@supertokens-plugins/rownd-nodejs 0.3.0-beta.6 → 0.3.0-beta.7

package/README.md

@@ -80,6 +80,62 @@ RowndMigrationPlugin.init({
 });
 ```
 
+### Passwordless Confirmation Bypass
+
+Use `createMagicLinkWithConfirmationBypass` when your backend needs to create a passwordless magic link that can be opened on a different device without showing the SuperTokens cross-device confirmation prompt.
+This is intended for trusted server-side flows only.
+
+First, configure the exact post-login paths that may use the bypass:
+
+```typescript
+const rowndPluginConfig = {
+  rowndAppKey: process.env.ROWND_APP_KEY,
+  rowndAppSecret: process.env.ROWND_APP_SECRET,
+  clientDomains: {
+    browser: "https://app.example.com",
+  },
+  crossDeviceConfirmationBypass: {
+    allowedRedirectPaths: ["/profile", "/settings/security"],
+  },
+};
+
+const superTokensConfig = {
+  // your app info and recipe list
+  experimental: {
+    plugins: [RowndMigrationPlugin.init(rowndPluginConfig)],
+  },
+};
+
+SuperTokens.init(superTokensConfig);
+```
+
+Then call the helper from your backend:
+
+```typescript
+import { createMagicLinkWithConfirmationBypass } from "@supertokens-plugins/rownd-nodejs";
+
+const magicLink = await createMagicLinkWithConfirmationBypass({
+  email: "user@example.com",
+  clientDomain: "browser",
+  redirectToPath: "/profile",
+  displayContext: "browser",
+});
+```
+
+`redirectToPath` is required and must match `crossDeviceConfirmationBypass.allowedRedirectPaths` exactly after normalization. Absolute URLs are accepted only when their origin matches the resolved `clientDomain`; they are normalized back to a relative path before being added to the magic link.
+
+`clientDomain` must be a configured `clientDomains` key, not a raw domain. Omit it to use the SuperTokens website domain.
+
+Pass exactly one of `email` or `phoneNumber`. The helper returns the rewritten magic link with `bypassDeviceConfirmation=true`.
+
+Before skipping the cross-device confirmation prompt, the frontend should validate the callback against the plugin:
+
+- **POST** `/plugin/passwordless-cross-device-confirmation/validate`
+- **Body**: `{ "clientDomain": "browser", "redirectToPath": "/profile", "appVariantId": "optional_variant" }`
+- **Success response**: `{ "status": "OK", "bypass": true }`
+
+If validation fails, the frontend should show the normal cross-device confirmation prompt.
+
 ## API Endpoint
 
 The plugin exposes a single endpoint:
@@ -91,8 +147,8 @@ The plugin exposes a single endpoint:
 ### Migrate
 
 - **POST** `/plugin/rownd/migrate`
-- **Headers**: `Authorization: Bearer <Rownd_JWT>`
-- **Description**: Validates the Rownd JWT, ensures the user is migrated to SuperTokens in the `public` tenant, syncs Rownd user data to SuperTokens UserMetadata, and then creates a new SuperTokens session for that user.
+- **Headers**: `Authorization: Bearer <Rownd_JWT>`. Header-token clients should also send `rid: session`, `fdi-version: 1.18`, and `st-auth-mode: header`.
+- **Description**: Validates the Rownd JWT, ensures the user is migrated to SuperTokens in the `public` tenant, syncs Rownd user data to SuperTokens UserMetadata, and then creates a new SuperTokens session for that user. Header-token clients must receive `st-access-token`, `st-refresh-token`, and `front-token` response headers.
 
 ## Debug Logging
 

package/dist/bulkMigrate.js

@@ -41,6 +41,7 @@ var import_zod2 = require("zod");
 
 // src/rownd-compatibility.ts
 var import_supertokens_node = __toESM(require("supertokens-node"));
+var import_usermetadata = __toESM(require("supertokens-node/recipe/usermetadata"));
 
 // src/constants.ts
 var GUEST_AUTH_METHOD_ID = "guest";

package/dist/generateAppConfig.js

@@ -349,7 +349,10 @@ function convertRowndConfigToPluginConfig(rowndApp, creds) {
         } else if (key === "apple") {
           result.push({
             method: "apple",
-            clientId: value.client_id
+            clientId: value.client_id,
+            webClientType: value.web_client_type,
+            iosClientType: value.ios_client_type,
+            androidClientType: value.android_client_type
           });
           instructions.push(
             `Apple sign-in was enabled. Please ensure you configure the "apple" provider in your SuperTokens ThirdParty recipe. You will need to manually provide the Apple 'clientSecret' (or private key) as Rownd cannot export it.`

package/dist/index.d.mts

@@ -1,5 +1,6 @@
-import * as supertokens_node from 'supertokens-node';
+import * as SuperTokens from 'supertokens-node';
 import { JSONObject, SuperTokensPlugin } from 'supertokens-node/types';
+import { SessionContainerInterface } from 'supertokens-node/recipe/session/types';
 
 type RowndSignInMethod = {
     /**
@@ -24,6 +25,18 @@ type RowndSignInMethod = {
      * @default ""
      */
     clientId?: string;
+    /**
+     * SuperTokens provider clientType used for browser Apple redirect flows.
+     */
+    webClientType?: string;
+    /**
+     * SuperTokens provider clientType used for native iOS Apple auth code exchange.
+     */
+    iosClientType?: string;
+    /**
+     * SuperTokens provider clientType used for native Android Apple auth code exchange.
+     */
+    androidClientType?: string;
 } | {
     /**
      * Enables Sign in with Google.
@@ -661,6 +674,9 @@ interface RowndPluginConfig {
     rowndAppSecret: string;
     enableDebugLogs?: boolean;
     clientDomains?: RowndClientDomains;
+    crossDeviceConfirmationBypass?: {
+        allowedRedirectPaths: string[];
+    };
     telemetry?: RowndTelemetryConfig;
     schema?: RowndSchema;
     appConfig?: RowndAppConfigInput;
@@ -742,6 +758,9 @@ interface RowndPluginNormalisedConfig {
     rowndAppSecret: string;
     enableDebugLogs?: boolean;
     clientDomains?: RowndClientDomains;
+    crossDeviceConfirmationBypass?: {
+        allowedRedirectPaths: string[];
+    };
     telemetry?: RowndTelemetryConfig;
     schema?: RowndSchema;
     appConfig?: RowndAppConfigInput;
@@ -814,6 +833,7 @@ declare const ROWND_JWT_CLAIMS: {
 declare const DEFAULT_ROWND_SCHEMA: RowndSchema;
 declare const HUB_LOGIN_PAGE_PATH = "/account/login";
 declare const HUB_VERIFY_EMAIL_PAGE_PATH = "/account/verify-email";
+declare const PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM = "bypassDeviceConfirmation";
 
 declare const ROWND_PLUGIN_ERROR_MESSAGES: {
     readonly MISSING_AUTHORIZATION_HEADER: "Missing authorization header";
@@ -825,11 +845,26 @@ declare class RowndPluginError extends Error {
     constructor(type: RowndPluginErrorType);
 }
 
+type BypassDisplayContext = "browser" | "mobile_app" | "customer_web_view";
+type CreateMagicLinkWithConfirmationBypassInput = {
+    email?: string;
+    phoneNumber?: string;
+    tenantId?: string;
+    request?: any;
+    session?: SessionContainerInterface;
+    userContext?: Record<string, any>;
+    redirectToPath?: string;
+    clientDomain?: string;
+    displayContext?: BypassDisplayContext;
+    appVariantId?: string;
+};
+declare function createMagicLinkWithConfirmationBypass(input: CreateMagicLinkWithConfirmationBypassInput): Promise<string>;
+
 declare function setRowndClient(client: IRowndClient): void;
 declare function getRowndClient(): IRowndClient;
 
 declare const _default: {
-    init: (config: RowndPluginConfig) => supertokens_node.SuperTokensPlugin;
+    init: (config: RowndPluginConfig) => SuperTokens.SuperTokensPlugin;
 };
 
-export { DEFAULT_ROWND_SCHEMA, GUEST_AUTH_METHOD_ID, HANDLE_BASE_PATH, HUB_LOGIN_PAGE_PATH, HUB_VERIFY_EMAIL_PAGE_PATH, INSTANT_AUTH_METHOD_ID, type IRowndClient, type MigrationResponse, PLUGIN_ID, PLUGIN_SDK_VERSION, PLUGIN_VERSION, PUBLIC_TENANT_ID, ROWND_JWT_CLAIMS, ROWND_PLUGIN_ERROR_MESSAGES, type RowndAppConfigInput, type RowndAuthConfig, type RowndBranding, type RowndClientDomains, type RowndCustomContent, type RowndLegal, type RowndPluginConfig, RowndPluginError, type RowndPluginErrorType, type RowndPluginNormalisedConfig, type RowndProfileConfig, type RowndSchema, type RowndSchemaField, type RowndSignInMethod, type RowndSubBrandConfigInput, type RowndTelemetryClient, type RowndTelemetryConfig, type RowndTelemetryEvent, type RowndUser, type RowndUserMetadata, type SuperTokensUserImport, _default as default, getRowndClient, init, setRowndClient };
+export { type CreateMagicLinkWithConfirmationBypassInput, DEFAULT_ROWND_SCHEMA, GUEST_AUTH_METHOD_ID, HANDLE_BASE_PATH, HUB_LOGIN_PAGE_PATH, HUB_VERIFY_EMAIL_PAGE_PATH, INSTANT_AUTH_METHOD_ID, type IRowndClient, type MigrationResponse, PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM, PLUGIN_ID, PLUGIN_SDK_VERSION, PLUGIN_VERSION, PUBLIC_TENANT_ID, ROWND_JWT_CLAIMS, ROWND_PLUGIN_ERROR_MESSAGES, type RowndAppConfigInput, type RowndAuthConfig, type RowndBranding, type RowndClientDomains, type RowndCustomContent, type RowndLegal, type RowndPluginConfig, RowndPluginError, type RowndPluginErrorType, type RowndPluginNormalisedConfig, type RowndProfileConfig, type RowndSchema, type RowndSchemaField, type RowndSignInMethod, type RowndSubBrandConfigInput, type RowndTelemetryClient, type RowndTelemetryConfig, type RowndTelemetryEvent, type RowndUser, type RowndUserMetadata, type SuperTokensUserImport, createMagicLinkWithConfirmationBypass, _default as default, getRowndClient, init, setRowndClient };

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-import * as supertokens_node from 'supertokens-node';
+import * as SuperTokens from 'supertokens-node';
 import { JSONObject, SuperTokensPlugin } from 'supertokens-node/types';
+import { SessionContainerInterface } from 'supertokens-node/recipe/session/types';
 
 type RowndSignInMethod = {
     /**
@@ -24,6 +25,18 @@ type RowndSignInMethod = {
      * @default ""
      */
     clientId?: string;
+    /**
+     * SuperTokens provider clientType used for browser Apple redirect flows.
+     */
+    webClientType?: string;
+    /**
+     * SuperTokens provider clientType used for native iOS Apple auth code exchange.
+     */
+    iosClientType?: string;
+    /**
+     * SuperTokens provider clientType used for native Android Apple auth code exchange.
+     */
+    androidClientType?: string;
 } | {
     /**
      * Enables Sign in with Google.
@@ -661,6 +674,9 @@ interface RowndPluginConfig {
     rowndAppSecret: string;
     enableDebugLogs?: boolean;
     clientDomains?: RowndClientDomains;
+    crossDeviceConfirmationBypass?: {
+        allowedRedirectPaths: string[];
+    };
     telemetry?: RowndTelemetryConfig;
     schema?: RowndSchema;
     appConfig?: RowndAppConfigInput;
@@ -742,6 +758,9 @@ interface RowndPluginNormalisedConfig {
     rowndAppSecret: string;
     enableDebugLogs?: boolean;
     clientDomains?: RowndClientDomains;
+    crossDeviceConfirmationBypass?: {
+        allowedRedirectPaths: string[];
+    };
     telemetry?: RowndTelemetryConfig;
     schema?: RowndSchema;
     appConfig?: RowndAppConfigInput;
@@ -814,6 +833,7 @@ declare const ROWND_JWT_CLAIMS: {
 declare const DEFAULT_ROWND_SCHEMA: RowndSchema;
 declare const HUB_LOGIN_PAGE_PATH = "/account/login";
 declare const HUB_VERIFY_EMAIL_PAGE_PATH = "/account/verify-email";
+declare const PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM = "bypassDeviceConfirmation";
 
 declare const ROWND_PLUGIN_ERROR_MESSAGES: {
     readonly MISSING_AUTHORIZATION_HEADER: "Missing authorization header";
@@ -825,11 +845,26 @@ declare class RowndPluginError extends Error {
     constructor(type: RowndPluginErrorType);
 }
 
+type BypassDisplayContext = "browser" | "mobile_app" | "customer_web_view";
+type CreateMagicLinkWithConfirmationBypassInput = {
+    email?: string;
+    phoneNumber?: string;
+    tenantId?: string;
+    request?: any;
+    session?: SessionContainerInterface;
+    userContext?: Record<string, any>;
+    redirectToPath?: string;
+    clientDomain?: string;
+    displayContext?: BypassDisplayContext;
+    appVariantId?: string;
+};
+declare function createMagicLinkWithConfirmationBypass(input: CreateMagicLinkWithConfirmationBypassInput): Promise<string>;
+
 declare function setRowndClient(client: IRowndClient): void;
 declare function getRowndClient(): IRowndClient;
 
 declare const _default: {
-    init: (config: RowndPluginConfig) => supertokens_node.SuperTokensPlugin;
+    init: (config: RowndPluginConfig) => SuperTokens.SuperTokensPlugin;
 };
 
-export { DEFAULT_ROWND_SCHEMA, GUEST_AUTH_METHOD_ID, HANDLE_BASE_PATH, HUB_LOGIN_PAGE_PATH, HUB_VERIFY_EMAIL_PAGE_PATH, INSTANT_AUTH_METHOD_ID, type IRowndClient, type MigrationResponse, PLUGIN_ID, PLUGIN_SDK_VERSION, PLUGIN_VERSION, PUBLIC_TENANT_ID, ROWND_JWT_CLAIMS, ROWND_PLUGIN_ERROR_MESSAGES, type RowndAppConfigInput, type RowndAuthConfig, type RowndBranding, type RowndClientDomains, type RowndCustomContent, type RowndLegal, type RowndPluginConfig, RowndPluginError, type RowndPluginErrorType, type RowndPluginNormalisedConfig, type RowndProfileConfig, type RowndSchema, type RowndSchemaField, type RowndSignInMethod, type RowndSubBrandConfigInput, type RowndTelemetryClient, type RowndTelemetryConfig, type RowndTelemetryEvent, type RowndUser, type RowndUserMetadata, type SuperTokensUserImport, _default as default, getRowndClient, init, setRowndClient };
+export { type CreateMagicLinkWithConfirmationBypassInput, DEFAULT_ROWND_SCHEMA, GUEST_AUTH_METHOD_ID, HANDLE_BASE_PATH, HUB_LOGIN_PAGE_PATH, HUB_VERIFY_EMAIL_PAGE_PATH, INSTANT_AUTH_METHOD_ID, type IRowndClient, type MigrationResponse, PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM, PLUGIN_ID, PLUGIN_SDK_VERSION, PLUGIN_VERSION, PUBLIC_TENANT_ID, ROWND_JWT_CLAIMS, ROWND_PLUGIN_ERROR_MESSAGES, type RowndAppConfigInput, type RowndAuthConfig, type RowndBranding, type RowndClientDomains, type RowndCustomContent, type RowndLegal, type RowndPluginConfig, RowndPluginError, type RowndPluginErrorType, type RowndPluginNormalisedConfig, type RowndProfileConfig, type RowndSchema, type RowndSchemaField, type RowndSignInMethod, type RowndSubBrandConfigInput, type RowndTelemetryClient, type RowndTelemetryConfig, type RowndTelemetryEvent, type RowndUser, type RowndUserMetadata, type SuperTokensUserImport, createMagicLinkWithConfirmationBypass, _default as default, getRowndClient, init, setRowndClient };