@atlasauth/cli 0.25.0 → 0.25.1

package/dist/migrate/export/supertokens-config.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchSupertokensConfig = fetchSupertokensConfig;
+exports.translateSupertokensConfig = translateSupertokensConfig;
+const supertokens_1 = require("./supertokens");
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function fetchSupertokensConfig(http, origin, appId) {
+    let tenants = [];
+    try {
+        tenants = await (0, supertokens_1.listTenants)(http, appId);
+    }
+    catch (err) {
+        if (!(err instanceof vendor_http_1.VendorApiError) || ![401, 403, 404, 501].includes(err.status))
+            throw err;
+    }
+    // A core without the multitenancy listing still has the public tenant's single-tenant view.
+    if (!tenants.length) {
+        try {
+            const { body } = await http.get(`${(0, supertokens_1.corePrefix)(appId, 'public')}/recipe/multitenancy/tenant?tenantId=public`);
+            if ((0, record_set_1.isObj)(body))
+                tenants = [body];
+        }
+        catch (err) {
+            if (!(err instanceof vendor_http_1.VendorApiError) || ![401, 403, 404, 501].includes(err.status))
+                throw err;
+        }
+    }
+    return { origin, appId, tenants };
+}
+const enabled = (v) => (0, record_set_1.isObj)(v) && v.enabled === true;
+const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : undefined);
+/** Core defaults when the tenant's config does not override them. */
+const DEFAULT_REFRESH_MINUTES = 144_000;
+function translateSupertokensConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const pub = snap.tenants.find((t) => (0, record_set_1.str)(t.tenantId) === 'public') ?? snap.tenants[0];
+    if (!pub) {
+        b.add('manual', 'core', 'tenant list', 'The core did not return its tenants (check the API key): nothing to translate. Your recipes live in supertokens.init in your backend; list them by hand.');
+    }
+    else {
+        const first = (0, record_set_1.strs)(pub.firstFactors);
+        const hasFirst = (...f) => f.some((x) => first.includes(x));
+        // firstFactors is absent on older cores: fall back to the recipes' enabled flags.
+        const legacy = first.length === 0;
+        // ── recipes and first factors ──
+        if (enabled(pub.emailPassword) && (legacy || hasFirst('emailpassword'))) {
+            b.set('strategies.password', true);
+            b.add('differs', 'recipes emailpassword', 'emailPassword.enabled', 'Password sign-in. The core API never returns password hashes: export from the core database (bcrypt and Argon2 verify as they are) or use the supertokens lazy-migration preset.', 'auth_config.strategies.password');
+        }
+        if (enabled(pub.passwordless)) {
+            if (legacy || hasFirst('otp-email')) {
+                b.set('strategies.emailCode', true);
+                b.add('mapped', 'recipes passwordless', 'firstFactors otp-email', 'Email one-time codes.', 'auth_config.strategies.emailCode');
+            }
+            if (legacy || hasFirst('link-email')) {
+                b.set('strategies.emailLink', true);
+                b.add('mapped', 'recipes passwordless', 'firstFactors link-email', 'Email magic links.', 'auth_config.strategies.emailLink');
+            }
+            if (legacy || hasFirst('otp-phone')) {
+                b.set('strategies.phoneCode', true);
+                b.add('mapped', 'recipes passwordless', 'firstFactors otp-phone', 'SMS codes (bring your own SMS provider).', 'auth_config.strategies.phoneCode');
+            }
+            if (hasFirst('link-phone'))
+                b.add('differs', 'recipes passwordless', 'firstFactors link-phone', 'SMS magic links have no Atlas counterpart: use SMS codes.', 'auth_config.strategies.phoneCode');
+        }
+        // ── third-party providers ──
+        const providers = (0, record_set_1.isObj)(pub.thirdParty) ? (0, record_set_1.objs)(pub.thirdParty.providers) : [];
+        if (enabled(pub.thirdParty) || providers.length) {
+            for (const p of providers) {
+                const id = (0, record_set_1.str)(p.thirdPartyId) ?? '';
+                const name = (0, record_set_1.str)(p.name) ?? id;
+                const clients = (0, record_set_1.objs)(p.clients);
+                const client = clients[0];
+                const key = (0, translate_kit_1.socialKey)(id);
+                if (!key) {
+                    b.add('manual', 'recipes thirdparty', `${name} (${id})`, 'No built-in Atlas provider: add it as a custom OAuth provider (or an SSO connection for SAML via Boxy).', 'custom_oauth_providers');
+                    continue;
+                }
+                b.socialProvider({ atlasKey: key, vendorName: name, area: 'recipes thirdparty', setting: `${name} (${id})`, clientId: (0, record_set_1.str)(client?.clientId), scopes: (0, record_set_1.strs)(client?.scope) });
+                if (clients.length > 1)
+                    b.add('differs', 'recipes thirdparty', `${name} clients`, `${clients.length} OAuth clients (web, mobile…): Atlas keeps one per provider; add the others as native-app credentials.`, `oauth_providers ${key}`);
+            }
+        }
+        // ── multi-factor ──
+        const second = (0, record_set_1.strs)(pub.requiredSecondaryFactors);
+        if (second.includes('totp')) {
+            b.set('mfa.factors.totp', true);
+            b.add('mapped', 'recipes multifactorauth', 'requiredSecondaryFactors totp', 'Authenticator apps; verified TOTP devices move with a database export.', 'auth_config.mfa.factors.totp');
+        }
+        for (const f of second.filter((x) => x !== 'totp')) {
+            const channel = f === 'otp-email' ? 'emailCode' : null;
+            if (channel) {
+                b.set('mfa.factors.emailCode', true);
+                b.add('mapped', 'recipes multifactorauth', `requiredSecondaryFactors ${f}`, 'Email code as a second factor.', 'auth_config.mfa.factors.emailCode');
+            }
+            else {
+                b.add('differs', 'recipes multifactorauth', `requiredSecondaryFactors ${f}`, 'Atlas recommends authenticator apps or passkeys as the second factor; enable the factors you want in auth_config.mfa.', 'auth_config.mfa');
+            }
+        }
+        if (second.length) {
+            b.set('mfaPolicy', 'required');
+            b.add('differs', 'recipes multifactorauth', 'requiredSecondaryFactors', 'A second factor on every sign-in. If your backend decides per user (the MFA recipe\'s getMFARequirementsForAuth override), set the policy to optional and use step-up for the sensitive routes.', 'auth_config.mfaPolicy');
+        }
+        else if ((0, record_set_1.strs)(pub.firstFactors).length) {
+            b.add('manual', 'recipes multifactorauth', 'getMFARequirementsForAuth override', 'MFA requirements set in code (supertokens.init) are not visible to the core: port them to the Atlas MFA policy or step-up rules.', 'auth_config.mfaPolicy');
+        }
+        // ── core configuration ──
+        const core = (0, record_set_1.isObj)(pub.coreConfig) ? pub.coreConfig : {};
+        const refresh = num(core.refresh_token_validity) ?? DEFAULT_REFRESH_MINUTES;
+        b.set('session.absoluteMs', (0, translate_kit_1.clampSessionMs)(refresh * 60_000));
+        b.add('mapped', 'core config', 'refresh_token_validity', `${refresh} minutes (the session lives as long as its refresh token); Atlas caps a session at 90 days.`, 'auth_config.session.absoluteMs');
+        const access = num(core.access_token_validity);
+        if (access !== undefined)
+            b.add('differs', 'core config', 'access_token_validity', `SuperTokens access tokens lived ${access}s. Atlas session tokens are short-lived and refreshed by its SDKs (auth_config.session.jwtTtlSeconds).`, 'auth_config.session.jwtTtlSeconds');
+        const codeLife = num(core.passwordless_code_lifetime);
+        if (codeLife !== undefined) {
+            const minutes = Math.max(1, Math.round(codeLife / 60_000));
+            b.set('verification.emailCode.ttlMinutes', minutes);
+            b.add('mapped', 'core config', 'passwordless_code_lifetime', `Codes live ${minutes} minute(s).`, 'auth_config.verification.emailCode.ttlMinutes');
+        }
+        const attempts = num(core.passwordless_max_code_input_attempts);
+        if (attempts !== undefined) {
+            b.set('verification.emailCode.maxAttempts', attempts);
+            b.add('mapped', 'core config', 'passwordless_max_code_input_attempts', `${attempts} attempts per code.`, 'auth_config.verification.emailCode.maxAttempts');
+        }
+        for (const k of ['password_reset_token_lifetime', 'email_verification_token_lifetime']) {
+            if (num(core[k]) !== undefined)
+                b.add('differs', 'core config', k, 'Atlas link and code lifetimes are instance settings; review auth_config.verification.', 'auth_config.verification');
+        }
+        if (core.totp_max_attempts !== undefined || core.totp_rate_limit_cooldown_sec !== undefined) {
+            b.add('differs', 'core config', 'totp_max_attempts / totp_rate_limit_cooldown_sec', 'Atlas throttles failed second-factor attempts per account and IP.', 'auth_config.rateLimit');
+        }
+        // ── other tenants ──
+        const others = snap.tenants.filter((t) => t !== pub);
+        for (const t of others) {
+            b.add('differs', `tenants ${(0, record_set_1.str)(t.tenantId) ?? '?'}`, 'tenant', 'A tenant becomes an organization with the data export; its own enabled recipes and providers are not translated: configure per-organization SSO connections for them.', 'organizations');
+        }
+    }
+    // ── what the core never sees ──
+    b.add('manual', 'backend config', 'supertokens.init override functions', 'Recipe overrides (custom sign-up rules, claims, email and SMS delivery) live in your backend: port sign-up rules to Atlas actions, claims to a JWT template, and delivery to your own email / SMS provider.', 'actions');
+    b.add('manual', 'backend config', 'EmailVerification mode (REQUIRED / OPTIONAL)', 'The mode is set in supertokens.init, not in the core: set auth_config.requireEmailVerification to match it.', 'auth_config.requireEmailVerification');
+    b.add('manual', 'backend config', 'appInfo (apiDomain, websiteDomain, cookieDomain)', 'Add your website origin to the instance allowed origins; set the cross-subdomain cookie setting if you used cookieDomain.', 'instance.allowed_origins');
+    // The bridge needs the app's API domain (apiDomain), not the core's address: the plugin asks for it.
+    return b.result(`SuperTokens core ${snap.origin} (app ${snap.appId})`, {
+        lazy: { preset: 'supertokens', config: { base_url: snap.origin } },
+    });
+}
+//# sourceMappingURL=supertokens-config.js.map

package/dist/migrate/export/supertokens-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supertokens-config.js","sourceRoot":"","sources":["../../../src/migrate/export/supertokens-config.ts"],"names":[],"mappings":";;AAsBA,wDAiBC;AAQD,gEAgHC;AA9JD,+CAAwD;AACxD,6CAAgE;AAChE,mDAA2E;AAC3E,+CAAgE;AAkBzD,KAAK,UAAU,sBAAsB,CAAC,IAAgB,EAAE,MAAc,EAAE,KAAa;IAC1F,IAAI,OAAO,GAAU,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAA,yBAAW,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,GAAG,CAAC;IAChG,CAAC;IACD,4FAA4F;IAC5F,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAM,GAAG,IAAA,wBAAU,EAAC,KAAK,EAAE,QAAQ,CAAC,6CAA6C,CAAC,CAAC;YAClH,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,GAAG,CAAC;QAChG,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;AACxE,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAE9G,qEAAqE;AACrE,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAExC,SAAgB,0BAA0B,CAAC,IAA+B;IACxE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,0JAA0J,CAAC,CAAC;IACrM,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,kFAAkF;QAClF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QAElC,kCAAkC;QAClC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACxE,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,kLAAkL,EAAE,iCAAiC,CAAC,CAAC;QAC5R,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,IAAI,MAAM,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;gBACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,kCAAkC,CAAC,CAAC;YACjI,CAAC;YACD,IAAI,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;gBACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;YAC/H,CAAC;YACD,IAAI,MAAM,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;gBACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,0CAA0C,EAAE,kCAAkC,CAAC,CAAC;YACpJ,CAAC;YACD,IAAI,QAAQ,CAAC,YAAY,CAAC;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,2DAA2D,EAAE,kCAAkC,CAAC,CAAC;QACnM,CAAC;QAED,8BAA8B;QAC9B,MAAM,SAAS,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YAChD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAA,yBAAS,EAAC,EAAE,CAAC,CAAC;gBAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,EAAE,GAAG,EAAE,yGAAyG,EAAE,wBAAwB,CAAC,CAAC;oBAC9L,SAAS;gBACX,CAAC;gBACD,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC5K,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,EAAE,GAAG,IAAI,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,wGAAwG,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;YACzO,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,wEAAwE,EAAE,8BAA8B,CAAC,CAAC;QACxL,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,IAAI,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;gBACrC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,4BAA4B,CAAC,EAAE,EAAE,gCAAgC,EAAE,mCAAmC,CAAC,CAAC;YACrJ,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,yBAAyB,EAAE,4BAA4B,CAAC,EAAE,EAAE,uHAAuH,EAAE,iBAAiB,CAAC,CAAC;YAC3N,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC/B,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,iMAAiM,EAAE,uBAAuB,CAAC,CAAC;QACtS,CAAC;aAAM,IAAI,IAAA,iBAAI,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YACzC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,oCAAoC,EAAE,kIAAkI,EAAE,uBAAuB,CAAC,CAAC;QAChP,CAAC;QAED,2BAA2B;QAC3B,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,uBAAuB,CAAC;QAC5E,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAA,8BAAc,EAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,wBAAwB,EAAE,GAAG,OAAO,6FAA6F,EAAE,gCAAgC,CAAC,CAAC;QACpM,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,uBAAuB,EAAE,mCAAmC,MAAM,wGAAwG,EAAE,mCAAmC,CAAC,CAAC;QAC3Q,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,GAAG,CAAC,mCAAmC,EAAE,OAAO,CAAC,CAAC;YACpD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,4BAA4B,EAAE,cAAc,OAAO,aAAa,EAAE,+CAA+C,CAAC,CAAC;QACpJ,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,CAAC,CAAC,GAAG,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC;YACtD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,sCAAsC,EAAE,GAAG,QAAQ,qBAAqB,EAAE,gDAAgD,CAAC,CAAC;QAC7J,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,mCAAmC,CAAC,EAAE,CAAC;YACvF,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,EAAE,uFAAuF,EAAE,0BAA0B,CAAC,CAAC;QAC1L,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,IAAI,IAAI,CAAC,4BAA4B,KAAK,SAAS,EAAE,CAAC;YAC5F,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,kDAAkD,EAAE,mEAAmE,EAAE,uBAAuB,CAAC,CAAC;QACpL,CAAC;QACD,sBAAsB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,uKAAuK,EAAE,eAAe,CAAC,CAAC;QAC5P,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,qCAAqC,EAAE,6MAA6M,EAAE,SAAS,CAAC,CAAC;IACnS,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,8CAA8C,EAAE,6GAA6G,EAAE,sCAAsC,CAAC,CAAC;IACzO,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,kDAAkD,EAAE,2HAA2H,EAAE,0BAA0B,CAAC,CAAC;IAE/O,qGAAqG;IACrG,OAAO,CAAC,CAAC,MAAM,CAAC,oBAAoB,IAAI,CAAC,MAAM,SAAS,IAAI,CAAC,KAAK,GAAG,EAAE;QACrE,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;KACnE,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/supertokens.d.ts

@@ -0,0 +1,125 @@
+import type { PasswordHash, Timestamp } from '@atlasauth/migrate';
+import { type Tables } from './frameworks/tables';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate export supertokens` — a SuperTokens core (self-hosted, or the
+ * managed service) onto the canonical bundle models. Two ways in:
+ *
+ *   - a DATABASE DUMP of the core (one file per table, made with
+ *     `psql \copy … csv header`, see the guide): everything the core keeps —
+ *     password hashes (bcrypt, Argon2), TOTP device secrets, email verification
+ *     state, user metadata, roles, tenants, user id mappings;
+ *   - the core's HTTP API with its API key (`GET /users`, `/recipe/user/…`,
+ *     `/recipe/roles`, `/recipe/multitenancy/tenant/list`): users, linked
+ *     login methods, verified flags, metadata, roles and tenants. The API never
+ *     returns password hashes or TOTP secrets: those users move by lazy
+ *     migration / enrol again.
+ *
+ * What maps where:
+ *   - users: one Atlas user per SuperTokens PRIMARY user (account linking
+ *     folds emailpassword, thirdparty and passwordless login methods into one);
+ *     the id is the id the app sees (`userid_mapping` external id when set), the
+ *     `sub` of every access token;
+ *   - emails (verified from `emailverification_verified_emails`; passwordless
+ *     addresses and phone numbers are verified by the sign-in itself);
+ *   - passwords: bcrypt and Argon2 PHC strings as they are; anything else is
+ *     counted and left for lazy migration;
+ *   - third-party links as identities (`thirdparty_users`);
+ *   - roles (app roles with their permissions; roles a user holds on the
+ *     public tenant) and tenants (every non-public tenant becomes an
+ *     organization, its users members, roles held there their organization role);
+ *   - verified TOTP devices as authenticator-app factors;
+ *   - user metadata as private metadata (names carried over when present).
+ */
+export interface SupertokensExportOptions {
+    /** A dump of the core database (one table per file). */
+    tables?: Tables;
+    /** The core's address (`https://st-dev-abc.aws.supertokens.io`, `http://core:3567`). */
+    connectionUri?: string;
+    /** The core's API key (`api-key` header). */
+    apiKey?: string;
+    /** The SuperTokens app id (multi-app cores); `public` by default. */
+    appId?: string;
+    /** The `table_names_prefix` the core runs with, when it has one. */
+    tablePrefix?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+/** One way of signing in as seen by the core (a recipe user). */
+export interface LoginMethod {
+    recipeUserId: string;
+    recipeId: string;
+    email?: string;
+    phone?: string;
+    thirdParty?: {
+        id: string;
+        userId: string;
+    };
+    passwordHash?: string;
+    verified: boolean;
+    timeJoined?: Timestamp;
+    tenantIds: string[];
+}
+/** A primary user and the login methods linked to it. */
+export interface StUser {
+    /** The primary user id (before any `userid_mapping`). */
+    id: string;
+    loginMethods: LoginMethod[];
+    timeJoined?: Timestamp;
+}
+export interface TotpDevice {
+    name?: string;
+    secret?: string;
+    period?: number;
+    verified: boolean;
+}
+export interface SupertokensSnapshot {
+    source: 'database' | 'api';
+    users: StUser[];
+    /** User id → metadata object. */
+    metadata: Map<string, Obj>;
+    /** Role → permissions. */
+    roles: Map<string, string[]>;
+    userRoles: Array<{
+        userId: string;
+        tenantId: string;
+        role: string;
+    }>;
+    /** Tenant ids other than `public`. */
+    tenants: string[];
+    /** User id → TOTP devices (a database dump; the API carries no secrets). */
+    totp: Map<string, TotpDevice[]>;
+    /** User id → last active time (epoch ms). */
+    lastActive: Map<string, number>;
+    /** SuperTokens user id → the external id the app uses. */
+    idMappings: Map<string, string>;
+    warnings: string[];
+}
+export declare function exportSupertokens(opts: SupertokensExportOptions): Promise<RecordSet>;
+/** `st-dev-x.aws.supertokens.io` → `https://st-dev-x.aws.supertokens.io`; an http address is kept (a core inside your network). */
+export declare function normalizeCoreUri(raw: string): string;
+export declare function snapshotFromTables(tables: Tables, appId: string, prefix?: string): SupertokensSnapshot;
+/** A core client: the API key header, the app and tenant path prefixes. */
+export declare function supertokensHttp(o: {
+    connectionUri: string;
+    apiKey?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+}): VendorHttp;
+/** `/appid-<app>/<tenant>` path prefix of an app and tenant on the core (public → none). */
+export declare function corePrefix(appId: string, tenantId: string): string;
+/** The tenants of an app, from the multitenancy recipe (older cores answer on the v1 path). */
+export declare function listTenants(http: VendorHttp, appId: string): Promise<Obj[]>;
+export declare function fetchSupertokensSnapshot(o: SupertokensExportOptions & {
+    connectionUri: string;
+    appId: string;
+    onProgress: (m: string) => void;
+}): Promise<SupertokensSnapshot>;
+/** A SuperTokens `password_hash` → the bundle's password; null for a shape Atlas cannot verify. */
+export declare function mapSupertokensPassword(hash: unknown): PasswordHash | null;
+export declare function buildSupertokensRecordSet(snap: SupertokensSnapshot, o: {
+    origin: string;
+    appId: string;
+}): RecordSet;