@supertokens-plugins/rownd-nodejs 0.5.1 → 0.6.1

package/README.md

@@ -44,6 +44,26 @@ SuperTokens.init({
 });
 ```
 
+### Disabling Rownd User Migration
+
+After migration is complete, disable Rownd user and session migration to run
+the compatibility endpoints without Rownd credentials:
+
+```typescript
+RowndMigrationPlugin.init({
+  disableRowndUserMigration: true,
+});
+```
+
+This prevents the Rownd API client and the `/plugin/rownd/migrate` and
+`/plugin/migrate-session` routes from being initialized. Other compatibility
+endpoints remain enabled. Passwordless and email-verification links continue to
+use the Rownd Hub with an internal dummy app key when `rowndAppKey` is omitted.
+The plugin logs a warning during initialization while migration is disabled.
+
+Without `disableRowndUserMigration: true`, both `rowndAppKey` and
+`rowndAppSecret` are required.
+
 ### Session Claim Fields
 
 Schema fields can be copied into the SuperTokens access-token payload by setting `include_in_session_claims: true`. Use `session_claim_name` when the claim name should differ from the Rownd data field name.
@@ -116,6 +136,7 @@ import { createMagicLinkWithConfirmationBypass } from "@supertokens-plugins/rown
 
 const magicLink = await createMagicLinkWithConfirmationBypass({
   email: "user@example.com",
+  tenantId: "tenant-a",
   clientDomain: "browser",
   redirectToPath: "/profile",
   displayContext: "browser",
@@ -126,7 +147,7 @@ const magicLink = await createMagicLinkWithConfirmationBypass({
 
 `clientDomain` must be a configured `clientDomains` key, not a raw domain. Omit it to use the SuperTokens website domain.
 
-Pass exactly one of `email` or `phoneNumber`. The helper returns the rewritten magic link with `bypassDeviceConfirmation=true`.
+Pass exactly one of `email` or `phoneNumber`. `tenantId` defaults to `public`. The helper returns the rewritten magic link with `bypassDeviceConfirmation=true`.
 
 Before skipping the cross-device confirmation prompt, the frontend should validate the callback against the plugin. Routes are mounted under your SuperTokens `apiBasePath`, which defaults to `/auth`.
 
@@ -141,16 +162,25 @@ If validation fails, the frontend should show the normal cross-device confirmati
 
 Routes are mounted under your SuperTokens `apiBasePath`, which defaults to `/auth`. The migration endpoint is the main Rownd-to-SuperTokens session handoff endpoint; the plugin also exposes Rownd-compatible app config, guest, user, metadata, field, and sign-out endpoints under `{apiBasePath}/plugin/rownd/...`.
 
+Unauthenticated migration and guest routes accept an optional `tenantId` query parameter. It defaults to `public`. SuperTokens Core validates the tenant when the operation runs. Authenticated identity-field and sign-out operations use the tenant from the current session; custom Rownd metadata remains global to the SuperTokens user.
+
 > [!IMPORTANT]
-> The plugin always migrates users and sessions into the `public` tenant.
 > Rownd users with multiple supported login methods are rejected unless SuperTokens account linking is enabled in the target environment.
 
 ### Migrate
 
 - **POST** `{apiBasePath}/plugin/rownd/migrate`
 - **Default**: `POST /auth/plugin/rownd/migrate`
+- **Non-public tenant**: `POST /auth/plugin/rownd/migrate?tenantId=tenant-a`
 - **Headers**: `Authorization: Bearer <Rownd_JWT>`. Header-token clients should also send `rid: session`, `fdi-version: 1.18`, and `st-auth-mode: header`.
-- **Description**: Validates the Rownd JWT, ensures the user is migrated to SuperTokens in the `public` tenant, syncs Rownd user data to SuperTokens UserMetadata, and then creates a new SuperTokens session for that user. Header-token clients must receive `st-access-token`, `st-refresh-token`, and `front-token` response headers.
+- **Description**: Validates the Rownd JWT, imports new users with their Rownd profile data, ensures the selected login method is associated with the requested SuperTokens tenant, and then creates a new SuperTokens session in that tenant. Header-token clients must receive `st-access-token`, `st-refresh-token`, and `front-token` response headers.
+
+### Guest
+
+- **POST** `{apiBasePath}/plugin/rownd/guest`
+- **Default**: `POST /auth/plugin/rownd/guest`
+- **Non-public tenant**: `POST /auth/plugin/rownd/guest?tenantId=tenant-a`
+- **Description**: Creates a guest or instant user and session in the requested tenant.
 
 ## Debug Logging
 
@@ -228,6 +258,8 @@ RowndMigrationPlugin.init({
 
 The package includes a bulk migration script for importing Rownd users into SuperTokens.
 
+Set `supertokens.tenantId` in the generated configuration to associate every imported login method with a non-public tenant. It defaults to `public` when omitted. Resuming from a checkpoint with a different tenant is rejected.
+
 The script runs from a YAML config file generated from the included template.
 
 ### Usage

package/dist/bulkMigrate.js

@@ -64,7 +64,7 @@ function buildSuperTokensFakeEmail(thirdPartyUserId, thirdPartyId) {
 function isIdentityField(field) {
   return IDENTITY_USER_DATA_FIELDS.has(field);
 }
-function mapRowndUserToSuperTokens(rowndUser) {
+function mapRowndUserToSuperTokens(rowndUser, tenantId) {
   const loginMethods = [];
   const rowndUserData = rowndUser.data || {};
   const rowndUserVerifiedData = rowndUser.verified_data || {};
@@ -78,7 +78,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
       email: googleEmail,
-      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.apple_id) {
@@ -88,21 +89,24 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
       email: appleEmail,
-      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.phone_number) {
     loginMethods.push({
       recipeId: "passwordless",
       phoneNumber: rowndUserData.phone_number,
-      isVerified: !!rowndUserVerifiedData.phone_number
+      isVerified: !!rowndUserVerifiedData.phone_number,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.email && !rowndUserData.google_id && !rowndUserData.apple_id) {
     loginMethods.push({
       recipeId: "passwordless",
       email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.email
+      isVerified: !!rowndUserVerifiedData.email,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   let authLevel = rowndUser.auth_level;
@@ -114,7 +118,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId,
       thirdPartyUserId: rowndUserData.user_id,
       email: `${rowndUserData.user_id}@anonymous.local`,
-      isVerified: false
+      isVerified: false,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   const userMetadata = buildRowndUserMetadata(rowndUser);
@@ -168,7 +173,8 @@ var ConfigSchema = import_zod.z.object({
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),
     apiKey: import_zod.z.string().optional(),
-    batchSize: import_zod.z.number().int().positive()
+    batchSize: import_zod.z.number().int().positive(),
+    tenantId: import_zod.z.string().min(1).default("public")
   }),
   thirdPartyProviders: import_zod.z.array(
     import_zod.z.object({
@@ -366,6 +372,7 @@ Options:
 var CheckpointSchema = import_zod2.z.object({
   cursor: import_zod2.z.string().optional(),
   importedCount: import_zod2.z.number().int().nonnegative().optional(),
+  tenantId: import_zod2.z.string().optional(),
   updatedAt: import_zod2.z.string()
 });
 async function loadCheckpoint(checkpointFile) {
@@ -456,6 +463,11 @@ async function importUsersBatch(config, users, totalImportedBeforeBatch) {
 }
 async function migrateRowndUsersToSuperTokens(config) {
   const checkpoint = config.checkpoint.resume ? await loadCheckpoint(config.checkpoint.file) : null;
+  if (checkpoint && (checkpoint.tenantId ?? "public") !== config.supertokens.tenantId) {
+    throw new Error(
+      `Checkpoint tenant ${checkpoint.tenantId ?? "public"} does not match configured tenant ${config.supertokens.tenantId}`
+    );
+  }
   const failedMappingsFile = getFailedMappingsFilePath(config.checkpoint.file);
   let cursor = checkpoint?.cursor;
   let totalProcessed = 0;
@@ -489,7 +501,10 @@ async function migrateRowndUsersToSuperTokens(config) {
       try {
         mappedUsers.push({
           rowndUserId,
-          user: mapRowndUserToSuperTokens(rowndUser)
+          user: mapRowndUserToSuperTokens(
+            rowndUser,
+            config.supertokens.tenantId === "public" ? void 0 : config.supertokens.tenantId
+          )
         });
       } catch (error) {
         const errorMessage = error instanceof Error ? error.message : "Unknown mapping error";
@@ -511,6 +526,7 @@ async function migrateRowndUsersToSuperTokens(config) {
     await saveCheckpoint(config.checkpoint.file, {
       cursor,
       importedCount: totalImported,
+      tenantId: config.supertokens.tenantId,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
     console.log(`Processed ${totalProcessed} users so far`);

package/dist/generateAppConfig.js

@@ -68,7 +68,8 @@ var ConfigSchema = import_zod.z.object({
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),
     apiKey: import_zod.z.string().optional(),
-    batchSize: import_zod.z.number().int().positive()
+    batchSize: import_zod.z.number().int().positive(),
+    tenantId: import_zod.z.string().min(1).default("public")
   }),
   thirdPartyProviders: import_zod.z.array(
     import_zod.z.object({

package/dist/index.d.mts

@@ -670,8 +670,14 @@ type RowndSubBrandConfigInput = RowndAppConfigInput & {
     };
 };
 interface RowndPluginConfig {
-    rowndAppKey: string;
-    rowndAppSecret: string;
+    rowndAppKey?: string;
+    rowndAppSecret?: string;
+    /**
+     * Disables Rownd user and session migration. This must be enabled when
+     * rowndAppKey or rowndAppSecret is omitted.
+     * @default false
+     */
+    disableRowndUserMigration?: boolean;
     enableDebugLogs?: boolean;
     clientDomains?: RowndClientDomains;
     crossDeviceConfirmationBypass?: {
@@ -746,6 +752,7 @@ type RowndUserMetadata = {
         field: string;
         value: string;
         created_at: string;
+        tenantId?: string;
     }>;
     [key: string]: unknown;
 };
@@ -755,7 +762,8 @@ interface MigrationResponse {
 }
 interface RowndPluginNormalisedConfig {
     rowndAppKey: string;
-    rowndAppSecret: string;
+    rowndAppSecret?: string;
+    disableRowndUserMigration: boolean;
     enableDebugLogs?: boolean;
     clientDomains?: RowndClientDomains;
     crossDeviceConfirmationBypass?: {
@@ -860,7 +868,7 @@ type CreateMagicLinkWithConfirmationBypassInput = {
 };
 declare function createMagicLinkWithConfirmationBypass(input: CreateMagicLinkWithConfirmationBypassInput): Promise<string>;
 
-declare function setRowndClient(client: IRowndClient): void;
+declare function setRowndClient(client: IRowndClient | undefined): void;
 declare function getRowndClient(): IRowndClient;
 
 declare const _default: {

package/dist/index.d.ts

@@ -670,8 +670,14 @@ type RowndSubBrandConfigInput = RowndAppConfigInput & {
     };
 };
 interface RowndPluginConfig {
-    rowndAppKey: string;
-    rowndAppSecret: string;
+    rowndAppKey?: string;
+    rowndAppSecret?: string;
+    /**
+     * Disables Rownd user and session migration. This must be enabled when
+     * rowndAppKey or rowndAppSecret is omitted.
+     * @default false
+     */
+    disableRowndUserMigration?: boolean;
     enableDebugLogs?: boolean;
     clientDomains?: RowndClientDomains;
     crossDeviceConfirmationBypass?: {
@@ -746,6 +752,7 @@ type RowndUserMetadata = {
         field: string;
         value: string;
         created_at: string;
+        tenantId?: string;
     }>;
     [key: string]: unknown;
 };
@@ -755,7 +762,8 @@ interface MigrationResponse {
 }
 interface RowndPluginNormalisedConfig {
     rowndAppKey: string;
-    rowndAppSecret: string;
+    rowndAppSecret?: string;
+    disableRowndUserMigration: boolean;
     enableDebugLogs?: boolean;
     clientDomains?: RowndClientDomains;
     crossDeviceConfirmationBypass?: {
@@ -860,7 +868,7 @@ type CreateMagicLinkWithConfirmationBypassInput = {
 };
 declare function createMagicLinkWithConfirmationBypass(input: CreateMagicLinkWithConfirmationBypassInput): Promise<string>;
 
-declare function setRowndClient(client: IRowndClient): void;
+declare function setRowndClient(client: IRowndClient | undefined): void;
 declare function getRowndClient(): IRowndClient;
 
 declare const _default: {