@supertokens-plugins/rownd-nodejs 0.5.1 → 0.6.0

package/README.md

@@ -116,6 +116,7 @@ import { createMagicLinkWithConfirmationBypass } from "@supertokens-plugins/rown
 
 const magicLink = await createMagicLinkWithConfirmationBypass({
   email: "user@example.com",
+  tenantId: "tenant-a",
   clientDomain: "browser",
   redirectToPath: "/profile",
   displayContext: "browser",
@@ -126,7 +127,7 @@ const magicLink = await createMagicLinkWithConfirmationBypass({
 
 `clientDomain` must be a configured `clientDomains` key, not a raw domain. Omit it to use the SuperTokens website domain.
 
-Pass exactly one of `email` or `phoneNumber`. The helper returns the rewritten magic link with `bypassDeviceConfirmation=true`.
+Pass exactly one of `email` or `phoneNumber`. `tenantId` defaults to `public`. The helper returns the rewritten magic link with `bypassDeviceConfirmation=true`.
 
 Before skipping the cross-device confirmation prompt, the frontend should validate the callback against the plugin. Routes are mounted under your SuperTokens `apiBasePath`, which defaults to `/auth`.
 
@@ -141,16 +142,25 @@ If validation fails, the frontend should show the normal cross-device confirmati
 
 Routes are mounted under your SuperTokens `apiBasePath`, which defaults to `/auth`. The migration endpoint is the main Rownd-to-SuperTokens session handoff endpoint; the plugin also exposes Rownd-compatible app config, guest, user, metadata, field, and sign-out endpoints under `{apiBasePath}/plugin/rownd/...`.
 
+Unauthenticated migration and guest routes accept an optional `tenantId` query parameter. It defaults to `public`. SuperTokens Core validates the tenant when the operation runs. Authenticated identity-field and sign-out operations use the tenant from the current session; custom Rownd metadata remains global to the SuperTokens user.
+
 > [!IMPORTANT]
-> The plugin always migrates users and sessions into the `public` tenant.
 > Rownd users with multiple supported login methods are rejected unless SuperTokens account linking is enabled in the target environment.
 
 ### Migrate
 
 - **POST** `{apiBasePath}/plugin/rownd/migrate`
 - **Default**: `POST /auth/plugin/rownd/migrate`
+- **Non-public tenant**: `POST /auth/plugin/rownd/migrate?tenantId=tenant-a`
 - **Headers**: `Authorization: Bearer <Rownd_JWT>`. Header-token clients should also send `rid: session`, `fdi-version: 1.18`, and `st-auth-mode: header`.
-- **Description**: Validates the Rownd JWT, ensures the user is migrated to SuperTokens in the `public` tenant, syncs Rownd user data to SuperTokens UserMetadata, and then creates a new SuperTokens session for that user. Header-token clients must receive `st-access-token`, `st-refresh-token`, and `front-token` response headers.
+- **Description**: Validates the Rownd JWT, imports new users with their Rownd profile data, ensures the selected login method is associated with the requested SuperTokens tenant, and then creates a new SuperTokens session in that tenant. Header-token clients must receive `st-access-token`, `st-refresh-token`, and `front-token` response headers.
+
+### Guest
+
+- **POST** `{apiBasePath}/plugin/rownd/guest`
+- **Default**: `POST /auth/plugin/rownd/guest`
+- **Non-public tenant**: `POST /auth/plugin/rownd/guest?tenantId=tenant-a`
+- **Description**: Creates a guest or instant user and session in the requested tenant.
 
 ## Debug Logging
 
@@ -228,6 +238,8 @@ RowndMigrationPlugin.init({
 
 The package includes a bulk migration script for importing Rownd users into SuperTokens.
 
+Set `supertokens.tenantId` in the generated configuration to associate every imported login method with a non-public tenant. It defaults to `public` when omitted. Resuming from a checkpoint with a different tenant is rejected.
+
 The script runs from a YAML config file generated from the included template.
 
 ### Usage

package/dist/bulkMigrate.js

@@ -64,7 +64,7 @@ function buildSuperTokensFakeEmail(thirdPartyUserId, thirdPartyId) {
 function isIdentityField(field) {
   return IDENTITY_USER_DATA_FIELDS.has(field);
 }
-function mapRowndUserToSuperTokens(rowndUser) {
+function mapRowndUserToSuperTokens(rowndUser, tenantId) {
   const loginMethods = [];
   const rowndUserData = rowndUser.data || {};
   const rowndUserVerifiedData = rowndUser.verified_data || {};
@@ -78,7 +78,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
       email: googleEmail,
-      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.apple_id) {
@@ -88,21 +89,24 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
       email: appleEmail,
-      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.phone_number) {
     loginMethods.push({
       recipeId: "passwordless",
       phoneNumber: rowndUserData.phone_number,
-      isVerified: !!rowndUserVerifiedData.phone_number
+      isVerified: !!rowndUserVerifiedData.phone_number,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.email && !rowndUserData.google_id && !rowndUserData.apple_id) {
     loginMethods.push({
       recipeId: "passwordless",
       email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.email
+      isVerified: !!rowndUserVerifiedData.email,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   let authLevel = rowndUser.auth_level;
@@ -114,7 +118,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId,
       thirdPartyUserId: rowndUserData.user_id,
       email: `${rowndUserData.user_id}@anonymous.local`,
-      isVerified: false
+      isVerified: false,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   const userMetadata = buildRowndUserMetadata(rowndUser);
@@ -168,7 +173,8 @@ var ConfigSchema = import_zod.z.object({
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),
     apiKey: import_zod.z.string().optional(),
-    batchSize: import_zod.z.number().int().positive()
+    batchSize: import_zod.z.number().int().positive(),
+    tenantId: import_zod.z.string().min(1).default("public")
   }),
   thirdPartyProviders: import_zod.z.array(
     import_zod.z.object({
@@ -366,6 +372,7 @@ Options:
 var CheckpointSchema = import_zod2.z.object({
   cursor: import_zod2.z.string().optional(),
   importedCount: import_zod2.z.number().int().nonnegative().optional(),
+  tenantId: import_zod2.z.string().optional(),
   updatedAt: import_zod2.z.string()
 });
 async function loadCheckpoint(checkpointFile) {
@@ -456,6 +463,11 @@ async function importUsersBatch(config, users, totalImportedBeforeBatch) {
 }
 async function migrateRowndUsersToSuperTokens(config) {
   const checkpoint = config.checkpoint.resume ? await loadCheckpoint(config.checkpoint.file) : null;
+  if (checkpoint && (checkpoint.tenantId ?? "public") !== config.supertokens.tenantId) {
+    throw new Error(
+      `Checkpoint tenant ${checkpoint.tenantId ?? "public"} does not match configured tenant ${config.supertokens.tenantId}`
+    );
+  }
   const failedMappingsFile = getFailedMappingsFilePath(config.checkpoint.file);
   let cursor = checkpoint?.cursor;
   let totalProcessed = 0;
@@ -489,7 +501,10 @@ async function migrateRowndUsersToSuperTokens(config) {
       try {
         mappedUsers.push({
           rowndUserId,
-          user: mapRowndUserToSuperTokens(rowndUser)
+          user: mapRowndUserToSuperTokens(
+            rowndUser,
+            config.supertokens.tenantId === "public" ? void 0 : config.supertokens.tenantId
+          )
         });
       } catch (error) {
         const errorMessage = error instanceof Error ? error.message : "Unknown mapping error";
@@ -511,6 +526,7 @@ async function migrateRowndUsersToSuperTokens(config) {
     await saveCheckpoint(config.checkpoint.file, {
       cursor,
       importedCount: totalImported,
+      tenantId: config.supertokens.tenantId,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
     console.log(`Processed ${totalProcessed} users so far`);

package/dist/generateAppConfig.js

@@ -68,7 +68,8 @@ var ConfigSchema = import_zod.z.object({
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),
     apiKey: import_zod.z.string().optional(),
-    batchSize: import_zod.z.number().int().positive()
+    batchSize: import_zod.z.number().int().positive(),
+    tenantId: import_zod.z.string().min(1).default("public")
   }),
   thirdPartyProviders: import_zod.z.array(
     import_zod.z.object({

package/dist/index.d.mts

@@ -746,6 +746,7 @@ type RowndUserMetadata = {
         field: string;
         value: string;
         created_at: string;
+        tenantId?: string;
     }>;
     [key: string]: unknown;
 };

package/dist/index.d.ts

@@ -746,6 +746,7 @@ type RowndUserMetadata = {
         field: string;
         value: string;
         created_at: string;
+        tenantId?: string;
     }>;
     [key: string]: unknown;
 };

package/dist/index.js

@@ -866,6 +866,9 @@ var RowndPluginError = class extends Error {
 
 // src/utils.ts
 var ROWND_OAUTH_LOGIN_CHALLENGE_PARAM = "rownd_oauth_login_challenge";
+function resolveTenantId(req) {
+  return req.getKeyValueFromQuery("tenantId") || PUBLIC_TENANT_ID;
+}
 function rewriteLinkPath(inputUrl, targetPath, searchParams) {
   try {
     const url = new URL(inputUrl);
@@ -1497,7 +1500,7 @@ function isIdentityField(field) {
 function isInternalMetadataField(field) {
   return INTERNAL_METADATA_FIELDS.has(field);
 }
-function mapRowndUserToSuperTokens(rowndUser) {
+function mapRowndUserToSuperTokens(rowndUser, tenantId) {
   const loginMethods = [];
   const rowndUserData = rowndUser.data || {};
   const rowndUserVerifiedData = rowndUser.verified_data || {};
@@ -1511,7 +1514,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
       email: googleEmail,
-      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.apple_id) {
@@ -1521,21 +1525,24 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
       email: appleEmail,
-      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.phone_number) {
     loginMethods.push({
       recipeId: "passwordless",
       phoneNumber: rowndUserData.phone_number,
-      isVerified: !!rowndUserVerifiedData.phone_number
+      isVerified: !!rowndUserVerifiedData.phone_number,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.email && !rowndUserData.google_id && !rowndUserData.apple_id) {
     loginMethods.push({
       recipeId: "passwordless",
       email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.email
+      isVerified: !!rowndUserVerifiedData.email,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   let authLevel = rowndUser.auth_level;
@@ -1547,7 +1554,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId,
       thirdPartyUserId: rowndUserData.user_id,
       email: `${rowndUserData.user_id}@anonymous.local`,
-      isVerified: false
+      isVerified: false,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   const userMetadata = buildRowndUserMetadata(rowndUser);
@@ -2093,7 +2101,7 @@ function getPendingVerifications(metadata) {
 function isPendingVerification(value) {
   return isRecord(value) && typeof value.id === "string" && typeof value.field === "string" && typeof value.value === "string" && typeof value.created_at === "string";
 }
-async function getUserById(userId) {
+async function getUserById(userId, tenantId = PUBLIC_TENANT_ID) {
   const metadata = await getUserMetadata(userId);
   const stUser = await import_supertokens_node2.default.getUser(userId);
   if (!stUser) {
@@ -2122,7 +2130,10 @@ async function getUserById(userId) {
   const verifiedData = {
     ...originalRowndUser?.verified_data || {}
   };
-  for (const method of stUser.loginMethods) {
+  const tenantLoginMethods = stUser.loginMethods.filter(
+    (method) => method.tenantIds.includes(tenantId)
+  );
+  for (const method of tenantLoginMethods) {
     if (method.recipeId === "passwordless") {
       if (method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
@@ -2162,12 +2173,16 @@ async function getUserById(userId) {
   if (verifiedData.phone_number === true && typeof data.phone_number === "string") {
     verifiedData.phone_number = data.phone_number;
   }
-  const anonymousId = getAnonymousId(stUser.id, stUser, metadata);
+  const tenantUser = {
+    ...stUser,
+    loginMethods: tenantLoginMethods
+  };
+  const anonymousId = getAnonymousId(stUser.id, tenantUser, metadata);
   if (anonymousId && data.anonymous_id === void 0) {
     data.anonymous_id = anonymousId;
   }
   const authLevel = getEffectiveAuthLevel(
-    stUser,
+    tenantUser,
     originalRowndUser?.auth_level,
     verifiedData
   );
@@ -2176,15 +2191,15 @@ async function getUserById(userId) {
       data[key] = "";
     }
   }
-  const sortedByJoined = [...stUser.loginMethods].sort(
+  const sortedByJoined = [...tenantLoginMethods].sort(
     (a, b) => a.timeJoined - b.timeJoined
   );
-  const latestSessionInfo = await getLatestSessionInfo(stUser.id);
+  const latestSessionInfo = await getLatestSessionInfo(stUser.id, tenantId);
   const firstMethod = sortedByJoined[0];
   const latestSessionRecipeUserId = latestSessionInfo?.recipeUserId.getAsString();
   const lastMethod = latestSessionRecipeUserId ? stUser.loginMethods.find(
     (method) => method.recipeUserId.getAsString() === latestSessionRecipeUserId
-  ) : [...stUser.loginMethods].sort((a, b) => b.timeJoined - a.timeJoined)[0];
+  ) : [...tenantLoginMethods].sort((a, b) => b.timeJoined - a.timeJoined)[0];
   const lastSignInAt = latestSessionInfo?.timeCreated ?? stUser.timeJoined;
   const metadataMeta = Object.fromEntries(
     Object.entries(metadata).filter(
@@ -2212,11 +2227,11 @@ async function getUserById(userId) {
     attributes: originalRowndUser?.attributes || {}
   };
 }
-async function getLatestSessionInfo(userId) {
+async function getLatestSessionInfo(userId, tenantId) {
   const sessionHandles = await import_session.default.getAllSessionHandlesForUser(
     userId,
     true,
-    PUBLIC_TENANT_ID
+    tenantId
   );
   const sessionInfos = await Promise.all(
     sessionHandles.map(
@@ -2231,21 +2246,21 @@ async function getLatestSessionInfo(userId) {
   }
   return latestSessionInfo;
 }
-async function updateUserData(userId, inputData) {
+async function updateUserData(userId, inputData, tenantId = PUBLIC_TENANT_ID) {
   const metadata = await getUserMetadata(userId);
   const updatedMetadata = {
     ...metadata,
     ...inputData
   };
   await import_usermetadata3.default.updateUserMetadata(userId, updatedMetadata);
-  return getUserById(userId);
+  return getUserById(userId, tenantId);
 }
 async function startPendingEmailVerification(input) {
   const metadata = await getUserMetadata(input.userId);
-  const currentEmail = (await getUserById(input.userId)).data.email;
+  const currentEmail = (await getUserById(input.userId, input.tenantId)).data.email;
   const pendingVerifications = getPendingVerifications(metadata);
   const pendingEmailVerifications = pendingVerifications.filter(
-    (pendingVerification2) => pendingVerification2.field === "email"
+    (pendingVerification2) => pendingVerification2.field === "email" && (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) === input.tenantId
   );
   if (currentEmail === input.email) {
     for (const pendingVerification2 of pendingEmailVerifications) {
@@ -2260,11 +2275,11 @@ async function startPendingEmailVerification(input) {
       await import_usermetadata3.default.updateUserMetadata(input.userId, {
         ...metadata,
         rownd_pending_verification: pendingVerifications.filter(
-          (pendingVerification2) => pendingVerification2.field !== "email"
+          (pendingVerification2) => pendingVerification2.field !== "email" || (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) !== input.tenantId
         )
       });
     }
-    return getUserById(input.userId);
+    return getUserById(input.userId, input.tenantId);
   }
   for (const pendingVerification2 of pendingEmailVerifications) {
     await import_emailverification.default.revokeEmailVerificationTokens(
@@ -2278,13 +2293,14 @@ async function startPendingEmailVerification(input) {
     id: input.pendingVerificationId,
     field: "email",
     value: input.email,
-    created_at: (/* @__PURE__ */ new Date()).toISOString()
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    tenantId: input.tenantId
   };
   await import_usermetadata3.default.updateUserMetadata(input.userId, {
     ...metadata,
     rownd_pending_verification: [
       ...pendingVerifications.filter(
-        (pendingVerification2) => pendingVerification2.field !== "email"
+        (pendingVerification2) => pendingVerification2.field !== "email" || (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) !== input.tenantId
       ),
       pendingVerification
     ]
@@ -2303,12 +2319,14 @@ async function startPendingEmailVerification(input) {
     await completePendingEmailVerification({
       recipeUserId: input.recipeUserId,
       email: input.email,
+      tenantId: input.tenantId,
       userContext: input.userContext
     });
   }
-  return getUserById(input.userId);
+  return getUserById(input.userId, input.tenantId);
 }
 async function completePendingEmailVerification(input) {
+  const tenantId = input.tenantId ?? PUBLIC_TENANT_ID;
   const user = await import_supertokens_node2.default.getUser(
     input.recipeUserId.getAsString(),
     input.userContext
@@ -2319,7 +2337,8 @@ async function completePendingEmailVerification(input) {
   const pendingVerification = pendingVerifications.find(
     (pendingVerification2) => isMatchingPendingEmailVerification(
       pendingVerification2,
-      input.email
+      input.email,
+      tenantId
     )
   );
   if (!pendingVerification) {
@@ -2327,7 +2346,12 @@ async function completePendingEmailVerification(input) {
   }
   let metadataUserId = userId;
   let verifiedRecipeUserId = input.recipeUserId;
-  const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(user);
+  const tenantLoginMethods = user?.loginMethods.filter(
+    (method) => method.tenantIds.includes(tenantId)
+  ) ?? [];
+  const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(
+    tenantLoginMethods
+  );
   if (passwordlessEmailMethod) {
     const updateResult = await import_passwordless.default.updateUser({
       recipeUserId: passwordlessEmailMethod.recipeUserId,
@@ -2340,9 +2364,9 @@ async function completePendingEmailVerification(input) {
       );
     }
     verifiedRecipeUserId = passwordlessEmailMethod.recipeUserId;
-  } else if (hasOnlyGuestLoginMethods(user)) {
+  } else if (hasOnlyGuestLoginMethods(user ? { ...user, loginMethods: tenantLoginMethods } : user)) {
     const isPasswordlessSignUpAllowed = await import_accountlinking.default.isSignUpAllowed(
-      PUBLIC_TENANT_ID,
+      tenantId,
       {
         recipeId: "passwordless",
         email: input.email
@@ -2356,7 +2380,7 @@ async function completePendingEmailVerification(input) {
     }
     const passwordlessUser = await import_passwordless.default.signInUp({
       email: input.email,
-      tenantId: PUBLIC_TENANT_ID,
+      tenantId,
       userContext: input.userContext
     });
     verifiedRecipeUserId = passwordlessUser.recipeUserId;
@@ -2400,7 +2424,8 @@ async function completePendingEmailVerification(input) {
     rownd_pending_verification: targetPendingVerifications.filter(
       (verification) => !isMatchingPendingEmailVerification(
         verification,
-        input.email
+        input.email,
+        tenantId
       )
     )
   };
@@ -2410,8 +2435,8 @@ async function completePendingEmailVerification(input) {
     recipeUserId: verifiedRecipeUserId
   };
 }
-function isMatchingPendingEmailVerification(verification, email) {
-  return verification.field === "email" && verification.value === email;
+function isMatchingPendingEmailVerification(verification, email, tenantId) {
+  return verification.field === "email" && verification.value === email && (verification.tenantId ?? PUBLIC_TENANT_ID) === tenantId;
 }
 async function updateUserMetadata(userId, inputMeta) {
   const metadata = await getUserMetadata(userId);
@@ -2429,8 +2454,8 @@ async function updateUserMetadata(userId, inputMeta) {
     )
   };
 }
-function getPasswordlessEmailLoginMethod(user) {
-  return user?.loginMethods.find((method) => {
+function getPasswordlessEmailLoginMethod(loginMethods) {
+  return loginMethods.find((method) => {
     return method.recipeId === "passwordless" && !!method.email;
   });
 }
@@ -2440,6 +2465,7 @@ var import_crypto = require("crypto");
 var import_supertokens_node3 = __toESM(require("supertokens-node"));
 var import_session2 = __toESM(require("supertokens-node/recipe/session"));
 var import_thirdparty = __toESM(require("supertokens-node/recipe/thirdparty"));
+var import_multitenancy = __toESM(require("supertokens-node/recipe/multitenancy"));
 function isBodyString(body, key) {
   return isRecord(body) && typeof body[key] === "string" && body[key].length > 0;
 }
@@ -2504,7 +2530,9 @@ function handleGuestLogin(deps) {
   return async (req, res, _session, userContext) => {
     const startedAt = Date.now();
     const guestId = `guest_${(0, import_crypto.randomUUID)()}`;
+    let tenantId;
     try {
+      tenantId = resolveTenantId(req);
       const body = parseGuestBody(await getJsonBody(req));
       const appVariantId = getRequestedAppVariantIdFromRequest(req);
       assertRowndAppVariantIsConfigured(appVariantId);
@@ -2512,7 +2540,7 @@ function handleGuestLogin(deps) {
       const thirdPartyUserId = thirdPartyId === INSTANT_AUTH_METHOD_ID ? `anon_${(0, import_crypto.randomUUID)()}` : guestId;
       const authLevel = thirdPartyId === INSTANT_AUTH_METHOD_ID ? INSTANT_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
       const response = await import_thirdparty.default.manuallyCreateOrUpdateUser(
-        PUBLIC_TENANT_ID,
+        tenantId,
         thirdPartyId,
         thirdPartyUserId,
         `${thirdPartyUserId}@anonymous.local`,
@@ -2528,7 +2556,7 @@ function handleGuestLogin(deps) {
       await import_session2.default.createNewSession(
         req,
         res,
-        PUBLIC_TENANT_ID,
+        tenantId,
         response.recipeUserId,
         {
           ...buildRowndAudience({}, appVariantId),
@@ -2543,7 +2571,7 @@ function handleGuestLogin(deps) {
       deps.telemetryClient.recordSuccess({
         outcome: "success",
         durationMs: Date.now() - startedAt,
-        tenantId: PUBLIC_TENANT_ID,
+        tenantId,
         superTokensUserId: response.user.id
       });
       return {
@@ -2555,7 +2583,7 @@ function handleGuestLogin(deps) {
       deps.telemetryClient.recordError({
         error,
         startedAt,
-        tenantId: PUBLIC_TENANT_ID
+        tenantId
       });
       return {
         status: "ERROR",
@@ -2567,7 +2595,7 @@ function handleGuestLogin(deps) {
 function handleMigrate(deps) {
   return async (req, res, _session, userContext) => {
     const startedAt = Date.now();
-    let tenantId = PUBLIC_TENANT_ID;
+    let tenantId;
     let rowndUserId;
     let superTokensUserId;
     let user;
@@ -2576,6 +2604,7 @@ function handleMigrate(deps) {
       if (!deps.stConfig.supertokens) {
         throw new Error("Supertokens config not found");
       }
+      tenantId = resolveTenantId(req);
       const parsed = await parseRequest(req);
       const appVariantId = getRequestedAppVariantIdFromRequest(req);
       assertRowndAppVariantIsConfigured(appVariantId);
@@ -2583,13 +2612,16 @@ function handleMigrate(deps) {
       const rowndUser = await fetchOptionalRowndUserInfo(rowndUserId);
       if (!rowndUser) {
         logDebugMessage(
-          `Skipping migration because user does not exist in Rownd. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `Skipping migration because user does not exist in Rownd. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
         return { status: "OK" };
       }
       user = await import_supertokens_node3.default.getUser(rowndUserId, userContext);
       if (!user) {
-        const stUserImport = mapRowndUserToSuperTokens(rowndUser);
+        const stUserImport = mapRowndUserToSuperTokens(
+          rowndUser,
+          tenantId === PUBLIC_TENANT_ID ? void 0 : tenantId
+        );
         try {
           await importUser(stUserImport, deps.stConfig.supertokens);
           clearSuperTokensCoreCallCache(userContext);
@@ -2607,29 +2639,43 @@ function handleMigrate(deps) {
           superTokensUserId = user.id;
           recipeUserId = user.loginMethods[0]?.recipeUserId;
           logDebugMessage(
-            `User already migrated (race condition). tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+            `User already migrated (race condition). tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
           );
         }
         logDebugMessage(
-          `User migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `User migrated successfully. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
       } else {
         superTokensUserId = user.id;
         recipeUserId = user.loginMethods[0]?.recipeUserId;
         logDebugMessage(
-          `User already migrated. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `User already migrated. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
       }
       if (superTokensUserId) {
         await recordRowndAppVariantForUser(superTokensUserId, appVariantId);
       }
+      const tenantLoginMethod = user?.loginMethods.find(
+        (method) => method.tenantIds.includes(tenantId)
+      );
+      recipeUserId = tenantLoginMethod?.recipeUserId ?? recipeUserId;
       if (!recipeUserId) {
         throw new Error("User not found or has no login methods");
       }
+      if (!tenantLoginMethod) {
+        const associationResult = await import_multitenancy.default.associateUserToTenant(
+          tenantId,
+          recipeUserId,
+          userContext
+        );
+        if (associationResult.status !== "OK") {
+          throw new Error(`Failed to associate migrated user with tenant: ${associationResult.status}`);
+        }
+      }
       await import_session2.default.createNewSession(
         req,
         res,
-        PUBLIC_TENANT_ID,
+        tenantId,
         recipeUserId,
         {
           ...buildRowndAudience({}, appVariantId)
@@ -2638,7 +2684,7 @@ function handleMigrate(deps) {
         userContext
       );
       logDebugMessage(
-        `Session migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, userId: ${superTokensUserId}`
+        `Session migrated successfully. tenantId: ${tenantId}, userId: ${superTokensUserId}`
       );
       deps.telemetryClient.recordSuccess({
         outcome: "success",
@@ -2672,7 +2718,7 @@ function clearSuperTokensCoreCallCache(userContext) {
 }
 function handleGetUser() {
   return async (_req, _res, session) => {
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       ...user
@@ -2698,7 +2744,11 @@ function handleUpdateUser() {
       return permissionError;
     }
     if (Object.keys(dataWithoutEmail).length > 0) {
-      await updateUserData(session.getUserId(), dataWithoutEmail);
+      await updateUserData(
+        session.getUserId(),
+        dataWithoutEmail,
+        session.getTenantId()
+      );
     }
     if (hasEmailUpdate) {
       const pendingVerificationResult = await startPendingEmailVerification({
@@ -2714,7 +2764,7 @@ function handleUpdateUser() {
         ...pendingVerificationResult
       };
     }
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       ...user
@@ -2781,7 +2831,7 @@ function handleGetUserField() {
     if (!field) {
       return missingFieldResponse();
     }
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       value: user.data[field]
@@ -2815,9 +2865,11 @@ function handleUpdateUserField() {
     if (permissionError) {
       return permissionError;
     }
-    const updateUserDataResult = await updateUserData(session.getUserId(), {
-      [field]: payload.value
-    });
+    const updateUserDataResult = await updateUserData(
+      session.getUserId(),
+      { [field]: payload.value },
+      session.getTenantId()
+    );
     return {
       status: "OK",
       ...updateUserDataResult
@@ -3300,6 +3352,7 @@ var init = createPluginInitFunction(
                 const verificationResult = await completePendingEmailVerification({
                   recipeUserId: response.user.recipeUserId,
                   email: response.user.email,
+                  tenantId: input.tenantId,
                   userContext: input.userContext
                 });
                 const session = input.session;

package/dist/index.mjs

@@ -843,6 +843,9 @@ var RowndPluginError = class extends Error {
 
 // src/utils.ts
 var ROWND_OAUTH_LOGIN_CHALLENGE_PARAM = "rownd_oauth_login_challenge";
+function resolveTenantId(req) {
+  return req.getKeyValueFromQuery("tenantId") || PUBLIC_TENANT_ID;
+}
 function rewriteLinkPath(inputUrl, targetPath, searchParams) {
   try {
     const url = new URL(inputUrl);
@@ -1474,7 +1477,7 @@ function isIdentityField(field) {
 function isInternalMetadataField(field) {
   return INTERNAL_METADATA_FIELDS.has(field);
 }
-function mapRowndUserToSuperTokens(rowndUser) {
+function mapRowndUserToSuperTokens(rowndUser, tenantId) {
   const loginMethods = [];
   const rowndUserData = rowndUser.data || {};
   const rowndUserVerifiedData = rowndUser.verified_data || {};
@@ -1488,7 +1491,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
       email: googleEmail,
-      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.apple_id) {
@@ -1498,21 +1502,24 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
       email: appleEmail,
-      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.phone_number) {
     loginMethods.push({
       recipeId: "passwordless",
       phoneNumber: rowndUserData.phone_number,
-      isVerified: !!rowndUserVerifiedData.phone_number
+      isVerified: !!rowndUserVerifiedData.phone_number,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.email && !rowndUserData.google_id && !rowndUserData.apple_id) {
     loginMethods.push({
       recipeId: "passwordless",
       email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.email
+      isVerified: !!rowndUserVerifiedData.email,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   let authLevel = rowndUser.auth_level;
@@ -1524,7 +1531,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId,
       thirdPartyUserId: rowndUserData.user_id,
       email: `${rowndUserData.user_id}@anonymous.local`,
-      isVerified: false
+      isVerified: false,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   const userMetadata = buildRowndUserMetadata(rowndUser);
@@ -2070,7 +2078,7 @@ function getPendingVerifications(metadata) {
 function isPendingVerification(value) {
   return isRecord(value) && typeof value.id === "string" && typeof value.field === "string" && typeof value.value === "string" && typeof value.created_at === "string";
 }
-async function getUserById(userId) {
+async function getUserById(userId, tenantId = PUBLIC_TENANT_ID) {
   const metadata = await getUserMetadata(userId);
   const stUser = await SuperTokens2.getUser(userId);
   if (!stUser) {
@@ -2099,7 +2107,10 @@ async function getUserById(userId) {
   const verifiedData = {
     ...originalRowndUser?.verified_data || {}
   };
-  for (const method of stUser.loginMethods) {
+  const tenantLoginMethods = stUser.loginMethods.filter(
+    (method) => method.tenantIds.includes(tenantId)
+  );
+  for (const method of tenantLoginMethods) {
     if (method.recipeId === "passwordless") {
       if (method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
@@ -2139,12 +2150,16 @@ async function getUserById(userId) {
   if (verifiedData.phone_number === true && typeof data.phone_number === "string") {
     verifiedData.phone_number = data.phone_number;
   }
-  const anonymousId = getAnonymousId(stUser.id, stUser, metadata);
+  const tenantUser = {
+    ...stUser,
+    loginMethods: tenantLoginMethods
+  };
+  const anonymousId = getAnonymousId(stUser.id, tenantUser, metadata);
   if (anonymousId && data.anonymous_id === void 0) {
     data.anonymous_id = anonymousId;
   }
   const authLevel = getEffectiveAuthLevel(
-    stUser,
+    tenantUser,
     originalRowndUser?.auth_level,
     verifiedData
   );
@@ -2153,15 +2168,15 @@ async function getUserById(userId) {
       data[key] = "";
     }
   }
-  const sortedByJoined = [...stUser.loginMethods].sort(
+  const sortedByJoined = [...tenantLoginMethods].sort(
     (a, b) => a.timeJoined - b.timeJoined
   );
-  const latestSessionInfo = await getLatestSessionInfo(stUser.id);
+  const latestSessionInfo = await getLatestSessionInfo(stUser.id, tenantId);
   const firstMethod = sortedByJoined[0];
   const latestSessionRecipeUserId = latestSessionInfo?.recipeUserId.getAsString();
   const lastMethod = latestSessionRecipeUserId ? stUser.loginMethods.find(
     (method) => method.recipeUserId.getAsString() === latestSessionRecipeUserId
-  ) : [...stUser.loginMethods].sort((a, b) => b.timeJoined - a.timeJoined)[0];
+  ) : [...tenantLoginMethods].sort((a, b) => b.timeJoined - a.timeJoined)[0];
   const lastSignInAt = latestSessionInfo?.timeCreated ?? stUser.timeJoined;
   const metadataMeta = Object.fromEntries(
     Object.entries(metadata).filter(
@@ -2189,11 +2204,11 @@ async function getUserById(userId) {
     attributes: originalRowndUser?.attributes || {}
   };
 }
-async function getLatestSessionInfo(userId) {
+async function getLatestSessionInfo(userId, tenantId) {
   const sessionHandles = await Session.getAllSessionHandlesForUser(
     userId,
     true,
-    PUBLIC_TENANT_ID
+    tenantId
   );
   const sessionInfos = await Promise.all(
     sessionHandles.map(
@@ -2208,21 +2223,21 @@ async function getLatestSessionInfo(userId) {
   }
   return latestSessionInfo;
 }
-async function updateUserData(userId, inputData) {
+async function updateUserData(userId, inputData, tenantId = PUBLIC_TENANT_ID) {
   const metadata = await getUserMetadata(userId);
   const updatedMetadata = {
     ...metadata,
     ...inputData
   };
   await UserMetadata3.updateUserMetadata(userId, updatedMetadata);
-  return getUserById(userId);
+  return getUserById(userId, tenantId);
 }
 async function startPendingEmailVerification(input) {
   const metadata = await getUserMetadata(input.userId);
-  const currentEmail = (await getUserById(input.userId)).data.email;
+  const currentEmail = (await getUserById(input.userId, input.tenantId)).data.email;
   const pendingVerifications = getPendingVerifications(metadata);
   const pendingEmailVerifications = pendingVerifications.filter(
-    (pendingVerification2) => pendingVerification2.field === "email"
+    (pendingVerification2) => pendingVerification2.field === "email" && (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) === input.tenantId
   );
   if (currentEmail === input.email) {
     for (const pendingVerification2 of pendingEmailVerifications) {
@@ -2237,11 +2252,11 @@ async function startPendingEmailVerification(input) {
       await UserMetadata3.updateUserMetadata(input.userId, {
         ...metadata,
         rownd_pending_verification: pendingVerifications.filter(
-          (pendingVerification2) => pendingVerification2.field !== "email"
+          (pendingVerification2) => pendingVerification2.field !== "email" || (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) !== input.tenantId
         )
       });
     }
-    return getUserById(input.userId);
+    return getUserById(input.userId, input.tenantId);
   }
   for (const pendingVerification2 of pendingEmailVerifications) {
     await EmailVerification.revokeEmailVerificationTokens(
@@ -2255,13 +2270,14 @@ async function startPendingEmailVerification(input) {
     id: input.pendingVerificationId,
     field: "email",
     value: input.email,
-    created_at: (/* @__PURE__ */ new Date()).toISOString()
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    tenantId: input.tenantId
   };
   await UserMetadata3.updateUserMetadata(input.userId, {
     ...metadata,
     rownd_pending_verification: [
       ...pendingVerifications.filter(
-        (pendingVerification2) => pendingVerification2.field !== "email"
+        (pendingVerification2) => pendingVerification2.field !== "email" || (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) !== input.tenantId
       ),
       pendingVerification
     ]
@@ -2280,12 +2296,14 @@ async function startPendingEmailVerification(input) {
     await completePendingEmailVerification({
       recipeUserId: input.recipeUserId,
       email: input.email,
+      tenantId: input.tenantId,
       userContext: input.userContext
     });
   }
-  return getUserById(input.userId);
+  return getUserById(input.userId, input.tenantId);
 }
 async function completePendingEmailVerification(input) {
+  const tenantId = input.tenantId ?? PUBLIC_TENANT_ID;
   const user = await SuperTokens2.getUser(
     input.recipeUserId.getAsString(),
     input.userContext
@@ -2296,7 +2314,8 @@ async function completePendingEmailVerification(input) {
   const pendingVerification = pendingVerifications.find(
     (pendingVerification2) => isMatchingPendingEmailVerification(
       pendingVerification2,
-      input.email
+      input.email,
+      tenantId
     )
   );
   if (!pendingVerification) {
@@ -2304,7 +2323,12 @@ async function completePendingEmailVerification(input) {
   }
   let metadataUserId = userId;
   let verifiedRecipeUserId = input.recipeUserId;
-  const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(user);
+  const tenantLoginMethods = user?.loginMethods.filter(
+    (method) => method.tenantIds.includes(tenantId)
+  ) ?? [];
+  const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(
+    tenantLoginMethods
+  );
   if (passwordlessEmailMethod) {
     const updateResult = await Passwordless.updateUser({
       recipeUserId: passwordlessEmailMethod.recipeUserId,
@@ -2317,9 +2341,9 @@ async function completePendingEmailVerification(input) {
       );
     }
     verifiedRecipeUserId = passwordlessEmailMethod.recipeUserId;
-  } else if (hasOnlyGuestLoginMethods(user)) {
+  } else if (hasOnlyGuestLoginMethods(user ? { ...user, loginMethods: tenantLoginMethods } : user)) {
     const isPasswordlessSignUpAllowed = await AccountLinking.isSignUpAllowed(
-      PUBLIC_TENANT_ID,
+      tenantId,
       {
         recipeId: "passwordless",
         email: input.email
@@ -2333,7 +2357,7 @@ async function completePendingEmailVerification(input) {
     }
     const passwordlessUser = await Passwordless.signInUp({
       email: input.email,
-      tenantId: PUBLIC_TENANT_ID,
+      tenantId,
       userContext: input.userContext
     });
     verifiedRecipeUserId = passwordlessUser.recipeUserId;
@@ -2377,7 +2401,8 @@ async function completePendingEmailVerification(input) {
     rownd_pending_verification: targetPendingVerifications.filter(
       (verification) => !isMatchingPendingEmailVerification(
         verification,
-        input.email
+        input.email,
+        tenantId
       )
     )
   };
@@ -2387,8 +2412,8 @@ async function completePendingEmailVerification(input) {
     recipeUserId: verifiedRecipeUserId
   };
 }
-function isMatchingPendingEmailVerification(verification, email) {
-  return verification.field === "email" && verification.value === email;
+function isMatchingPendingEmailVerification(verification, email, tenantId) {
+  return verification.field === "email" && verification.value === email && (verification.tenantId ?? PUBLIC_TENANT_ID) === tenantId;
 }
 async function updateUserMetadata(userId, inputMeta) {
   const metadata = await getUserMetadata(userId);
@@ -2406,8 +2431,8 @@ async function updateUserMetadata(userId, inputMeta) {
     )
   };
 }
-function getPasswordlessEmailLoginMethod(user) {
-  return user?.loginMethods.find((method) => {
+function getPasswordlessEmailLoginMethod(loginMethods) {
+  return loginMethods.find((method) => {
     return method.recipeId === "passwordless" && !!method.email;
   });
 }
@@ -2417,6 +2442,7 @@ import { randomUUID } from "crypto";
 import SuperTokens3 from "supertokens-node";
 import Session2 from "supertokens-node/recipe/session";
 import ThirdParty from "supertokens-node/recipe/thirdparty";
+import MultiTenancy from "supertokens-node/recipe/multitenancy";
 function isBodyString(body, key) {
   return isRecord(body) && typeof body[key] === "string" && body[key].length > 0;
 }
@@ -2481,7 +2507,9 @@ function handleGuestLogin(deps) {
   return async (req, res, _session, userContext) => {
     const startedAt = Date.now();
     const guestId = `guest_${randomUUID()}`;
+    let tenantId;
     try {
+      tenantId = resolveTenantId(req);
       const body = parseGuestBody(await getJsonBody(req));
       const appVariantId = getRequestedAppVariantIdFromRequest(req);
       assertRowndAppVariantIsConfigured(appVariantId);
@@ -2489,7 +2517,7 @@ function handleGuestLogin(deps) {
       const thirdPartyUserId = thirdPartyId === INSTANT_AUTH_METHOD_ID ? `anon_${randomUUID()}` : guestId;
       const authLevel = thirdPartyId === INSTANT_AUTH_METHOD_ID ? INSTANT_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
       const response = await ThirdParty.manuallyCreateOrUpdateUser(
-        PUBLIC_TENANT_ID,
+        tenantId,
         thirdPartyId,
         thirdPartyUserId,
         `${thirdPartyUserId}@anonymous.local`,
@@ -2505,7 +2533,7 @@ function handleGuestLogin(deps) {
       await Session2.createNewSession(
         req,
         res,
-        PUBLIC_TENANT_ID,
+        tenantId,
         response.recipeUserId,
         {
           ...buildRowndAudience({}, appVariantId),
@@ -2520,7 +2548,7 @@ function handleGuestLogin(deps) {
       deps.telemetryClient.recordSuccess({
         outcome: "success",
         durationMs: Date.now() - startedAt,
-        tenantId: PUBLIC_TENANT_ID,
+        tenantId,
         superTokensUserId: response.user.id
       });
       return {
@@ -2532,7 +2560,7 @@ function handleGuestLogin(deps) {
       deps.telemetryClient.recordError({
         error,
         startedAt,
-        tenantId: PUBLIC_TENANT_ID
+        tenantId
       });
       return {
         status: "ERROR",
@@ -2544,7 +2572,7 @@ function handleGuestLogin(deps) {
 function handleMigrate(deps) {
   return async (req, res, _session, userContext) => {
     const startedAt = Date.now();
-    let tenantId = PUBLIC_TENANT_ID;
+    let tenantId;
     let rowndUserId;
     let superTokensUserId;
     let user;
@@ -2553,6 +2581,7 @@ function handleMigrate(deps) {
       if (!deps.stConfig.supertokens) {
         throw new Error("Supertokens config not found");
       }
+      tenantId = resolveTenantId(req);
       const parsed = await parseRequest(req);
       const appVariantId = getRequestedAppVariantIdFromRequest(req);
       assertRowndAppVariantIsConfigured(appVariantId);
@@ -2560,13 +2589,16 @@ function handleMigrate(deps) {
       const rowndUser = await fetchOptionalRowndUserInfo(rowndUserId);
       if (!rowndUser) {
         logDebugMessage(
-          `Skipping migration because user does not exist in Rownd. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `Skipping migration because user does not exist in Rownd. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
         return { status: "OK" };
       }
       user = await SuperTokens3.getUser(rowndUserId, userContext);
       if (!user) {
-        const stUserImport = mapRowndUserToSuperTokens(rowndUser);
+        const stUserImport = mapRowndUserToSuperTokens(
+          rowndUser,
+          tenantId === PUBLIC_TENANT_ID ? void 0 : tenantId
+        );
         try {
           await importUser(stUserImport, deps.stConfig.supertokens);
           clearSuperTokensCoreCallCache(userContext);
@@ -2584,29 +2616,43 @@ function handleMigrate(deps) {
           superTokensUserId = user.id;
           recipeUserId = user.loginMethods[0]?.recipeUserId;
           logDebugMessage(
-            `User already migrated (race condition). tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+            `User already migrated (race condition). tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
           );
         }
         logDebugMessage(
-          `User migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `User migrated successfully. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
       } else {
         superTokensUserId = user.id;
         recipeUserId = user.loginMethods[0]?.recipeUserId;
         logDebugMessage(
-          `User already migrated. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `User already migrated. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
       }
       if (superTokensUserId) {
         await recordRowndAppVariantForUser(superTokensUserId, appVariantId);
       }
+      const tenantLoginMethod = user?.loginMethods.find(
+        (method) => method.tenantIds.includes(tenantId)
+      );
+      recipeUserId = tenantLoginMethod?.recipeUserId ?? recipeUserId;
       if (!recipeUserId) {
         throw new Error("User not found or has no login methods");
       }
+      if (!tenantLoginMethod) {
+        const associationResult = await MultiTenancy.associateUserToTenant(
+          tenantId,
+          recipeUserId,
+          userContext
+        );
+        if (associationResult.status !== "OK") {
+          throw new Error(`Failed to associate migrated user with tenant: ${associationResult.status}`);
+        }
+      }
       await Session2.createNewSession(
         req,
         res,
-        PUBLIC_TENANT_ID,
+        tenantId,
         recipeUserId,
         {
           ...buildRowndAudience({}, appVariantId)
@@ -2615,7 +2661,7 @@ function handleMigrate(deps) {
         userContext
       );
       logDebugMessage(
-        `Session migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, userId: ${superTokensUserId}`
+        `Session migrated successfully. tenantId: ${tenantId}, userId: ${superTokensUserId}`
       );
       deps.telemetryClient.recordSuccess({
         outcome: "success",
@@ -2649,7 +2695,7 @@ function clearSuperTokensCoreCallCache(userContext) {
 }
 function handleGetUser() {
   return async (_req, _res, session) => {
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       ...user
@@ -2675,7 +2721,11 @@ function handleUpdateUser() {
       return permissionError;
     }
     if (Object.keys(dataWithoutEmail).length > 0) {
-      await updateUserData(session.getUserId(), dataWithoutEmail);
+      await updateUserData(
+        session.getUserId(),
+        dataWithoutEmail,
+        session.getTenantId()
+      );
     }
     if (hasEmailUpdate) {
       const pendingVerificationResult = await startPendingEmailVerification({
@@ -2691,7 +2741,7 @@ function handleUpdateUser() {
         ...pendingVerificationResult
       };
     }
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       ...user
@@ -2758,7 +2808,7 @@ function handleGetUserField() {
     if (!field) {
       return missingFieldResponse();
     }
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       value: user.data[field]
@@ -2792,9 +2842,11 @@ function handleUpdateUserField() {
     if (permissionError) {
       return permissionError;
     }
-    const updateUserDataResult = await updateUserData(session.getUserId(), {
-      [field]: payload.value
-    });
+    const updateUserDataResult = await updateUserData(
+      session.getUserId(),
+      { [field]: payload.value },
+      session.getTenantId()
+    );
     return {
       status: "OK",
       ...updateUserDataResult
@@ -3277,6 +3329,7 @@ var init = createPluginInitFunction(
                 const verificationResult = await completePendingEmailVerification({
                   recipeUserId: response.user.recipeUserId,
                   email: response.user.email,
+                  tenantId: input.tenantId,
                   userContext: input.userContext
                 });
                 const session = input.session;

package/dist/initConfig.js

@@ -63,6 +63,8 @@ rownd:
 supertokens:
   connectionURI: <CONNECTION_URI>
   apiKey: <API_KEY>
+  # Tenant that receives every imported login method.
+  tenantId: public
   # Number of users to send to SuperTokens per bulk import request.
   batchSize: 500
 `;

package/dist/setupCoreInstance.js

@@ -69,7 +69,8 @@ var ConfigSchema = import_zod.z.object({
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),
     apiKey: import_zod.z.string().optional(),
-    batchSize: import_zod.z.number().int().positive()
+    batchSize: import_zod.z.number().int().positive(),
+    tenantId: import_zod.z.string().min(1).default("public")
   }),
   thirdPartyProviders: import_zod.z.array(
     import_zod.z.object({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supertokens-plugins/rownd-nodejs",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Rownd User Migration Plugin for SuperTokens",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",