;
+}
+/**
+ * Pluggable OAuth Provider integration strategy
+ */
+export interface OAuthProvider<T = unknown> {
+    /** The identifier of the provider (e.g. "github", "google") */
+    id: string;
+    /** Zod schema validating the expected request payload (e.g. { code: string }) */
+    schema: z.ZodSchema<T>;
+    /**
+     * Verify external tokens/codes and return a standardized user profile.
+     *
+     * NOTE: Declared as method syntax (not arrow property) intentionally.
+     * This makes `OAuthProvider` bivariant in `T`, which is correct because
+     * each provider is self-contained — `schema` validates the request body
+     * and `verify` consumes the same `T`. Bivariance lets heterogeneous
+     * providers (`OAuthProvider<SpecificPayload>`) coexist in a single
+     * `OAuthProvider<unknown>[]` array without resorting to `any`.
+     */
+    verify(payload: T): Promise<OAuthProviderProfile | null>;
+}
+/**
+ * Role data structure
+ */
+export interface RoleData {
+    id: string;
+    name: string;
+    isAdmin: boolean;
+    defaultPermissions: {
+        read?: boolean;
+        create?: boolean;
+        edit?: boolean;
+        delete?: boolean;
+    } | null;
+    collectionPermissions: Record<string, {
+        read?: boolean;
+        create?: boolean;
+        edit?: boolean;
+        delete?: boolean;
+    }> | null;
+}
+/**
+ * Data for creating a new role
+ */
+export interface CreateRoleData {
+    id: string;
+    name: string;
+    isAdmin?: boolean;
+    defaultPermissions?: RoleData["defaultPermissions"];
+    collectionPermissions?: RoleData["collectionPermissions"];
+}
+/**
+ * Refresh token info
+ */
+export interface RefreshTokenInfo {
+    id: string;
+    userId: string;
+    tokenHash: string;
+    expiresAt: Date;
+    createdAt: Date;
+    userAgent?: string | null;
+    ipAddress?: string | null;
+}
+/**
+ * Password reset token info
+ */
+export interface PasswordResetTokenInfo {
+    userId: string;
+    expiresAt: Date;
+}
+/**
+ * Magic link token info
+ */
+export interface MagicLinkTokenInfo {
+    userId: string;
+    expiresAt: Date;
+}
+/**
+ * Options for paginated user listing
+ */
+export interface ListUsersOptions {
+    /** Max results per page (default 25) */
+    limit?: number;
+    /** Number of results to skip (default 0) */
+    offset?: number;
+    /** Search term — matches against email and displayName (case-insensitive) */
+    search?: string;
+    /** Field to sort by (default "createdAt") */
+    orderBy?: string;
+    /** Sort direction (default "desc") */
+    orderDir?: "asc" | "desc";
+    /** Filter by role ID */
+    roleId?: string;
+}
+/**
+ * Result of a paginated user listing
+ */
+export interface PaginatedUsersResult {
+    users: UserData[];
+    /** Total number of users matching the filters (ignoring limit/offset) */
+    total: number;
+    limit: number;
+    offset: number;
+}
+/**
+ * Abstract user repository interface.
+ * Handles all user-related database operations.
+ */
+export interface UserRepository {
+    /**
+     * Create a new user
+     */
+    createUser(data: CreateUserData): Promise<UserData>;
+    /**
+     * Get a user by ID
+     */
+    getUserById(id: string): Promise<UserData | null>;
+    /**
+     * Get a user by email
+     */
+    getUserByEmail(email: string): Promise<UserData | null>;
+    /**
+     * Get a user by an OAuth identity
+     */
+    getUserByIdentity(provider: string, providerId: string): Promise<UserData | null>;
+    /**
+     * Get all identities linked to a user
+     */
+    getUserIdentities(userId: string): Promise<UserIdentityData[]>;
+    /**
+     * Link a new OAuth identity to a user
+     */
+    linkUserIdentity(userId: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void>;
+    /**
+     * Update a user
+     */
+    updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null>;
+    /**
+     * Delete a user
+     */
+    deleteUser(id: string): Promise<void>;
+    /**
+     * List all users (unbounded — use listUsersPaginated for large datasets)
+     */
+    listUsers(): Promise<UserData[]>;
+    /**
+     * List users with server-side pagination, search, and sorting.
+     */
+    listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
+    /**
+     * Update user's password hash
+     */
+    updatePassword(id: string, passwordHash: string): Promise<void>;
+    /**
+     * Set email verification status
+     */
+    setEmailVerified(id: string, verified: boolean): Promise<void>;
+    /**
+     * Set email verification token
+     */
+    setVerificationToken(id: string, token: string | null): Promise<void>;
+    /**
+     * Find user by email verification token
+     */
+    getUserByVerificationToken(token: string): Promise<UserData | null>;
+    /**
+     * Get roles for a user
+     */
+    getUserRoles(userId: string): Promise<RoleData[]>;
+    /**
+     * Get role IDs for a user
+     */
+    getUserRoleIds(userId: string): Promise<string[]>;
+    /**
+     * Set roles for a user (replaces existing roles)
+     */
+    setUserRoles(userId: string, roleIds: string[]): Promise<void>;
+    /**
+     * Assign a specific role to a new user
+     */
+    assignDefaultRole(userId: string, roleId: string): Promise<void>;
+    /**
+     * Get user with their roles
+     */
+    getUserWithRoles(userId: string): Promise<{
+        user: UserData;
+        roles: RoleData[];
+    } | null>;
+}
+/**
+ * Abstract role repository interface.
+ * Handles all role-related database operations.
+ */
+export interface RoleRepository {
+    /**
+     * Get a role by ID
+     */
+    getRoleById(id: string): Promise<RoleData | null>;
+    /**
+     * List all roles
+     */
+    listRoles(): Promise<RoleData[]>;
+    /**
+     * Create a new role
+     */
+    createRole(data: CreateRoleData): Promise<RoleData>;
+    /**
+     * Update a role
+     */
+    updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
+    /**
+     * Delete a role
+     */
+    deleteRole(id: string): Promise<void>;
+}
+/**
+ * Abstract token repository interface.
+ * Handles refresh tokens and password reset tokens.
+ */
+export interface TokenRepository {
+    /**
+     * Create a new refresh token
+     */
+    createRefreshToken(userId: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    /**
+     * Find a refresh token by hash
+     */
+    findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
+    /**
+     * Delete a refresh token by hash
+     */
+    deleteRefreshToken(tokenHash: string): Promise<void>;
+    /**
+     * Delete all refresh tokens for a user
+     */
+    deleteAllRefreshTokensForUser(userId: string): Promise<void>;
+    /**
+     * List all refresh tokens for a user
+     */
+    listRefreshTokensForUser(userId: string): Promise<RefreshTokenInfo[]>;
+    /**
+     * Delete a specific refresh token by its primary key ID
+     */
+    deleteRefreshTokenById(id: string, userId: string): Promise<void>;
+    /**
+     * Create a password reset token
+     */
+    createPasswordResetToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+    /**
+     * Find a valid (not expired, not used) password reset token by hash
+     */
+    findValidPasswordResetToken(tokenHash: string): Promise<PasswordResetTokenInfo | null>;
+    /**
+     * Mark a password reset token as used
+     */
+    markPasswordResetTokenUsed(tokenHash: string): Promise<void>;
+    /**
+     * Delete all password reset tokens for a user
+     */
+    deleteAllPasswordResetTokensForUser(userId: string): Promise<void>;
+    /**
+     * Clean up expired tokens
+     */
+    deleteExpiredTokens(): Promise<void>;
+    /**
+     * Create a magic link token
+     */
+    createMagicLinkToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+    /**
+     * Find a valid (not expired, not used) magic link token by hash
+     */
+    findValidMagicLinkToken(tokenHash: string): Promise<MagicLinkTokenInfo | null>;
+    /**
+     * Mark a magic link token as used
+     */
+    markMagicLinkTokenUsed(tokenHash: string): Promise<void>;
+}
+/**
+ * MFA factor data structure
+ */
+export interface MfaFactor {
+    id: string;
+    userId: string;
+    factorType: "totp";
+    friendlyName?: string;
+    verified: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/**
+ * MFA challenge information
+ */
+export interface MfaChallengeInfo {
+    id: string;
+    factorId: string;
+    createdAt: Date;
+    verifiedAt?: Date;
+    ipAddress?: string;
+}
+/**
+ * Recovery code data structure
+ */
+export interface RecoveryCode {
+    id: string;
+    userId: string;
+    usedAt?: Date;
+}
+/**
+ * Abstract MFA repository interface.
+ * Handles all MFA-related database operations.
+ */
+export interface MfaRepository {
+    /**
+     * Create a new MFA factor for a user
+     */
+    createMfaFactor(userId: string, factorType: "totp", secretEncrypted: string, friendlyName?: string): Promise<MfaFactor>;
+    /**
+     * Get all MFA factors for a user
+     */
+    getMfaFactors(userId: string): Promise<MfaFactor[]>;
+    /**
+     * Get a specific MFA factor by ID
+     */
+    getMfaFactorById(factorId: string): Promise<(MfaFactor & {
+        secretEncrypted: string;
+    }) | null>;
+    /**
+     * Mark an MFA factor as verified
+     */
+    verifyMfaFactor(factorId: string): Promise<void>;
+    /**
+     * Delete an MFA factor
+     */
+    deleteMfaFactor(factorId: string, userId: string): Promise<void>;
+    /**
+     * Create an MFA challenge
+     */
+    createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
+    /**
+     * Get an MFA challenge by ID
+     */
+    getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;
+    /**
+     * Mark an MFA challenge as verified
+     */
+    verifyMfaChallenge(challengeId: string): Promise<void>;
+    /**
+     * Create recovery codes for a user
+     */
+    createRecoveryCodes(userId: string, codeHashes: string[]): Promise<void>;
+    /**
+     * Use a recovery code (mark as used)
+     */
+    useRecoveryCode(userId: string, codeHash: string): Promise<boolean>;
+    /**
+     * Get unused recovery code count for a user
+     */
+    getUnusedRecoveryCodeCount(userId: string): Promise<number>;
+    /**
+     * Delete all recovery codes for a user
+     */
+    deleteAllRecoveryCodes(userId: string): Promise<void>;
+    /**
+     * Check if a user has any verified MFA factors
+     */
+    hasVerifiedMfaFactors(userId: string): Promise<boolean>;
+}
+/**
+ * Combined auth repository interface for convenience
+ */
+export interface AuthRepository extends UserRepository, RoleRepository, TokenRepository, MfaRepository {
+}

package/dist/auth/jwt.d.ts

@@ -0,0 +1,55 @@
+export interface JwtConfig {
+    secret: string;
+    accessExpiresIn?: string;
+    refreshExpiresIn?: string;
+}
+export interface AccessTokenPayload {
+    userId: string;
+    roles: string[];
+    uid?: string;
+    /** Authentication Assurance Level: aal1 = password/oauth, aal2 = MFA verified */
+    aal?: "aal1" | "aal2";
+    /** Email claim from the JWT, if present */
+    email?: string;
+    /** Display name claim from the JWT, if present */
+    displayName?: string;
+    /** Photo URL claim from the JWT, if present */
+    photoURL?: string;
+    /** Whether MFA has been verified for this session */
+    mfa_verified?: boolean;
+    /** Authentication Methods Reference — list of methods used (e.g. 'pwd', 'otp') */
+    amr?: string[];
+}
+/**
+ * Configure JWT settings - call this during initialization.
+ * Validates the secret strength to prevent deployment with default/weak secrets.
+ */
+export declare function configureJwt(config: JwtConfig): void;
+/**
+ * Generate an access token (short-lived, 1 hour by default)
+ */
+export declare function generateAccessToken(userId: string, roles: string[], aal?: "aal1" | "aal2", customClaims?: Record<string, unknown>): string;
+/**
+ * Get the expiration time of an access token in milliseconds from now
+ */
+export declare function getAccessTokenExpiryMs(): number;
+/**
+ * Get the expiration timestamp for an access token
+ */
+export declare function getAccessTokenExpiry(): number;
+/**
+ * Verify and decode an access token
+ */
+export declare function verifyAccessToken(token: string): AccessTokenPayload | null;
+/**
+ * Generate a random refresh token (long-lived, 30 days by default)
+ */
+export declare function generateRefreshToken(): string;
+/**
+ * Hash a refresh token for database storage (don't store raw tokens)
+ */
+export declare function hashRefreshToken(token: string): string;
+/**
+ * Calculate refresh token expiration date
+ */
+export declare function getRefreshTokenExpiry(): Date;

package/dist/auth/linkedin-oauth.d.ts

@@ -0,0 +1,18 @@
+import type { OAuthProvider } from "./interfaces";
+export interface LinkedinUserInfo {
+    linkedinId: string;
+    email: string;
+    displayName: string | null;
+    photoUrl: string | null;
+    emailVerified: boolean;
+}
+/**
+ * Creates a LinkedIn OAuth Provider integration
+ */
+export declare function createLinkedinProvider(config: {
+    clientId: string;
+    clientSecret: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+}>;

package/dist/auth/magic-link-routes.d.ts

@@ -0,0 +1,30 @@
+import { Hono } from "hono";
+import type { AuthModuleConfig } from "./routes";
+import type { ResolvedAuthHooks } from "./auth-hooks";
+import type { HonoEnv } from "../api/types";
+import { z } from "zod";
+import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
+/**
+ * Mount magic link routes onto the auth router.
+ *
+ * Follows the same delegation pattern as `mountMfaRoutes()` and `mountSessionRoutes()`.
+ */
+export declare function mountMagicLinkRoutes(deps: {
+    router: Hono<HonoEnv>;
+    config: AuthModuleConfig;
+    ops: ResolvedAuthHooks;
+    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T;
+    buildAuthResponse: (user: {
+        id: string;
+        email: string;
+        displayName?: string | null;
+        photoUrl?: string | null;
+        metadata?: Record<string, unknown> | null;
+    }, roleIds: string[], accessToken: string, refreshToken: string) => unknown;
+    createSessionAndTokens: (userId: string, userAgent: string, ipAddress: string) => Promise<{
+        roleIds: string[];
+        accessToken: string;
+        refreshToken: string;
+    }>;
+    applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, userId: string) => Promise<AuthResponsePayload>;
+}): void;

package/dist/auth/mfa-crypto.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Envelope encryption for TOTP secrets using AES-256-GCM.
+ *
+ * - Derives a 32-byte key via SHA-256 from `MFA_ENCRYPTION_KEY` or `JWT_SECRET`.
+ * - Generates a random 12-byte IV per encryption call.
+ * - Returns ciphertexts in the format `iv_hex:authTag_hex:ciphertext_hex`.
+ *
+ * @module
+ */
+/**
+ * Encrypt a plaintext TOTP secret.
+ *
+ * @param plaintext - The Base32 TOTP secret to encrypt.
+ * @returns A string in the format `iv_hex:authTag_hex:ciphertext_hex`.
+ */
+export declare function encryptTotpSecret(plaintext: string): string;
+/**
+ * Decrypt a previously encrypted TOTP secret.
+ *
+ * @param ciphertext - A string in the format `iv_hex:authTag_hex:ciphertext_hex`.
+ * @returns The original Base32 TOTP secret.
+ */
+export declare function decryptTotpSecret(ciphertext: string): string;

package/dist/auth/mfa-routes.d.ts

@@ -0,0 +1,7 @@
+import { Hono } from "hono";
+import { z } from "zod";
+import { HonoEnv } from "../api/types";
+import type { AuthModuleConfig } from "./routes";
+import { resolveAuthHooks } from "./auth-hooks";
+import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
+export declare function mountMfaRoutes(router: Hono<HonoEnv>, config: AuthModuleConfig, ops: ReturnType<typeof resolveAuthHooks>, parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T, applyTransformHook?: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, userId: string) => Promise<AuthResponsePayload>): void;