Passwordless and token based authentication and authorization in Nodejs

Asking for a efficient and simplified authentication and authorization library in express Nodejs. The module must use OTP for authentication and JWT for authorization to be used by a client API. The sequence of use is as follow: 1) Via HTTPS POST express API, user send email to ask for OTP. 2) An email with a 6 digit OTP valid for the current day is sent to the email provided. 3) Via HTTPS POST user send email and the OTP to be authenticated 4) If no valid ,return HTTP no authorized status with an error message. If valid, a JWT is generated and returned to the user in the response. 5) User can call other API that requires authorization with the JWT Conditions: - JWT can be valid for 1 month. Additional, any authorized request should validate with a callback provided that returns true or false even if JWT is valid. A false of that callback inmediately invalidates the JWT. JWT subject field must contain email. - If DB if needed for storing the OTP , use Mongo. Recommended to use some algorithm that doesnt require storing, like using the current date for seed. - The "ask otp" could return "no authorized" because email doesnt exist. But the logic of checking if email existe will be provided in a callback that returns true or false. - if JWT is expired, return new JWT in a response field when doing any request. - When using Authenticate email and OTP, if successful, OTP is invalidated and a new JWT is generated - API function list: Ask OTP : Return OTP or no authorized send to the email Authenticate email and OTP: return new JWT or no authorized. Logout: Invalidate a JWT or no authorized. - Keep module dependencies to a minimum. - Well documented code. Provided a sample API call that requires to be authorized with a valid JWT