@supertokens-plugins/rownd-nodejs 0.3.0-beta.5 → 0.3.0-beta.7

package/dist/index.js

@@ -267,12 +267,13 @@ var require_supports_color = __commonJS({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  ANONYMOUS_AUTH_METHOD_ID: () => ANONYMOUS_AUTH_METHOD_ID,
   DEFAULT_ROWND_SCHEMA: () => DEFAULT_ROWND_SCHEMA,
   GUEST_AUTH_METHOD_ID: () => GUEST_AUTH_METHOD_ID,
   HANDLE_BASE_PATH: () => HANDLE_BASE_PATH,
   HUB_LOGIN_PAGE_PATH: () => HUB_LOGIN_PAGE_PATH,
   HUB_VERIFY_EMAIL_PAGE_PATH: () => HUB_VERIFY_EMAIL_PAGE_PATH,
+  INSTANT_AUTH_METHOD_ID: () => INSTANT_AUTH_METHOD_ID,
+  PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM: () => PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM,
   PLUGIN_ID: () => PLUGIN_ID,
   PLUGIN_SDK_VERSION: () => PLUGIN_SDK_VERSION,
   PLUGIN_VERSION: () => PLUGIN_VERSION,
@@ -280,6 +281,7 @@ __export(index_exports, {
   ROWND_JWT_CLAIMS: () => ROWND_JWT_CLAIMS,
   ROWND_PLUGIN_ERROR_MESSAGES: () => ROWND_PLUGIN_ERROR_MESSAGES,
   RowndPluginError: () => RowndPluginError,
+  createMagicLinkWithConfirmationBypass: () => createMagicLinkWithConfirmationBypass,
   default: () => index_default,
   getRowndClient: () => getRowndClient,
   init: () => init,
@@ -690,7 +692,7 @@ var PLUGIN_SDK_VERSION = ["23.0.0", "23.0.1", ">=23.0.1"];
 var HANDLE_BASE_PATH = "/plugin/rownd";
 var PUBLIC_TENANT_ID = "public";
 var GUEST_AUTH_METHOD_ID = "guest";
-var ANONYMOUS_AUTH_METHOD_ID = "anonymous";
+var INSTANT_AUTH_METHOD_ID = "instant";
 var ROWND_JWT_CLAIMS = {
   AppUserId: "https://auth.rownd.io/app_user_id",
   IsVerifiedUser: "https://auth.rownd.io/is_verified_user",
@@ -724,6 +726,7 @@ var DEFAULT_ROWND_SCHEMA = {
 };
 var HUB_LOGIN_PAGE_PATH = "/account/login";
 var HUB_VERIFY_EMAIL_PAGE_PATH = "/account/verify-email";
+var PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM = "bypassDeviceConfirmation";
 
 // src/logger.ts
 var { logDebugMessage, enableDebugLogs } = buildLogger(
@@ -966,6 +969,109 @@ function getStringList(value) {
 function getErrorMessage(error) {
   return error instanceof Error ? error.message : "Unknown error";
 }
+function getAppInfoString(value) {
+  return value.getAsStringDangerous();
+}
+function getWebsiteDomain(input) {
+  return getAppInfoString(input.stConfig.appInfo.getOrigin({
+    request: input.request,
+    userContext: input.userContext ?? {}
+  }));
+}
+function normalizeClientDomain(value) {
+  if (value.endsWith("://")) {
+    return value;
+  }
+  const parsed = new URL(value);
+  if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+    return parsed.origin;
+  }
+  return `${parsed.protocol}//${parsed.host}`;
+}
+function resolveClientDomain(input) {
+  if (!input.clientDomain) {
+    return input.websiteDomain;
+  }
+  const resolved = input.pluginConfig.clientDomains?.[input.clientDomain];
+  if (!resolved) {
+    throw new Error(`Unknown clientDomain key: ${input.clientDomain}`);
+  }
+  return resolved;
+}
+function resolveAllowedClientDomain(input) {
+  const websiteDomain = getWebsiteDomain(input);
+  const resolvedClientDomain = resolveClientDomain({
+    clientDomain: input.clientDomain,
+    pluginConfig: input.pluginConfig,
+    websiteDomain
+  });
+  const normalizedClientDomain = normalizeClientDomain(resolvedClientDomain);
+  const allowed = [
+    websiteDomain,
+    ...Object.values(input.pluginConfig.clientDomains ?? {})
+  ].map(normalizeClientDomain);
+  if (!allowed.includes(normalizedClientDomain)) {
+    throw new Error(`clientDomain is not allowed: ${resolvedClientDomain}`);
+  }
+  return normalizedClientDomain;
+}
+function normalizeRedirectToPathForClientDomain(redirectToPath, clientDomain) {
+  if (!redirectToPath) {
+    return void 0;
+  }
+  if (redirectToPath === "NATIVE_APP") {
+    return redirectToPath;
+  }
+  if (redirectToPath.startsWith("//")) {
+    throw new Error("redirectToPath cannot be schemaless");
+  }
+  const normalizedClientDomain = normalizeClientDomain(clientDomain);
+  const redirectUrl = new URL(
+    redirectToPath,
+    normalizedClientDomain.endsWith("://") ? "http://localhost" : normalizedClientDomain
+  );
+  const hasExplicitScheme = /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(redirectToPath);
+  if (hasExplicitScheme) {
+    if (redirectUrl.protocol !== "http:" && redirectUrl.protocol !== "https:") {
+      throw new Error("redirectToPath must be http(s) or relative");
+    }
+    if (redirectUrl.origin !== normalizedClientDomain) {
+      throw new Error("redirectToPath must match clientDomain");
+    }
+  }
+  return `${redirectUrl.pathname}${redirectUrl.search}${redirectUrl.hash}`;
+}
+function assertAllowedBypassRedirectPath(pluginConfig2, redirectToPath) {
+  if (!redirectToPath) {
+    throw new Error("redirectToPath is required for confirmation bypass magic links");
+  }
+  const allowedRedirectPaths = pluginConfig2.crossDeviceConfirmationBypass?.allowedRedirectPaths ?? [];
+  if (allowedRedirectPaths.length === 0) {
+    throw new Error("crossDeviceConfirmationBypass.allowedRedirectPaths must be configured");
+  }
+  if (!allowedRedirectPaths.includes(redirectToPath)) {
+    throw new Error(`redirectToPath is not allowed for confirmation bypass: ${redirectToPath}`);
+  }
+}
+function getMagicLinkBootstrapParams(input) {
+  return {
+    appKey: input.appKey,
+    apiDomain: input.apiDomain,
+    apiBasePath: input.apiBasePath,
+    ...input.appVariantId ? { appVariantId: input.appVariantId } : {},
+    ...input.displayContext ? { displayContext: input.displayContext } : {},
+    ...input.redirectToPath ? { redirectToPath: input.redirectToPath } : {},
+    ...input.clientDomainKey ? { clientDomain: input.clientDomainKey } : {}
+  };
+}
+function rewriteMagicLink(input) {
+  return rewriteLinkToBaseUrl(
+    input.magicLink,
+    HUB_LOGIN_PAGE_PATH,
+    input.clientDomain,
+    input.bootstrapParams
+  );
+}
 function getRequestedAppVariantIdFromRequest(req) {
   return req.getKeyValueFromQuery("app_variant_id");
 }
@@ -984,12 +1090,19 @@ function getRequestedRedirectToPathFromRequest(req) {
 
 // src/config.ts
 var pluginConfig;
+var superTokensConfig;
 function setPluginConfig(config2) {
   pluginConfig = config2;
 }
 function getPluginConfig() {
   return pluginConfig;
 }
+function setSuperTokensConfig(config2) {
+  superTokensConfig = config2;
+}
+function getSuperTokensConfig() {
+  return superTokensConfig;
+}
 function assertRowndAppVariantIsConfigured(appVariantId) {
   if (!appVariantId) {
     return;
@@ -1070,7 +1183,10 @@ function buildSignInMethodsConfig(methodsArray) {
     },
     apple: {
       enabled: !!appleMethod,
-      client_id: getStringMethodProperty(appleMethod, "clientId") ?? ""
+      client_id: getStringMethodProperty(appleMethod, "clientId") ?? "",
+      ...getStringMethodProperty(appleMethod, "webClientType") !== void 0 ? { web_client_type: getStringMethodProperty(appleMethod, "webClientType") } : {},
+      ...getStringMethodProperty(appleMethod, "iosClientType") !== void 0 ? { ios_client_type: getStringMethodProperty(appleMethod, "iosClientType") } : {},
+      ...getStringMethodProperty(appleMethod, "androidClientType") !== void 0 ? { android_client_type: getStringMethodProperty(appleMethod, "androidClientType") } : {}
     },
     anonymous: {
       enabled: !!anonymousMethod && anonymousType !== "instant",
@@ -1344,6 +1460,7 @@ function buildAuthMobileConfig(authMobile) {
 
 // src/rownd-compatibility.ts
 var import_supertokens_node = __toESM(require("supertokens-node"));
+var import_usermetadata2 = __toESM(require("supertokens-node/recipe/usermetadata"));
 var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
   "user_id",
   "email",
@@ -1408,7 +1525,7 @@ function mapRowndUserToSuperTokens(rowndUser) {
   }
   let authLevel = rowndUser.auth_level;
   if (loginMethods.length === 0) {
-    const thirdPartyId = authLevel === GUEST_AUTH_METHOD_ID ? GUEST_AUTH_METHOD_ID : ANONYMOUS_AUTH_METHOD_ID;
+    const thirdPartyId = authLevel === GUEST_AUTH_METHOD_ID ? GUEST_AUTH_METHOD_ID : INSTANT_AUTH_METHOD_ID;
     if (!authLevel) authLevel = thirdPartyId;
     loginMethods.push({
       recipeId: "thirdparty",
@@ -1480,11 +1597,10 @@ function getAnonymousId(userId, user, metadata) {
   if (typeof originalAnonymousId === "string") {
     return originalAnonymousId;
   }
-  const anonymousMethod = user?.loginMethods.find((loginMethod) => {
-    return loginMethod.recipeId === "thirdparty" && getThirdPartyId(loginMethod) === ANONYMOUS_AUTH_METHOD_ID;
+  const guestMethod = user?.loginMethods.find((loginMethod) => {
+    return loginMethod.recipeId === "thirdparty" && getThirdPartyId(loginMethod) === GUEST_AUTH_METHOD_ID;
   });
-  const thirdPartyUserId = anonymousMethod ? getThirdPartyUserId(anonymousMethod) : void 0;
-  return thirdPartyUserId || (hasAnonymousLoginMethod(user) ? `anon_${userId}` : void 0);
+  return guestMethod ? `anon_${user?.id || userId}` : void 0;
 }
 function buildRowndSessionClaimPayload(input) {
   const currentPayload = input.currentPayload ?? {};
@@ -1501,7 +1617,7 @@ function buildRowndSessionClaimPayload(input) {
     currentPayload,
     input.metadata
   );
-  const isAnonymous = currentPayload.is_anonymous === true || authLevel === GUEST_AUTH_METHOD_ID || authLevel === ANONYMOUS_AUTH_METHOD_ID;
+  const isAnonymous = currentPayload.is_anonymous === true || [GUEST_AUTH_METHOD_ID, INSTANT_AUTH_METHOD_ID].includes(authLevel);
   const anonymousId = getAnonymousId(input.userId, input.user, input.metadata);
   const isVerifiedUser = authLevel !== "unverified";
   const audience = buildRowndAudience(currentPayload, input.appVariantId);
@@ -1515,10 +1631,144 @@ function buildRowndSessionClaimPayload(input) {
     [ROWND_JWT_CLAIMS.AppUserId]: appUserId,
     [ROWND_JWT_CLAIMS.AuthLevel]: authLevel,
     [ROWND_JWT_CLAIMS.IsVerifiedUser]: isVerifiedUser,
-    [ROWND_JWT_CLAIMS.IsAnonymous]: isAnonymous,
+    ...isAnonymous ? { [ROWND_JWT_CLAIMS.IsAnonymous]: true } : {},
     ...anonymousId ? { anonymous_id: anonymousId } : {}
   };
 }
+function normalizeRowndOAuthScopes(scopes) {
+  return [...new Set(scopes.filter((scope) => scope.length > 0))];
+}
+function getRowndOAuthAudience(input) {
+  const requested = input.requestedResource ?? input.requestedAudience;
+  if (requested?.startsWith("app:")) {
+    return requested;
+  }
+  return void 0;
+}
+function applyRowndOAuthResourceParams(input) {
+  const resource = firstString(input.params.resource);
+  const audience = firstString(input.params.audience);
+  const rowndAudience = getRowndOAuthAudience({
+    requestedResource: resource,
+    requestedAudience: audience
+  });
+  if (!rowndAudience) {
+    return;
+  }
+  input.userContext.rowndOAuthAudience = rowndAudience;
+  input.params.audience = audience ?? rowndAudience;
+  delete input.params.resource;
+}
+async function buildRowndOAuthPayload(input) {
+  const currentPayload = input.currentPayload ?? {};
+  const standardClaims = input.user ? await buildStandardOAuthClaims(input.user, input.scopes) : {};
+  const rowndClaims = input.user ? await buildRowndOAuthSessionClaims(input.user, currentPayload) : {};
+  const audience = getRowndOAuthAudience({
+    requestedAudience: typeof input.userContext?.rowndOAuthAudience === "string" ? input.userContext.rowndOAuthAudience : void 0
+  });
+  return {
+    ...currentPayload,
+    ...standardClaims,
+    ...rowndClaims,
+    ...audience ? { aud: audience } : {}
+  };
+}
+async function buildRowndOAuthUserInfo(input) {
+  const standardClaims = await buildStandardOAuthClaims(
+    input.user,
+    input.scopes
+  );
+  const rowndClaims = pickOAuthUserInfoRowndClaims(input.accessTokenPayload);
+  return {
+    ...input.currentPayload,
+    ...standardClaims,
+    ...rowndClaims
+  };
+}
+async function buildStandardOAuthClaims(user, scopes) {
+  const claims = {};
+  const metadata = await getRowndMetadata(user.id);
+  const rowndData = isJsonRecord(metadata.original_rownd_user?.data) ? metadata.original_rownd_user.data : {};
+  const verifiedData = isJsonRecord(metadata.original_rownd_user?.verified_data) ? metadata.original_rownd_user.verified_data : {};
+  if (scopes.includes("email")) {
+    const email = firstString(rowndData.email) ?? user.emails[0];
+    if (email) {
+      claims.email = email;
+      claims.email_verified = isOAuthClaimVerified(
+        verifiedData.email,
+        email,
+        user.loginMethods.some(
+          (method) => method.hasSameEmailAs(email) && method.verified
+        )
+      );
+    }
+  }
+  if (scopes.includes("phone")) {
+    const phoneNumber = firstString(rowndData.phone_number) ?? user.phoneNumbers[0];
+    if (phoneNumber) {
+      claims.phone_number = phoneNumber;
+      claims.phone_number_verified = isOAuthClaimVerified(
+        verifiedData.phone_number,
+        phoneNumber,
+        user.loginMethods.some(
+          (method) => method.hasSamePhoneNumberAs(phoneNumber) && method.verified
+        )
+      );
+    }
+  }
+  if (scopes.includes("profile")) {
+    const givenName = firstString(rowndData.first_name);
+    const familyName = firstString(rowndData.last_name);
+    const name = [givenName, familyName].filter(Boolean).join(" ");
+    if (name) claims.name = name;
+    if (givenName) claims.given_name = givenName;
+    if (familyName) claims.family_name = familyName;
+    if (typeof metadata.original_rownd_user?.data?.updated_at === "string") {
+      claims.updated_at = metadata.original_rownd_user.data.updated_at;
+    }
+  }
+  return claims;
+}
+async function getRowndMetadata(userId) {
+  const metadata = await import_usermetadata2.default.getUserMetadata(userId);
+  return metadata.metadata || {};
+}
+function pickOAuthUserInfoRowndClaims(payload) {
+  const claims = {};
+  for (const key of [
+    "app_user_id",
+    "auth_level",
+    "is_verified_user",
+    "is_anonymous",
+    "anonymous_id",
+    "https://auth.rownd.io/app_user_id",
+    "https://auth.rownd.io/auth_level",
+    "https://auth.rownd.io/is_verified_user",
+    "https://auth.rownd.io/is_anonymous"
+  ]) {
+    if (payload[key] !== void 0) {
+      claims[key] = payload[key];
+    }
+  }
+  return claims;
+}
+function firstString(value) {
+  if (Array.isArray(value)) {
+    return value.find((entry) => typeof entry === "string");
+  }
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function isOAuthClaimVerified(value, expectedValue, fallback) {
+  return value === true || value === expectedValue || fallback;
+}
+async function buildRowndOAuthSessionClaims(user, currentPayload) {
+  return buildRowndSessionClaimPayload({
+    userId: user.id,
+    user,
+    metadata: await getRowndMetadata(user.id),
+    currentPayload
+  });
+}
 async function shouldLinkRowndAccounts(input) {
   const [newAccountInfo, , session] = input;
   if (!session) {
@@ -1561,23 +1811,26 @@ function getThirdPartyUserId(method) {
   return method.thirdParty?.userId;
 }
 function getGuestAuthLevel(user) {
-  const guestMethod = user?.loginMethods.find(isGuestLoginMethod);
-  return guestMethod ? GUEST_AUTH_METHOD_ID : void 0;
-}
-function hasAnonymousLoginMethod(user) {
-  return !!user?.loginMethods.some((loginMethod) => {
-    return loginMethod.recipeId === "thirdparty" && getThirdPartyId(loginMethod) === ANONYMOUS_AUTH_METHOD_ID;
+  const guestMethod = user?.loginMethods.find((method) => {
+    return method.recipeId === "thirdparty" && getThirdPartyId(method) === GUEST_AUTH_METHOD_ID;
   });
+  if (guestMethod) {
+    return GUEST_AUTH_METHOD_ID;
+  }
+  const instantMethod = user?.loginMethods.find((method) => {
+    return method.recipeId === "thirdparty" && getThirdPartyId(method) === INSTANT_AUTH_METHOD_ID;
+  });
+  return instantMethod ? INSTANT_AUTH_METHOD_ID : void 0;
 }
 function hasOnlyGuestLoginMethods(user) {
   return !!user?.loginMethods.length && user.loginMethods.every(isGuestLoginMethod);
 }
 function isGuestLoginMethod(method) {
   const thirdPartyId = getThirdPartyId(method);
-  return method.recipeId === "thirdparty" && (thirdPartyId === GUEST_AUTH_METHOD_ID || thirdPartyId === ANONYMOUS_AUTH_METHOD_ID);
+  return method.recipeId === "thirdparty" && (thirdPartyId === GUEST_AUTH_METHOD_ID || thirdPartyId === INSTANT_AUTH_METHOD_ID);
 }
 function isGuestAccountInfo(input) {
-  return input?.recipeId === "thirdparty" && (input.thirdParty?.id === GUEST_AUTH_METHOD_ID || input.thirdParty?.id === ANONYMOUS_AUTH_METHOD_ID);
+  return input?.recipeId === "thirdparty" && (input.thirdParty?.id === GUEST_AUTH_METHOD_ID || input.thirdParty?.id === INSTANT_AUTH_METHOD_ID);
 }
 function doesAccountInfoMatchAuthMethod(user, accountInfo) {
   if (!user) {
@@ -1617,8 +1870,8 @@ function hasVerifiedRealLoginMethod(user) {
   });
 }
 function getEffectiveAuthLevel(user, originalAuthLevel, verifiedData) {
-  if (originalAuthLevel === ANONYMOUS_AUTH_METHOD_ID) {
-    return ANONYMOUS_AUTH_METHOD_ID;
+  if (originalAuthLevel === INSTANT_AUTH_METHOD_ID) {
+    return INSTANT_AUTH_METHOD_ID;
   }
   if (hasVerifiedRealLoginMethod(user)) {
     return "verified";
@@ -1663,7 +1916,7 @@ var import_emailverification = __toESM(require("supertokens-node/recipe/emailver
 var import_passwordless = __toESM(require("supertokens-node/recipe/passwordless"));
 var import_session = __toESM(require("supertokens-node/recipe/session"));
 var import_claims = require("supertokens-node/recipe/session/claims");
-var import_usermetadata2 = __toESM(require("supertokens-node/recipe/usermetadata"));
+var import_usermetadata3 = __toESM(require("supertokens-node/recipe/usermetadata"));
 async function importUser(stUser, config2) {
   const headers = {
     "Content-Type": "application/json"
@@ -1702,7 +1955,7 @@ async function recordRowndAppVariantForUser(userId, appVariantId) {
   if (appVariants.includes(appVariantId)) {
     return;
   }
-  await import_usermetadata2.default.updateUserMetadata(userId, {
+  await import_usermetadata3.default.updateUserMetadata(userId, {
     ...metadata,
     original_rownd_user: {
       ...originalRowndUser,
@@ -1720,7 +1973,7 @@ var RowndIsAnonymousClaim = new import_claims.BooleanClaim({
   fetchValue: async (userId) => {
     const user = await import_supertokens_node2.default.getUser(userId);
     const effectiveAuthLevel = getEffectiveAuthLevel(user);
-    return effectiveAuthLevel === GUEST_AUTH_METHOD_ID;
+    return [GUEST_AUTH_METHOD_ID, INSTANT_AUTH_METHOD_ID].includes(effectiveAuthLevel);
   }
 });
 async function buildRowndSessionClaims(userId, currentPayload = {}, appVariantId) {
@@ -1734,8 +1987,78 @@ async function buildRowndSessionClaims(userId, currentPayload = {}, appVariantId
     appVariantId
   });
 }
+async function createMagicLinkWithConfirmationBypass(input) {
+  const hasEmail = typeof input.email === "string" && input.email.length > 0;
+  const hasPhoneNumber = typeof input.phoneNumber === "string" && input.phoneNumber.length > 0;
+  if (hasEmail === hasPhoneNumber) {
+    throw new Error("Exactly one of email or phoneNumber is required");
+  }
+  const stConfig = getSuperTokensConfig();
+  if (!stConfig) {
+    throw new Error("SuperTokens config is not initialized");
+  }
+  const pluginConfig2 = getPluginConfig();
+  if (!pluginConfig2) {
+    throw new Error("Rownd plugin config is not initialized");
+  }
+  const tenantId = input.tenantId ?? PUBLIC_TENANT_ID;
+  const appVariantId = input.appVariantId;
+  assertRowndAppVariantIsConfigured(appVariantId);
+  const clientDomain = resolveAllowedClientDomain({
+    clientDomain: input.clientDomain,
+    pluginConfig: pluginConfig2,
+    stConfig,
+    request: input.request,
+    userContext: input.userContext
+  });
+  const redirectToPath = normalizeRedirectToPathForClientDomain(input.redirectToPath, clientDomain);
+  assertAllowedBypassRedirectPath(pluginConfig2, redirectToPath);
+  const userContext = {
+    ...input.userContext ?? {},
+    ...input.displayContext ? { rowndDisplayContext: input.displayContext } : {},
+    rowndRedirectToPath: redirectToPath,
+    ...input.clientDomain ? { rowndClientDomain: input.clientDomain } : {},
+    ...appVariantId ? { rowndAppVariantId: appVariantId } : {}
+  };
+  const codeInfo = hasEmail ? await import_passwordless.default.createCode({
+    email: input.email,
+    tenantId,
+    session: input.session,
+    userContext
+  }) : await import_passwordless.default.createCode({
+    phoneNumber: input.phoneNumber,
+    tenantId,
+    session: input.session,
+    userContext
+  });
+  if (codeInfo.status !== "OK") {
+    throw new Error("Failed to create magic link");
+  }
+  const magicLink = `${getWebsiteDomain({
+    stConfig,
+    request: input.request,
+    userContext
+  })}${getAppInfoString(stConfig.appInfo.websiteBasePath)}/verify?preAuthSessionId=${encodeURIComponent(
+    codeInfo.preAuthSessionId
+  )}&tenantId=${encodeURIComponent(tenantId)}#${encodeURIComponent(codeInfo.linkCode)}`;
+  const rewrittenUrl = new URL(rewriteMagicLink({
+    magicLink,
+    clientDomain,
+    bootstrapParams: getMagicLinkBootstrapParams({
+      appKey: pluginConfig2.rowndAppKey,
+      apiDomain: getAppInfoString(stConfig.appInfo.apiDomain),
+      apiBasePath: getAppInfoString(stConfig.appInfo.apiBasePath),
+      appVariantId,
+      displayContext: input.displayContext,
+      redirectToPath,
+      clientDomainKey: input.clientDomain
+    })
+  }));
+  rewrittenUrl.searchParams.set(PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM, "true");
+  return rewrittenUrl.toString();
+}
 async function getUserMetadata(userId) {
-  const metadata = await import_usermetadata2.default.getUserMetadata(userId);
+  const metadata = await import_usermetadata3.default.getUserMetadata(userId);
   return metadata.metadata || {};
 }
 function getPendingVerifications(metadata) {
@@ -1892,7 +2215,7 @@ async function updateUserData(userId, inputData) {
     ...metadata,
     ...inputData
   };
-  await import_usermetadata2.default.updateUserMetadata(userId, updatedMetadata);
+  await import_usermetadata3.default.updateUserMetadata(userId, updatedMetadata);
   return getUserById(userId);
 }
 async function startPendingEmailVerification(input) {
@@ -1912,7 +2235,7 @@ async function startPendingEmailVerification(input) {
       );
     }
     if (pendingEmailVerifications.length > 0) {
-      await import_usermetadata2.default.updateUserMetadata(input.userId, {
+      await import_usermetadata3.default.updateUserMetadata(input.userId, {
         ...metadata,
         rownd_pending_verification: pendingVerifications.filter(
           (pendingVerification2) => pendingVerification2.field !== "email"
@@ -1935,7 +2258,7 @@ async function startPendingEmailVerification(input) {
     value: input.email,
     created_at: (/* @__PURE__ */ new Date()).toISOString()
   };
-  await import_usermetadata2.default.updateUserMetadata(input.userId, {
+  await import_usermetadata3.default.updateUserMetadata(input.userId, {
     ...metadata,
     rownd_pending_verification: [
       ...pendingVerifications.filter(
@@ -2056,7 +2379,7 @@ async function completePendingEmailVerification(input) {
       )
     )
   };
-  await import_usermetadata2.default.updateUserMetadata(metadataUserId, updatedMetadata);
+  await import_usermetadata3.default.updateUserMetadata(metadataUserId, updatedMetadata);
 }
 function isMatchingPendingEmailVerification(verification, email) {
   return verification.field === "email" && verification.value === email;
@@ -2067,7 +2390,7 @@ async function updateUserMetadata(userId, inputMeta) {
     ...metadata,
     ...inputMeta
   };
-  await import_usermetadata2.default.updateUserMetadata(userId, updatedMetadata);
+  await import_usermetadata3.default.updateUserMetadata(userId, updatedMetadata);
   return {
     id: userId,
     meta: Object.fromEntries(
@@ -2088,6 +2411,9 @@ var import_crypto = require("crypto");
 var import_supertokens_node3 = __toESM(require("supertokens-node"));
 var import_session2 = __toESM(require("supertokens-node/recipe/session"));
 var import_thirdparty = __toESM(require("supertokens-node/recipe/thirdparty"));
+function isBodyString(body, key) {
+  return isRecord(body) && typeof body[key] === "string" && body[key].length > 0;
+}
 function handleGetAppConfig(deps) {
   return async (req) => {
     const appVariantId = getRequestedAppVariantIdFromRequest(req);
@@ -2108,6 +2434,43 @@ function handleGetAppConfig(deps) {
     };
   };
 }
+function handleValidatePasswordlessConfirmationBypass(deps) {
+  return async (req) => {
+    try {
+      const body = await getJsonBody(req);
+      const clientDomain = isBodyString(body, "clientDomain") ? body.clientDomain : void 0;
+      const redirectToPath = isBodyString(body, "redirectToPath") ? body.redirectToPath : void 0;
+      const appVariantId = isBodyString(body, "appVariantId") ? body.appVariantId : void 0;
+      assertRowndAppVariantIsConfigured(appVariantId);
+      const resolvedClientDomain = resolveAllowedClientDomain({
+        clientDomain,
+        pluginConfig: deps.pluginConfig,
+        stConfig: deps.stConfig,
+        request: req
+      });
+      const normalizedRedirectToPath = normalizeRedirectToPathForClientDomain(
+        redirectToPath,
+        resolvedClientDomain
+      );
+      assertAllowedBypassRedirectPath(
+        deps.pluginConfig,
+        normalizedRedirectToPath
+      );
+      return {
+        status: "OK",
+        bypass: true
+      };
+    } catch (error) {
+      logDebugMessage(
+        `Passwordless confirmation bypass validation failed. Error: ${getErrorMessage(error)}`
+      );
+      return {
+        status: "ERROR",
+        bypass: false
+      };
+    }
+  };
+}
 function handleGuestLogin(deps) {
   return async (req, res, _session, userContext) => {
     const startedAt = Date.now();
@@ -2116,9 +2479,9 @@ function handleGuestLogin(deps) {
       const body = parseGuestBody(await getJsonBody(req));
       const appVariantId = getRequestedAppVariantIdFromRequest(req);
       assertRowndAppVariantIsConfigured(appVariantId);
-      const thirdPartyId = body.authLevel === ANONYMOUS_AUTH_METHOD_ID ? ANONYMOUS_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
-      const thirdPartyUserId = thirdPartyId === ANONYMOUS_AUTH_METHOD_ID ? `anon_${(0, import_crypto.randomUUID)()}` : guestId;
-      const authLevel = thirdPartyId === ANONYMOUS_AUTH_METHOD_ID ? ANONYMOUS_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
+      const thirdPartyId = body.authLevel === INSTANT_AUTH_METHOD_ID ? INSTANT_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
+      const thirdPartyUserId = thirdPartyId === INSTANT_AUTH_METHOD_ID ? `anon_${(0, import_crypto.randomUUID)()}` : guestId;
+      const authLevel = thirdPartyId === INSTANT_AUTH_METHOD_ID ? INSTANT_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
       const response = await import_thirdparty.default.manuallyCreateOrUpdateUser(
         PUBLIC_TENANT_ID,
         thirdPartyId,
@@ -2141,7 +2504,7 @@ function handleGuestLogin(deps) {
         {
           ...buildRowndAudience({}, appVariantId),
           auth_level: authLevel,
-          is_anonymous: true,
+          ...[GUEST_AUTH_METHOD_ID, INSTANT_AUTH_METHOD_ID].includes(authLevel) ? { is_anonymous: true } : {},
           app_user_id: response.user.id
         },
         {},
@@ -2505,6 +2868,7 @@ var init = createPluginInitFunction(
         }
       },
       routeHandlers(stConfig) {
+        setSuperTokensConfig(stConfig);
         const apiBasePath = stConfig.appInfo.apiBasePath.getAsStringDangerous();
         hubBootstrapParams = {
           apiDomain: stConfig.appInfo.apiDomain.getAsStringDangerous(),
@@ -2535,6 +2899,13 @@ var init = createPluginInitFunction(
               method: "post",
               handler: withRequestHandler(handleMigrate(routeHandlerDeps))
             },
+            {
+              path: `${apiBasePath}/plugin/passwordless-cross-device-confirmation/validate`,
+              method: "post",
+              handler: withRequestHandler(
+                handleValidatePasswordlessConfirmationBypass(routeHandlerDeps)
+              )
+            },
             {
               path: `${apiBasePath}/plugin/migrate-session`,
               method: "post",
@@ -2595,6 +2966,74 @@ var init = createPluginInitFunction(
         };
       },
       overrideMap: {
+        oauth2provider: {
+          recipeInitRequired: false,
+          functions: (originalImplementation) => ({
+            ...originalImplementation,
+            getRequestedScopes: async (input) => {
+              const scopes = await originalImplementation.getRequestedScopes(
+                input
+              );
+              return normalizeRowndOAuthScopes(scopes);
+            },
+            buildAccessTokenPayload: async (input) => {
+              const payload = await originalImplementation.buildAccessTokenPayload(
+                input
+              );
+              return buildRowndOAuthPayload({
+                user: input.user,
+                client: input.client,
+                scopes: input.scopes,
+                currentPayload: payload,
+                userContext: input.userContext
+              });
+            },
+            buildIdTokenPayload: async (input) => {
+              const payload = await originalImplementation.buildIdTokenPayload(
+                input
+              );
+              return buildRowndOAuthPayload({
+                user: input.user,
+                client: input.client,
+                scopes: input.scopes,
+                currentPayload: payload,
+                userContext: input.userContext
+              });
+            },
+            buildUserInfo: async (input) => {
+              const payload = await originalImplementation.buildUserInfo(input);
+              return buildRowndOAuthUserInfo({
+                user: input.user,
+                accessTokenPayload: input.accessTokenPayload,
+                scopes: input.scopes,
+                currentPayload: payload
+              });
+            }
+          }),
+          apis: (originalImplementation) => ({
+            ...originalImplementation,
+            authGET: async (input) => {
+              if (originalImplementation.authGET === void 0) {
+                throw new Error("OAuth2Provider authGET is unavailable");
+              }
+              applyRowndOAuthResourceParams({
+                params: input.params,
+                userContext: input.userContext
+              });
+              return originalImplementation.authGET(input);
+            },
+            tokenPOST: async (input) => {
+              if (originalImplementation.tokenPOST === void 0) {
+                throw new Error("OAuth2Provider tokenPOST is unavailable");
+              }
+              applyRowndOAuthResourceParams({
+                params: input.body,
+                userContext: input.userContext
+              });
+              return originalImplementation.tokenPOST(input);
+            }
+          })
+        },
         passwordless: {
           config: (config2) => {
             const originalEmailDeliveryOverride = config2.emailDelivery?.override;
@@ -2857,6 +3296,7 @@ var init = createPluginInitFunction(
       rowndAppSecret: config2.rowndAppSecret,
       enableDebugLogs: config2.enableDebugLogs,
       clientDomains: config2.clientDomains,
+      crossDeviceConfirmationBypass: config2.crossDeviceConfirmationBypass,
       telemetry: config2.telemetry,
       schema: config2.schema,
       appConfig: config2.appConfig,
@@ -2879,12 +3319,13 @@ function validateClientDomainUrl(key, value) {
 var index_default = { init };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  ANONYMOUS_AUTH_METHOD_ID,
   DEFAULT_ROWND_SCHEMA,
   GUEST_AUTH_METHOD_ID,
   HANDLE_BASE_PATH,
   HUB_LOGIN_PAGE_PATH,
   HUB_VERIFY_EMAIL_PAGE_PATH,
+  INSTANT_AUTH_METHOD_ID,
+  PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM,
   PLUGIN_ID,
   PLUGIN_SDK_VERSION,
   PLUGIN_VERSION,
@@ -2892,6 +3333,7 @@ var index_default = { init };
   ROWND_JWT_CLAIMS,
   ROWND_PLUGIN_ERROR_MESSAGES,
   RowndPluginError,
+  createMagicLinkWithConfirmationBypass,
   getRowndClient,
   init,
   setRowndClient