@supertokens-plugins/rownd-nodejs 0.5.0 → 0.6.0

package/dist/index.mjs

@@ -616,12 +616,11 @@ function createLoggerConfig() {
 }
 var config = createLoggerConfig();
 var logger = common_default(config);
-var formatters = logger.formatters;
-if (formatters) {
-  formatters.o = function(value) {
+if (logger.formatters) {
+  logger.formatters.o = function(value) {
     return util.inspect(value, { colors: this.useColors, compact: true }).split("\n").map((line) => line.trim()).join(" ");
   };
-  formatters.O = function(value) {
+  logger.formatters.O = function(value) {
     return util.inspect(value, { colors: this.useColors, compact: false });
   };
 }
@@ -843,6 +842,10 @@ var RowndPluginError = class extends Error {
 };
 
 // src/utils.ts
+var ROWND_OAUTH_LOGIN_CHALLENGE_PARAM = "rownd_oauth_login_challenge";
+function resolveTenantId(req) {
+  return req.getKeyValueFromQuery("tenantId") || PUBLIC_TENANT_ID;
+}
 function rewriteLinkPath(inputUrl, targetPath, searchParams) {
   try {
     const url = new URL(inputUrl);
@@ -1043,7 +1046,8 @@ function getMagicLinkBootstrapParams(input) {
     ...input.appVariantId ? { appVariantId: input.appVariantId } : {},
     ...input.displayContext ? { displayContext: input.displayContext } : {},
     ...input.redirectToPath ? { redirectToPath: input.redirectToPath } : {},
-    ...input.clientDomainKey ? { clientDomain: input.clientDomainKey } : {}
+    ...input.clientDomainKey ? { clientDomain: input.clientDomainKey } : {},
+    ...input.oauthLoginChallenge ? { oauthLoginChallenge: input.oauthLoginChallenge } : {}
   };
 }
 function rewriteMagicLink(input) {
@@ -1069,6 +1073,10 @@ function getRequestedRedirectToPathFromRequest(req) {
   const redirectToPath = req.getKeyValueFromQuery("rownd_redirect_to_path");
   return typeof redirectToPath === "string" && redirectToPath.length > 0 ? redirectToPath : void 0;
 }
+function getRequestedOAuthLoginChallengeFromRequest(req) {
+  const loginChallenge = req.getKeyValueFromQuery(ROWND_OAUTH_LOGIN_CHALLENGE_PARAM);
+  return typeof loginChallenge === "string" && loginChallenge.length > 0 ? loginChallenge : void 0;
+}
 
 // src/config.ts
 var pluginConfig;
@@ -1441,6 +1449,7 @@ function buildAuthMobileConfig(authMobile) {
 }
 
 // src/rownd-compatibility.ts
+import { createHash } from "crypto";
 import SuperTokens from "supertokens-node";
 import UserMetadata2 from "supertokens-node/recipe/usermetadata";
 var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
@@ -1454,13 +1463,21 @@ var INTERNAL_METADATA_FIELDS = /* @__PURE__ */ new Set([
   "original_rownd_user",
   "rownd_pending_verification"
 ]);
+var SUPERTOKENS_FAKE_EMAIL_DOMAIN = "stfakeemail.supertokens.com";
+function isSuperTokensFakeEmail(email) {
+  return typeof email === "string" && email.toLowerCase().endsWith(`@${SUPERTOKENS_FAKE_EMAIL_DOMAIN}`);
+}
+function buildSuperTokensFakeEmail(thirdPartyUserId, thirdPartyId) {
+  const hash = createHash("sha256").update(`${thirdPartyId}:${thirdPartyUserId}`).digest("hex").slice(0, 32);
+  return `st-${thirdPartyId}-${hash}@${SUPERTOKENS_FAKE_EMAIL_DOMAIN}`;
+}
 function isIdentityField(field) {
   return IDENTITY_USER_DATA_FIELDS.has(field);
 }
 function isInternalMetadataField(field) {
   return INTERNAL_METADATA_FIELDS.has(field);
 }
-function mapRowndUserToSuperTokens(rowndUser) {
+function mapRowndUserToSuperTokens(rowndUser, tenantId) {
   const loginMethods = [];
   const rowndUserData = rowndUser.data || {};
   const rowndUserVerifiedData = rowndUser.verified_data || {};
@@ -1468,41 +1485,41 @@ function mapRowndUserToSuperTokens(rowndUser) {
     throw new Error("Rownd user has no user_id");
   }
   if (rowndUserData.google_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Google user is missing email");
-    }
+    const googleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.google_id, "google");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.google_id
+      email: googleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.apple_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Apple user is missing email");
-    }
+    const appleEmail = rowndUserData.email ?? buildSuperTokensFakeEmail(rowndUserData.apple_id, "apple");
     loginMethods.push({
       recipeId: "thirdparty",
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.apple_id
+      email: appleEmail,
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.phone_number) {
     loginMethods.push({
       recipeId: "passwordless",
       phoneNumber: rowndUserData.phone_number,
-      isVerified: !!rowndUserVerifiedData.phone_number
+      isVerified: !!rowndUserVerifiedData.phone_number,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.email && !rowndUserData.google_id && !rowndUserData.apple_id) {
     loginMethods.push({
       recipeId: "passwordless",
       email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.email
+      isVerified: !!rowndUserVerifiedData.email,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   let authLevel = rowndUser.auth_level;
@@ -1514,7 +1531,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId,
       thirdPartyUserId: rowndUserData.user_id,
       email: `${rowndUserData.user_id}@anonymous.local`,
-      isVerified: false
+      isVerified: false,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   const userMetadata = buildRowndUserMetadata(rowndUser);
@@ -1673,7 +1691,7 @@ async function buildStandardOAuthClaims(user, scopes) {
   const rowndData = isJsonRecord(metadata.original_rownd_user?.data) ? metadata.original_rownd_user.data : {};
   const verifiedData = isJsonRecord(metadata.original_rownd_user?.verified_data) ? metadata.original_rownd_user.verified_data : {};
   if (scopes.includes("email")) {
-    const email = firstString(rowndData.email) ?? user.emails[0];
+    const email = firstRealEmail(firstString(rowndData.email), ...user.emails);
     if (email) {
       claims.email = email;
       claims.email_verified = isOAuthClaimVerified(
@@ -1740,6 +1758,11 @@ function firstString(value) {
   }
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
+function firstRealEmail(...values) {
+  return values.find((entry) => {
+    return typeof entry === "string" && entry.length > 0 && !isSuperTokensFakeEmail(entry);
+  });
+}
 function isOAuthClaimVerified(value, expectedValue, fallback) {
   return value === true || value === expectedValue || fallback;
 }
@@ -2023,6 +2046,7 @@ async function createMagicLinkWithConfirmationBypass(input) {
   })}${getAppInfoString(stConfig.appInfo.websiteBasePath)}/verify?preAuthSessionId=${encodeURIComponent(
     codeInfo.preAuthSessionId
   )}&tenantId=${encodeURIComponent(tenantId)}#${encodeURIComponent(codeInfo.linkCode)}`;
+  const oauthLoginChallenge = userContext.rowndOAuthLoginChallenge;
   const rewrittenUrl = new URL(rewriteMagicLink({
     magicLink,
     clientDomain,
@@ -2033,7 +2057,8 @@ async function createMagicLinkWithConfirmationBypass(input) {
       appVariantId,
       displayContext: input.displayContext,
       redirectToPath,
-      clientDomainKey: input.clientDomain
+      clientDomainKey: input.clientDomain,
+      oauthLoginChallenge: typeof oauthLoginChallenge === "string" ? oauthLoginChallenge : void 0
     })
   }));
   rewrittenUrl.searchParams.set(PASSWORDLESS_BYPASS_DEVICE_CONFIRMATION_PARAM, "true");
@@ -2053,7 +2078,7 @@ function getPendingVerifications(metadata) {
 function isPendingVerification(value) {
   return isRecord(value) && typeof value.id === "string" && typeof value.field === "string" && typeof value.value === "string" && typeof value.created_at === "string";
 }
-async function getUserById(userId) {
+async function getUserById(userId, tenantId = PUBLIC_TENANT_ID) {
   const metadata = await getUserMetadata(userId);
   const stUser = await SuperTokens2.getUser(userId);
   if (!stUser) {
@@ -2082,9 +2107,12 @@ async function getUserById(userId) {
   const verifiedData = {
     ...originalRowndUser?.verified_data || {}
   };
-  for (const method of stUser.loginMethods) {
+  const tenantLoginMethods = stUser.loginMethods.filter(
+    (method) => method.tenantIds.includes(tenantId)
+  );
+  for (const method of tenantLoginMethods) {
     if (method.recipeId === "passwordless") {
-      if (method.email) {
+      if (method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
         if (data.email === void 0) data.email = method.email;
       }
@@ -2096,10 +2124,10 @@ async function getUserById(userId) {
     } else if (method.recipeId === "thirdparty") {
       const thirdPartyId = getThirdPartyId(method);
       const thirdPartyUserId = getThirdPartyUserId(method);
-      if (method.verified && method.email) {
+      if (method.verified && method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
       }
-      if (method.email && data.email === void 0) {
+      if (method.email && !isSuperTokensFakeEmail(method.email) && data.email === void 0) {
         data.email = method.email;
       }
       if (thirdPartyId === "google" && thirdPartyUserId) {
@@ -2111,7 +2139,7 @@ async function getUserById(userId) {
         verifiedData.apple_id = thirdPartyUserId;
       }
     } else if (method.recipeId === "emailpassword") {
-      if (method.email && data.email === void 0) {
+      if (method.email && !isSuperTokensFakeEmail(method.email) && data.email === void 0) {
         data.email = method.email;
       }
     }
@@ -2122,12 +2150,16 @@ async function getUserById(userId) {
   if (verifiedData.phone_number === true && typeof data.phone_number === "string") {
     verifiedData.phone_number = data.phone_number;
   }
-  const anonymousId = getAnonymousId(stUser.id, stUser, metadata);
+  const tenantUser = {
+    ...stUser,
+    loginMethods: tenantLoginMethods
+  };
+  const anonymousId = getAnonymousId(stUser.id, tenantUser, metadata);
   if (anonymousId && data.anonymous_id === void 0) {
     data.anonymous_id = anonymousId;
   }
   const authLevel = getEffectiveAuthLevel(
-    stUser,
+    tenantUser,
     originalRowndUser?.auth_level,
     verifiedData
   );
@@ -2136,15 +2168,15 @@ async function getUserById(userId) {
       data[key] = "";
     }
   }
-  const sortedByJoined = [...stUser.loginMethods].sort(
+  const sortedByJoined = [...tenantLoginMethods].sort(
     (a, b) => a.timeJoined - b.timeJoined
   );
-  const latestSessionInfo = await getLatestSessionInfo(stUser.id);
+  const latestSessionInfo = await getLatestSessionInfo(stUser.id, tenantId);
   const firstMethod = sortedByJoined[0];
   const latestSessionRecipeUserId = latestSessionInfo?.recipeUserId.getAsString();
   const lastMethod = latestSessionRecipeUserId ? stUser.loginMethods.find(
     (method) => method.recipeUserId.getAsString() === latestSessionRecipeUserId
-  ) : [...stUser.loginMethods].sort((a, b) => b.timeJoined - a.timeJoined)[0];
+  ) : [...tenantLoginMethods].sort((a, b) => b.timeJoined - a.timeJoined)[0];
   const lastSignInAt = latestSessionInfo?.timeCreated ?? stUser.timeJoined;
   const metadataMeta = Object.fromEntries(
     Object.entries(metadata).filter(
@@ -2172,11 +2204,11 @@ async function getUserById(userId) {
     attributes: originalRowndUser?.attributes || {}
   };
 }
-async function getLatestSessionInfo(userId) {
+async function getLatestSessionInfo(userId, tenantId) {
   const sessionHandles = await Session.getAllSessionHandlesForUser(
     userId,
     true,
-    PUBLIC_TENANT_ID
+    tenantId
   );
   const sessionInfos = await Promise.all(
     sessionHandles.map(
@@ -2191,21 +2223,21 @@ async function getLatestSessionInfo(userId) {
   }
   return latestSessionInfo;
 }
-async function updateUserData(userId, inputData) {
+async function updateUserData(userId, inputData, tenantId = PUBLIC_TENANT_ID) {
   const metadata = await getUserMetadata(userId);
   const updatedMetadata = {
     ...metadata,
     ...inputData
   };
   await UserMetadata3.updateUserMetadata(userId, updatedMetadata);
-  return getUserById(userId);
+  return getUserById(userId, tenantId);
 }
 async function startPendingEmailVerification(input) {
   const metadata = await getUserMetadata(input.userId);
-  const currentEmail = (await getUserById(input.userId)).data.email;
+  const currentEmail = (await getUserById(input.userId, input.tenantId)).data.email;
   const pendingVerifications = getPendingVerifications(metadata);
   const pendingEmailVerifications = pendingVerifications.filter(
-    (pendingVerification2) => pendingVerification2.field === "email"
+    (pendingVerification2) => pendingVerification2.field === "email" && (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) === input.tenantId
   );
   if (currentEmail === input.email) {
     for (const pendingVerification2 of pendingEmailVerifications) {
@@ -2220,11 +2252,11 @@ async function startPendingEmailVerification(input) {
       await UserMetadata3.updateUserMetadata(input.userId, {
         ...metadata,
         rownd_pending_verification: pendingVerifications.filter(
-          (pendingVerification2) => pendingVerification2.field !== "email"
+          (pendingVerification2) => pendingVerification2.field !== "email" || (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) !== input.tenantId
         )
       });
     }
-    return getUserById(input.userId);
+    return getUserById(input.userId, input.tenantId);
   }
   for (const pendingVerification2 of pendingEmailVerifications) {
     await EmailVerification.revokeEmailVerificationTokens(
@@ -2238,13 +2270,14 @@ async function startPendingEmailVerification(input) {
     id: input.pendingVerificationId,
     field: "email",
     value: input.email,
-    created_at: (/* @__PURE__ */ new Date()).toISOString()
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    tenantId: input.tenantId
   };
   await UserMetadata3.updateUserMetadata(input.userId, {
     ...metadata,
     rownd_pending_verification: [
       ...pendingVerifications.filter(
-        (pendingVerification2) => pendingVerification2.field !== "email"
+        (pendingVerification2) => pendingVerification2.field !== "email" || (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) !== input.tenantId
       ),
       pendingVerification
     ]
@@ -2263,12 +2296,14 @@ async function startPendingEmailVerification(input) {
     await completePendingEmailVerification({
       recipeUserId: input.recipeUserId,
       email: input.email,
+      tenantId: input.tenantId,
       userContext: input.userContext
     });
   }
-  return getUserById(input.userId);
+  return getUserById(input.userId, input.tenantId);
 }
 async function completePendingEmailVerification(input) {
+  const tenantId = input.tenantId ?? PUBLIC_TENANT_ID;
   const user = await SuperTokens2.getUser(
     input.recipeUserId.getAsString(),
     input.userContext
@@ -2279,7 +2314,8 @@ async function completePendingEmailVerification(input) {
   const pendingVerification = pendingVerifications.find(
     (pendingVerification2) => isMatchingPendingEmailVerification(
       pendingVerification2,
-      input.email
+      input.email,
+      tenantId
     )
   );
   if (!pendingVerification) {
@@ -2287,7 +2323,12 @@ async function completePendingEmailVerification(input) {
   }
   let metadataUserId = userId;
   let verifiedRecipeUserId = input.recipeUserId;
-  const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(user);
+  const tenantLoginMethods = user?.loginMethods.filter(
+    (method) => method.tenantIds.includes(tenantId)
+  ) ?? [];
+  const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(
+    tenantLoginMethods
+  );
   if (passwordlessEmailMethod) {
     const updateResult = await Passwordless.updateUser({
       recipeUserId: passwordlessEmailMethod.recipeUserId,
@@ -2300,9 +2341,9 @@ async function completePendingEmailVerification(input) {
       );
     }
     verifiedRecipeUserId = passwordlessEmailMethod.recipeUserId;
-  } else if (hasOnlyGuestLoginMethods(user)) {
+  } else if (hasOnlyGuestLoginMethods(user ? { ...user, loginMethods: tenantLoginMethods } : user)) {
     const isPasswordlessSignUpAllowed = await AccountLinking.isSignUpAllowed(
-      PUBLIC_TENANT_ID,
+      tenantId,
       {
         recipeId: "passwordless",
         email: input.email
@@ -2316,7 +2357,7 @@ async function completePendingEmailVerification(input) {
     }
     const passwordlessUser = await Passwordless.signInUp({
       email: input.email,
-      tenantId: PUBLIC_TENANT_ID,
+      tenantId,
       userContext: input.userContext
     });
     verifiedRecipeUserId = passwordlessUser.recipeUserId;
@@ -2360,7 +2401,8 @@ async function completePendingEmailVerification(input) {
     rownd_pending_verification: targetPendingVerifications.filter(
       (verification) => !isMatchingPendingEmailVerification(
         verification,
-        input.email
+        input.email,
+        tenantId
       )
     )
   };
@@ -2370,8 +2412,8 @@ async function completePendingEmailVerification(input) {
     recipeUserId: verifiedRecipeUserId
   };
 }
-function isMatchingPendingEmailVerification(verification, email) {
-  return verification.field === "email" && verification.value === email;
+function isMatchingPendingEmailVerification(verification, email, tenantId) {
+  return verification.field === "email" && verification.value === email && (verification.tenantId ?? PUBLIC_TENANT_ID) === tenantId;
 }
 async function updateUserMetadata(userId, inputMeta) {
   const metadata = await getUserMetadata(userId);
@@ -2389,8 +2431,8 @@ async function updateUserMetadata(userId, inputMeta) {
     )
   };
 }
-function getPasswordlessEmailLoginMethod(user) {
-  return user?.loginMethods.find((method) => {
+function getPasswordlessEmailLoginMethod(loginMethods) {
+  return loginMethods.find((method) => {
     return method.recipeId === "passwordless" && !!method.email;
   });
 }
@@ -2400,6 +2442,7 @@ import { randomUUID } from "crypto";
 import SuperTokens3 from "supertokens-node";
 import Session2 from "supertokens-node/recipe/session";
 import ThirdParty from "supertokens-node/recipe/thirdparty";
+import MultiTenancy from "supertokens-node/recipe/multitenancy";
 function isBodyString(body, key) {
   return isRecord(body) && typeof body[key] === "string" && body[key].length > 0;
 }
@@ -2464,7 +2507,9 @@ function handleGuestLogin(deps) {
   return async (req, res, _session, userContext) => {
     const startedAt = Date.now();
     const guestId = `guest_${randomUUID()}`;
+    let tenantId;
     try {
+      tenantId = resolveTenantId(req);
       const body = parseGuestBody(await getJsonBody(req));
       const appVariantId = getRequestedAppVariantIdFromRequest(req);
       assertRowndAppVariantIsConfigured(appVariantId);
@@ -2472,7 +2517,7 @@ function handleGuestLogin(deps) {
       const thirdPartyUserId = thirdPartyId === INSTANT_AUTH_METHOD_ID ? `anon_${randomUUID()}` : guestId;
       const authLevel = thirdPartyId === INSTANT_AUTH_METHOD_ID ? INSTANT_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
       const response = await ThirdParty.manuallyCreateOrUpdateUser(
-        PUBLIC_TENANT_ID,
+        tenantId,
         thirdPartyId,
         thirdPartyUserId,
         `${thirdPartyUserId}@anonymous.local`,
@@ -2488,7 +2533,7 @@ function handleGuestLogin(deps) {
       await Session2.createNewSession(
         req,
         res,
-        PUBLIC_TENANT_ID,
+        tenantId,
         response.recipeUserId,
         {
           ...buildRowndAudience({}, appVariantId),
@@ -2503,7 +2548,7 @@ function handleGuestLogin(deps) {
       deps.telemetryClient.recordSuccess({
         outcome: "success",
         durationMs: Date.now() - startedAt,
-        tenantId: PUBLIC_TENANT_ID,
+        tenantId,
         superTokensUserId: response.user.id
       });
       return {
@@ -2515,7 +2560,7 @@ function handleGuestLogin(deps) {
       deps.telemetryClient.recordError({
         error,
         startedAt,
-        tenantId: PUBLIC_TENANT_ID
+        tenantId
       });
       return {
         status: "ERROR",
@@ -2527,7 +2572,7 @@ function handleGuestLogin(deps) {
 function handleMigrate(deps) {
   return async (req, res, _session, userContext) => {
     const startedAt = Date.now();
-    let tenantId = PUBLIC_TENANT_ID;
+    let tenantId;
     let rowndUserId;
     let superTokensUserId;
     let user;
@@ -2536,6 +2581,7 @@ function handleMigrate(deps) {
       if (!deps.stConfig.supertokens) {
         throw new Error("Supertokens config not found");
       }
+      tenantId = resolveTenantId(req);
       const parsed = await parseRequest(req);
       const appVariantId = getRequestedAppVariantIdFromRequest(req);
       assertRowndAppVariantIsConfigured(appVariantId);
@@ -2543,13 +2589,16 @@ function handleMigrate(deps) {
       const rowndUser = await fetchOptionalRowndUserInfo(rowndUserId);
       if (!rowndUser) {
         logDebugMessage(
-          `Skipping migration because user does not exist in Rownd. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `Skipping migration because user does not exist in Rownd. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
         return { status: "OK" };
       }
       user = await SuperTokens3.getUser(rowndUserId, userContext);
       if (!user) {
-        const stUserImport = mapRowndUserToSuperTokens(rowndUser);
+        const stUserImport = mapRowndUserToSuperTokens(
+          rowndUser,
+          tenantId === PUBLIC_TENANT_ID ? void 0 : tenantId
+        );
         try {
           await importUser(stUserImport, deps.stConfig.supertokens);
           clearSuperTokensCoreCallCache(userContext);
@@ -2567,29 +2616,43 @@ function handleMigrate(deps) {
           superTokensUserId = user.id;
           recipeUserId = user.loginMethods[0]?.recipeUserId;
           logDebugMessage(
-            `User already migrated (race condition). tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+            `User already migrated (race condition). tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
           );
         }
         logDebugMessage(
-          `User migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `User migrated successfully. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
       } else {
         superTokensUserId = user.id;
         recipeUserId = user.loginMethods[0]?.recipeUserId;
         logDebugMessage(
-          `User already migrated. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `User already migrated. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
       }
       if (superTokensUserId) {
         await recordRowndAppVariantForUser(superTokensUserId, appVariantId);
       }
+      const tenantLoginMethod = user?.loginMethods.find(
+        (method) => method.tenantIds.includes(tenantId)
+      );
+      recipeUserId = tenantLoginMethod?.recipeUserId ?? recipeUserId;
       if (!recipeUserId) {
         throw new Error("User not found or has no login methods");
       }
+      if (!tenantLoginMethod) {
+        const associationResult = await MultiTenancy.associateUserToTenant(
+          tenantId,
+          recipeUserId,
+          userContext
+        );
+        if (associationResult.status !== "OK") {
+          throw new Error(`Failed to associate migrated user with tenant: ${associationResult.status}`);
+        }
+      }
       await Session2.createNewSession(
         req,
         res,
-        PUBLIC_TENANT_ID,
+        tenantId,
         recipeUserId,
         {
           ...buildRowndAudience({}, appVariantId)
@@ -2598,7 +2661,7 @@ function handleMigrate(deps) {
         userContext
       );
       logDebugMessage(
-        `Session migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, userId: ${superTokensUserId}`
+        `Session migrated successfully. tenantId: ${tenantId}, userId: ${superTokensUserId}`
       );
       deps.telemetryClient.recordSuccess({
         outcome: "success",
@@ -2632,7 +2695,7 @@ function clearSuperTokensCoreCallCache(userContext) {
 }
 function handleGetUser() {
   return async (_req, _res, session) => {
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       ...user
@@ -2658,7 +2721,11 @@ function handleUpdateUser() {
       return permissionError;
     }
     if (Object.keys(dataWithoutEmail).length > 0) {
-      await updateUserData(session.getUserId(), dataWithoutEmail);
+      await updateUserData(
+        session.getUserId(),
+        dataWithoutEmail,
+        session.getTenantId()
+      );
     }
     if (hasEmailUpdate) {
       const pendingVerificationResult = await startPendingEmailVerification({
@@ -2674,7 +2741,7 @@ function handleUpdateUser() {
         ...pendingVerificationResult
       };
     }
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       ...user
@@ -2741,7 +2808,7 @@ function handleGetUserField() {
     if (!field) {
       return missingFieldResponse();
     }
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       value: user.data[field]
@@ -2775,9 +2842,11 @@ function handleUpdateUserField() {
     if (permissionError) {
       return permissionError;
     }
-    const updateUserDataResult = await updateUserData(session.getUserId(), {
-      [field]: payload.value
-    });
+    const updateUserDataResult = await updateUserData(
+      session.getUserId(),
+      { [field]: payload.value },
+      session.getTenantId()
+    );
     return {
       status: "OK",
       ...updateUserDataResult
@@ -2816,6 +2885,7 @@ var init = createPluginInitFunction(
       const displayContext = input?.userContext?.rowndDisplayContext;
       const redirectToPath = input?.userContext?.rowndRedirectToPath;
       const clientDomain = input?.userContext?.rowndClientDomain;
+      const oauthLoginChallenge = input?.userContext?.rowndOAuthLoginChallenge;
       const clientDomainKey = clientDomain ?? (displayContext === "mobile_app" ? "mobile" : "browser");
       const clientBaseUrl = pluginConfig2.clientDomains?.[clientDomainKey];
       const bootstrapParams = {
@@ -2823,7 +2893,8 @@ var init = createPluginInitFunction(
         ...hubBootstrapParams ?? {},
         ...typeof appVariantId === "string" ? { appVariantId } : {},
         ...typeof displayContext === "string" ? { displayContext } : {},
-        ...typeof redirectToPath === "string" ? { redirectToPath } : {}
+        ...typeof redirectToPath === "string" ? { redirectToPath } : {},
+        ...typeof oauthLoginChallenge === "string" ? { oauthLoginChallenge } : {}
       };
       const rewrittenLink = input[linkKey] ? clientBaseUrl ? rewriteLinkToBaseUrl(
         input[linkKey],
@@ -3109,6 +3180,12 @@ var init = createPluginInitFunction(
               if (appVariantId) {
                 input.userContext.rowndAppVariantId = appVariantId;
               }
+              const oauthLoginChallenge = getRequestedOAuthLoginChallengeFromRequest(
+                input.options.req
+              );
+              if (oauthLoginChallenge) {
+                input.userContext.rowndOAuthLoginChallenge = oauthLoginChallenge;
+              }
               assertRowndAppVariantIsConfigured(appVariantId);
               return originalImplementation.createCodePOST(input);
             },
@@ -3252,6 +3329,7 @@ var init = createPluginInitFunction(
                 const verificationResult = await completePendingEmailVerification({
                   recipeUserId: response.user.recipeUserId,
                   email: response.user.email,
+                  tenantId: input.tenantId,
                   userContext: input.userContext
                 });
                 const session = input.session;

package/dist/initConfig.js

@@ -49,10 +49,22 @@ rownd:
   # bearerToken: <ROWND_API_BEARER_TOKEN>
   # Number of Rownd users to request per page.
   pageSize: 100
+  # Rownd stores existing OIDC credential secrets hashed. Provide plaintext
+  # values here when migrating OIDC clients. Keys can be credential client IDs
+  # (key_...) and OIDC client configuration IDs (oc_...).
+  oidcClientSecrets: {}
+  # oidcClientSecrets:
+  #   key_123: ras_plaintext_secret
+  #   oc_123: ras_plaintext_secret_for_oidc_client_id_alias
+  # Rownd accepts the OIDC client configuration ID (oc_...) as a client_id in
+  # addition to each linked credential client_id (key_...).
+  provisionOidcClientIdAliases: true
 
 supertokens:
   connectionURI: <CONNECTION_URI>
   apiKey: <API_KEY>
+  # Tenant that receives every imported login method.
+  tenantId: public
   # Number of users to send to SuperTokens per bulk import request.
   batchSize: 500
 `;