@supertokens-plugins/rownd-nodejs 0.3.0-beta.7 → 0.5.0

package/README.md

@@ -15,7 +15,7 @@ npm install @supertokens-plugins/rownd-nodejs
 Initialize the plugin in your SuperTokens backend configuration.
 
 > [!IMPORTANT]
-> This plugin requires the `Session` and `UserMetadata` recipes to be initialized in your SuperTokens configuration.
+> This plugin always requires the `Session` and `UserMetadata` recipes. Enable `Passwordless` for email/phone, `ThirdParty` for Google/Apple/guest/anonymous users, `EmailVerification` for verified email profile updates, and `AccountLinking` when migrated Rownd users may have multiple supported login methods.
 
 ```typescript
 import SuperTokens from "supertokens-node";
@@ -128,17 +128,18 @@ const magicLink = await createMagicLinkWithConfirmationBypass({
 
 Pass exactly one of `email` or `phoneNumber`. The helper returns the rewritten magic link with `bypassDeviceConfirmation=true`.
 
-Before skipping the cross-device confirmation prompt, the frontend should validate the callback against the plugin:
+Before skipping the cross-device confirmation prompt, the frontend should validate the callback against the plugin. Routes are mounted under your SuperTokens `apiBasePath`, which defaults to `/auth`.
 
-- **POST** `/plugin/passwordless-cross-device-confirmation/validate`
+- **POST** `{apiBasePath}/plugin/passwordless-cross-device-confirmation/validate`
+- **Default**: `POST /auth/plugin/passwordless-cross-device-confirmation/validate`
 - **Body**: `{ "clientDomain": "browser", "redirectToPath": "/profile", "appVariantId": "optional_variant" }`
 - **Success response**: `{ "status": "OK", "bypass": true }`
 
 If validation fails, the frontend should show the normal cross-device confirmation prompt.
 
-## API Endpoint
+## API Endpoints
 
-The plugin exposes a single endpoint:
+Routes are mounted under your SuperTokens `apiBasePath`, which defaults to `/auth`. The migration endpoint is the main Rownd-to-SuperTokens session handoff endpoint; the plugin also exposes Rownd-compatible app config, guest, user, metadata, field, and sign-out endpoints under `{apiBasePath}/plugin/rownd/...`.
 
 > [!IMPORTANT]
 > The plugin always migrates users and sessions into the `public` tenant.
@@ -146,7 +147,8 @@ The plugin exposes a single endpoint:
 
 ### Migrate
 
-- **POST** `/plugin/rownd/migrate`
+- **POST** `{apiBasePath}/plugin/rownd/migrate`
+- **Default**: `POST /auth/plugin/rownd/migrate`
 - **Headers**: `Authorization: Bearer <Rownd_JWT>`. Header-token clients should also send `rid: session`, `fdi-version: 1.18`, and `st-auth-mode: header`.
 - **Description**: Validates the Rownd JWT, ensures the user is migrated to SuperTokens in the `public` tenant, syncs Rownd user data to SuperTokens UserMetadata, and then creates a new SuperTokens session for that user. Header-token clients must receive `st-access-token`, `st-refresh-token`, and `front-token` response headers.
 
@@ -164,13 +166,11 @@ The plugin emits exactly one telemetry event per `/migrate` call result.
 
 Each event includes endpoint outcome data only (not step-by-step events), including:
 
-- `operation`: `migrate`
 - `outcome`: `success` or `error`
 - `durationMs`
 - `tenantId` (when available)
 - `rowndUserId` (when available)
 - `superTokensUserId` (when available)
-- `migrationState`: `already-migrated` or `imported-during-request` (when available)
 - for errors: `error.message` and `error.name`
 
 > [!NOTE]
@@ -228,20 +228,21 @@ RowndMigrationPlugin.init({
 
 The package includes a bulk migration script for importing Rownd users into SuperTokens.
 
-The script now runs directly from a YAML config file that lives beside the script:
-
-- config file: `packages/rownd-nodejs/scripts/config.yaml`
-- script: `packages/rownd-nodejs/scripts/bulkMigrate.ts`
+The script runs from a YAML config file generated from the included template.
 
 ### Usage
 
-1. Edit `scripts/config.yaml` with your Rownd and SuperTokens credentials.
-2. Run the script from `packages/rownd-nodejs`.
+1. Generate a local config file.
+2. Edit the config with your Rownd and SuperTokens credentials.
+3. Run the migration.
 
 ```bash
-npm run bulk-import
+npx rownd-nodejs init-config --output ./rownd-bulk-migrate.yaml
+npx rownd-nodejs bulk-migrate --config ./rownd-bulk-migrate.yaml
 ```
 
+For repo-local development, use `npm run cli -- bulk-migrate --config ./rownd-bulk-migrate.yaml` from `packages/rownd-nodejs`.
+
 The script:
 
 - fetches users from Rownd page by page
@@ -252,5 +253,5 @@ The script:
 
 ### Config File
 
-All runtime config is read from `scripts/config.yaml`.
+All runtime config is read from the YAML file passed with `--config`.
 There is no environment variable parsing.

package/dist/index.js

@@ -289,6 +289,10 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/plugin.ts
+var import_emailverification2 = require("supertokens-node/recipe/emailverification");
+var import_session3 = __toESM(require("supertokens-node/recipe/session"));
+
 // ../../shared/js/src/createPluginInit.ts
 var import_supertokens_js_override = __toESM(require_build());
 var createPluginInitFunction = (init2, getImplementation, getNormalisedConfig = (config2) => config2) => {
@@ -635,11 +639,12 @@ function createLoggerConfig() {
 }
 var config = createLoggerConfig();
 var logger = common_default(config);
-if (logger.formatters) {
-  logger.formatters.o = function(value) {
+var formatters = logger.formatters;
+if (formatters) {
+  formatters.o = function(value) {
     return import_util.default.inspect(value, { colors: this.useColors, compact: true }).split("\n").map((line) => line.trim()).join(" ");
   };
-  logger.formatters.O = function(value) {
+  formatters.O = function(value) {
     return import_util.default.inspect(value, { colors: this.useColors, compact: false });
   };
 }
@@ -1870,12 +1875,12 @@ function hasVerifiedRealLoginMethod(user) {
   });
 }
 function getEffectiveAuthLevel(user, originalAuthLevel, verifiedData) {
-  if (originalAuthLevel === INSTANT_AUTH_METHOD_ID) {
-    return INSTANT_AUTH_METHOD_ID;
-  }
   if (hasVerifiedRealLoginMethod(user)) {
     return "verified";
   }
+  if (originalAuthLevel === INSTANT_AUTH_METHOD_ID) {
+    return INSTANT_AUTH_METHOD_ID;
+  }
   return getGuestAuthLevel(user) || originalAuthLevel || (verifiedData && Object.keys(verifiedData).length > 0 ? "verified" : "unverified");
 }
 function canUpdateUserDataField(field) {
@@ -2304,6 +2309,7 @@ async function completePendingEmailVerification(input) {
     return;
   }
   let metadataUserId = userId;
+  let verifiedRecipeUserId = input.recipeUserId;
   const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(user);
   if (passwordlessEmailMethod) {
     const updateResult = await import_passwordless.default.updateUser({
@@ -2316,6 +2322,7 @@ async function completePendingEmailVerification(input) {
         `Failed to update verified email method: ${updateResult.status}`
       );
     }
+    verifiedRecipeUserId = passwordlessEmailMethod.recipeUserId;
   } else if (hasOnlyGuestLoginMethods(user)) {
     const isPasswordlessSignUpAllowed = await import_accountlinking.default.isSignUpAllowed(
       PUBLIC_TENANT_ID,
@@ -2335,6 +2342,7 @@ async function completePendingEmailVerification(input) {
       tenantId: PUBLIC_TENANT_ID,
       userContext: input.userContext
     });
+    verifiedRecipeUserId = passwordlessUser.recipeUserId;
     const primaryUserResult = await import_accountlinking.default.createPrimaryUser(
       passwordlessUser.recipeUserId,
       input.userContext
@@ -2380,6 +2388,10 @@ async function completePendingEmailVerification(input) {
     )
   };
   await import_usermetadata3.default.updateUserMetadata(metadataUserId, updatedMetadata);
+  return {
+    userId: metadataUserId,
+    recipeUserId: verifiedRecipeUserId
+  };
 }
 function isMatchingPendingEmailVerification(verification, email) {
   return verification.field === "email" && verification.value === email;
@@ -2808,6 +2820,12 @@ function validateWritableFields(fields) {
 }
 
 // src/plugin.ts
+var verifyRowndUserSessionOptions = {
+  sessionRequired: true,
+  overrideGlobalClaimValidators: (validators) => validators.filter((validator) => {
+    return !("claim" in validator) || validator.claim.key !== import_emailverification2.EmailVerificationClaim.key;
+  })
+};
 var init = createPluginInitFunction(
   (pluginConfig2) => {
     const rowndClient2 = (0, import_node.createInstance)({
@@ -2923,13 +2941,13 @@ var init = createPluginInitFunction(
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/user`,
               method: "get",
-              verifySessionOptions: { sessionRequired: true },
+              verifySessionOptions: verifyRowndUserSessionOptions,
               handler: withRequestHandler(handleGetUser())
             },
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/user`,
               method: "put",
-              verifySessionOptions: { sessionRequired: true },
+              verifySessionOptions: verifyRowndUserSessionOptions,
               handler: withRequestHandler(handleUpdateUser())
             },
             {
@@ -2953,13 +2971,13 @@ var init = createPluginInitFunction(
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/user/field`,
               method: "get",
-              verifySessionOptions: { sessionRequired: true },
+              verifySessionOptions: verifyRowndUserSessionOptions,
               handler: withRequestHandler(handleGetUserField())
             },
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/user/field`,
               method: "put",
-              verifySessionOptions: { sessionRequired: true },
+              verifySessionOptions: verifyRowndUserSessionOptions,
               handler: withRequestHandler(handleUpdateUserField())
             }
           ]
@@ -3254,11 +3272,25 @@ var init = createPluginInitFunction(
               }
               const response = await originalImplementation.verifyEmailPOST(input);
               if (response.status === "OK") {
-                await completePendingEmailVerification({
+                const verificationResult = await completePendingEmailVerification({
                   recipeUserId: response.user.recipeUserId,
                   email: response.user.email,
                   userContext: input.userContext
                 });
+                const session = input.session;
+                const shouldReplaceSession = session && verificationResult && (session.getUserId(input.userContext) !== verificationResult.userId || session.getRecipeUserId(input.userContext).getAsString() !== verificationResult.recipeUserId.getAsString());
+                if (shouldReplaceSession) {
+                  await session.revokeSession(input.userContext);
+                  response.newSession = await import_session3.default.createNewSession(
+                    input.options.req,
+                    input.options.res,
+                    session.getTenantId(input.userContext),
+                    verificationResult.recipeUserId,
+                    {},
+                    {},
+                    input.userContext
+                  );
+                }
               }
               return response;
             }

package/dist/index.mjs

@@ -264,6 +264,12 @@ var require_supports_color = __commonJS({
   }
 });
 
+// src/plugin.ts
+import {
+  EmailVerificationClaim
+} from "supertokens-node/recipe/emailverification";
+import Session3 from "supertokens-node/recipe/session";
+
 // ../../shared/js/src/createPluginInit.ts
 var import_supertokens_js_override = __toESM(require_build());
 var createPluginInitFunction = (init2, getImplementation, getNormalisedConfig = (config2) => config2) => {
@@ -610,11 +616,12 @@ function createLoggerConfig() {
 }
 var config = createLoggerConfig();
 var logger = common_default(config);
-if (logger.formatters) {
-  logger.formatters.o = function(value) {
+var formatters = logger.formatters;
+if (formatters) {
+  formatters.o = function(value) {
     return util.inspect(value, { colors: this.useColors, compact: true }).split("\n").map((line) => line.trim()).join(" ");
   };
-  logger.formatters.O = function(value) {
+  formatters.O = function(value) {
     return util.inspect(value, { colors: this.useColors, compact: false });
   };
 }
@@ -1845,12 +1852,12 @@ function hasVerifiedRealLoginMethod(user) {
   });
 }
 function getEffectiveAuthLevel(user, originalAuthLevel, verifiedData) {
-  if (originalAuthLevel === INSTANT_AUTH_METHOD_ID) {
-    return INSTANT_AUTH_METHOD_ID;
-  }
   if (hasVerifiedRealLoginMethod(user)) {
     return "verified";
   }
+  if (originalAuthLevel === INSTANT_AUTH_METHOD_ID) {
+    return INSTANT_AUTH_METHOD_ID;
+  }
   return getGuestAuthLevel(user) || originalAuthLevel || (verifiedData && Object.keys(verifiedData).length > 0 ? "verified" : "unverified");
 }
 function canUpdateUserDataField(field) {
@@ -2279,6 +2286,7 @@ async function completePendingEmailVerification(input) {
     return;
   }
   let metadataUserId = userId;
+  let verifiedRecipeUserId = input.recipeUserId;
   const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(user);
   if (passwordlessEmailMethod) {
     const updateResult = await Passwordless.updateUser({
@@ -2291,6 +2299,7 @@ async function completePendingEmailVerification(input) {
         `Failed to update verified email method: ${updateResult.status}`
       );
     }
+    verifiedRecipeUserId = passwordlessEmailMethod.recipeUserId;
   } else if (hasOnlyGuestLoginMethods(user)) {
     const isPasswordlessSignUpAllowed = await AccountLinking.isSignUpAllowed(
       PUBLIC_TENANT_ID,
@@ -2310,6 +2319,7 @@ async function completePendingEmailVerification(input) {
       tenantId: PUBLIC_TENANT_ID,
       userContext: input.userContext
     });
+    verifiedRecipeUserId = passwordlessUser.recipeUserId;
     const primaryUserResult = await AccountLinking.createPrimaryUser(
       passwordlessUser.recipeUserId,
       input.userContext
@@ -2355,6 +2365,10 @@ async function completePendingEmailVerification(input) {
     )
   };
   await UserMetadata3.updateUserMetadata(metadataUserId, updatedMetadata);
+  return {
+    userId: metadataUserId,
+    recipeUserId: verifiedRecipeUserId
+  };
 }
 function isMatchingPendingEmailVerification(verification, email) {
   return verification.field === "email" && verification.value === email;
@@ -2783,6 +2797,12 @@ function validateWritableFields(fields) {
 }
 
 // src/plugin.ts
+var verifyRowndUserSessionOptions = {
+  sessionRequired: true,
+  overrideGlobalClaimValidators: (validators) => validators.filter((validator) => {
+    return !("claim" in validator) || validator.claim.key !== EmailVerificationClaim.key;
+  })
+};
 var init = createPluginInitFunction(
   (pluginConfig2) => {
     const rowndClient2 = createInstance({
@@ -2898,13 +2918,13 @@ var init = createPluginInitFunction(
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/user`,
               method: "get",
-              verifySessionOptions: { sessionRequired: true },
+              verifySessionOptions: verifyRowndUserSessionOptions,
               handler: withRequestHandler(handleGetUser())
             },
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/user`,
               method: "put",
-              verifySessionOptions: { sessionRequired: true },
+              verifySessionOptions: verifyRowndUserSessionOptions,
               handler: withRequestHandler(handleUpdateUser())
             },
             {
@@ -2928,13 +2948,13 @@ var init = createPluginInitFunction(
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/user/field`,
               method: "get",
-              verifySessionOptions: { sessionRequired: true },
+              verifySessionOptions: verifyRowndUserSessionOptions,
               handler: withRequestHandler(handleGetUserField())
             },
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/user/field`,
               method: "put",
-              verifySessionOptions: { sessionRequired: true },
+              verifySessionOptions: verifyRowndUserSessionOptions,
               handler: withRequestHandler(handleUpdateUserField())
             }
           ]
@@ -3229,11 +3249,25 @@ var init = createPluginInitFunction(
               }
               const response = await originalImplementation.verifyEmailPOST(input);
               if (response.status === "OK") {
-                await completePendingEmailVerification({
+                const verificationResult = await completePendingEmailVerification({
                   recipeUserId: response.user.recipeUserId,
                   email: response.user.email,
                   userContext: input.userContext
                 });
+                const session = input.session;
+                const shouldReplaceSession = session && verificationResult && (session.getUserId(input.userContext) !== verificationResult.userId || session.getRecipeUserId(input.userContext).getAsString() !== verificationResult.recipeUserId.getAsString());
+                if (shouldReplaceSession) {
+                  await session.revokeSession(input.userContext);
+                  response.newSession = await Session3.createNewSession(
+                    input.options.req,
+                    input.options.res,
+                    session.getTenantId(input.userContext),
+                    verificationResult.recipeUserId,
+                    {},
+                    {},
+                    input.userContext
+                  );
+                }
               }
               return response;
             }

package/package.json

@@ -1,10 +1,18 @@
 {
   "name": "@supertokens-plugins/rownd-nodejs",
-  "version": "0.3.0-beta.7",
+  "version": "0.5.0",
   "description": "Rownd User Migration Plugin for SuperTokens",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
   "bin": {
     "rownd-nodejs": "./dist/cli.js"
   },
@@ -15,6 +23,8 @@
     "build": "rm -rf dist && tsup",
     "cli": "npm run build && node dist/cli.js",
     "lint": "eslint ./src --ext .ts",
+    "prepack": "npm run build",
+    "typecheck": "tsc --noEmit",
     "test": "TEST_MODE=testing vitest run --pool=forks"
   },
   "keywords": [