@supertokens-plugins/rownd-nodejs 0.5.0 → 0.6.0

package/README.md

@@ -116,6 +116,7 @@ import { createMagicLinkWithConfirmationBypass } from "@supertokens-plugins/rown
 
 const magicLink = await createMagicLinkWithConfirmationBypass({
   email: "user@example.com",
+  tenantId: "tenant-a",
   clientDomain: "browser",
   redirectToPath: "/profile",
   displayContext: "browser",
@@ -126,7 +127,7 @@ const magicLink = await createMagicLinkWithConfirmationBypass({
 
 `clientDomain` must be a configured `clientDomains` key, not a raw domain. Omit it to use the SuperTokens website domain.
 
-Pass exactly one of `email` or `phoneNumber`. The helper returns the rewritten magic link with `bypassDeviceConfirmation=true`.
+Pass exactly one of `email` or `phoneNumber`. `tenantId` defaults to `public`. The helper returns the rewritten magic link with `bypassDeviceConfirmation=true`.
 
 Before skipping the cross-device confirmation prompt, the frontend should validate the callback against the plugin. Routes are mounted under your SuperTokens `apiBasePath`, which defaults to `/auth`.
 
@@ -141,16 +142,25 @@ If validation fails, the frontend should show the normal cross-device confirmati
 
 Routes are mounted under your SuperTokens `apiBasePath`, which defaults to `/auth`. The migration endpoint is the main Rownd-to-SuperTokens session handoff endpoint; the plugin also exposes Rownd-compatible app config, guest, user, metadata, field, and sign-out endpoints under `{apiBasePath}/plugin/rownd/...`.
 
+Unauthenticated migration and guest routes accept an optional `tenantId` query parameter. It defaults to `public`. SuperTokens Core validates the tenant when the operation runs. Authenticated identity-field and sign-out operations use the tenant from the current session; custom Rownd metadata remains global to the SuperTokens user.
+
 > [!IMPORTANT]
-> The plugin always migrates users and sessions into the `public` tenant.
 > Rownd users with multiple supported login methods are rejected unless SuperTokens account linking is enabled in the target environment.
 
 ### Migrate
 
 - **POST** `{apiBasePath}/plugin/rownd/migrate`
 - **Default**: `POST /auth/plugin/rownd/migrate`
+- **Non-public tenant**: `POST /auth/plugin/rownd/migrate?tenantId=tenant-a`
 - **Headers**: `Authorization: Bearer <Rownd_JWT>`. Header-token clients should also send `rid: session`, `fdi-version: 1.18`, and `st-auth-mode: header`.
-- **Description**: Validates the Rownd JWT, ensures the user is migrated to SuperTokens in the `public` tenant, syncs Rownd user data to SuperTokens UserMetadata, and then creates a new SuperTokens session for that user. Header-token clients must receive `st-access-token`, `st-refresh-token`, and `front-token` response headers.
+- **Description**: Validates the Rownd JWT, imports new users with their Rownd profile data, ensures the selected login method is associated with the requested SuperTokens tenant, and then creates a new SuperTokens session in that tenant. Header-token clients must receive `st-access-token`, `st-refresh-token`, and `front-token` response headers.
+
+### Guest
+
+- **POST** `{apiBasePath}/plugin/rownd/guest`
+- **Default**: `POST /auth/plugin/rownd/guest`
+- **Non-public tenant**: `POST /auth/plugin/rownd/guest?tenantId=tenant-a`
+- **Description**: Creates a guest or instant user and session in the requested tenant.
 
 ## Debug Logging
 
@@ -228,6 +238,8 @@ RowndMigrationPlugin.init({
 
 The package includes a bulk migration script for importing Rownd users into SuperTokens.
 
+Set `supertokens.tenantId` in the generated configuration to associate every imported login method with a non-public tenant. It defaults to `public` when omitted. Resuming from a checkpoint with a different tenant is rejected.
+
 The script runs from a YAML config file generated from the included template.
 
 ### Usage

package/dist/bulkMigrate.js

@@ -40,6 +40,7 @@ var fs2 = __toESM(require("fs/promises"));
 var import_zod2 = require("zod");
 
 // src/rownd-compatibility.ts
+var import_node_crypto = require("crypto");
 var import_supertokens_node = __toESM(require("supertokens-node"));
 var import_usermetadata = __toESM(require("supertokens-node/recipe/usermetadata"));
 
@@ -55,10 +56,15 @@ var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
   "google_id",
   "apple_id"
 ]);
+var SUPERTOKENS_FAKE_EMAIL_DOMAIN = "stfakeemail.supertokens.com";
+function buildSuperTokensFakeEmail(thirdPartyUserId, thirdPartyId) {
+  const hash = (0, import_node_crypto.createHash)("sha256").update(`${thirdPartyId}:${thirdPartyUserId}`).digest("hex").slice(0, 32);
+  return `st-${thirdPartyId}-${hash}@${SUPERTOKENS_FAKE_EMAIL_DOMAIN}`;
+}
 function isIdentityField(field) {
   return IDENTITY_USER_DATA_FIELDS.has(field);
 }
-function mapRowndUserToSuperTokens(rowndUser) {
+function mapRowndUserToSuperTokens(rowndUser, tenantId) {
   const loginMethods = [];
   const rowndUserData = rowndUser.data || {};
   const rowndUserVerifiedData = rowndUser.verified_data || {};
@@ -66,41 +72,41 @@ function mapRowndUserToSuperTokens(rowndUser) {
     throw new Error("Rownd user has no user_id");
   }
   if (rowndUserData.google_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Google user is missing email");
-    }
+    const googleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.google_id, "google");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.google_id
+      email: googleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.apple_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Apple user is missing email");
-    }
+    const appleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.apple_id, "apple");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.apple_id
+      email: appleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.phone_number) {
     loginMethods.push({
       recipeId: "passwordless",
       phoneNumber: rowndUserData.phone_number,
-      isVerified: !!rowndUserVerifiedData.phone_number
+      isVerified: !!rowndUserVerifiedData.phone_number,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.email && !rowndUserData.google_id && !rowndUserData.apple_id) {
     loginMethods.push({
       recipeId: "passwordless",
       email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.email
+      isVerified: !!rowndUserVerifiedData.email,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   let authLevel = rowndUser.auth_level;
@@ -112,7 +118,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId,
       thirdPartyUserId: rowndUserData.user_id,
       email: `${rowndUserData.user_id}@anonymous.local`,
-      isVerified: false
+      isVerified: false,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   const userMetadata = buildRowndUserMetadata(rowndUser);
@@ -159,12 +166,15 @@ var ConfigSchema = import_zod.z.object({
     appKey: import_zod.z.string(),
     appSecret: import_zod.z.string(),
     bearerToken: import_zod.z.string().optional(),
-    pageSize: import_zod.z.number().int().positive()
+    pageSize: import_zod.z.number().int().positive(),
+    oidcClientSecrets: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional(),
+    provisionOidcClientIdAliases: import_zod.z.boolean().default(true)
   }),
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),
     apiKey: import_zod.z.string().optional(),
-    batchSize: import_zod.z.number().int().positive()
+    batchSize: import_zod.z.number().int().positive(),
+    tenantId: import_zod.z.string().min(1).default("public")
   }),
   thirdPartyProviders: import_zod.z.array(
     import_zod.z.object({
@@ -362,6 +372,7 @@ Options:
 var CheckpointSchema = import_zod2.z.object({
   cursor: import_zod2.z.string().optional(),
   importedCount: import_zod2.z.number().int().nonnegative().optional(),
+  tenantId: import_zod2.z.string().optional(),
   updatedAt: import_zod2.z.string()
 });
 async function loadCheckpoint(checkpointFile) {
@@ -452,6 +463,11 @@ async function importUsersBatch(config, users, totalImportedBeforeBatch) {
 }
 async function migrateRowndUsersToSuperTokens(config) {
   const checkpoint = config.checkpoint.resume ? await loadCheckpoint(config.checkpoint.file) : null;
+  if (checkpoint && (checkpoint.tenantId ?? "public") !== config.supertokens.tenantId) {
+    throw new Error(
+      `Checkpoint tenant ${checkpoint.tenantId ?? "public"} does not match configured tenant ${config.supertokens.tenantId}`
+    );
+  }
   const failedMappingsFile = getFailedMappingsFilePath(config.checkpoint.file);
   let cursor = checkpoint?.cursor;
   let totalProcessed = 0;
@@ -485,7 +501,10 @@ async function migrateRowndUsersToSuperTokens(config) {
       try {
         mappedUsers.push({
           rowndUserId,
-          user: mapRowndUserToSuperTokens(rowndUser)
+          user: mapRowndUserToSuperTokens(
+            rowndUser,
+            config.supertokens.tenantId === "public" ? void 0 : config.supertokens.tenantId
+          )
         });
       } catch (error) {
         const errorMessage = error instanceof Error ? error.message : "Unknown mapping error";
@@ -507,6 +526,7 @@ async function migrateRowndUsersToSuperTokens(config) {
     await saveCheckpoint(config.checkpoint.file, {
       cursor,
       importedCount: totalImported,
+      tenantId: config.supertokens.tenantId,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
     console.log(`Processed ${totalProcessed} users so far`);

package/dist/generateAppConfig.js

@@ -61,12 +61,15 @@ var ConfigSchema = import_zod.z.object({
     appKey: import_zod.z.string(),
     appSecret: import_zod.z.string(),
     bearerToken: import_zod.z.string().optional(),
-    pageSize: import_zod.z.number().int().positive()
+    pageSize: import_zod.z.number().int().positive(),
+    oidcClientSecrets: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional(),
+    provisionOidcClientIdAliases: import_zod.z.boolean().default(true)
   }),
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),
     apiKey: import_zod.z.string().optional(),
-    batchSize: import_zod.z.number().int().positive()
+    batchSize: import_zod.z.number().int().positive(),
+    tenantId: import_zod.z.string().min(1).default("public")
   }),
   thirdPartyProviders: import_zod.z.array(
     import_zod.z.object({

package/dist/index.d.mts

@@ -746,6 +746,7 @@ type RowndUserMetadata = {
         field: string;
         value: string;
         created_at: string;
+        tenantId?: string;
     }>;
     [key: string]: unknown;
 };

package/dist/index.d.ts

@@ -746,6 +746,7 @@ type RowndUserMetadata = {
         field: string;
         value: string;
         created_at: string;
+        tenantId?: string;
     }>;
     [key: string]: unknown;
 };