@supertokens-plugins/rownd-nodejs 0.5.1 → 0.6.1

package/dist/index.mjs

@@ -843,6 +843,9 @@ var RowndPluginError = class extends Error {
 
 // src/utils.ts
 var ROWND_OAUTH_LOGIN_CHALLENGE_PARAM = "rownd_oauth_login_challenge";
+function resolveTenantId(req) {
+  return req.getKeyValueFromQuery("tenantId") || PUBLIC_TENANT_ID;
+}
 function rewriteLinkPath(inputUrl, targetPath, searchParams) {
   try {
     const url = new URL(inputUrl);
@@ -1474,7 +1477,7 @@ function isIdentityField(field) {
 function isInternalMetadataField(field) {
   return INTERNAL_METADATA_FIELDS.has(field);
 }
-function mapRowndUserToSuperTokens(rowndUser) {
+function mapRowndUserToSuperTokens(rowndUser, tenantId) {
   const loginMethods = [];
   const rowndUserData = rowndUser.data || {};
   const rowndUserVerifiedData = rowndUser.verified_data || {};
@@ -1488,7 +1491,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId: "google",
       thirdPartyUserId: rowndUserData.google_id,
       email: googleEmail,
-      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.google_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.apple_id) {
@@ -1498,21 +1502,24 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId: "apple",
       thirdPartyUserId: rowndUserData.apple_id,
       email: appleEmail,
-      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id
+      isVerified: !!rowndUserData.email && !!rowndUserVerifiedData.apple_id,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.phone_number) {
     loginMethods.push({
       recipeId: "passwordless",
       phoneNumber: rowndUserData.phone_number,
-      isVerified: !!rowndUserVerifiedData.phone_number
+      isVerified: !!rowndUserVerifiedData.phone_number,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   if (rowndUserData.email && !rowndUserData.google_id && !rowndUserData.apple_id) {
     loginMethods.push({
       recipeId: "passwordless",
       email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.email
+      isVerified: !!rowndUserVerifiedData.email,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   let authLevel = rowndUser.auth_level;
@@ -1524,7 +1531,8 @@ function mapRowndUserToSuperTokens(rowndUser) {
       thirdPartyId,
       thirdPartyUserId: rowndUserData.user_id,
       email: `${rowndUserData.user_id}@anonymous.local`,
-      isVerified: false
+      isVerified: false,
+      ...tenantId ? { tenantIds: [tenantId] } : {}
     });
   }
   const userMetadata = buildRowndUserMetadata(rowndUser);
@@ -2070,7 +2078,7 @@ function getPendingVerifications(metadata) {
 function isPendingVerification(value) {
   return isRecord(value) && typeof value.id === "string" && typeof value.field === "string" && typeof value.value === "string" && typeof value.created_at === "string";
 }
-async function getUserById(userId) {
+async function getUserById(userId, tenantId = PUBLIC_TENANT_ID) {
   const metadata = await getUserMetadata(userId);
   const stUser = await SuperTokens2.getUser(userId);
   if (!stUser) {
@@ -2099,7 +2107,10 @@ async function getUserById(userId) {
   const verifiedData = {
     ...originalRowndUser?.verified_data || {}
   };
-  for (const method of stUser.loginMethods) {
+  const tenantLoginMethods = stUser.loginMethods.filter(
+    (method) => method.tenantIds.includes(tenantId)
+  );
+  for (const method of tenantLoginMethods) {
     if (method.recipeId === "passwordless") {
       if (method.email && !isSuperTokensFakeEmail(method.email)) {
         verifiedData.email = method.email;
@@ -2139,12 +2150,16 @@ async function getUserById(userId) {
   if (verifiedData.phone_number === true && typeof data.phone_number === "string") {
     verifiedData.phone_number = data.phone_number;
   }
-  const anonymousId = getAnonymousId(stUser.id, stUser, metadata);
+  const tenantUser = {
+    ...stUser,
+    loginMethods: tenantLoginMethods
+  };
+  const anonymousId = getAnonymousId(stUser.id, tenantUser, metadata);
   if (anonymousId && data.anonymous_id === void 0) {
     data.anonymous_id = anonymousId;
   }
   const authLevel = getEffectiveAuthLevel(
-    stUser,
+    tenantUser,
     originalRowndUser?.auth_level,
     verifiedData
   );
@@ -2153,15 +2168,15 @@ async function getUserById(userId) {
       data[key] = "";
     }
   }
-  const sortedByJoined = [...stUser.loginMethods].sort(
+  const sortedByJoined = [...tenantLoginMethods].sort(
     (a, b) => a.timeJoined - b.timeJoined
   );
-  const latestSessionInfo = await getLatestSessionInfo(stUser.id);
+  const latestSessionInfo = await getLatestSessionInfo(stUser.id, tenantId);
   const firstMethod = sortedByJoined[0];
   const latestSessionRecipeUserId = latestSessionInfo?.recipeUserId.getAsString();
   const lastMethod = latestSessionRecipeUserId ? stUser.loginMethods.find(
     (method) => method.recipeUserId.getAsString() === latestSessionRecipeUserId
-  ) : [...stUser.loginMethods].sort((a, b) => b.timeJoined - a.timeJoined)[0];
+  ) : [...tenantLoginMethods].sort((a, b) => b.timeJoined - a.timeJoined)[0];
   const lastSignInAt = latestSessionInfo?.timeCreated ?? stUser.timeJoined;
   const metadataMeta = Object.fromEntries(
     Object.entries(metadata).filter(
@@ -2189,11 +2204,11 @@ async function getUserById(userId) {
     attributes: originalRowndUser?.attributes || {}
   };
 }
-async function getLatestSessionInfo(userId) {
+async function getLatestSessionInfo(userId, tenantId) {
   const sessionHandles = await Session.getAllSessionHandlesForUser(
     userId,
     true,
-    PUBLIC_TENANT_ID
+    tenantId
   );
   const sessionInfos = await Promise.all(
     sessionHandles.map(
@@ -2208,21 +2223,21 @@ async function getLatestSessionInfo(userId) {
   }
   return latestSessionInfo;
 }
-async function updateUserData(userId, inputData) {
+async function updateUserData(userId, inputData, tenantId = PUBLIC_TENANT_ID) {
   const metadata = await getUserMetadata(userId);
   const updatedMetadata = {
     ...metadata,
     ...inputData
   };
   await UserMetadata3.updateUserMetadata(userId, updatedMetadata);
-  return getUserById(userId);
+  return getUserById(userId, tenantId);
 }
 async function startPendingEmailVerification(input) {
   const metadata = await getUserMetadata(input.userId);
-  const currentEmail = (await getUserById(input.userId)).data.email;
+  const currentEmail = (await getUserById(input.userId, input.tenantId)).data.email;
   const pendingVerifications = getPendingVerifications(metadata);
   const pendingEmailVerifications = pendingVerifications.filter(
-    (pendingVerification2) => pendingVerification2.field === "email"
+    (pendingVerification2) => pendingVerification2.field === "email" && (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) === input.tenantId
   );
   if (currentEmail === input.email) {
     for (const pendingVerification2 of pendingEmailVerifications) {
@@ -2237,11 +2252,11 @@ async function startPendingEmailVerification(input) {
       await UserMetadata3.updateUserMetadata(input.userId, {
         ...metadata,
         rownd_pending_verification: pendingVerifications.filter(
-          (pendingVerification2) => pendingVerification2.field !== "email"
+          (pendingVerification2) => pendingVerification2.field !== "email" || (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) !== input.tenantId
         )
       });
     }
-    return getUserById(input.userId);
+    return getUserById(input.userId, input.tenantId);
   }
   for (const pendingVerification2 of pendingEmailVerifications) {
     await EmailVerification.revokeEmailVerificationTokens(
@@ -2255,13 +2270,14 @@ async function startPendingEmailVerification(input) {
     id: input.pendingVerificationId,
     field: "email",
     value: input.email,
-    created_at: (/* @__PURE__ */ new Date()).toISOString()
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    tenantId: input.tenantId
   };
   await UserMetadata3.updateUserMetadata(input.userId, {
     ...metadata,
     rownd_pending_verification: [
       ...pendingVerifications.filter(
-        (pendingVerification2) => pendingVerification2.field !== "email"
+        (pendingVerification2) => pendingVerification2.field !== "email" || (pendingVerification2.tenantId ?? PUBLIC_TENANT_ID) !== input.tenantId
       ),
       pendingVerification
     ]
@@ -2280,12 +2296,14 @@ async function startPendingEmailVerification(input) {
     await completePendingEmailVerification({
       recipeUserId: input.recipeUserId,
       email: input.email,
+      tenantId: input.tenantId,
       userContext: input.userContext
     });
   }
-  return getUserById(input.userId);
+  return getUserById(input.userId, input.tenantId);
 }
 async function completePendingEmailVerification(input) {
+  const tenantId = input.tenantId ?? PUBLIC_TENANT_ID;
   const user = await SuperTokens2.getUser(
     input.recipeUserId.getAsString(),
     input.userContext
@@ -2296,7 +2314,8 @@ async function completePendingEmailVerification(input) {
   const pendingVerification = pendingVerifications.find(
     (pendingVerification2) => isMatchingPendingEmailVerification(
       pendingVerification2,
-      input.email
+      input.email,
+      tenantId
     )
   );
   if (!pendingVerification) {
@@ -2304,7 +2323,12 @@ async function completePendingEmailVerification(input) {
   }
   let metadataUserId = userId;
   let verifiedRecipeUserId = input.recipeUserId;
-  const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(user);
+  const tenantLoginMethods = user?.loginMethods.filter(
+    (method) => method.tenantIds.includes(tenantId)
+  ) ?? [];
+  const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(
+    tenantLoginMethods
+  );
   if (passwordlessEmailMethod) {
     const updateResult = await Passwordless.updateUser({
       recipeUserId: passwordlessEmailMethod.recipeUserId,
@@ -2317,9 +2341,9 @@ async function completePendingEmailVerification(input) {
       );
     }
     verifiedRecipeUserId = passwordlessEmailMethod.recipeUserId;
-  } else if (hasOnlyGuestLoginMethods(user)) {
+  } else if (hasOnlyGuestLoginMethods(user ? { ...user, loginMethods: tenantLoginMethods } : user)) {
     const isPasswordlessSignUpAllowed = await AccountLinking.isSignUpAllowed(
-      PUBLIC_TENANT_ID,
+      tenantId,
       {
         recipeId: "passwordless",
         email: input.email
@@ -2333,7 +2357,7 @@ async function completePendingEmailVerification(input) {
     }
     const passwordlessUser = await Passwordless.signInUp({
       email: input.email,
-      tenantId: PUBLIC_TENANT_ID,
+      tenantId,
       userContext: input.userContext
     });
     verifiedRecipeUserId = passwordlessUser.recipeUserId;
@@ -2377,7 +2401,8 @@ async function completePendingEmailVerification(input) {
     rownd_pending_verification: targetPendingVerifications.filter(
       (verification) => !isMatchingPendingEmailVerification(
         verification,
-        input.email
+        input.email,
+        tenantId
       )
     )
   };
@@ -2387,8 +2412,8 @@ async function completePendingEmailVerification(input) {
     recipeUserId: verifiedRecipeUserId
   };
 }
-function isMatchingPendingEmailVerification(verification, email) {
-  return verification.field === "email" && verification.value === email;
+function isMatchingPendingEmailVerification(verification, email, tenantId) {
+  return verification.field === "email" && verification.value === email && (verification.tenantId ?? PUBLIC_TENANT_ID) === tenantId;
 }
 async function updateUserMetadata(userId, inputMeta) {
   const metadata = await getUserMetadata(userId);
@@ -2406,8 +2431,8 @@ async function updateUserMetadata(userId, inputMeta) {
     )
   };
 }
-function getPasswordlessEmailLoginMethod(user) {
-  return user?.loginMethods.find((method) => {
+function getPasswordlessEmailLoginMethod(loginMethods) {
+  return loginMethods.find((method) => {
     return method.recipeId === "passwordless" && !!method.email;
   });
 }
@@ -2417,6 +2442,7 @@ import { randomUUID } from "crypto";
 import SuperTokens3 from "supertokens-node";
 import Session2 from "supertokens-node/recipe/session";
 import ThirdParty from "supertokens-node/recipe/thirdparty";
+import MultiTenancy from "supertokens-node/recipe/multitenancy";
 function isBodyString(body, key) {
   return isRecord(body) && typeof body[key] === "string" && body[key].length > 0;
 }
@@ -2481,7 +2507,9 @@ function handleGuestLogin(deps) {
   return async (req, res, _session, userContext) => {
     const startedAt = Date.now();
     const guestId = `guest_${randomUUID()}`;
+    let tenantId;
     try {
+      tenantId = resolveTenantId(req);
       const body = parseGuestBody(await getJsonBody(req));
       const appVariantId = getRequestedAppVariantIdFromRequest(req);
       assertRowndAppVariantIsConfigured(appVariantId);
@@ -2489,7 +2517,7 @@ function handleGuestLogin(deps) {
       const thirdPartyUserId = thirdPartyId === INSTANT_AUTH_METHOD_ID ? `anon_${randomUUID()}` : guestId;
       const authLevel = thirdPartyId === INSTANT_AUTH_METHOD_ID ? INSTANT_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
       const response = await ThirdParty.manuallyCreateOrUpdateUser(
-        PUBLIC_TENANT_ID,
+        tenantId,
         thirdPartyId,
         thirdPartyUserId,
         `${thirdPartyUserId}@anonymous.local`,
@@ -2505,7 +2533,7 @@ function handleGuestLogin(deps) {
       await Session2.createNewSession(
         req,
         res,
-        PUBLIC_TENANT_ID,
+        tenantId,
         response.recipeUserId,
         {
           ...buildRowndAudience({}, appVariantId),
@@ -2520,7 +2548,7 @@ function handleGuestLogin(deps) {
       deps.telemetryClient.recordSuccess({
         outcome: "success",
         durationMs: Date.now() - startedAt,
-        tenantId: PUBLIC_TENANT_ID,
+        tenantId,
         superTokensUserId: response.user.id
       });
       return {
@@ -2532,7 +2560,7 @@ function handleGuestLogin(deps) {
       deps.telemetryClient.recordError({
         error,
         startedAt,
-        tenantId: PUBLIC_TENANT_ID
+        tenantId
       });
       return {
         status: "ERROR",
@@ -2544,7 +2572,7 @@ function handleGuestLogin(deps) {
 function handleMigrate(deps) {
   return async (req, res, _session, userContext) => {
     const startedAt = Date.now();
-    let tenantId = PUBLIC_TENANT_ID;
+    let tenantId;
     let rowndUserId;
     let superTokensUserId;
     let user;
@@ -2553,6 +2581,7 @@ function handleMigrate(deps) {
       if (!deps.stConfig.supertokens) {
         throw new Error("Supertokens config not found");
       }
+      tenantId = resolveTenantId(req);
       const parsed = await parseRequest(req);
       const appVariantId = getRequestedAppVariantIdFromRequest(req);
       assertRowndAppVariantIsConfigured(appVariantId);
@@ -2560,13 +2589,16 @@ function handleMigrate(deps) {
       const rowndUser = await fetchOptionalRowndUserInfo(rowndUserId);
       if (!rowndUser) {
         logDebugMessage(
-          `Skipping migration because user does not exist in Rownd. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `Skipping migration because user does not exist in Rownd. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
         return { status: "OK" };
       }
       user = await SuperTokens3.getUser(rowndUserId, userContext);
       if (!user) {
-        const stUserImport = mapRowndUserToSuperTokens(rowndUser);
+        const stUserImport = mapRowndUserToSuperTokens(
+          rowndUser,
+          tenantId === PUBLIC_TENANT_ID ? void 0 : tenantId
+        );
         try {
           await importUser(stUserImport, deps.stConfig.supertokens);
           clearSuperTokensCoreCallCache(userContext);
@@ -2584,29 +2616,43 @@ function handleMigrate(deps) {
           superTokensUserId = user.id;
           recipeUserId = user.loginMethods[0]?.recipeUserId;
           logDebugMessage(
-            `User already migrated (race condition). tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+            `User already migrated (race condition). tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
           );
         }
         logDebugMessage(
-          `User migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `User migrated successfully. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
       } else {
         superTokensUserId = user.id;
         recipeUserId = user.loginMethods[0]?.recipeUserId;
         logDebugMessage(
-          `User already migrated. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          `User already migrated. tenantId: ${tenantId}, rowndUserId: ${rowndUserId}`
         );
       }
       if (superTokensUserId) {
         await recordRowndAppVariantForUser(superTokensUserId, appVariantId);
       }
+      const tenantLoginMethod = user?.loginMethods.find(
+        (method) => method.tenantIds.includes(tenantId)
+      );
+      recipeUserId = tenantLoginMethod?.recipeUserId ?? recipeUserId;
       if (!recipeUserId) {
         throw new Error("User not found or has no login methods");
       }
+      if (!tenantLoginMethod) {
+        const associationResult = await MultiTenancy.associateUserToTenant(
+          tenantId,
+          recipeUserId,
+          userContext
+        );
+        if (associationResult.status !== "OK") {
+          throw new Error(`Failed to associate migrated user with tenant: ${associationResult.status}`);
+        }
+      }
       await Session2.createNewSession(
         req,
         res,
-        PUBLIC_TENANT_ID,
+        tenantId,
         recipeUserId,
         {
           ...buildRowndAudience({}, appVariantId)
@@ -2615,7 +2661,7 @@ function handleMigrate(deps) {
         userContext
       );
       logDebugMessage(
-        `Session migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, userId: ${superTokensUserId}`
+        `Session migrated successfully. tenantId: ${tenantId}, userId: ${superTokensUserId}`
       );
       deps.telemetryClient.recordSuccess({
         outcome: "success",
@@ -2649,7 +2695,7 @@ function clearSuperTokensCoreCallCache(userContext) {
 }
 function handleGetUser() {
   return async (_req, _res, session) => {
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       ...user
@@ -2675,7 +2721,11 @@ function handleUpdateUser() {
       return permissionError;
     }
     if (Object.keys(dataWithoutEmail).length > 0) {
-      await updateUserData(session.getUserId(), dataWithoutEmail);
+      await updateUserData(
+        session.getUserId(),
+        dataWithoutEmail,
+        session.getTenantId()
+      );
     }
     if (hasEmailUpdate) {
       const pendingVerificationResult = await startPendingEmailVerification({
@@ -2691,7 +2741,7 @@ function handleUpdateUser() {
         ...pendingVerificationResult
       };
     }
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       ...user
@@ -2758,7 +2808,7 @@ function handleGetUserField() {
     if (!field) {
       return missingFieldResponse();
     }
-    const user = await getUserById(session.getUserId());
+    const user = await getUserById(session.getUserId(), session.getTenantId());
     return {
       status: "OK",
       value: user.data[field]
@@ -2792,9 +2842,11 @@ function handleUpdateUserField() {
     if (permissionError) {
       return permissionError;
     }
-    const updateUserDataResult = await updateUserData(session.getUserId(), {
-      [field]: payload.value
-    });
+    const updateUserDataResult = await updateUserData(
+      session.getUserId(),
+      { [field]: payload.value },
+      session.getTenantId()
+    );
     return {
       status: "OK",
       ...updateUserDataResult
@@ -2814,6 +2866,7 @@ function validateWritableFields(fields) {
 }
 
 // src/plugin.ts
+var DISABLED_MIGRATION_ROWND_APP_KEY = "migration-disabled";
 var verifyRowndUserSessionOptions = {
   sessionRequired: true,
   overrideGlobalClaimValidators: (validators) => validators.filter((validator) => {
@@ -2822,10 +2875,10 @@ var verifyRowndUserSessionOptions = {
 };
 var init = createPluginInitFunction(
   (pluginConfig2) => {
-    const rowndClient2 = createInstance({
+    const rowndClient2 = !pluginConfig2.disableRowndUserMigration && pluginConfig2.rowndAppSecret ? createInstance({
       app_key: pluginConfig2.rowndAppKey,
       app_secret: pluginConfig2.rowndAppSecret
-    });
+    }) : void 0;
     const telemetryClient = createClient(pluginConfig2.telemetry);
     let hubBootstrapParams;
     const addHubBootstrapParams = (input, linkKey, targetPath) => {
@@ -2865,6 +2918,11 @@ var init = createPluginInitFunction(
       id: PLUGIN_ID,
       compatibleSDKVersions: PLUGIN_SDK_VERSION,
       init: async () => {
+        if (pluginConfig2.disableRowndUserMigration) {
+          console.warn(
+            "RowndMigrationPlugin: Rownd user and session migration is disabled."
+          );
+        }
         if (!supertokens.isRecipeInitialized("session")) {
           console.warn(
             "RowndMigrationPlugin: Session recipe is not initialized. Session migration will fail."
@@ -2908,11 +2966,11 @@ var init = createPluginInitFunction(
               method: "post",
               handler: withRequestHandler(handleGuestLogin(routeHandlerDeps))
             },
-            {
+            ...!pluginConfig2.disableRowndUserMigration ? [{
               path: `${apiBasePath}${HANDLE_BASE_PATH}/migrate`,
               method: "post",
               handler: withRequestHandler(handleMigrate(routeHandlerDeps))
-            },
+            }] : [],
             {
               path: `${apiBasePath}/plugin/passwordless-cross-device-confirmation/validate`,
               method: "post",
@@ -2920,11 +2978,11 @@ var init = createPluginInitFunction(
                 handleValidatePasswordlessConfirmationBypass(routeHandlerDeps)
               )
             },
-            {
+            ...!pluginConfig2.disableRowndUserMigration ? [{
               path: `${apiBasePath}/plugin/migrate-session`,
               method: "post",
               handler: withRequestHandler(handleMigrate(routeHandlerDeps))
-            },
+            }] : [],
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/signout`,
               method: "post",
@@ -3277,6 +3335,7 @@ var init = createPluginInitFunction(
                 const verificationResult = await completePendingEmailVerification({
                   recipeUserId: response.user.recipeUserId,
                   email: response.user.email,
+                  tenantId: input.tenantId,
                   userContext: input.userContext
                 });
                 const session = input.session;
@@ -3303,9 +3362,14 @@ var init = createPluginInitFunction(
   },
   () => ({}),
   (config2) => {
-    if (!config2?.rowndAppKey || !config2?.rowndAppSecret) {
+    if (config2?.disableRowndUserMigration !== void 0 && typeof config2.disableRowndUserMigration !== "boolean") {
+      throw new Error(
+        "disableRowndUserMigration must be a boolean in plugin config"
+      );
+    }
+    if (!config2?.disableRowndUserMigration && (!config2?.rowndAppKey || !config2?.rowndAppSecret)) {
       throw new Error(
-        "Missing rowndAppKey or rowndAppSecret in plugin config"
+        "Missing rowndAppKey or rowndAppSecret in plugin config. Set disableRowndUserMigration to true to disable migration."
       );
     }
     if (config2.telemetry?.provider === "axiom") {
@@ -3326,8 +3390,9 @@ var init = createPluginInitFunction(
       validateClientDomainUrl(key, value);
     }
     return {
-      rowndAppKey: config2.rowndAppKey,
+      rowndAppKey: config2.rowndAppKey ?? DISABLED_MIGRATION_ROWND_APP_KEY,
       rowndAppSecret: config2.rowndAppSecret,
+      disableRowndUserMigration: config2.disableRowndUserMigration === true,
       enableDebugLogs: config2.enableDebugLogs,
       clientDomains: config2.clientDomains,
       crossDeviceConfirmationBypass: config2.crossDeviceConfirmationBypass,

package/dist/initConfig.js

@@ -63,6 +63,8 @@ rownd:
 supertokens:
   connectionURI: <CONNECTION_URI>
   apiKey: <API_KEY>
+  # Tenant that receives every imported login method.
+  tenantId: public
   # Number of users to send to SuperTokens per bulk import request.
   batchSize: 500
 `;

package/dist/setupCoreInstance.js

@@ -69,7 +69,8 @@ var ConfigSchema = import_zod.z.object({
   supertokens: import_zod.z.object({
     connectionURI: import_zod.z.string(),
     apiKey: import_zod.z.string().optional(),
-    batchSize: import_zod.z.number().int().positive()
+    batchSize: import_zod.z.number().int().positive(),
+    tenantId: import_zod.z.string().min(1).default("public")
   }),
   thirdPartyProviders: import_zod.z.array(
     import_zod.z.object({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supertokens-plugins/rownd-nodejs",
-  "version": "0.5.1",
+  "version": "0.6.1",
   "description": "Rownd User Migration Plugin for SuperTokens",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",