@supertokens-plugins/rownd-nodejs 0.5.0 → 0.5.1

package/dist/bulkMigrate.js

@@ -40,6 +40,7 @@ var fs2 = __toESM(require("fs/promises"));
 var import_zod2 = require("zod");
 
 // src/rownd-compatibility.ts
+var import_node_crypto = require("crypto");
 var import_supertokens_node = __toESM(require("supertokens-node"));
 var import_usermetadata = __toESM(require("supertokens-node/recipe/usermetadata"));
 
@@ -55,6 +56,11 @@ var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
   "google_id",
   "apple_id"
 ]);
+var SUPERTOKENS_FAKE_EMAIL_DOMAIN = "stfakeemail.supertokens.com";
+function buildSuperTokensFakeEmail(thirdPartyUserId, thirdPartyId) {
+  const hash = (0, import_node_crypto.createHash)("sha256").update(`${thirdPartyId}:${thirdPartyUserId}`).digest("hex").slice(0, 32);
+  return `st-${thirdPartyId}-${hash}@${SUPERTOKENS_FAKE_EMAIL_DOMAIN}`;
+}
 function isIdentityField(field) {
   return IDENTITY_USER_DATA_FIELDS.has(field);
 }
@@ -66,27 +72,23 @@ function mapRowndUserToSuperTokens(rowndUser) {
     throw new Error("Rownd user has no user_id");
   }
   if (rowndUserData.google_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Google user is missing email");
-    }
+    const googleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.google_id, "google");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.google_id
+      email: googleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id
     });
   }
   if (rowndUserData.apple_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Apple user is missing email");
-    }
+    const appleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.apple_id, "apple");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.apple_id
+      email: appleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id
     });
   }
   if (rowndUserData.phone_number) {
@@ -159,7 +161,9 @@ var ConfigSchema = import_zod.z.object({
     appKey: import_zod.z.string(),
     appSecret: import_zod.z.string(),
     bearerToken: import_zod.z.string().optional(),
-    pageSize: import_zod.z.number().int().positive()
+    pageSize: import_zod.z.number().int().positive(),
+    oidcClientSecrets: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional(),
+    provisionOidcClientIdAliases: import_zod.z.boolean().default(true)
   }),
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),

package/dist/generateAppConfig.js

@@ -61,7 +61,9 @@ var ConfigSchema = import_zod.z.object({
     appKey: import_zod.z.string(),
     appSecret: import_zod.z.string(),
     bearerToken: import_zod.z.string().optional(),
-    pageSize: import_zod.z.number().int().positive()
+    pageSize: import_zod.z.number().int().positive(),
+    oidcClientSecrets: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional(),
+    provisionOidcClientIdAliases: import_zod.z.boolean().default(true)
   }),
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),

package/dist/index.js

@@ -639,12 +639,11 @@ function createLoggerConfig() {
 }
 var config = createLoggerConfig();
 var logger = common_default(config);
-var formatters = logger.formatters;
-if (formatters) {
-  formatters.o = function(value) {
+if (logger.formatters) {
+  logger.formatters.o = function(value) {
     return import_util.default.inspect(value, { colors: this.useColors, compact: true }).split("\n").map((line) => line.trim()).join(" ");
   };
-  formatters.O = function(value) {
+  logger.formatters.O = function(value) {
     return import_util.default.inspect(value, { colors: this.useColors, compact: false });
   };
 }
@@ -866,6 +865,7 @@ var RowndPluginError = class extends Error {
 };
 
 // src/utils.ts
+var ROWND_OAUTH_LOGIN_CHALLENGE_PARAM = "rownd_oauth_login_challenge";
 function rewriteLinkPath(inputUrl, targetPath, searchParams) {
   try {
     const url = new URL(inputUrl);
@@ -1066,7 +1066,8 @@ function getMagicLinkBootstrapParams(input) {
     ...input.appVariantId ? { appVariantId: input.appVariantId } : {},
     ...input.displayContext ? { displayContext: input.displayContext } : {},
     ...input.redirectToPath ? { redirectToPath: input.redirectToPath } : {},
-    ...input.clientDomainKey ? { clientDomain: input.clientDomainKey } : {}
+    ...input.clientDomainKey ? { clientDomain: input.clientDomainKey } : {},
+    ...input.oauthLoginChallenge ? { oauthLoginChallenge: input.oauthLoginChallenge } : {}
   };
 }
 function rewriteMagicLink(input) {
@@ -1092,6 +1093,10 @@ function getRequestedRedirectToPathFromRequest(req) {
   const redirectToPath = req.getKeyValueFromQuery("rownd_redirect_to_path");
   return typeof redirectToPath === "string" && redirectToPath.length > 0 ? redirectToPath : void 0;
 }
+function getRequestedOAuthLoginChallengeFromRequest(req) {
+  const loginChallenge = req.getKeyValueFromQuery(ROWND_OAUTH_LOGIN_CHALLENGE_PARAM);
+  return typeof loginChallenge === "string" && loginChallenge.length > 0 ? loginChallenge : void 0;
+}
 
 // src/config.ts
 var pluginConfig;
@@ -1464,6 +1469,7 @@ function buildAuthMobileConfig(authMobile) {
 }
 
 // src/rownd-compatibility.ts
+var import_node_crypto = require("crypto");
 var import_supertokens_node = __toESM(require("supertokens-node"));
 var import_usermetadata2 = __toESM(require("supertokens-node/recipe/usermetadata"));
 var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
@@ -1477,6 +1483,14 @@ var INTERNAL_METADATA_FIELDS = /* @__PURE__ */ new Set([
   "original_rownd_user",
   "rownd_pending_verification"
 ]);
+var SUPERTOKENS_FAKE_EMAIL_DOMAIN = "stfakeemail.supertokens.com";
+function isSuperTokensFakeEmail(email) {
+  return typeof email === "string" && email.toLowerCase().endsWith(`@${SUPERTOKENS_FAKE_EMAIL_DOMAIN}`);
+}
+function buildSuperTokensFakeEmail(thirdPartyUserId, thirdPartyId) {
+  const hash = (0, import_node_crypto.createHash)("sha256").update(`${thirdPartyId}:${thirdPartyUserId}`).digest("hex").slice(0, 32);
+  return `st-${thirdPartyId}-${hash}@${SUPERTOKENS_FAKE_EMAIL_DOMAIN}`;
+}
 function isIdentityField(field) {
   return IDENTITY_USER_DATA_FIELDS.has(field);
 }
@@ -1491,27 +1505,23 @@ function mapRowndUserToSuperTokens(rowndUser) {
     throw new Error("Rownd user has no user_id");
   }
   if (rowndUserData.google_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Google user is missing email");
-    }
+    const googleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.google_id, "google");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.google_id
+      email: googleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id
     });
   }
   if (rowndUserData.apple_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Apple user is missing email");
-    }
+    const appleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.apple_id, "apple");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.apple_id
+      email: appleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id
     });
   }
   if (rowndUserData.phone_number) {
@@ -1696,7 +1706,7 @@ async function buildStandardOAuthClaims(user, scopes) {
   const rowndData = isJsonRecord(metadata.original_rownd_user?.data) ? metadata.original_rownd_user.data : {};
   const verifiedData = isJsonRecord(metadata.original_rownd_user?.verified_data) ? metadata.original_rownd_user.verified_data : {};
   if (scopes.includes("email")) {
-    const email = firstString(rowndData.email) ?? user.emails[0];
+    const email = firstRealEmail(firstString(rowndData.email), ...user.emails);
     if (email) {
       claims.email = email;
       claims.email_verified = isOAuthClaimVerified(
@@ -1763,6 +1773,11 @@ function firstString(value) {
   }
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
+function firstRealEmail(...values) {
+  return values.find((entry) => {
+    return typeof entry === "string" && entry.length > 0 && !isSuperTokensFakeEmail(entry);
+  });
+}
 function isOAuthClaimVerified(value, expectedValue, fallback) {
   return value === true || value === expectedValue || fallback;
 }
@@ -2046,6 +2061,7 @@ async function createMagicLinkWithConfirmationBypass(input) {
   })}${getAppInfoString(stConfig.appInfo.websiteBasePath)}/verify?preAuthSessionId=${encodeURIComponent(
     codeInfo.preAuthSessionId
   )}&tenantId=${encodeURIComponent(tenantId)}#${encodeURIComponent(codeInfo.linkCode)}`;
+  const oauthLoginChallenge = userContext.rowndOAuthLoginChallenge;
   const rewrittenUrl = new URL(rewriteMagicLink({
     magicLink,
     clientDomain,
@@ -2056,7 +2072,8 @@ async function createMagicLinkWithConfirmationBypass(input) {
       appVariantId,
       displayContext: input.displayContext,
       redirectToPath,
-      clientDomainKey: input.clientDomain
+      clientDomainKey: input.clientDomain,
+      oauthLoginChallenge: typeof oauthLoginChallenge === "string" ? oauthLoginChallenge : void 0
     })
   }));
   rewrittenUrl.searchParams.set(PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM, "true");
@@ -2107,7 +2124,7 @@ async function getUserById(userId) {
   };
   for (const method of stUser.loginMethods) {
     if (method.recipeId === "passwordless") {
-      if (method.email) {
+      if (method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
         if (data.email === void 0) data.email = method.email;
       }
@@ -2119,10 +2136,10 @@ async function getUserById(userId) {
     } else if (method.recipeId === "thirdparty") {
       const thirdPartyId = getThirdPartyId(method);
       const thirdPartyUserId = getThirdPartyUserId(method);
-      if (method.verified && method.email) {
+      if (method.verified && method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
       }
-      if (method.email && data.email === void 0) {
+      if (method.email && !isSuperTokensFakeEmail(method.email) && data.email === void 0) {
         data.email = method.email;
       }
       if (thirdPartyId === "google" && thirdPartyUserId) {
@@ -2134,7 +2151,7 @@ async function getUserById(userId) {
         verifiedData.apple_id = thirdPartyUserId;
       }
     } else if (method.recipeId === "emailpassword") {
-      if (method.email && data.email === void 0) {
+      if (method.email && !isSuperTokensFakeEmail(method.email) && data.email === void 0) {
         data.email = method.email;
       }
     }
@@ -2839,6 +2856,7 @@ var init = createPluginInitFunction(
       const displayContext = input?.userContext?.rowndDisplayContext;
       const redirectToPath = input?.userContext?.rowndRedirectToPath;
       const clientDomain = input?.userContext?.rowndClientDomain;
+      const oauthLoginChallenge = input?.userContext?.rowndOAuthLoginChallenge;
       const clientDomainKey = clientDomain ?? (displayContext === "mobile_app" ? "mobile" : "browser");
       const clientBaseUrl = pluginConfig2.clientDomains?.[clientDomainKey];
       const bootstrapParams = {
@@ -2846,7 +2864,8 @@ var init = createPluginInitFunction(
         ...hubBootstrapParams ?? {},
         ...typeof appVariantId === "string" ? { appVariantId } : {},
         ...typeof displayContext === "string" ? { displayContext } : {},
-        ...typeof redirectToPath === "string" ? { redirectToPath } : {}
+        ...typeof redirectToPath === "string" ? { redirectToPath } : {},
+        ...typeof oauthLoginChallenge === "string" ? { oauthLoginChallenge } : {}
       };
       const rewrittenLink = input[linkKey] ? clientBaseUrl ? rewriteLinkToBaseUrl(
         input[linkKey],
@@ -3132,6 +3151,12 @@ var init = createPluginInitFunction(
               if (appVariantId) {
                 input.userContext.rowndAppVariantId = appVariantId;
               }
+              const oauthLoginChallenge = getRequestedOAuthLoginChallengeFromRequest(
+                input.options.req
+              );
+              if (oauthLoginChallenge) {
+                input.userContext.rowndOAuthLoginChallenge = oauthLoginChallenge;
+              }
               assertRowndAppVariantIsConfigured(appVariantId);
               return originalImplementation.createCodePOST(input);
             },

package/dist/index.mjs

@@ -616,12 +616,11 @@ function createLoggerConfig() {
 }
 var config = createLoggerConfig();
 var logger = common_default(config);
-var formatters = logger.formatters;
-if (formatters) {
-  formatters.o = function(value) {
+if (logger.formatters) {
+  logger.formatters.o = function(value) {
     return util.inspect(value, { colors: this.useColors, compact: true }).split("\n").map((line) => line.trim()).join(" ");
   };
-  formatters.O = function(value) {
+  logger.formatters.O = function(value) {
     return util.inspect(value, { colors: this.useColors, compact: false });
   };
 }
@@ -843,6 +842,7 @@ var RowndPluginError = class extends Error {
 };
 
 // src/utils.ts
+var ROWND_OAUTH_LOGIN_CHALLENGE_PARAM = "rownd_oauth_login_challenge";
 function rewriteLinkPath(inputUrl, targetPath, searchParams) {
   try {
     const url = new URL(inputUrl);
@@ -1043,7 +1043,8 @@ function getMagicLinkBootstrapParams(input) {
     ...input.appVariantId ? { appVariantId: input.appVariantId } : {},
     ...input.displayContext ? { displayContext: input.displayContext } : {},
     ...input.redirectToPath ? { redirectToPath: input.redirectToPath } : {},
-    ...input.clientDomainKey ? { clientDomain: input.clientDomainKey } : {}
+    ...input.clientDomainKey ? { clientDomain: input.clientDomainKey } : {},
+    ...input.oauthLoginChallenge ? { oauthLoginChallenge: input.oauthLoginChallenge } : {}
   };
 }
 function rewriteMagicLink(input) {
@@ -1069,6 +1070,10 @@ function getRequestedRedirectToPathFromRequest(req) {
   const redirectToPath = req.getKeyValueFromQuery("rownd_redirect_to_path");
   return typeof redirectToPath === "string" && redirectToPath.length > 0 ? redirectToPath : void 0;
 }
+function getRequestedOAuthLoginChallengeFromRequest(req) {
+  const loginChallenge = req.getKeyValueFromQuery(ROWND_OAUTH_LOGIN_CHALLENGE_PARAM);
+  return typeof loginChallenge === "string" && loginChallenge.length > 0 ? loginChallenge : void 0;
+}
 
 // src/config.ts
 var pluginConfig;
@@ -1441,6 +1446,7 @@ function buildAuthMobileConfig(authMobile) {
 }
 
 // src/rownd-compatibility.ts
+import { createHash } from "crypto";
 import SuperTokens from "supertokens-node";
 import UserMetadata2 from "supertokens-node/recipe/usermetadata";
 var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
@@ -1454,6 +1460,14 @@ var INTERNAL_METADATA_FIELDS = /* @__PURE__ */ new Set([
   "original_rownd_user",
   "rownd_pending_verification"
 ]);
+var SUPERTOKENS_FAKE_EMAIL_DOMAIN = "stfakeemail.supertokens.com";
+function isSuperTokensFakeEmail(email) {
+  return typeof email === "string" && email.toLowerCase().endsWith(`@${SUPERTOKENS_FAKE_EMAIL_DOMAIN}`);
+}
+function buildSuperTokensFakeEmail(thirdPartyUserId, thirdPartyId) {
+  const hash = createHash("sha256").update(`${thirdPartyId}:${thirdPartyUserId}`).digest("hex").slice(0, 32);
+  return `st-${thirdPartyId}-${hash}@${SUPERTOKENS_FAKE_EMAIL_DOMAIN}`;
+}
 function isIdentityField(field) {
   return IDENTITY_USER_DATA_FIELDS.has(field);
 }
@@ -1468,27 +1482,23 @@ function mapRowndUserToSuperTokens(rowndUser) {
     throw new Error("Rownd user has no user_id");
   }
   if (rowndUserData.google_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Google user is missing email");
-    }
+    const googleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.google_id, "google");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.google_id
+      email: googleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id
     });
   }
   if (rowndUserData.apple_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Apple user is missing email");
-    }
+    const appleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.apple_id, "apple");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.apple_id
+      email: appleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id
     });
   }
   if (rowndUserData.phone_number) {
@@ -1673,7 +1683,7 @@ async function buildStandardOAuthClaims(user, scopes) {
   const rowndData = isJsonRecord(metadata.original_rownd_user?.data) ? metadata.original_rownd_user.data : {};
   const verifiedData = isJsonRecord(metadata.original_rownd_user?.verified_data) ? metadata.original_rownd_user.verified_data : {};
   if (scopes.includes("email")) {
-    const email = firstString(rowndData.email) ?? user.emails[0];
+    const email = firstRealEmail(firstString(rowndData.email), ...user.emails);
     if (email) {
       claims.email = email;
       claims.email_verified = isOAuthClaimVerified(
@@ -1740,6 +1750,11 @@ function firstString(value) {
   }
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
+function firstRealEmail(...values) {
+  return values.find((entry) => {
+    return typeof entry === "string" && entry.length > 0 && !isSuperTokensFakeEmail(entry);
+  });
+}
 function isOAuthClaimVerified(value, expectedValue, fallback) {
   return value === true || value === expectedValue || fallback;
 }
@@ -2023,6 +2038,7 @@ async function createMagicLinkWithConfirmationBypass(input) {
   })}${getAppInfoString(stConfig.appInfo.websiteBasePath)}/verify?preAuthSessionId=${encodeURIComponent(
     codeInfo.preAuthSessionId
   )}&tenantId=${encodeURIComponent(tenantId)}#${encodeURIComponent(codeInfo.linkCode)}`;
+  const oauthLoginChallenge = userContext.rowndOAuthLoginChallenge;
   const rewrittenUrl = new URL(rewriteMagicLink({
     magicLink,
     clientDomain,
@@ -2033,7 +2049,8 @@ async function createMagicLinkWithConfirmationBypass(input) {
       appVariantId,
       displayContext: input.displayContext,
       redirectToPath,
-      clientDomainKey: input.clientDomain
+      clientDomainKey: input.clientDomain,
+      oauthLoginChallenge: typeof oauthLoginChallenge === "string" ? oauthLoginChallenge : void 0
     })
   }));
   rewrittenUrl.searchParams.set(PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM, "true");
@@ -2084,7 +2101,7 @@ async function getUserById(userId) {
   };
   for (const method of stUser.loginMethods) {
     if (method.recipeId === "passwordless") {
-      if (method.email) {
+      if (method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
         if (data.email === void 0) data.email = method.email;
       }
@@ -2096,10 +2113,10 @@ async function getUserById(userId) {
     } else if (method.recipeId === "thirdparty") {
       const thirdPartyId = getThirdPartyId(method);
       const thirdPartyUserId = getThirdPartyUserId(method);
-      if (method.verified && method.email) {
+      if (method.verified && method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
       }
-      if (method.email && data.email === void 0) {
+      if (method.email && !isSuperTokensFakeEmail(method.email) && data.email === void 0) {
         data.email = method.email;
       }
       if (thirdPartyId === "google" && thirdPartyUserId) {
@@ -2111,7 +2128,7 @@ async function getUserById(userId) {
         verifiedData.apple_id = thirdPartyUserId;
       }
     } else if (method.recipeId === "emailpassword") {
-      if (method.email && data.email === void 0) {
+      if (method.email && !isSuperTokensFakeEmail(method.email) && data.email === void 0) {
         data.email = method.email;
       }
     }
@@ -2816,6 +2833,7 @@ var init = createPluginInitFunction(
       const displayContext = input?.userContext?.rowndDisplayContext;
       const redirectToPath = input?.userContext?.rowndRedirectToPath;
       const clientDomain = input?.userContext?.rowndClientDomain;
+      const oauthLoginChallenge = input?.userContext?.rowndOAuthLoginChallenge;
       const clientDomainKey = clientDomain ?? (displayContext === "mobile_app" ? "mobile" : "browser");
       const clientBaseUrl = pluginConfig2.clientDomains?.[clientDomainKey];
       const bootstrapParams = {
@@ -2823,7 +2841,8 @@ var init = createPluginInitFunction(
         ...hubBootstrapParams ?? {},
         ...typeof appVariantId === "string" ? { appVariantId } : {},
         ...typeof displayContext === "string" ? { displayContext } : {},
-        ...typeof redirectToPath === "string" ? { redirectToPath } : {}
+        ...typeof redirectToPath === "string" ? { redirectToPath } : {},
+        ...typeof oauthLoginChallenge === "string" ? { oauthLoginChallenge } : {}
       };
       const rewrittenLink = input[linkKey] ? clientBaseUrl ? rewriteLinkToBaseUrl(
         input[linkKey],
@@ -3109,6 +3128,12 @@ var init = createPluginInitFunction(
               if (appVariantId) {
                 input.userContext.rowndAppVariantId = appVariantId;
               }
+              const oauthLoginChallenge = getRequestedOAuthLoginChallengeFromRequest(
+                input.options.req
+              );
+              if (oauthLoginChallenge) {
+                input.userContext.rowndOAuthLoginChallenge = oauthLoginChallenge;
+              }
               assertRowndAppVariantIsConfigured(appVariantId);
               return originalImplementation.createCodePOST(input);
             },

package/dist/initConfig.js

@@ -49,6 +49,16 @@ rownd:
   # bearerToken: <ROWND_API_BEARER_TOKEN>
   # Number of Rownd users to request per page.
   pageSize: 100
+  # Rownd stores existing OIDC credential secrets hashed. Provide plaintext
+  # values here when migrating OIDC clients. Keys can be credential client IDs
+  # (key_...) and OIDC client configuration IDs (oc_...).
+  oidcClientSecrets: {}
+  # oidcClientSecrets:
+  #   key_123: ras_plaintext_secret
+  #   oc_123: ras_plaintext_secret_for_oidc_client_id_alias
+  # Rownd accepts the OIDC client configuration ID (oc_...) as a client_id in
+  # addition to each linked credential client_id (key_...).
+  provisionOidcClientIdAliases: true
 
 supertokens:
   connectionURI: <CONNECTION_URI>

package/dist/setupCoreInstance.js

@@ -62,7 +62,9 @@ var ConfigSchema = import_zod.z.object({
     appKey: import_zod.z.string(),
     appSecret: import_zod.z.string(),
     bearerToken: import_zod.z.string().optional(),
-    pageSize: import_zod.z.number().int().positive()
+    pageSize: import_zod.z.number().int().positive(),
+    oidcClientSecrets: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional(),
+    provisionOidcClientIdAliases: import_zod.z.boolean().default(true)
   }),
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),
@@ -187,55 +189,118 @@ async function provisionSuperTokensInfrastructure(config, oidcClients) {
   if (config.supertokens.apiKey) {
     headers["api-key"] = config.supertokens.apiKey;
   }
+  const provisionedClientIds = /* @__PURE__ */ new Set();
   for (const oidcClient of oidcClients) {
-    for (const credential of oidcClient.credentials ?? []) {
-      console.log(
-        `Provisioning SuperTokens OAuth2 Client: ${credential.client_id}`
+    const credentials = oidcClient.credentials ?? [];
+    for (const credential of credentials) {
+      await createSuperTokensOAuthClient({
+        config,
+        headers,
+        oidcClient,
+        clientId: credential.client_id,
+        clientSecret: resolveOidcClientSecret(
+          config,
+          credential.client_id,
+          credential.secret
+        ),
+        appVariantId: credential.app_variant_id,
+        provisionedClientIds
+      });
+    }
+    if (config.rownd.provisionOidcClientIdAliases && credentials.length > 0) {
+      const firstCredential = credentials[0];
+      if (!firstCredential) {
+        continue;
+      }
+      const firstCredentialSecret = resolveOidcClientSecret(
+        config,
+        firstCredential.client_id,
+        firstCredential.secret
       );
-      const oauthRes = await fetch(
-        new URL(
-          "/recipe/oauth/clients",
-          config.supertokens.connectionURI
-        ).toString(),
-        {
-          method: "POST",
-          headers,
-          body: JSON.stringify({
-            clientName: oidcClient.name || credential.client_id || "Rownd Client",
-            clientId: credential.client_id,
-            clientSecret: credential.secret,
-            redirectUris: oidcClient.config.redirect_uris || [],
-            postLogoutRedirectUris: oidcClient.config.post_logout_uris || [],
-            scope: oidcClient.config.allowed_scopes?.join(" "),
-            responseTypes: ["code", "token", "id_token"],
-            grantTypes: [
-              "authorization_code",
-              "refresh_token",
-              "client_credentials",
-              "implicit"
-            ],
-            tokenEndpointAuthMethod: oidcClient.config.token_endpoint_auth_method ?? "client_secret_basic",
-            audience: [`app:${config.rownd.appId}`],
-            metadata: {
-              rowndOidcClientId: oidcClient.id,
-              rowndAppVariantId: credential.app_variant_id || void 0,
-              rowndAllowedScopes: oidcClient.config.allowed_scopes || [],
-              rowndApplicationType: oidcClient.config.application_type,
-              rowndIsPkceRequired: oidcClient.config.is_pkce_required,
-              rowndIsPkceSupported: oidcClient.config.is_pkce_supported,
-              rowndDeviceFlowEnabled: oidcClient.config.device_flow_enabled
-            }
-          })
-        }
+      const aliasSecret = resolveOidcClientSecret(
+        config,
+        oidcClient.id,
+        firstCredentialSecret
       );
-      if (!oauthRes.ok) {
-        const errorText = await oauthRes.text();
-        if (!errorText.includes("already exists") && !errorText.includes("Duplicate")) {
-          throw new Error(
-            `Failed to create OAuth2 Client ${credential.client_id}: ${oauthRes.status} ${errorText}`
-          );
+      await createSuperTokensOAuthClient({
+        config,
+        headers,
+        oidcClient,
+        clientId: oidcClient.id,
+        clientSecret: aliasSecret,
+        isOidcClientIdAlias: true,
+        provisionedClientIds
+      });
+    }
+  }
+}
+function resolveOidcClientSecret(config, clientId, apiSecret) {
+  const secret = config.rownd.oidcClientSecrets?.[clientId] ?? apiSecret;
+  if (!secret) {
+    throw new Error(
+      `Missing plaintext secret for Rownd OIDC client ${clientId}. Add rownd.oidcClientSecrets.${clientId} to the config.`
+    );
+  }
+  if (secret.startsWith("$argon2")) {
+    throw new Error(
+      `Rownd returned a hashed secret for OIDC client ${clientId}. Add the plaintext secret under rownd.oidcClientSecrets.${clientId}.`
+    );
+  }
+  return secret;
+}
+async function createSuperTokensOAuthClient(input) {
+  if (input.provisionedClientIds.has(input.clientId)) {
+    return;
+  }
+  input.provisionedClientIds.add(input.clientId);
+  console.log(`Provisioning SuperTokens OAuth2 Client: ${input.clientId}`);
+  const grantTypes = [
+    "authorization_code",
+    "refresh_token",
+    "client_credentials",
+    "implicit"
+  ];
+  if (input.oidcClient.config.device_flow_enabled) {
+    grantTypes.push("urn:ietf:params:oauth:grant-type:device_code");
+  }
+  const oauthRes = await fetch(
+    new URL(
+      "/recipe/oauth/clients",
+      input.config.supertokens.connectionURI
+    ).toString(),
+    {
+      method: "POST",
+      headers: input.headers,
+      body: JSON.stringify({
+        clientName: input.oidcClient.name || input.clientId || "Rownd Client",
+        clientId: input.clientId,
+        clientSecret: input.clientSecret,
+        redirectUris: input.oidcClient.config.redirect_uris || [],
+        postLogoutRedirectUris: input.oidcClient.config.post_logout_uris || [],
+        scope: input.oidcClient.config.allowed_scopes?.join(" "),
+        responseTypes: ["code", "token", "id_token"],
+        grantTypes,
+        tokenEndpointAuthMethod: input.oidcClient.config.token_endpoint_auth_method ?? "client_secret_basic",
+        audience: [`app:${input.config.rownd.appId}`],
+        metadata: {
+          rowndOidcClientId: input.oidcClient.id,
+          rowndAppVariantId: input.appVariantId || void 0,
+          rowndAllowedScopes: input.oidcClient.config.allowed_scopes || [],
+          rowndApplicationType: input.oidcClient.config.application_type,
+          rowndIsPkceRequired: input.oidcClient.config.is_pkce_required,
+          rowndIsPkceSupported: input.oidcClient.config.is_pkce_supported,
+          rowndDeviceFlowEnabled: input.oidcClient.config.device_flow_enabled,
+          rowndIsOidcClientIdAlias: input.isOidcClientIdAlias || void 0
         }
-      }
+      })
+    }
+  );
+  if (!oauthRes.ok) {
+    const errorText = await oauthRes.text();
+    if (!errorText.includes("already exists") && !errorText.includes("Duplicate")) {
+      throw new Error(
+        `Failed to create OAuth2 Client ${input.clientId}: ${oauthRes.status} ${errorText}`
+      );
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supertokens-plugins/rownd-nodejs",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Rownd User Migration Plugin for SuperTokens",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",