@supertokens-plugins/rownd-nodejs 0.3.0-beta.6 → 0.3.0-beta.8

package/dist/index.mjs

@@ -264,6 +264,12 @@ var require_supports_color = __commonJS({
   }
 });
 
+// src/plugin.ts
+import {
+  EmailVerificationClaim
+} from "supertokens-node/recipe/emailverification";
+import Session3 from "supertokens-node/recipe/session";
+
 // ../../shared/js/src/createPluginInit.ts
 var import_supertokens_js_override = __toESM(require_build());
 var createPluginInitFunction = (init2, getImplementation, getNormalisedConfig = (config2) => config2) => {
@@ -701,6 +707,7 @@ var DEFAULT_ROWND_SCHEMA = {
 };
 var HUB_LOGIN_PAGE_PATH = "/account/login";
 var HUB_VERIFY_EMAIL_PAGE_PATH = "/account/verify-email";
+var PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM = "bypassDeviceConfirmation";
 
 // src/logger.ts
 var { logDebugMessage, enableDebugLogs } = buildLogger(
@@ -943,6 +950,109 @@ function getStringList(value) {
 function getErrorMessage(error) {
   return error instanceof Error ? error.message : "Unknown error";
 }
+function getAppInfoString(value) {
+  return value.getAsStringDangerous();
+}
+function getWebsiteDomain(input) {
+  return getAppInfoString(input.stConfig.appInfo.getOrigin({
+    request: input.request,
+    userContext: input.userContext ?? {}
+  }));
+}
+function normalizeClientDomain(value) {
+  if (value.endsWith("://")) {
+    return value;
+  }
+  const parsed = new URL(value);
+  if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+    return parsed.origin;
+  }
+  return `${parsed.protocol}//${parsed.host}`;
+}
+function resolveClientDomain(input) {
+  if (!input.clientDomain) {
+    return input.websiteDomain;
+  }
+  const resolved = input.pluginConfig.clientDomains?.[input.clientDomain];
+  if (!resolved) {
+    throw new Error(`Unknown clientDomain key: ${input.clientDomain}`);
+  }
+  return resolved;
+}
+function resolveAllowedClientDomain(input) {
+  const websiteDomain = getWebsiteDomain(input);
+  const resolvedClientDomain = resolveClientDomain({
+    clientDomain: input.clientDomain,
+    pluginConfig: input.pluginConfig,
+    websiteDomain
+  });
+  const normalizedClientDomain = normalizeClientDomain(resolvedClientDomain);
+  const allowed = [
+    websiteDomain,
+    ...Object.values(input.pluginConfig.clientDomains ?? {})
+  ].map(normalizeClientDomain);
+  if (!allowed.includes(normalizedClientDomain)) {
+    throw new Error(`clientDomain is not allowed: ${resolvedClientDomain}`);
+  }
+  return normalizedClientDomain;
+}
+function normalizeRedirectToPathForClientDomain(redirectToPath, clientDomain) {
+  if (!redirectToPath) {
+    return void 0;
+  }
+  if (redirectToPath === "NATIVE_APP") {
+    return redirectToPath;
+  }
+  if (redirectToPath.startsWith("//")) {
+    throw new Error("redirectToPath cannot be schemaless");
+  }
+  const normalizedClientDomain = normalizeClientDomain(clientDomain);
+  const redirectUrl = new URL(
+    redirectToPath,
+    normalizedClientDomain.endsWith("://") ? "http://localhost" : normalizedClientDomain
+  );
+  const hasExplicitScheme = /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(redirectToPath);
+  if (hasExplicitScheme) {
+    if (redirectUrl.protocol !== "http:" && redirectUrl.protocol !== "https:") {
+      throw new Error("redirectToPath must be http(s) or relative");
+    }
+    if (redirectUrl.origin !== normalizedClientDomain) {
+      throw new Error("redirectToPath must match clientDomain");
+    }
+  }
+  return `${redirectUrl.pathname}${redirectUrl.search}${redirectUrl.hash}`;
+}
+function assertAllowedBypassRedirectPath(pluginConfig2, redirectToPath) {
+  if (!redirectToPath) {
+    throw new Error("redirectToPath is required for confirmation bypass magic links");
+  }
+  const allowedRedirectPaths = pluginConfig2.crossDeviceConfirmationBypass?.allowedRedirectPaths ?? [];
+  if (allowedRedirectPaths.length === 0) {
+    throw new Error("crossDeviceConfirmationBypass.allowedRedirectPaths must be configured");
+  }
+  if (!allowedRedirectPaths.includes(redirectToPath)) {
+    throw new Error(`redirectToPath is not allowed for confirmation bypass: ${redirectToPath}`);
+  }
+}
+function getMagicLinkBootstrapParams(input) {
+  return {
+    appKey: input.appKey,
+    apiDomain: input.apiDomain,
+    apiBasePath: input.apiBasePath,
+    ...input.appVariantId ? { appVariantId: input.appVariantId } : {},
+    ...input.displayContext ? { displayContext: input.displayContext } : {},
+    ...input.redirectToPath ? { redirectToPath: input.redirectToPath } : {},
+    ...input.clientDomainKey ? { clientDomain: input.clientDomainKey } : {}
+  };
+}
+function rewriteMagicLink(input) {
+  return rewriteLinkToBaseUrl(
+    input.magicLink,
+    HUB_LOGIN_PAGE_PATH,
+    input.clientDomain,
+    input.bootstrapParams
+  );
+}
 function getRequestedAppVariantIdFromRequest(req) {
   return req.getKeyValueFromQuery("app_variant_id");
 }
@@ -961,12 +1071,19 @@ function getRequestedRedirectToPathFromRequest(req) {
 
 // src/config.ts
 var pluginConfig;
+var superTokensConfig;
 function setPluginConfig(config2) {
   pluginConfig = config2;
 }
 function getPluginConfig() {
   return pluginConfig;
 }
+function setSuperTokensConfig(config2) {
+  superTokensConfig = config2;
+}
+function getSuperTokensConfig() {
+  return superTokensConfig;
+}
 function assertRowndAppVariantIsConfigured(appVariantId) {
   if (!appVariantId) {
     return;
@@ -1047,7 +1164,10 @@ function buildSignInMethodsConfig(methodsArray) {
     },
     apple: {
       enabled: !!appleMethod,
-      client_id: getStringMethodProperty(appleMethod, "clientId") ?? ""
+      client_id: getStringMethodProperty(appleMethod, "clientId") ?? "",
+      ...getStringMethodProperty(appleMethod, "webClientType") !== void 0 ? { web_client_type: getStringMethodProperty(appleMethod, "webClientType") } : {},
+      ...getStringMethodProperty(appleMethod, "iosClientType") !== void 0 ? { ios_client_type: getStringMethodProperty(appleMethod, "iosClientType") } : {},
+      ...getStringMethodProperty(appleMethod, "androidClientType") !== void 0 ? { android_client_type: getStringMethodProperty(appleMethod, "androidClientType") } : {}
     },
     anonymous: {
       enabled: !!anonymousMethod && anonymousType !== "instant",
@@ -1321,6 +1441,7 @@ function buildAuthMobileConfig(authMobile) {
 
 // src/rownd-compatibility.ts
 import SuperTokens from "supertokens-node";
+import UserMetadata2 from "supertokens-node/recipe/usermetadata";
 var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
   "user_id",
   "email",
@@ -1495,6 +1616,140 @@ function buildRowndSessionClaimPayload(input) {
     ...anonymousId ? { anonymous_id: anonymousId } : {}
   };
 }
+function normalizeRowndOAuthScopes(scopes) {
+  return [...new Set(scopes.filter((scope) => scope.length > 0))];
+}
+function getRowndOAuthAudience(input) {
+  const requested = input.requestedResource ?? input.requestedAudience;
+  if (requested?.startsWith("app:")) {
+    return requested;
+  }
+  return void 0;
+}
+function applyRowndOAuthResourceParams(input) {
+  const resource = firstString(input.params.resource);
+  const audience = firstString(input.params.audience);
+  const rowndAudience = getRowndOAuthAudience({
+    requestedResource: resource,
+    requestedAudience: audience
+  });
+  if (!rowndAudience) {
+    return;
+  }
+  input.userContext.rowndOAuthAudience = rowndAudience;
+  input.params.audience = audience ?? rowndAudience;
+  delete input.params.resource;
+}
+async function buildRowndOAuthPayload(input) {
+  const currentPayload = input.currentPayload ?? {};
+  const standardClaims = input.user ? await buildStandardOAuthClaims(input.user, input.scopes) : {};
+  const rowndClaims = input.user ? await buildRowndOAuthSessionClaims(input.user, currentPayload) : {};
+  const audience = getRowndOAuthAudience({
+    requestedAudience: typeof input.userContext?.rowndOAuthAudience === "string" ? input.userContext.rowndOAuthAudience : void 0
+  });
+  return {
+    ...currentPayload,
+    ...standardClaims,
+    ...rowndClaims,
+    ...audience ? { aud: audience } : {}
+  };
+}
+async function buildRowndOAuthUserInfo(input) {
+  const standardClaims = await buildStandardOAuthClaims(
+    input.user,
+    input.scopes
+  );
+  const rowndClaims = pickOAuthUserInfoRowndClaims(input.accessTokenPayload);
+  return {
+    ...input.currentPayload,
+    ...standardClaims,
+    ...rowndClaims
+  };
+}
+async function buildStandardOAuthClaims(user, scopes) {
+  const claims = {};
+  const metadata = await getRowndMetadata(user.id);
+  const rowndData = isJsonRecord(metadata.original_rownd_user?.data) ? metadata.original_rownd_user.data : {};
+  const verifiedData = isJsonRecord(metadata.original_rownd_user?.verified_data) ? metadata.original_rownd_user.verified_data : {};
+  if (scopes.includes("email")) {
+    const email = firstString(rowndData.email) ?? user.emails[0];
+    if (email) {
+      claims.email = email;
+      claims.email_verified = isOAuthClaimVerified(
+        verifiedData.email,
+        email,
+        user.loginMethods.some(
+          (method) => method.hasSameEmailAs(email) && method.verified
+        )
+      );
+    }
+  }
+  if (scopes.includes("phone")) {
+    const phoneNumber = firstString(rowndData.phone_number) ?? user.phoneNumbers[0];
+    if (phoneNumber) {
+      claims.phone_number = phoneNumber;
+      claims.phone_number_verified = isOAuthClaimVerified(
+        verifiedData.phone_number,
+        phoneNumber,
+        user.loginMethods.some(
+          (method) => method.hasSamePhoneNumberAs(phoneNumber) && method.verified
+        )
+      );
+    }
+  }
+  if (scopes.includes("profile")) {
+    const givenName = firstString(rowndData.first_name);
+    const familyName = firstString(rowndData.last_name);
+    const name = [givenName, familyName].filter(Boolean).join(" ");
+    if (name) claims.name = name;
+    if (givenName) claims.given_name = givenName;
+    if (familyName) claims.family_name = familyName;
+    if (typeof metadata.original_rownd_user?.data?.updated_at === "string") {
+      claims.updated_at = metadata.original_rownd_user.data.updated_at;
+    }
+  }
+  return claims;
+}
+async function getRowndMetadata(userId) {
+  const metadata = await UserMetadata2.getUserMetadata(userId);
+  return metadata.metadata || {};
+}
+function pickOAuthUserInfoRowndClaims(payload) {
+  const claims = {};
+  for (const key of [
+    "app_user_id",
+    "auth_level",
+    "is_verified_user",
+    "is_anonymous",
+    "anonymous_id",
+    "https://auth.rownd.io/app_user_id",
+    "https://auth.rownd.io/auth_level",
+    "https://auth.rownd.io/is_verified_user",
+    "https://auth.rownd.io/is_anonymous"
+  ]) {
+    if (payload[key] !== void 0) {
+      claims[key] = payload[key];
+    }
+  }
+  return claims;
+}
+function firstString(value) {
+  if (Array.isArray(value)) {
+    return value.find((entry) => typeof entry === "string");
+  }
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function isOAuthClaimVerified(value, expectedValue, fallback) {
+  return value === true || value === expectedValue || fallback;
+}
+async function buildRowndOAuthSessionClaims(user, currentPayload) {
+  return buildRowndSessionClaimPayload({
+    userId: user.id,
+    user,
+    metadata: await getRowndMetadata(user.id),
+    currentPayload
+  });
+}
 async function shouldLinkRowndAccounts(input) {
   const [newAccountInfo, , session] = input;
   if (!session) {
@@ -1596,12 +1851,12 @@ function hasVerifiedRealLoginMethod(user) {
   });
 }
 function getEffectiveAuthLevel(user, originalAuthLevel, verifiedData) {
-  if (originalAuthLevel === INSTANT_AUTH_METHOD_ID) {
-    return INSTANT_AUTH_METHOD_ID;
-  }
   if (hasVerifiedRealLoginMethod(user)) {
     return "verified";
   }
+  if (originalAuthLevel === INSTANT_AUTH_METHOD_ID) {
+    return INSTANT_AUTH_METHOD_ID;
+  }
   return getGuestAuthLevel(user) || originalAuthLevel || (verifiedData && Object.keys(verifiedData).length > 0 ? "verified" : "unverified");
 }
 function canUpdateUserDataField(field) {
@@ -1642,7 +1897,7 @@ import EmailVerification from "supertokens-node/recipe/emailverification";
 import Passwordless from "supertokens-node/recipe/passwordless";
 import Session from "supertokens-node/recipe/session";
 import { BooleanClaim } from "supertokens-node/recipe/session/claims";
-import UserMetadata2 from "supertokens-node/recipe/usermetadata";
+import UserMetadata3 from "supertokens-node/recipe/usermetadata";
 async function importUser(stUser, config2) {
   const headers = {
     "Content-Type": "application/json"
@@ -1681,7 +1936,7 @@ async function recordRowndAppVariantForUser(userId, appVariantId) {
   if (appVariants.includes(appVariantId)) {
     return;
   }
-  await UserMetadata2.updateUserMetadata(userId, {
+  await UserMetadata3.updateUserMetadata(userId, {
     ...metadata,
     original_rownd_user: {
       ...originalRowndUser,
@@ -1713,8 +1968,78 @@ async function buildRowndSessionClaims(userId, currentPayload = {}, appVariantId
     appVariantId
   });
 }
+async function createMagicLinkWithConfirmationBypass(input) {
+  const hasEmail = typeof input.email === "string" && input.email.length > 0;
+  const hasPhoneNumber = typeof input.phoneNumber === "string" && input.phoneNumber.length > 0;
+  if (hasEmail === hasPhoneNumber) {
+    throw new Error("Exactly one of email or phoneNumber is required");
+  }
+  const stConfig = getSuperTokensConfig();
+  if (!stConfig) {
+    throw new Error("SuperTokens config is not initialized");
+  }
+  const pluginConfig2 = getPluginConfig();
+  if (!pluginConfig2) {
+    throw new Error("Rownd plugin config is not initialized");
+  }
+  const tenantId = input.tenantId ?? PUBLIC_TENANT_ID;
+  const appVariantId = input.appVariantId;
+  assertRowndAppVariantIsConfigured(appVariantId);
+  const clientDomain = resolveAllowedClientDomain({
+    clientDomain: input.clientDomain,
+    pluginConfig: pluginConfig2,
+    stConfig,
+    request: input.request,
+    userContext: input.userContext
+  });
+  const redirectToPath = normalizeRedirectToPathForClientDomain(input.redirectToPath, clientDomain);
+  assertAllowedBypassRedirectPath(pluginConfig2, redirectToPath);
+  const userContext = {
+    ...input.userContext ?? {},
+    ...input.displayContext ? { rowndDisplayContext: input.displayContext } : {},
+    rowndRedirectToPath: redirectToPath,
+    ...input.clientDomain ? { rowndClientDomain: input.clientDomain } : {},
+    ...appVariantId ? { rowndAppVariantId: appVariantId } : {}
+  };
+  const codeInfo = hasEmail ? await Passwordless.createCode({
+    email: input.email,
+    tenantId,
+    session: input.session,
+    userContext
+  }) : await Passwordless.createCode({
+    phoneNumber: input.phoneNumber,
+    tenantId,
+    session: input.session,
+    userContext
+  });
+  if (codeInfo.status !== "OK") {
+    throw new Error("Failed to create magic link");
+  }
+  const magicLink = `${getWebsiteDomain({
+    stConfig,
+    request: input.request,
+    userContext
+  })}${getAppInfoString(stConfig.appInfo.websiteBasePath)}/verify?preAuthSessionId=${encodeURIComponent(
+    codeInfo.preAuthSessionId
+  )}&tenantId=${encodeURIComponent(tenantId)}#${encodeURIComponent(codeInfo.linkCode)}`;
+  const rewrittenUrl = new URL(rewriteMagicLink({
+    magicLink,
+    clientDomain,
+    bootstrapParams: getMagicLinkBootstrapParams({
+      appKey: pluginConfig2.rowndAppKey,
+      apiDomain: getAppInfoString(stConfig.appInfo.apiDomain),
+      apiBasePath: getAppInfoString(stConfig.appInfo.apiBasePath),
+      appVariantId,
+      displayContext: input.displayContext,
+      redirectToPath,
+      clientDomainKey: input.clientDomain
+    })
+  }));
+  rewrittenUrl.searchParams.set(PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM, "true");
+  return rewrittenUrl.toString();
+}
 async function getUserMetadata(userId) {
-  const metadata = await UserMetadata2.getUserMetadata(userId);
+  const metadata = await UserMetadata3.getUserMetadata(userId);
   return metadata.metadata || {};
 }
 function getPendingVerifications(metadata) {
@@ -1871,7 +2196,7 @@ async function updateUserData(userId, inputData) {
     ...metadata,
     ...inputData
   };
-  await UserMetadata2.updateUserMetadata(userId, updatedMetadata);
+  await UserMetadata3.updateUserMetadata(userId, updatedMetadata);
   return getUserById(userId);
 }
 async function startPendingEmailVerification(input) {
@@ -1891,7 +2216,7 @@ async function startPendingEmailVerification(input) {
       );
     }
     if (pendingEmailVerifications.length > 0) {
-      await UserMetadata2.updateUserMetadata(input.userId, {
+      await UserMetadata3.updateUserMetadata(input.userId, {
         ...metadata,
         rownd_pending_verification: pendingVerifications.filter(
           (pendingVerification2) => pendingVerification2.field !== "email"
@@ -1914,7 +2239,7 @@ async function startPendingEmailVerification(input) {
     value: input.email,
     created_at: (/* @__PURE__ */ new Date()).toISOString()
   };
-  await UserMetadata2.updateUserMetadata(input.userId, {
+  await UserMetadata3.updateUserMetadata(input.userId, {
     ...metadata,
     rownd_pending_verification: [
       ...pendingVerifications.filter(
@@ -1960,6 +2285,7 @@ async function completePendingEmailVerification(input) {
     return;
   }
   let metadataUserId = userId;
+  let verifiedRecipeUserId = input.recipeUserId;
   const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(user);
   if (passwordlessEmailMethod) {
     const updateResult = await Passwordless.updateUser({
@@ -1972,6 +2298,7 @@ async function completePendingEmailVerification(input) {
         `Failed to update verified email method: ${updateResult.status}`
       );
     }
+    verifiedRecipeUserId = passwordlessEmailMethod.recipeUserId;
   } else if (hasOnlyGuestLoginMethods(user)) {
     const isPasswordlessSignUpAllowed = await AccountLinking.isSignUpAllowed(
       PUBLIC_TENANT_ID,
@@ -1991,6 +2318,7 @@ async function completePendingEmailVerification(input) {
       tenantId: PUBLIC_TENANT_ID,
       userContext: input.userContext
     });
+    verifiedRecipeUserId = passwordlessUser.recipeUserId;
     const primaryUserResult = await AccountLinking.createPrimaryUser(
       passwordlessUser.recipeUserId,
       input.userContext
@@ -2035,7 +2363,11 @@ async function completePendingEmailVerification(input) {
       )
     )
   };
-  await UserMetadata2.updateUserMetadata(metadataUserId, updatedMetadata);
+  await UserMetadata3.updateUserMetadata(metadataUserId, updatedMetadata);
+  return {
+    userId: metadataUserId,
+    recipeUserId: verifiedRecipeUserId
+  };
 }
 function isMatchingPendingEmailVerification(verification, email) {
   return verification.field === "email" && verification.value === email;
@@ -2046,7 +2378,7 @@ async function updateUserMetadata(userId, inputMeta) {
     ...metadata,
     ...inputMeta
   };
-  await UserMetadata2.updateUserMetadata(userId, updatedMetadata);
+  await UserMetadata3.updateUserMetadata(userId, updatedMetadata);
   return {
     id: userId,
     meta: Object.fromEntries(
@@ -2067,6 +2399,9 @@ import { randomUUID } from "crypto";
 import SuperTokens3 from "supertokens-node";
 import Session2 from "supertokens-node/recipe/session";
 import ThirdParty from "supertokens-node/recipe/thirdparty";
+function isBodyString(body, key) {
+  return isRecord(body) && typeof body[key] === "string" && body[key].length > 0;
+}
 function handleGetAppConfig(deps) {
   return async (req) => {
     const appVariantId = getRequestedAppVariantIdFromRequest(req);
@@ -2087,6 +2422,43 @@ function handleGetAppConfig(deps) {
     };
   };
 }
+function handleValidatePasswordlessConfirmationBypass(deps) {
+  return async (req) => {
+    try {
+      const body = await getJsonBody(req);
+      const clientDomain = isBodyString(body, "clientDomain") ? body.clientDomain : void 0;
+      const redirectToPath = isBodyString(body, "redirectToPath") ? body.redirectToPath : void 0;
+      const appVariantId = isBodyString(body, "appVariantId") ? body.appVariantId : void 0;
+      assertRowndAppVariantIsConfigured(appVariantId);
+      const resolvedClientDomain = resolveAllowedClientDomain({
+        clientDomain,
+        pluginConfig: deps.pluginConfig,
+        stConfig: deps.stConfig,
+        request: req
+      });
+      const normalizedRedirectToPath = normalizeRedirectToPathForClientDomain(
+        redirectToPath,
+        resolvedClientDomain
+      );
+      assertAllowedBypassRedirectPath(
+        deps.pluginConfig,
+        normalizedRedirectToPath
+      );
+      return {
+        status: "OK",
+        bypass: true
+      };
+    } catch (error) {
+      logDebugMessage(
+        `Passwordless confirmation bypass validation failed. Error: ${getErrorMessage(error)}`
+      );
+      return {
+        status: "ERROR",
+        bypass: false
+      };
+    }
+  };
+}
 function handleGuestLogin(deps) {
   return async (req, res, _session, userContext) => {
     const startedAt = Date.now();
@@ -2424,6 +2796,12 @@ function validateWritableFields(fields) {
 }
 
 // src/plugin.ts
+var verifyRowndUserSessionOptions = {
+  sessionRequired: true,
+  overrideGlobalClaimValidators: (validators) => validators.filter((validator) => {
+    return !("claim" in validator) || validator.claim.key !== EmailVerificationClaim.key;
+  })
+};
 var init = createPluginInitFunction(
   (pluginConfig2) => {
     const rowndClient2 = createInstance({
@@ -2484,6 +2862,7 @@ var init = createPluginInitFunction(
         }
       },
       routeHandlers(stConfig) {
+        setSuperTokensConfig(stConfig);
         const apiBasePath = stConfig.appInfo.apiBasePath.getAsStringDangerous();
         hubBootstrapParams = {
           apiDomain: stConfig.appInfo.apiDomain.getAsStringDangerous(),
@@ -2514,6 +2893,13 @@ var init = createPluginInitFunction(
               method: "post",
               handler: withRequestHandler(handleMigrate(routeHandlerDeps))
             },
+            {
+              path: `${apiBasePath}/plugin/passwordless-cross-device-confirmation/validate`,
+              method: "post",
+              handler: withRequestHandler(
+                handleValidatePasswordlessConfirmationBypass(routeHandlerDeps)
+              )
+            },
             {
               path: `${apiBasePath}/plugin/migrate-session`,
               method: "post",
@@ -2531,13 +2917,13 @@ var init = createPluginInitFunction(
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/user`,
               method: "get",
-              verifySessionOptions: { sessionRequired: true },
+              verifySessionOptions: verifyRowndUserSessionOptions,
               handler: withRequestHandler(handleGetUser())
             },
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/user`,
               method: "put",
-              verifySessionOptions: { sessionRequired: true },
+              verifySessionOptions: verifyRowndUserSessionOptions,
               handler: withRequestHandler(handleUpdateUser())
             },
             {
@@ -2561,19 +2947,87 @@ var init = createPluginInitFunction(
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/user/field`,
               method: "get",
-              verifySessionOptions: { sessionRequired: true },
+              verifySessionOptions: verifyRowndUserSessionOptions,
               handler: withRequestHandler(handleGetUserField())
             },
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/user/field`,
               method: "put",
-              verifySessionOptions: { sessionRequired: true },
+              verifySessionOptions: verifyRowndUserSessionOptions,
               handler: withRequestHandler(handleUpdateUserField())
             }
           ]
         };
       },
       overrideMap: {
+        oauth2provider: {
+          recipeInitRequired: false,
+          functions: (originalImplementation) => ({
+            ...originalImplementation,
+            getRequestedScopes: async (input) => {
+              const scopes = await originalImplementation.getRequestedScopes(
+                input
+              );
+              return normalizeRowndOAuthScopes(scopes);
+            },
+            buildAccessTokenPayload: async (input) => {
+              const payload = await originalImplementation.buildAccessTokenPayload(
+                input
+              );
+              return buildRowndOAuthPayload({
+                user: input.user,
+                client: input.client,
+                scopes: input.scopes,
+                currentPayload: payload,
+                userContext: input.userContext
+              });
+            },
+            buildIdTokenPayload: async (input) => {
+              const payload = await originalImplementation.buildIdTokenPayload(
+                input
+              );
+              return buildRowndOAuthPayload({
+                user: input.user,
+                client: input.client,
+                scopes: input.scopes,
+                currentPayload: payload,
+                userContext: input.userContext
+              });
+            },
+            buildUserInfo: async (input) => {
+              const payload = await originalImplementation.buildUserInfo(input);
+              return buildRowndOAuthUserInfo({
+                user: input.user,
+                accessTokenPayload: input.accessTokenPayload,
+                scopes: input.scopes,
+                currentPayload: payload
+              });
+            }
+          }),
+          apis: (originalImplementation) => ({
+            ...originalImplementation,
+            authGET: async (input) => {
+              if (originalImplementation.authGET === void 0) {
+                throw new Error("OAuth2Provider authGET is unavailable");
+              }
+              applyRowndOAuthResourceParams({
+                params: input.params,
+                userContext: input.userContext
+              });
+              return originalImplementation.authGET(input);
+            },
+            tokenPOST: async (input) => {
+              if (originalImplementation.tokenPOST === void 0) {
+                throw new Error("OAuth2Provider tokenPOST is unavailable");
+              }
+              applyRowndOAuthResourceParams({
+                params: input.body,
+                userContext: input.userContext
+              });
+              return originalImplementation.tokenPOST(input);
+            }
+          })
+        },
         passwordless: {
           config: (config2) => {
             const originalEmailDeliveryOverride = config2.emailDelivery?.override;
@@ -2794,11 +3248,25 @@ var init = createPluginInitFunction(
               }
               const response = await originalImplementation.verifyEmailPOST(input);
               if (response.status === "OK") {
-                await completePendingEmailVerification({
+                const verificationResult = await completePendingEmailVerification({
                   recipeUserId: response.user.recipeUserId,
                   email: response.user.email,
                   userContext: input.userContext
                 });
+                const session = input.session;
+                const shouldReplaceSession = session && verificationResult && (session.getUserId(input.userContext) !== verificationResult.userId || session.getRecipeUserId(input.userContext).getAsString() !== verificationResult.recipeUserId.getAsString());
+                if (shouldReplaceSession) {
+                  await session.revokeSession(input.userContext);
+                  response.newSession = await Session3.createNewSession(
+                    input.options.req,
+                    input.options.res,
+                    session.getTenantId(input.userContext),
+                    verificationResult.recipeUserId,
+                    {},
+                    {},
+                    input.userContext
+                  );
+                }
               }
               return response;
             }
@@ -2836,6 +3304,7 @@ var init = createPluginInitFunction(
       rowndAppSecret: config2.rowndAppSecret,
       enableDebugLogs: config2.enableDebugLogs,
       clientDomains: config2.clientDomains,
+      crossDeviceConfirmationBypass: config2.crossDeviceConfirmationBypass,
       telemetry: config2.telemetry,
       schema: config2.schema,
       appConfig: config2.appConfig,
@@ -2863,6 +3332,7 @@ export {
   HUB_LOGIN_PAGE_PATH,
   HUB_VERIFY_EMAIL_PAGE_PATH,
   INSTANT_AUTH_METHOD_ID,
+  PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM,
   PLUGIN_ID,
   PLUGIN_SDK_VERSION,
   PLUGIN_VERSION,
@@ -2870,6 +3340,7 @@ export {
   ROWND_JWT_CLAIMS,
   ROWND_PLUGIN_ERROR_MESSAGES,
   RowndPluginError,
+  createMagicLinkWithConfirmationBypass,
   index_default as default,
   getRowndClient,
   init,