Skip to content

Add SDK compatibility endpoints#40

Open
bcbogdan wants to merge 93 commits into
mainfrom
rownd-plugin
Open

Add SDK compatibility endpoints#40
bcbogdan wants to merge 93 commits into
mainfrom
rownd-plugin

Conversation

@bcbogdan

@bcbogdan bcbogdan commented Apr 26, 2026

Copy link
Copy Markdown
Collaborator

Summary

Adds Rownd compatibility endpoints and migration tooling needed to run Rownd-backed apps on SuperTokens while preserving Rownd API behavior during migration.

Compatibility Endpoints

  • GET /plugin/rownd/app-config: returns Rownd-compatible app, branding, schema, auth method, legal, and profile configuration for the hub/client.
  • POST /plugin/rownd/guest: creates a guest or anonymous SuperTokens user and starts a session with Rownd-compatible claims.
  • POST /plugin/rownd/migrate: validates a Rownd token, imports the Rownd user into SuperTokens when needed, and creates a SuperTokens session.
  • GET /plugin/rownd/user: returns a Rownd-compatible user payload derived from SuperTokens login methods plus migrated Rownd profile data.
  • PUT /plugin/rownd/user: updates writable profile data and defers email changes through SuperTokens email verification.
  • DELETE /plugin/rownd/user: deletes the current authenticated user.
  • GET /plugin/rownd/user/meta: returns user metadata while hiding internal migration and verification state.
  • PUT /plugin/rownd/user/meta: updates user metadata while rejecting internal Rownd compatibility fields.
  • GET /plugin/rownd/user/field: returns a single synthesized user data field, including auth-derived identity fields.
  • PUT /plugin/rownd/user/field: updates a single writable profile field, with email updates routed through verification.

Recipe Overrides

  • passwordless.emailDelivery: rewrites passwordless magic-link URLs to the Rownd-compatible /account/login path.
  • emailverification.emailDelivery: rewrites email verification links to the Rownd-compatible /account/verify-email path.
  • emailverification.verifyEmailPOST: completes pending Rownd-compatible email updates after SuperTokens verifies the email.
  • accountlinking.shouldDoAutomaticAccountLinking: allows guest/anonymous upgrades and matching real-auth identity linking while delegating unsafe cases to app policy.
  • session.createNewSession: injects Rownd-compatible session claims such as auth_level, is_anonymous, and anonymous_id.

@changeset-bot

changeset-bot Bot commented Apr 26, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: cd4a915

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

feat(rownd-nodejs): provision multi-tenancy and OIDC clients separately
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants