@supertokens-plugins/rownd-nodejs 0.3.0-beta.8 → 0.5.1

package/README.md

@@ -15,7 +15,7 @@ npm install @supertokens-plugins/rownd-nodejs
 Initialize the plugin in your SuperTokens backend configuration.
 
 > [!IMPORTANT]
-> This plugin requires the `Session` and `UserMetadata` recipes to be initialized in your SuperTokens configuration.
+> This plugin always requires the `Session` and `UserMetadata` recipes. Enable `Passwordless` for email/phone, `ThirdParty` for Google/Apple/guest/anonymous users, `EmailVerification` for verified email profile updates, and `AccountLinking` when migrated Rownd users may have multiple supported login methods.
 
 ```typescript
 import SuperTokens from "supertokens-node";
@@ -128,17 +128,18 @@ const magicLink = await createMagicLinkWithConfirmationBypass({
 
 Pass exactly one of `email` or `phoneNumber`. The helper returns the rewritten magic link with `bypassDeviceConfirmation=true`.
 
-Before skipping the cross-device confirmation prompt, the frontend should validate the callback against the plugin:
+Before skipping the cross-device confirmation prompt, the frontend should validate the callback against the plugin. Routes are mounted under your SuperTokens `apiBasePath`, which defaults to `/auth`.
 
-- **POST** `/plugin/passwordless-cross-device-confirmation/validate`
+- **POST** `{apiBasePath}/plugin/passwordless-cross-device-confirmation/validate`
+- **Default**: `POST /auth/plugin/passwordless-cross-device-confirmation/validate`
 - **Body**: `{ "clientDomain": "browser", "redirectToPath": "/profile", "appVariantId": "optional_variant" }`
 - **Success response**: `{ "status": "OK", "bypass": true }`
 
 If validation fails, the frontend should show the normal cross-device confirmation prompt.
 
-## API Endpoint
+## API Endpoints
 
-The plugin exposes a single endpoint:
+Routes are mounted under your SuperTokens `apiBasePath`, which defaults to `/auth`. The migration endpoint is the main Rownd-to-SuperTokens session handoff endpoint; the plugin also exposes Rownd-compatible app config, guest, user, metadata, field, and sign-out endpoints under `{apiBasePath}/plugin/rownd/...`.
 
 > [!IMPORTANT]
 > The plugin always migrates users and sessions into the `public` tenant.
@@ -146,7 +147,8 @@ The plugin exposes a single endpoint:
 
 ### Migrate
 
-- **POST** `/plugin/rownd/migrate`
+- **POST** `{apiBasePath}/plugin/rownd/migrate`
+- **Default**: `POST /auth/plugin/rownd/migrate`
 - **Headers**: `Authorization: Bearer <Rownd_JWT>`. Header-token clients should also send `rid: session`, `fdi-version: 1.18`, and `st-auth-mode: header`.
 - **Description**: Validates the Rownd JWT, ensures the user is migrated to SuperTokens in the `public` tenant, syncs Rownd user data to SuperTokens UserMetadata, and then creates a new SuperTokens session for that user. Header-token clients must receive `st-access-token`, `st-refresh-token`, and `front-token` response headers.
 
@@ -164,13 +166,11 @@ The plugin emits exactly one telemetry event per `/migrate` call result.
 
 Each event includes endpoint outcome data only (not step-by-step events), including:
 
-- `operation`: `migrate`
 - `outcome`: `success` or `error`
 - `durationMs`
 - `tenantId` (when available)
 - `rowndUserId` (when available)
 - `superTokensUserId` (when available)
-- `migrationState`: `already-migrated` or `imported-during-request` (when available)
 - for errors: `error.message` and `error.name`
 
 > [!NOTE]
@@ -228,20 +228,21 @@ RowndMigrationPlugin.init({
 
 The package includes a bulk migration script for importing Rownd users into SuperTokens.
 
-The script now runs directly from a YAML config file that lives beside the script:
-
-- config file: `packages/rownd-nodejs/scripts/config.yaml`
-- script: `packages/rownd-nodejs/scripts/bulkMigrate.ts`
+The script runs from a YAML config file generated from the included template.
 
 ### Usage
 
-1. Edit `scripts/config.yaml` with your Rownd and SuperTokens credentials.
-2. Run the script from `packages/rownd-nodejs`.
+1. Generate a local config file.
+2. Edit the config with your Rownd and SuperTokens credentials.
+3. Run the migration.
 
 ```bash
-npm run bulk-import
+npx rownd-nodejs init-config --output ./rownd-bulk-migrate.yaml
+npx rownd-nodejs bulk-migrate --config ./rownd-bulk-migrate.yaml
 ```
 
+For repo-local development, use `npm run cli -- bulk-migrate --config ./rownd-bulk-migrate.yaml` from `packages/rownd-nodejs`.
+
 The script:
 
 - fetches users from Rownd page by page
@@ -252,5 +253,5 @@ The script:
 
 ### Config File
 
-All runtime config is read from `scripts/config.yaml`.
+All runtime config is read from the YAML file passed with `--config`.
 There is no environment variable parsing.

package/dist/bulkMigrate.js

@@ -40,6 +40,7 @@ var fs2 = __toESM(require("fs/promises"));
 var import_zod2 = require("zod");
 
 // src/rownd-compatibility.ts
+var import_node_crypto = require("crypto");
 var import_supertokens_node = __toESM(require("supertokens-node"));
 var import_usermetadata = __toESM(require("supertokens-node/recipe/usermetadata"));
 
@@ -55,6 +56,11 @@ var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
   "google_id",
   "apple_id"
 ]);
+var SUPERTOKENS_FAKE_EMAIL_DOMAIN = "stfakeemail.supertokens.com";
+function buildSuperTokensFakeEmail(thirdPartyUserId, thirdPartyId) {
+  const hash = (0, import_node_crypto.createHash)("sha256").update(`${thirdPartyId}:${thirdPartyUserId}`).digest("hex").slice(0, 32);
+  return `st-${thirdPartyId}-${hash}@${SUPERTOKENS_FAKE_EMAIL_DOMAIN}`;
+}
 function isIdentityField(field) {
   return IDENTITY_USER_DATA_FIELDS.has(field);
 }
@@ -66,27 +72,23 @@ function mapRowndUserToSuperTokens(rowndUser) {
     throw new Error("Rownd user has no user_id");
   }
   if (rowndUserData.google_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Google user is missing email");
-    }
+    const googleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.google_id, "google");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.google_id
+      email: googleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id
     });
   }
   if (rowndUserData.apple_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Apple user is missing email");
-    }
+    const appleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.apple_id, "apple");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.apple_id
+      email: appleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id
     });
   }
   if (rowndUserData.phone_number) {
@@ -159,7 +161,9 @@ var ConfigSchema = import_zod.z.object({
     appKey: import_zod.z.string(),
     appSecret: import_zod.z.string(),
     bearerToken: import_zod.z.string().optional(),
-    pageSize: import_zod.z.number().int().positive()
+    pageSize: import_zod.z.number().int().positive(),
+    oidcClientSecrets: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional(),
+    provisionOidcClientIdAliases: import_zod.z.boolean().default(true)
   }),
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),

package/dist/generateAppConfig.js

@@ -61,7 +61,9 @@ var ConfigSchema = import_zod.z.object({
     appKey: import_zod.z.string(),
     appSecret: import_zod.z.string(),
     bearerToken: import_zod.z.string().optional(),
-    pageSize: import_zod.z.number().int().positive()
+    pageSize: import_zod.z.number().int().positive(),
+    oidcClientSecrets: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional(),
+    provisionOidcClientIdAliases: import_zod.z.boolean().default(true)
   }),
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),

package/dist/index.js

@@ -865,6 +865,7 @@ var RowndPluginError = class extends Error {
 };
 
 // src/utils.ts
+var ROWND_OAUTH_LOGIN_CHALLENGE_PARAM = "rownd_oauth_login_challenge";
 function rewriteLinkPath(inputUrl, targetPath, searchParams) {
   try {
     const url = new URL(inputUrl);
@@ -1065,7 +1066,8 @@ function getMagicLinkBootstrapParams(input) {
     ...input.appVariantId ? { appVariantId: input.appVariantId } : {},
     ...input.displayContext ? { displayContext: input.displayContext } : {},
     ...input.redirectToPath ? { redirectToPath: input.redirectToPath } : {},
-    ...input.clientDomainKey ? { clientDomain: input.clientDomainKey } : {}
+    ...input.clientDomainKey ? { clientDomain: input.clientDomainKey } : {},
+    ...input.oauthLoginChallenge ? { oauthLoginChallenge: input.oauthLoginChallenge } : {}
   };
 }
 function rewriteMagicLink(input) {
@@ -1091,6 +1093,10 @@ function getRequestedRedirectToPathFromRequest(req) {
   const redirectToPath = req.getKeyValueFromQuery("rownd_redirect_to_path");
   return typeof redirectToPath === "string" && redirectToPath.length > 0 ? redirectToPath : void 0;
 }
+function getRequestedOAuthLoginChallengeFromRequest(req) {
+  const loginChallenge = req.getKeyValueFromQuery(ROWND_OAUTH_LOGIN_CHALLENGE_PARAM);
+  return typeof loginChallenge === "string" && loginChallenge.length > 0 ? loginChallenge : void 0;
+}
 
 // src/config.ts
 var pluginConfig;
@@ -1463,6 +1469,7 @@ function buildAuthMobileConfig(authMobile) {
 }
 
 // src/rownd-compatibility.ts
+var import_node_crypto = require("crypto");
 var import_supertokens_node = __toESM(require("supertokens-node"));
 var import_usermetadata2 = __toESM(require("supertokens-node/recipe/usermetadata"));
 var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
@@ -1476,6 +1483,14 @@ var INTERNAL_METADATA_FIELDS = /* @__PURE__ */ new Set([
   "original_rownd_user",
   "rownd_pending_verification"
 ]);
+var SUPERTOKENS_FAKE_EMAIL_DOMAIN = "stfakeemail.supertokens.com";
+function isSuperTokensFakeEmail(email) {
+  return typeof email === "string" && email.toLowerCase().endsWith(`@${SUPERTOKENS_FAKE_EMAIL_DOMAIN}`);
+}
+function buildSuperTokensFakeEmail(thirdPartyUserId, thirdPartyId) {
+  const hash = (0, import_node_crypto.createHash)("sha256").update(`${thirdPartyId}:${thirdPartyUserId}`).digest("hex").slice(0, 32);
+  return `st-${thirdPartyId}-${hash}@${SUPERTOKENS_FAKE_EMAIL_DOMAIN}`;
+}
 function isIdentityField(field) {
   return IDENTITY_USER_DATA_FIELDS.has(field);
 }
@@ -1490,27 +1505,23 @@ function mapRowndUserToSuperTokens(rowndUser) {
     throw new Error("Rownd user has no user_id");
   }
   if (rowndUserData.google_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Google user is missing email");
-    }
+    const googleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.google_id, "google");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.google_id
+      email: googleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id
     });
   }
   if (rowndUserData.apple_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Apple user is missing email");
-    }
+    const appleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.apple_id, "apple");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.apple_id
+      email: appleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id
     });
   }
   if (rowndUserData.phone_number) {
@@ -1695,7 +1706,7 @@ async function buildStandardOAuthClaims(user, scopes) {
   const rowndData = isJsonRecord(metadata.original_rownd_user?.data) ? metadata.original_rownd_user.data : {};
   const verifiedData = isJsonRecord(metadata.original_rownd_user?.verified_data) ? metadata.original_rownd_user.verified_data : {};
   if (scopes.includes("email")) {
-    const email = firstString(rowndData.email) ?? user.emails[0];
+    const email = firstRealEmail(firstString(rowndData.email), ...user.emails);
     if (email) {
       claims.email = email;
       claims.email_verified = isOAuthClaimVerified(
@@ -1762,6 +1773,11 @@ function firstString(value) {
   }
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
+function firstRealEmail(...values) {
+  return values.find((entry) => {
+    return typeof entry === "string" && entry.length > 0 && !isSuperTokensFakeEmail(entry);
+  });
+}
 function isOAuthClaimVerified(value, expectedValue, fallback) {
   return value === true || value === expectedValue || fallback;
 }
@@ -2045,6 +2061,7 @@ async function createMagicLinkWithConfirmationBypass(input) {
   })}${getAppInfoString(stConfig.appInfo.websiteBasePath)}/verify?preAuthSessionId=${encodeURIComponent(
     codeInfo.preAuthSessionId
   )}&tenantId=${encodeURIComponent(tenantId)}#${encodeURIComponent(codeInfo.linkCode)}`;
+  const oauthLoginChallenge = userContext.rowndOAuthLoginChallenge;
   const rewrittenUrl = new URL(rewriteMagicLink({
     magicLink,
     clientDomain,
@@ -2055,7 +2072,8 @@ async function createMagicLinkWithConfirmationBypass(input) {
       appVariantId,
       displayContext: input.displayContext,
       redirectToPath,
-      clientDomainKey: input.clientDomain
+      clientDomainKey: input.clientDomain,
+      oauthLoginChallenge: typeof oauthLoginChallenge === "string" ? oauthLoginChallenge : void 0
     })
   }));
   rewrittenUrl.searchParams.set(PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM, "true");
@@ -2106,7 +2124,7 @@ async function getUserById(userId) {
   };
   for (const method of stUser.loginMethods) {
     if (method.recipeId === "passwordless") {
-      if (method.email) {
+      if (method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
         if (data.email === void 0) data.email = method.email;
       }
@@ -2118,10 +2136,10 @@ async function getUserById(userId) {
     } else if (method.recipeId === "thirdparty") {
       const thirdPartyId = getThirdPartyId(method);
       const thirdPartyUserId = getThirdPartyUserId(method);
-      if (method.verified && method.email) {
+      if (method.verified && method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
       }
-      if (method.email && data.email === void 0) {
+      if (method.email && !isSuperTokensFakeEmail(method.email) && data.email === void 0) {
         data.email = method.email;
       }
       if (thirdPartyId === "google" && thirdPartyUserId) {
@@ -2133,7 +2151,7 @@ async function getUserById(userId) {
         verifiedData.apple_id = thirdPartyUserId;
       }
     } else if (method.recipeId === "emailpassword") {
-      if (method.email && data.email === void 0) {
+      if (method.email && !isSuperTokensFakeEmail(method.email) && data.email === void 0) {
         data.email = method.email;
       }
     }
@@ -2838,6 +2856,7 @@ var init = createPluginInitFunction(
       const displayContext = input?.userContext?.rowndDisplayContext;
       const redirectToPath = input?.userContext?.rowndRedirectToPath;
       const clientDomain = input?.userContext?.rowndClientDomain;
+      const oauthLoginChallenge = input?.userContext?.rowndOAuthLoginChallenge;
       const clientDomainKey = clientDomain ?? (displayContext === "mobile_app" ? "mobile" : "browser");
       const clientBaseUrl = pluginConfig2.clientDomains?.[clientDomainKey];
       const bootstrapParams = {
@@ -2845,7 +2864,8 @@ var init = createPluginInitFunction(
         ...hubBootstrapParams ?? {},
         ...typeof appVariantId === "string" ? { appVariantId } : {},
         ...typeof displayContext === "string" ? { displayContext } : {},
-        ...typeof redirectToPath === "string" ? { redirectToPath } : {}
+        ...typeof redirectToPath === "string" ? { redirectToPath } : {},
+        ...typeof oauthLoginChallenge === "string" ? { oauthLoginChallenge } : {}
       };
       const rewrittenLink = input[linkKey] ? clientBaseUrl ? rewriteLinkToBaseUrl(
         input[linkKey],
@@ -3131,6 +3151,12 @@ var init = createPluginInitFunction(
               if (appVariantId) {
                 input.userContext.rowndAppVariantId = appVariantId;
               }
+              const oauthLoginChallenge = getRequestedOAuthLoginChallengeFromRequest(
+                input.options.req
+              );
+              if (oauthLoginChallenge) {
+                input.userContext.rowndOAuthLoginChallenge = oauthLoginChallenge;
+              }
               assertRowndAppVariantIsConfigured(appVariantId);
               return originalImplementation.createCodePOST(input);
             },

package/dist/index.mjs

@@ -842,6 +842,7 @@ var RowndPluginError = class extends Error {
 };
 
 // src/utils.ts
+var ROWND_OAUTH_LOGIN_CHALLENGE_PARAM = "rownd_oauth_login_challenge";
 function rewriteLinkPath(inputUrl, targetPath, searchParams) {
   try {
     const url = new URL(inputUrl);
@@ -1042,7 +1043,8 @@ function getMagicLinkBootstrapParams(input) {
     ...input.appVariantId ? { appVariantId: input.appVariantId } : {},
     ...input.displayContext ? { displayContext: input.displayContext } : {},
     ...input.redirectToPath ? { redirectToPath: input.redirectToPath } : {},
-    ...input.clientDomainKey ? { clientDomain: input.clientDomainKey } : {}
+    ...input.clientDomainKey ? { clientDomain: input.clientDomainKey } : {},
+    ...input.oauthLoginChallenge ? { oauthLoginChallenge: input.oauthLoginChallenge } : {}
   };
 }
 function rewriteMagicLink(input) {
@@ -1068,6 +1070,10 @@ function getRequestedRedirectToPathFromRequest(req) {
   const redirectToPath = req.getKeyValueFromQuery("rownd_redirect_to_path");
   return typeof redirectToPath === "string" && redirectToPath.length > 0 ? redirectToPath : void 0;
 }
+function getRequestedOAuthLoginChallengeFromRequest(req) {
+  const loginChallenge = req.getKeyValueFromQuery(ROWND_OAUTH_LOGIN_CHALLENGE_PARAM);
+  return typeof loginChallenge === "string" && loginChallenge.length > 0 ? loginChallenge : void 0;
+}
 
 // src/config.ts
 var pluginConfig;
@@ -1440,6 +1446,7 @@ function buildAuthMobileConfig(authMobile) {
 }
 
 // src/rownd-compatibility.ts
+import { createHash } from "crypto";
 import SuperTokens from "supertokens-node";
 import UserMetadata2 from "supertokens-node/recipe/usermetadata";
 var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
@@ -1453,6 +1460,14 @@ var INTERNAL_METADATA_FIELDS = /* @__PURE__ */ new Set([
   "original_rownd_user",
   "rownd_pending_verification"
 ]);
+var SUPERTOKENS_FAKE_EMAIL_DOMAIN = "stfakeemail.supertokens.com";
+function isSuperTokensFakeEmail(email) {
+  return typeof email === "string" && email.toLowerCase().endsWith(`@${SUPERTOKENS_FAKE_EMAIL_DOMAIN}`);
+}
+function buildSuperTokensFakeEmail(thirdPartyUserId, thirdPartyId) {
+  const hash = createHash("sha256").update(`${thirdPartyId}:${thirdPartyUserId}`).digest("hex").slice(0, 32);
+  return `st-${thirdPartyId}-${hash}@${SUPERTOKENS_FAKE_EMAIL_DOMAIN}`;
+}
 function isIdentityField(field) {
   return IDENTITY_USER_DATA_FIELDS.has(field);
 }
@@ -1467,27 +1482,23 @@ function mapRowndUserToSuperTokens(rowndUser) {
     throw new Error("Rownd user has no user_id");
   }
   if (rowndUserData.google_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Google user is missing email");
-    }
+    const googleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.google_id, "google");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.google_id
+      email: googleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id
     });
   }
   if (rowndUserData.apple_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Apple user is missing email");
-    }
+    const appleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.apple_id, "apple");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.apple_id
+      email: appleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id
     });
   }
   if (rowndUserData.phone_number) {
@@ -1672,7 +1683,7 @@ async function buildStandardOAuthClaims(user, scopes) {
   const rowndData = isJsonRecord(metadata.original_rownd_user?.data) ? metadata.original_rownd_user.data : {};
   const verifiedData = isJsonRecord(metadata.original_rownd_user?.verified_data) ? metadata.original_rownd_user.verified_data : {};
   if (scopes.includes("email")) {
-    const email = firstString(rowndData.email) ?? user.emails[0];
+    const email = firstRealEmail(firstString(rowndData.email), ...user.emails);
     if (email) {
       claims.email = email;
       claims.email_verified = isOAuthClaimVerified(
@@ -1739,6 +1750,11 @@ function firstString(value) {
   }
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
+function firstRealEmail(...values) {
+  return values.find((entry) => {
+    return typeof entry === "string" && entry.length > 0 && !isSuperTokensFakeEmail(entry);
+  });
+}
 function isOAuthClaimVerified(value, expectedValue, fallback) {
   return value === true || value === expectedValue || fallback;
 }
@@ -2022,6 +2038,7 @@ async function createMagicLinkWithConfirmationBypass(input) {
   })}${getAppInfoString(stConfig.appInfo.websiteBasePath)}/verify?preAuthSessionId=${encodeURIComponent(
     codeInfo.preAuthSessionId
   )}&tenantId=${encodeURIComponent(tenantId)}#${encodeURIComponent(codeInfo.linkCode)}`;
+  const oauthLoginChallenge = userContext.rowndOAuthLoginChallenge;
   const rewrittenUrl = new URL(rewriteMagicLink({
     magicLink,
     clientDomain,
@@ -2032,7 +2049,8 @@ async function createMagicLinkWithConfirmationBypass(input) {
       appVariantId,
       displayContext: input.displayContext,
       redirectToPath,
-      clientDomainKey: input.clientDomain
+      clientDomainKey: input.clientDomain,
+      oauthLoginChallenge: typeof oauthLoginChallenge === "string" ? oauthLoginChallenge : void 0
     })
   }));
   rewrittenUrl.searchParams.set(PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM, "true");
@@ -2083,7 +2101,7 @@ async function getUserById(userId) {
   };
   for (const method of stUser.loginMethods) {
     if (method.recipeId === "passwordless") {
-      if (method.email) {
+      if (method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
         if (data.email === void 0) data.email = method.email;
       }
@@ -2095,10 +2113,10 @@ async function getUserById(userId) {
     } else if (method.recipeId === "thirdparty") {
       const thirdPartyId = getThirdPartyId(method);
       const thirdPartyUserId = getThirdPartyUserId(method);
-      if (method.verified && method.email) {
+      if (method.verified && method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
       }
-      if (method.email && data.email === void 0) {
+      if (method.email && !isSuperTokensFakeEmail(method.email) && data.email === void 0) {
         data.email = method.email;
       }
       if (thirdPartyId === "google" && thirdPartyUserId) {
@@ -2110,7 +2128,7 @@ async function getUserById(userId) {
         verifiedData.apple_id = thirdPartyUserId;
       }
     } else if (method.recipeId === "emailpassword") {
-      if (method.email && data.email === void 0) {
+      if (method.email && !isSuperTokensFakeEmail(method.email) && data.email === void 0) {
         data.email = method.email;
       }
     }
@@ -2815,6 +2833,7 @@ var init = createPluginInitFunction(
       const displayContext = input?.userContext?.rowndDisplayContext;
       const redirectToPath = input?.userContext?.rowndRedirectToPath;
       const clientDomain = input?.userContext?.rowndClientDomain;
+      const oauthLoginChallenge = input?.userContext?.rowndOAuthLoginChallenge;
       const clientDomainKey = clientDomain ?? (displayContext === "mobile_app" ? "mobile" : "browser");
       const clientBaseUrl = pluginConfig2.clientDomains?.[clientDomainKey];
       const bootstrapParams = {
@@ -2822,7 +2841,8 @@ var init = createPluginInitFunction(
         ...hubBootstrapParams ?? {},
         ...typeof appVariantId === "string" ? { appVariantId } : {},
         ...typeof displayContext === "string" ? { displayContext } : {},
-        ...typeof redirectToPath === "string" ? { redirectToPath } : {}
+        ...typeof redirectToPath === "string" ? { redirectToPath } : {},
+        ...typeof oauthLoginChallenge === "string" ? { oauthLoginChallenge } : {}
       };
       const rewrittenLink = input[linkKey] ? clientBaseUrl ? rewriteLinkToBaseUrl(
         input[linkKey],
@@ -3108,6 +3128,12 @@ var init = createPluginInitFunction(
               if (appVariantId) {
                 input.userContext.rowndAppVariantId = appVariantId;
               }
+              const oauthLoginChallenge = getRequestedOAuthLoginChallengeFromRequest(
+                input.options.req
+              );
+              if (oauthLoginChallenge) {
+                input.userContext.rowndOAuthLoginChallenge = oauthLoginChallenge;
+              }
               assertRowndAppVariantIsConfigured(appVariantId);
               return originalImplementation.createCodePOST(input);
             },

package/dist/initConfig.js

@@ -49,6 +49,16 @@ rownd:
   # bearerToken: <ROWND_API_BEARER_TOKEN>
   # Number of Rownd users to request per page.
   pageSize: 100
+  # Rownd stores existing OIDC credential secrets hashed. Provide plaintext
+  # values here when migrating OIDC clients. Keys can be credential client IDs
+  # (key_...) and OIDC client configuration IDs (oc_...).
+  oidcClientSecrets: {}
+  # oidcClientSecrets:
+  #   key_123: ras_plaintext_secret
+  #   oc_123: ras_plaintext_secret_for_oidc_client_id_alias
+  # Rownd accepts the OIDC client configuration ID (oc_...) as a client_id in
+  # addition to each linked credential client_id (key_...).
+  provisionOidcClientIdAliases: true
 
 supertokens:
   connectionURI: <CONNECTION_URI>

package/dist/setupCoreInstance.js

@@ -62,7 +62,9 @@ var ConfigSchema = import_zod.z.object({
     appKey: import_zod.z.string(),
     appSecret: import_zod.z.string(),
     bearerToken: import_zod.z.string().optional(),
-    pageSize: import_zod.z.number().int().positive()
+    pageSize: import_zod.z.number().int().positive(),
+    oidcClientSecrets: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional(),
+    provisionOidcClientIdAliases: import_zod.z.boolean().default(true)
   }),
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),
@@ -187,55 +189,118 @@ async function provisionSuperTokensInfrastructure(config, oidcClients) {
   if (config.supertokens.apiKey) {
     headers["api-key"] = config.supertokens.apiKey;
   }
+  const provisionedClientIds = /* @__PURE__ */ new Set();
   for (const oidcClient of oidcClients) {
-    for (const credential of oidcClient.credentials ?? []) {
-      console.log(
-        `Provisioning SuperTokens OAuth2 Client: ${credential.client_id}`
+    const credentials = oidcClient.credentials ?? [];
+    for (const credential of credentials) {
+      await createSuperTokensOAuthClient({
+        config,
+        headers,
+        oidcClient,
+        clientId: credential.client_id,
+        clientSecret: resolveOidcClientSecret(
+          config,
+          credential.client_id,
+          credential.secret
+        ),
+        appVariantId: credential.app_variant_id,
+        provisionedClientIds
+      });
+    }
+    if (config.rownd.provisionOidcClientIdAliases && credentials.length > 0) {
+      const firstCredential = credentials[0];
+      if (!firstCredential) {
+        continue;
+      }
+      const firstCredentialSecret = resolveOidcClientSecret(
+        config,
+        firstCredential.client_id,
+        firstCredential.secret
       );
-      const oauthRes = await fetch(
-        new URL(
-          "/recipe/oauth/clients",
-          config.supertokens.connectionURI
-        ).toString(),
-        {
-          method: "POST",
-          headers,
-          body: JSON.stringify({
-            clientName: oidcClient.name || credential.client_id || "Rownd Client",
-            clientId: credential.client_id,
-            clientSecret: credential.secret,
-            redirectUris: oidcClient.config.redirect_uris || [],
-            postLogoutRedirectUris: oidcClient.config.post_logout_uris || [],
-            scope: oidcClient.config.allowed_scopes?.join(" "),
-            responseTypes: ["code", "token", "id_token"],
-            grantTypes: [
-              "authorization_code",
-              "refresh_token",
-              "client_credentials",
-              "implicit"
-            ],
-            tokenEndpointAuthMethod: oidcClient.config.token_endpoint_auth_method ?? "client_secret_basic",
-            audience: [`app:${config.rownd.appId}`],
-            metadata: {
-              rowndOidcClientId: oidcClient.id,
-              rowndAppVariantId: credential.app_variant_id || void 0,
-              rowndAllowedScopes: oidcClient.config.allowed_scopes || [],
-              rowndApplicationType: oidcClient.config.application_type,
-              rowndIsPkceRequired: oidcClient.config.is_pkce_required,
-              rowndIsPkceSupported: oidcClient.config.is_pkce_supported,
-              rowndDeviceFlowEnabled: oidcClient.config.device_flow_enabled
-            }
-          })
-        }
+      const aliasSecret = resolveOidcClientSecret(
+        config,
+        oidcClient.id,
+        firstCredentialSecret
       );
-      if (!oauthRes.ok) {
-        const errorText = await oauthRes.text();
-        if (!errorText.includes("already exists") && !errorText.includes("Duplicate")) {
-          throw new Error(
-            `Failed to create OAuth2 Client ${credential.client_id}: ${oauthRes.status} ${errorText}`
-          );
+      await createSuperTokensOAuthClient({
+        config,
+        headers,
+        oidcClient,
+        clientId: oidcClient.id,
+        clientSecret: aliasSecret,
+        isOidcClientIdAlias: true,
+        provisionedClientIds
+      });
+    }
+  }
+}
+function resolveOidcClientSecret(config, clientId, apiSecret) {
+  const secret = config.rownd.oidcClientSecrets?.[clientId] ?? apiSecret;
+  if (!secret) {
+    throw new Error(
+      `Missing plaintext secret for Rownd OIDC client ${clientId}. Add rownd.oidcClientSecrets.${clientId} to the config.`
+    );
+  }
+  if (secret.startsWith("$argon2")) {
+    throw new Error(
+      `Rownd returned a hashed secret for OIDC client ${clientId}. Add the plaintext secret under rownd.oidcClientSecrets.${clientId}.`
+    );
+  }
+  return secret;
+}
+async function createSuperTokensOAuthClient(input) {
+  if (input.provisionedClientIds.has(input.clientId)) {
+    return;
+  }
+  input.provisionedClientIds.add(input.clientId);
+  console.log(`Provisioning SuperTokens OAuth2 Client: ${input.clientId}`);
+  const grantTypes = [
+    "authorization_code",
+    "refresh_token",
+    "client_credentials",
+    "implicit"
+  ];
+  if (input.oidcClient.config.device_flow_enabled) {
+    grantTypes.push("urn:ietf:params:oauth:grant-type:device_code");
+  }
+  const oauthRes = await fetch(
+    new URL(
+      "/recipe/oauth/clients",
+      input.config.supertokens.connectionURI
+    ).toString(),
+    {
+      method: "POST",
+      headers: input.headers,
+      body: JSON.stringify({
+        clientName: input.oidcClient.name || input.clientId || "Rownd Client",
+        clientId: input.clientId,
+        clientSecret: input.clientSecret,
+        redirectUris: input.oidcClient.config.redirect_uris || [],
+        postLogoutRedirectUris: input.oidcClient.config.post_logout_uris || [],
+        scope: input.oidcClient.config.allowed_scopes?.join(" "),
+        responseTypes: ["code", "token", "id_token"],
+        grantTypes,
+        tokenEndpointAuthMethod: input.oidcClient.config.token_endpoint_auth_method ?? "client_secret_basic",
+        audience: [`app:${input.config.rownd.appId}`],
+        metadata: {
+          rowndOidcClientId: input.oidcClient.id,
+          rowndAppVariantId: input.appVariantId || void 0,
+          rowndAllowedScopes: input.oidcClient.config.allowed_scopes || [],
+          rowndApplicationType: input.oidcClient.config.application_type,
+          rowndIsPkceRequired: input.oidcClient.config.is_pkce_required,
+          rowndIsPkceSupported: input.oidcClient.config.is_pkce_supported,
+          rowndDeviceFlowEnabled: input.oidcClient.config.device_flow_enabled,
+          rowndIsOidcClientIdAlias: input.isOidcClientIdAlias || void 0
         }
-      }
+      })
+    }
+  );
+  if (!oauthRes.ok) {
+    const errorText = await oauthRes.text();
+    if (!errorText.includes("already exists") && !errorText.includes("Duplicate")) {
+      throw new Error(
+        `Failed to create OAuth2 Client ${input.clientId}: ${oauthRes.status} ${errorText}`
+      );
     }
   }
 }

package/package.json

@@ -1,10 +1,18 @@
 {
   "name": "@supertokens-plugins/rownd-nodejs",
-  "version": "0.3.0-beta.8",
+  "version": "0.5.1",
   "description": "Rownd User Migration Plugin for SuperTokens",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
   "bin": {
     "rownd-nodejs": "./dist/cli.js"
   },
@@ -15,6 +23,8 @@
     "build": "rm -rf dist && tsup",
     "cli": "npm run build && node dist/cli.js",
     "lint": "eslint ./src --ext .ts",
+    "prepack": "npm run build",
+    "typecheck": "tsc --noEmit",
     "test": "TEST_MODE=testing vitest run --pool=forks"
   },
   "keywords": [