@supertokens-plugins/rownd-nodejs 0.5.1 → 0.6.1

package/dist/index.js

@@ -866,6 +866,9 @@ var RowndPluginError = class extends Error {
 
 // src/utils.ts
 var ROWND_OAUTH_LOGIN_CHALLENGE_PARAM = "rownd_oauth_login_challenge";
+function resolveTenantId(req) {
+  return req.getKeyValueFromQuery("tenantId") || PUBLIC_TENANT_ID;
+}
 function rewriteLinkPath(inputUrl, targetPath, searchParams) {
   try {
     const url = new URL(inputUrl);
@@ -1497,7 +1500,7 @@ function isIdentityField(field) {
 function isInternalMetadataField(field) {
   return INTERNAL_METADATA_FIELDS.has(field);
 }
-function mapRowndUserToSuperTokens(rowndUser) {
+function mapRowndUserToSuperTokens(rowndUser, tenantId) {
   const loginMethods = [];
   const rowndUserData = rowndUser.data || {};
   const rowndUserVerifiedData = rowndUser.verified_data || {};
@@ -1511,7 +1514,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
       email: googleEmail,
-      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.apple_id) {
@@ -1521,21 +1525,24 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
       email: appleEmail,
-      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.phone_number) {
     loginMethods.push({
       recipeId: "passwordless",
       phoneNumber: rowndUserData.phone_number,
-      isVerified: !!rowndUserVerifiedData.phone_number
+      isVerified: !!rowndUserVerifiedData.phone_number,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.email && !rowndUserData.google_id && !rowndUserData.apple_id) {
     loginMethods.push({
       recipeId: "passwordless",
       email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.email
+      isVerified: !!rowndUserVerifiedData.email,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   let authLevel = rowndUser.auth_level;
@@ -1547,7 +1554,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId,
       thirdPartyUserId: rowndUserData.user_id,
       email: `${rowndUserData.user_id}@anonymous.local`,
-      isVerified: false
+      isVerified: false,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   const userMetadata = buildRowndUserMetadata(rowndUser);
@@ -2093,7 +2101,7 @@ function getPendingVerifications(metadata) {
 function isPendingVerification(value) {
   return isRecord(value) && typeof value.id === "string" && typeof value.field === "string" && typeof value.value === "string" && typeof value.created_at === "string";
 }
-async function getUserById(userId) {
+async function getUserById(userId, tenantId = PUBLIC_TENANT_ID) {
   const metadata = await getUserMetadata(userId);
   const stUser = await import_supertokens_node2.default.getUser(userId);
   if (!stUser) {
@@ -2122,7 +2130,10 @@ async function getUserById(userId) {
   const verifiedData = {
     ...originalRowndUser?.verified_data || {}
   };
-  for (const method of stUser.loginMethods) {
+  const tenantLoginMethods = stUser.loginMethods.filter(
+    (method) => method.tenantIds.includes(tenantId)
+  );
+  for (const method of tenantLoginMethods) {
     if (method.recipeId === "passwordless") {
       if (method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
@@ -2162,12 +2173,16 @@ async function getUserById(userId) {
   if (verifiedData.phone_number === true && typeof data.phone_number === "string") {
     verifiedData.phone_number = data.phone_number;
   }
-  const anonymousId = getAnonymousId(stUser.id, stUser, metadata);
+  const tenantUser = {
+    ...stUser,
+    loginMethods: tenantLoginMethods
+  };
+  const anonymousId = getAnonymousId(stUser.id, tenantUser, metadata);
   if (anonymousId && data.anonymous_id === void 0) {
     data.anonymous_id = anonymousId;
   }
   const authLevel = getEffectiveAuthLevel(
-    stUser,
+    tenantUser,
     originalRowndUser?.auth_level,
     verifiedData
   );
@@ -2176,15 +2191,15 @@ async function getUserById(userId) {
       data[key] = "";
     }
   }
-  const sortedByJoined = [...stUser.loginMethods].sort(
+  const sortedByJoined = [...tenantLoginMethods].sort(
     (a, b) => a.timeJoined - b.timeJoined
   );
-  const latestSessionInfo = await getLatestSessionInfo(stUser.id);
+  const latestSessionInfo = await getLatestSessionInfo(stUser.id, tenantId);
   const firstMethod = sortedByJoined[0];
   const latestSessionRecipeUserId = latestSessionInfo?.recipeUserId.getAsString();
   const lastMethod = latestSessionRecipeUserId ? stUser.loginMethods.find(
     (method) => method.recipeUserId.getAsString() === latestSessionRecipeUserId
-  ) : [...stUser.loginMethods].sort((a, b) => b.timeJoined - a.timeJoined)[0];
+  ) : [...tenantLoginMethods].sort((a, b) => b.timeJoined - a.timeJoined)[0];
   const lastSignInAt = latestSessionInfo?.timeCreated ?? stUser.timeJoined;
   const metadataMeta = Object.fromEntries(
     Object.entries(metadata).filter(
@@ -2212,11 +2227,11 @@ async function getUserById(userId) {
     attributes: originalRowndUser?.attributes || {}
   };
 }
-async function getLatestSessionInfo(userId) {
+async function getLatestSessionInfo(userId, tenantId) {
   const sessionHandles = await import_session.default.getAllSessionHandlesForUser(
     userId,
     true,
-    PUBLIC_TENANT_ID
+    tenantId
   );
   const sessionInfos = await Promise.all(
     sessionHandles.map(
@@ -2231,21 +2246,21 @@ async function getLatestSessionInfo(userId) {
   }
   return latestSessionInfo;
 }
-async function updateUserData(userId, inputData) {
+async function updateUserData(userId, inputData, tenantId = PUBLIC_TENANT_ID) {
   const metadata = await getUserMetadata(userId);
   const updatedMetadata = {
     ...metadata,
     ...inputData
   };
   await import_usermetadata3.default.updateUserMetadata(userId, updatedMetadata);
-  return getUserById(userId);
+  return getUserById(userId, tenantId);
 }
 async function startPendingEmailVerification(input) {
   const metadata = await getUserMetadata(input.userId);
-  const currentEmail = (await getUserById(input.userId)).data.email;
+  const currentEmail = (await getUserById(input.userId, input.tenantId)).data.email;
   const pendingVerifications = getPendingVerifications(metadata);
   const pendingEmailVerifications = pendingVerifications.filter(
-    (pendingVerification2) => pendingVerification2.field === "email"
+    (pendingVerification2) => pendingVerification2.field === "email" && (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) === input.tenantId
   );
   if (currentEmail === input.email) {
     for (const pendingVerification2 of pendingEmailVerifications) {
@@ -2260,11 +2275,11 @@ async function startPendingEmailVerification(input) {
       await import_usermetadata3.default.updateUserMetadata(input.userId, {
         ...metadata,
         rownd_pending_verification: pendingVerifications.filter(
-          (pendingVerification2) => pendingVerification2.field !== "email"
+          (pendingVerification2) => pendingVerification2.field !== "email" || (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) !== input.tenantId
         )
       });
     }
-    return getUserById(input.userId);
+    return getUserById(input.userId, input.tenantId);
   }
   for (const pendingVerification2 of pendingEmailVerifications) {
     await import_emailverification.default.revokeEmailVerificationTokens(
@@ -2278,13 +2293,14 @@ async function startPendingEmailVerification(input) {
     id: input.pendingVerificationId,
     field: "email",
     value: input.email,
-    created_at: (/* @__PURE__ */ new Date()).toISOString()
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    tenantId: input.tenantId
   };
   await import_usermetadata3.default.updateUserMetadata(input.userId, {
     ...metadata,
     rownd_pending_verification: [
       ...pendingVerifications.filter(
-        (pendingVerification2) => pendingVerification2.field !== "email"
+        (pendingVerification2) => pendingVerification2.field !== "email" || (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) !== input.tenantId
       ),
       pendingVerification
     ]
@@ -2303,12 +2319,14 @@ async function startPendingEmailVerification(input) {
     await completePendingEmailVerification({
       recipeUserId: input.recipeUserId,
       email: input.email,
+      tenantId: input.tenantId,
       userContext: input.userContext
     });
   }
-  return getUserById(input.userId);
+  return getUserById(input.userId, input.tenantId);
 }
 async function completePendingEmailVerification(input) {
+  const tenantId = input.tenantId ?? PUBLIC_TENANT_ID;
   const user = await import_supertokens_node2.default.getUser(
     input.recipeUserId.getAsString(),
     input.userContext
@@ -2319,7 +2337,8 @@ async function completePendingEmailVerification(input) {
   const pendingVerification = pendingVerifications.find(
     (pendingVerification2) => isMatchingPendingEmailVerification(
       pendingVerification2,
-      input.email
+      input.email,
+      tenantId
     )
   );
   if (!pendingVerification) {
@@ -2327,7 +2346,12 @@ async function completePendingEmailVerification(input) {
   }
   let metadataUserId = userId;
   let verifiedRecipeUserId = input.recipeUserId;
-  const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(user);
+  const tenantLoginMethods = user?.loginMethods.filter(
+    (method) => method.tenantIds.includes(tenantId)
+  ) ?? [];
+  const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(
+    tenantLoginMethods
+  );
   if (passwordlessEmailMethod) {
     const updateResult = await import_passwordless.default.updateUser({
       recipeUserId: passwordlessEmailMethod.recipeUserId,
@@ -2340,9 +2364,9 @@ async function completePendingEmailVerification(input) {
       );
     }
     verifiedRecipeUserId = passwordlessEmailMethod.recipeUserId;
-  } else if (hasOnlyGuestLoginMethods(user)) {
+  } else if (hasOnlyGuestLoginMethods(user ? { ...user, loginMethods: tenantLoginMethods } : user)) {
     const isPasswordlessSignUpAllowed = await import_accountlinking.default.isSignUpAllowed(
-      PUBLIC_TENANT_ID,
+      tenantId,
       {
         recipeId: "passwordless",
         email: input.email
@@ -2356,7 +2380,7 @@ async function completePendingEmailVerification(input) {
     }
     const passwordlessUser = await import_passwordless.default.signInUp({
       email: input.email,
-      tenantId: PUBLIC_TENANT_ID,
+      tenantId,
       userContext: input.userContext
     });
     verifiedRecipeUserId = passwordlessUser.recipeUserId;
@@ -2400,7 +2424,8 @@ async function completePendingEmailVerification(input) {
     rownd_pending_verification: targetPendingVerifications.filter(
       (verification) => !isMatchingPendingEmailVerification(
         verification,
-        input.email
+        input.email,
+        tenantId
       )
     )
   };
@@ -2410,8 +2435,8 @@ async function completePendingEmailVerification(input) {
     recipeUserId: verifiedRecipeUserId
   };
 }
-function isMatchingPendingEmailVerification(verification, email) {
-  return verification.field === "email" && verification.value === email;
+function isMatchingPendingEmailVerification(verification, email, tenantId) {
+  return verification.field === "email" && verification.value === email && (verification.tenantId ?? PUBLIC_TENANT_ID) === tenantId;
 }
 async function updateUserMetadata(userId, inputMeta) {
   const metadata = await getUserMetadata(userId);
@@ -2429,8 +2454,8 @@ async function updateUserMetadata(userId, inputMeta) {
     )
   };
 }
-function getPasswordlessEmailLoginMethod(user) {
-  return user?.loginMethods.find((method) => {
+function getPasswordlessEmailLoginMethod(loginMethods) {
+  return loginMethods.find((method) => {
     return method.recipeId === "passwordless" && !!method.email;
   });
 }
@@ -2440,6 +2465,7 @@ var import_crypto = require("crypto");
 var import_supertokens_node3 = __toESM(require("supertokens-node"));
 var import_session2 = __toESM(require("supertokens-node/recipe/session"));
 var import_thirdparty = __toESM(require("supertokens-node/recipe/thirdparty"));
+var import_multitenancy = __toESM(require("supertokens-node/recipe/multitenancy"));
 function isBodyString(body, key) {
   return isRecord(body) && typeof body[key] === "string" && body[key].length > 0;
 }
@@ -2504,7 +2530,9 @@ function handleGuestLogin(deps) {
   return async (req, res, _session, userContext) => {
     const startedAt = Date.now();
     const guestId = `guest_${(0, import_crypto.randomUUID)()}`;
+    let tenantId;
     try {
+      tenantId = resolveTenantId(req);
       const body = parseGuestBody(await getJsonBody(req));
       const appVariantId = getRequestedAppVariantIdFromRequest(req);
       assertRowndAppVariantIsConfigured(appVariantId);
@@ -2512,7 +2540,7 @@ function handleGuestLogin(deps) {
       const thirdPartyUserId = thirdPartyId === INSTANT_AUTH_METHOD_ID ? `anon_${(0, import_crypto.randomUUID)()}` : guestId;
       const authLevel = thirdPartyId === INSTANT_AUTH_METHOD_ID ? INSTANT_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
       const response = await import_thirdparty.default.manuallyCreateOrUpdateUser(
-        PUBLIC_TENANT_ID,
+        tenantId,
         thirdPartyId,
         thirdPartyUserId,
         `${thirdPartyUserId}@anonymous.local`,
@@ -2528,7 +2556,7 @@ function handleGuestLogin(deps) {
       await import_session2.default.createNewSession(
         req,
         res,
-        PUBLIC_TENANT_ID,
+        tenantId,
         response.recipeUserId,
         {
           ...buildRowndAudience({}, appVariantId),
@@ -2543,7 +2571,7 @@ function handleGuestLogin(deps) {
       deps.telemetryClient.recordSuccess({
         outcome: "success",
         durationMs: Date.now() - startedAt,
-        tenantId: PUBLIC_TENANT_ID,
+        tenantId,
         superTokensUserId: response.user.id
       });
       return {
@@ -2555,7 +2583,7 @@ function handleGuestLogin(deps) {
       deps.telemetryClient.recordError({
         error,
         startedAt,
-        tenantId: PUBLIC_TENANT_ID
+        tenantId
       });
       return {
         status: "ERROR",
@@ -2567,7 +2595,7 @@ function handleGuestLogin(deps) {
 function handleMigrate(deps) {
   return async (req, res, _session, userContext) => {
     const startedAt = Date.now();
-    let tenantId = PUBLIC_TENANT_ID;
+    let tenantId;
     let rowndUserId;
     let superTokensUserId;
     let user;
@@ -2576,6 +2604,7 @@ function handleMigrate(deps) {
       if (!deps.stConfig.supertokens) {
         throw new Error("Supertokens config not found");
       }
+      tenantId = resolveTenantId(req);
       const parsed = await parseRequest(req);
       const appVariantId = getRequestedAppVariantIdFromRequest(req);
       assertRowndAppVariantIsConfigured(appVariantId);
@@ -2583,13 +2612,16 @@ function handleMigrate(deps) {
       const rowndUser = await fetchOptionalRowndUserInfo(rowndUserId);
       if (!rowndUser) {
         logDebugMessage(
-          `Skipping migration because user does not exist in Rownd. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `Skipping migration because user does not exist in Rownd. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
         return { status: "OK" };
       }
       user = await import_supertokens_node3.default.getUser(rowndUserId, userContext);
       if (!user) {
-        const stUserImport = mapRowndUserToSuperTokens(rowndUser);
+        const stUserImport = mapRowndUserToSuperTokens(
+          rowndUser,
+          tenantId === PUBLIC_TENANT_ID ? void 0 : tenantId
+        );
         try {
           await importUser(stUserImport, deps.stConfig.supertokens);
           clearSuperTokensCoreCallCache(userContext);
@@ -2607,29 +2639,43 @@ function handleMigrate(deps) {
           superTokensUserId = user.id;
           recipeUserId = user.loginMethods[0]?.recipeUserId;
           logDebugMessage(
-            `User already migrated (race condition). tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+            `User already migrated (race condition). tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
           );
         }
         logDebugMessage(
-          `User migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `User migrated successfully. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
       } else {
         superTokensUserId = user.id;
         recipeUserId = user.loginMethods[0]?.recipeUserId;
         logDebugMessage(
-          `User already migrated. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `User already migrated. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
       }
       if (superTokensUserId) {
         await recordRowndAppVariantForUser(superTokensUserId, appVariantId);
       }
+      const tenantLoginMethod = user?.loginMethods.find(
+        (method) => method.tenantIds.includes(tenantId)
+      );
+      recipeUserId = tenantLoginMethod?.recipeUserId ?? recipeUserId;
       if (!recipeUserId) {
         throw new Error("User not found or has no login methods");
       }
+      if (!tenantLoginMethod) {
+        const associationResult = await import_multitenancy.default.associateUserToTenant(
+          tenantId,
+          recipeUserId,
+          userContext
+        );
+        if (associationResult.status !== "OK") {
+          throw new Error(`Failed to associate migrated user with tenant: ${associationResult.status}`);
+        }
+      }
       await import_session2.default.createNewSession(
         req,
         res,
-        PUBLIC_TENANT_ID,
+        tenantId,
         recipeUserId,
         {
           ...buildRowndAudience({}, appVariantId)
@@ -2638,7 +2684,7 @@ function handleMigrate(deps) {
         userContext
       );
       logDebugMessage(
-        `Session migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, userId: ${superTokensUserId}`
+        `Session migrated successfully. tenantId: ${tenantId}, userId: ${superTokensUserId}`
       );
       deps.telemetryClient.recordSuccess({
         outcome: "success",
@@ -2672,7 +2718,7 @@ function clearSuperTokensCoreCallCache(userContext) {
 }
 function handleGetUser() {
   return async (_req, _res, session) => {
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       ...user
@@ -2698,7 +2744,11 @@ function handleUpdateUser() {
       return permissionError;
     }
     if (Object.keys(dataWithoutEmail).length > 0) {
-      await updateUserData(session.getUserId(), dataWithoutEmail);
+      await updateUserData(
+        session.getUserId(),
+        dataWithoutEmail,
+        session.getTenantId()
+      );
     }
     if (hasEmailUpdate) {
       const pendingVerificationResult = await startPendingEmailVerification({
@@ -2714,7 +2764,7 @@ function handleUpdateUser() {
         ...pendingVerificationResult
       };
     }
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       ...user
@@ -2781,7 +2831,7 @@ function handleGetUserField() {
     if (!field) {
       return missingFieldResponse();
     }
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       value: user.data[field]
@@ -2815,9 +2865,11 @@ function handleUpdateUserField() {
     if (permissionError) {
       return permissionError;
     }
-    const updateUserDataResult = await updateUserData(session.getUserId(), {
-      [field]: payload.value
-    });
+    const updateUserDataResult = await updateUserData(
+      session.getUserId(),
+      { [field]: payload.value },
+      session.getTenantId()
+    );
     return {
       status: "OK",
       ...updateUserDataResult
@@ -2837,6 +2889,7 @@ function validateWritableFields(fields) {
 }
 
 // src/plugin.ts
+var DISABLED_MIGRATION_ROWND_APP_KEY = "migration-disabled";
 var verifyRowndUserSessionOptions = {
   sessionRequired: true,
   overrideGlobalClaimValidators: (validators) => validators.filter((validator) => {
@@ -2845,10 +2898,10 @@ var verifyRowndUserSessionOptions = {
 };
 var init = createPluginInitFunction(
   (pluginConfig2) => {
-    const rowndClient2 = (0, import_node.createInstance)({
+    const rowndClient2 = !pluginConfig2.disableRowndUserMigration && pluginConfig2.rowndAppSecret ? (0, import_node.createInstance)({
       app_key: pluginConfig2.rowndAppKey,
       app_secret: pluginConfig2.rowndAppSecret
-    });
+    }) : void 0;
     const telemetryClient = createClient(pluginConfig2.telemetry);
     let hubBootstrapParams;
     const addHubBootstrapParams = (input, linkKey, targetPath) => {
@@ -2888,6 +2941,11 @@ var init = createPluginInitFunction(
       id: PLUGIN_ID,
       compatibleSDKVersions: PLUGIN_SDK_VERSION,
       init: async () => {
+        if (pluginConfig2.disableRowndUserMigration) {
+          console.warn(
+            "RowndMigrationPlugin: Rownd user and session migration is disabled."
+          );
+        }
         if (!import_supertokens_node4.default.isRecipeInitialized("session")) {
           console.warn(
             "RowndMigrationPlugin: Session recipe is not initialized. Session migration will fail."
@@ -2931,11 +2989,11 @@ var init = createPluginInitFunction(
               method: "post",
               handler: withRequestHandler(handleGuestLogin(routeHandlerDeps))
             },
-            {
+            ...!pluginConfig2.disableRowndUserMigration ? [{
               path: `${apiBasePath}${HANDLE_BASE_PATH}/migrate`,
               method: "post",
               handler: withRequestHandler(handleMigrate(routeHandlerDeps))
-            },
+            }] : [],
             {
               path: `${apiBasePath}/plugin/passwordless-cross-device-confirmation/validate`,
               method: "post",
@@ -2943,11 +3001,11 @@ var init = createPluginInitFunction(
                 handleValidatePasswordlessConfirmationBypass(routeHandlerDeps)
               )
             },
-            {
+            ...!pluginConfig2.disableRowndUserMigration ? [{
               path: `${apiBasePath}/plugin/migrate-session`,
               method: "post",
               handler: withRequestHandler(handleMigrate(routeHandlerDeps))
-            },
+            }] : [],
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/signout`,
               method: "post",
@@ -3300,6 +3358,7 @@ var init = createPluginInitFunction(
                 const verificationResult = await completePendingEmailVerification({
                   recipeUserId: response.user.recipeUserId,
                   email: response.user.email,
+                  tenantId: input.tenantId,
                   userContext: input.userContext
                 });
                 const session = input.session;
@@ -3326,9 +3385,14 @@ var init = createPluginInitFunction(
   },
   () => ({}),
   (config2) => {
-    if (!config2?.rowndAppKey || !config2?.rowndAppSecret) {
+    if (config2?.disableRowndUserMigration !== void 0 && typeof config2.disableRowndUserMigration !== "boolean") {
+      throw new Error(
+        "disableRowndUserMigration must be a boolean in plugin config"
+      );
+    }
+    if (!config2?.disableRowndUserMigration && (!config2?.rowndAppKey || !config2?.rowndAppSecret)) {
       throw new Error(
-        "Missing rowndAppKey or rowndAppSecret in plugin config"
+        "Missing rowndAppKey or rowndAppSecret in plugin config. Set disableRowndUserMigration to true to disable migration."
       );
     }
     if (config2.telemetry?.provider === "axiom") {
@@ -3349,8 +3413,9 @@ var init = createPluginInitFunction(
       validateClientDomainUrl(key, value);
     }
     return {
-      rowndAppKey: config2.rowndAppKey,
+      rowndAppKey: config2.rowndAppKey ?? DISABLED_MIGRATION_ROWND_APP_KEY,
       rowndAppSecret: config2.rowndAppSecret,
+      disableRowndUserMigration: config2.disableRowndUserMigration === true,
       enableDebugLogs: config2.enableDebugLogs,
       clientDomains: config2.clientDomains,
       crossDeviceConfirmationBypass: config2.crossDeviceConfirmationBypass,