type AuthAccessCallback = (error: string | null, access: boolean) => void;

interface IPluginAuth<T> extends IPlugin<T> {
  authenticate(user: string, password: string, cb: AuthCallback): void;
  adduser?(user: string, password: string, cb: AuthCallback): void;
  changePassword?(user: string, password: string, newPassword: string, cb: AuthCallback): void;
  allow_publish?(user: RemoteUser, pkg: T & PackageAccess, cb: AuthAccessCallback): void;
  allow_access?(user: RemoteUser, pkg: T & PackageAccess, cb: AuthAccessCallback): void;
  allow_unpublish?(user: RemoteUser, pkg: T & PackageAccess, cb: AuthAccessCallback): void;
  allow_publish?(user: RemoteUser, pkg: AllowAccess & PackageAccess, cb: AuthAccessCallback): void;
  allow_access?(user: RemoteUser, pkg: AllowAccess & PackageAccess, cb: AuthAccessCallback): void;
  allow_unpublish?(user: RemoteUser, pkg: AllowAccess & PackageAccess, cb: AuthAccessCallback): void;
  apiJWTmiddleware?(helpers: any): Function;
}

public authenticate(username: string, password: string, cb: AuthCallback): void {

  // fetch the user and set validPassword

  return validPassword ? cb(null, fetchedUser.groups) : cb('user not found', false);
}