[RELEASE]: Multi tenancy

[rishabhpoddar]

📅 Checklist

🔶 Staging

Dev Tag

• supertokens-core:X.Y
  • [x] core
    • [x] check CDI, plugin interface list
  • [x] plugin-interface
    • [x] check plugin interface list
  • [x] mysql-plugin
    • [x] check plugin interface list
  • [x] postgresql-plugin
    • [x] check plugin interface list
  • [x] mongodb-plugin
    • [x] check plugin interface list
• [x] supertokens-node:X.Y
  • [x] check CDI, FDI list
  • [x] dashboard version updating.
  • [x] Why do we override the getPayload and getLastFetch function in allowedDomainClaims?
  • [x] In the changelog, mention the compatible frontend SDKs and core as well.
  • [x] userinfo map bug fix: https://github.com/supertokens/supertokens-node/pull/651
  • [x] if we do thirdpartyemailpassword init without a provider, it will disable all third party routes. This means that even though a tenant has third party provider, it won’t work - cause all third party routes will have been disabled.
  • [x] mention in the Changelog the changes in FDI spec. Specifically for third party sign in up. Since mobile apps make the call manually. Also, that it doesn’t support older CDIs and older FDIs.
  • [x] Make sure that this is resolved: https://supertokens.slack.com/archives/D03CNFWTP99/p1689342076274879
  • [x] add test to make sure that appId can be used in connectionuri and things work with that.
• [x] supertokens-golang:X.Y
  • [x] check CDI, FDI list
• [x] supertokens-python:X.Y
  • [x] check CDI, FDI list
  • [x] test all the providers manually.
• [x] supertokens-website:X.Y
  • [x] check FDI list
• [x] supertokens-web-js:X.Y
  • [x] check FDI list
  • [x] check web-js interface version
  • [x] Update dependency version of supertokens-website in package.json from npm registry
  • [x] API calls that require a session (like refresh, email verification token generation, isEmailVerified), should not call the global getTenantId function and just query the path without a tenantId.
  • [x] Add a migration guide to https://github.com/supertokens/supertokens-web-js/blob/master/CHANGELOG.md
• [x] supertokens-auth-react:X.Y
  • [x] check FDI list
  • [x] check web-js interface version
  • [x] Updated dependencies to use supertokens-web-js in package.json from npm registry
  • [x] Various browsers - Safari, Firefox, Chrome, Edge
  • [x] Mobile responsiveness
  • [x] Make sure using with-typescript example that types are correct for every new configs exposed to users
  • [x] Make sure frontend login UI shows even if backend is not working.
  • [x] ID for allowed domains claims needs to be the same as what's on the backend.
• [x] supertokens-dashboard
  • [x] Need to make request queue system for all older minor versions of the dashboard as well.
  • [ ] Need to add ability to remove and add users to tenants in the dashboard.
  • [ ] User permissions
  • [x] Check that all items in this list (https://github.com/supertokens/supertokens-node/pull/471) are done for:
  • [x] nodejs
  • [x] golang
  • [x] python
  • [x] Change CLI to show a temp unavailable message for golang and python
  • [x] Test that the dev credentials work as expected post pushing website to prod.
  • [x] License key should not be required for in memory
  • [ ] In backend SDk, we need to verify that the access token is valid for that client ID in the case of client ID + secret flow (we already check the aud for id token)

Others

• [x] Example apps in create-supertokens-app CLI
  • [x] Examples apps in supertokens-auth-react
  • [x] Examples apps in supertokens-web-js
  • [x] Examples apps in supertokens-react-native
  • [x] Examples apps in supertokens-golang
  • [x] Examples apps in supertokens-python
  • [x] Examples apps in supertokens-node
  • [x] Examples apps in android
  • [x] Example apps in ios
  • [x] Example apps in flutter
  • [x] next.js:canary
  • [x] RedwoodJS and playground-auth
  • [ ] Run on netlify (and hence AWS lambda) to check if it works fine there
  • [ ] Test on vercel (with-emailpassword-vercel app)
  • [ ] SuperTokens Jackson SAML example update
  • [ ] Supabase docs
  • [ ] Capacitor template app: https://github.com/RobSchilderr/capacitor-supertokens-nextjs-turborepo

📚 Documentation (test site)

• [x] All recipe main documentation update
• [x] Code type checking versions are pointing to X.Y
  • [x] jsEnv
  • [x] goEnv
  • [x] pythonEnv
• [x] Update table schema in mysql / postgresql section for self hosted
• [x] community documentation update
• [x] website changes (test.supertokens.io)
  • [x] homepage - remove multi tenancy waitlist section
  • [x] product roadmap page
  • [x] Update API key code snippet in SaaS dashboard
  • [x] Update recipe list and links to the docs for supertokens.com dashboard
• [x] Check coreinjector putting in right uri with older and newer APIs in prod
• [x] in the saas dashboard, for the option of Please select your desired Recipe (auth method), you need to also add “Multi login, multi tenant” option, and that should link to the multi tenancy docs.
• [x] There is a glitch in billing section where the SMS cost section shows for a few seconds, and then disappears.
• [x] Need to confirm that the react code for submitting the tenantId in “common-domain-login” is correct.
• [x] Check that cURL commands for creating a saas app is correct (for example, they should use PUT and not POST).
• [x] For python and golang, in post login email change docs, in method 2, we need to check if the email exists for any tenant that the user is a part of.
• [x] Check coreinjector putting in right uri with older and newer APIs in prod.
• [x] In websocket session management, we need to mention that the claims should be checked properly.
• [x] use the released versions of the sdks in code type checking for all SDKs
• [x] Fix all golang and python snippets - from branch tp-rework-partial-snippets
  • [x] also apply changes from this PR https://github.com/supertokens/docs/pull/683/files
• [x] Verify that the dev credentials for oauth still work - for older and newer versions of the backend sdk. especially for apple login
• [ ] Solve https://github.com/supertokens/supertokens-core/issues/731#issuecomment-1641680289
• [x] Make sure that there is no delete button on the saas dashboard in prod.
• [x] Fix nextjs CLI app
• [x] In multi tenancy docs, the link to thirdpartyemailpassword points to thirdpartypasswordless in the last doc
• [x] In post sign up docs, add code snippet for python (api way): https://supertokens.com/docs/thirdpartyemailpassword/common-customizations/handling-signinup-success
• [ ] Write about spinner behaviour in multi tenancy and why it's needed and how to override and style it.
• [x] In intro of multi tenancy, write about different login methods being supported
• [ ] In common UX flow, where we mention about building the form to ask tenant ID, in vue and angular, actually use vue and angular code instead of react.
• [x] Add demo app link in docs to live demo for multi tenancy + mention the use of CLI to generate multi tenancy docs.
• [x] IIn muoti tenancy features, write about flexible tenant discovery
• [x] sign in up code snippets for python need to be functions and not apis
• [x] there are also issues where you have syncio and asyncio in python, but both those code tabs are asyncio (for example, in email verification > generate link manually
• [x] there are cases in python where the claim.build function is being called without a tenant id - check in all places where build( is there and make sure it passes in tenant id
• [x] Issues with comments in golang in third party > handling sign in up success where the comment says overriding api, but we are overriding functions
• [x] GetUsersByEmail in golang has certain places where tenant id and email are flipped. Same thing goes for python
• [x] Check that getting user info from provider is correctly done, and it shows how to get the first name, last name, access token from the third party provider.
• [ ] Docs for how to change tenants whilst being logged in - checks for if the user belongs to the tenant and calling the createNewSession without the protected props.
• [ ] Docs on common UX flow 3 where user logs in first and then is asked to choose a tenant, or is assigned the non public tenant automatically if there exists just one such tenant.
• [ ] Docs for how to create a new app on our managed service vs in self hosted.
• [ ] DOcs for how to check if a tenant exists on the backend

🔥 Production

💻 NPM and core release

• core
  • [x] supertokens-core:X.Y
  • [x] plugin-interface
  • [x] mysql-plugin
  • [x] postgresql-plugin
  • [x] mongodb-plugin
  • Docker update
    • [x] MySQL
      • [x] check if new env cnofigs need to be added
    • [x] Postgres
      • [x] check if new env cnofigs need to be added
    • [x] MongoDB
      • [x] check if new env cnofigs need to be added
  • [x] try.supertokens.io

    docker rm try-supertokens -f
    docker rmi supertokens/supertokens-postgresql:<VERSION>
    nano ~/try-supertokens/start_container.sh (update version tag)
    ~/try-supertokens/start_container.sh

  • [x] Update SaaS config
  • [x] Change lambda function to use new slack bot
  • [x] Fix healthcheck not not update instatus if a core can't be found and it was just released.
  • [x] Discuss how we can move a user's prod shared instance to their own dedicated instance for core 6.0
  • [x] Need to limit prod instances to only work with prod SSH keys
  • [x] Update to tables checked for user count / or to know if a deployment is being used or not
  • [ ] Update logic for deleting all data in dev env if a new table was added and if the data should be removed from it too
  • [x] Update logic for exporting csv file for registered users
  • [x] Update SaaS instances to use the latest docker images.
  • [ ] Change checklist in contributing guide for which tables to pick when migrating data from dev to prod instance.
  • [x] Update license key used for cores to include nea feature.
  • [x] Update table schema in mysql / postgresql section for self hosted in docs
  • [ ] Update SaaS to monitor for 429s
  • [x] uncomment dangling instance and core instance removal part once we are confident that the cronjobs are identifying the instances correctly
  • [ ] Update rate limit for new infra:
    • [ ] for shared instance (t3.large):
      • [ ] dev 10 rps, 20 burst; nodelay
      • [ ] prod: 10 rps, 20 burst; nodelay
    • [ ] for dedicated instance (t3.small)
      • [ ] dev: 100 rps, 150 burst; nodelay
      • [ ] prod: 100 rps, 150 burst; nodelay
  • [x] Confirm the rate limit setting is fine based on demo apps and their RPS.
  • [x] Defragment dev instances of older supertokens core apps - for example, in us-east-1, we still have 56 instances. Why?
• [x] supertokens-node:X.Y
• [ ] supertokens-golang:X.Y
  • [x] Change CLI to use latest of auth react here too
  • [x] Add support for multi tenancy example
  • [ ] Update frontend SDK changelog to mention the right version for this SDK
• [x] supertokens-website:X.Y
• [x] supertokens-web-js:X.Y
• [x] supertokens-auth-react:X.Y
• [ ] supertokens-python:X.Y
  • [x] Change CLI to use latest of auth react here too
  • [x] Add support for multi tenancy example
  • [ ] Update frontend SDK changelog to mention the right version for this SDK
  • [x] supertokens-dashboard
  • [x] Clear data button on saas dashboard should only delete for the app and nothing more - not other app, no CUD etc etc.
  • [x] Add in docs for frontend SDK that if using python or golang, use the older versions.
  • [x] change multi tenancy title in guides to have organizations in the name

📚 Documentation

• [x] Pushed to production
• [x] Post message on discord about new update
• [x] Post release of golang and python sdk on discord
• [x] Updated swaggerhub FDI spec
• [x] Update frontend-driver-interface repo
• [x] Updated swaggerhub CDI spec
• [x] Update core-driver-interface-repo
• [x] Updated dashboard spec on swaggerhub
• [x] Update dashboard spec
• [x] Update internal contributing guide to move from previous core version to the latest one
• [x] Algolia search update for docs
• [x] robots.txt, sitemap.xml, noindex page update
• Auto generate release note on github:
  • [x] supertokens-core
  • [x] supertokens-plugin-interface
  • [x] supertokens-mysql-plugin
  • [x] supertokens-postgresql-plugin
  • [x] supertokens-mongodb-plugin
  • [x] supertokens-node
  • [x] supertokens-golang
  • [x] supertokens-python
  • [x] supertokens-website
  • [x] supertokens-web-js
  • [x] supertokens-auth-react
  • [x] supertokens-dashboard
• [ ] Add CLI example app fro multi tenancy - we need to complete vue and angular frontends, and those will implement the tenantId form in vue and angular respectively.
• [x] Remove the page reload stuff in the CLI example apps after releasing the auth-react update
• [ ] Finish all saas changes: https://github.com/supertokens/backend/issues/275
• [x] All changes mentioned here: https://github.com/supertokens/supertokens-core/issues/731#issuecomment-1669156390

[rishabhpoddar]

changes to docs / auth react flows

docs: https://test.supertokens.com/docs/thirdpartyemailpassword/common-customizations/multi-tenancy/common-domain-login (pre built ui)

• [x] We need to refresh the page once the tenantID has been submitted
• [x] We need to not clear the tenant ID in useEffect and read from that when initialising TenantLoginPage
• [x] getRedirectionURL can directly redirect to a different sub domain.
• [x] Instead of rendering the <SignInAndUp /> component in TenantLoginPage, we should use the getRoutingComponent - to confirm that, it still uses react router dom in case getSuperTokensRoutesForReactRouterDom is called in the main router of the app.
• [x] Need to also say to clear tenantId in onHandleEvent for SIGN_OUT or UNAUTHORISED.
• [x] If react router dom is being used, we should tell users to remove that from the app.js.
• [x] Remove the step for disabling the default UI in step 2

https://test.supertokens.com/docs/thirdpartyemailpassword/common-customizations/multi-tenancy/sub-domain-login (pre build ui):

• [x] Indentation of getTenantId is not proper.

In both the UX flows:

• [x] Instead of adding hasAccessToCurrentDomain to each session auth (pre built UI), we should add it to the global session.init override.
• [x] Instead of adding hasAccessToCurrentDomain in shouldLoadRoute (custom UI), we should add it to the global session.init override.

auth-react SDK:

• [x] if reset password (or any other) route is loaded even though the current tenant doesn't have the associated recipe enabled, it should not throw an error. Instead, it should redirect to the auth screen.
• [x] canHandleRoute should only depend on the static list of recipes that are initialised and nothing else. In case, this returns true, but the tenant has not enabled that recipe, then it will just cause a redirection to the auth page (see point above)
• [x] add a new optional param getSuperTokensRoutesForReactRouterDom like getSuperTokensRoutesForReactRouterDom(reactRouterDom, [...], "/auth")

TODO later

docs: https://test.supertokens.com/docs/thirdpartyemailpassword/common-customizations/multi-tenancy/common-domain-login (pre built ui)

• [ ] Add a part about clearing the current tenant ID in TenantLoginPage (giving the user a button to change tenant id)
• [x] Update with-one-login-many-subdomains to not reload the page

auth-rect SDK:

• [x] We don't want to call getLoginMethods when the sdk is initialised and want to delay that to when pre built UI is rendered. We will show a spinner while that's being called (if more than 200 ms has lapsed, or just show a white screen). This should eliminate the for manual page refresh in TenantLoginPage component.
• [x] Revisit the disableDefaultUI config and how it works with useDynamicLoading is set to true.
  • [x] As a side task, check how example apps like splitting sign up / in UI will work in the case of multi tenancy
• [x] Improve the example of examples/with-one-login-many-subdomains to have some Ui which allows users to change the current tenant ID during login.
• [x] When calling the generateEmailVerifyTokenPOST we do not need to pass a tenantId in the path
• [x] When calling the isEmailVerifiedGET we do not need to pass a tenantId in the path .
• [ ] We should consider adding a function like supertokens.hasTenantBeenSpecifiedByUser() in the auth-react SDK which would return true if the getTenantId function returns a string vlaue, or a session exists, or the current path has a tenantId query param - this would make it easier for users to build the AuthPage UI in the common UX 1 flow.
• [ ] Google workspaces button in pre built UI doesn't look fine since the width is too small
• [x] We cache the loginMethods per tenant, and we always call getTenantId function (wherever applicable) instead of reading the tenant ID from some cache. So this means, that if the tenantID is changed (from the return of getTenantId), the next time any feature component is rendered, we will show the login methods based on the new tenantId (either from the cache, or by fetching over the network).

[rishabhpoddar]

Things to do after pushing to prod:

• [x] Check that links on docs cross recipe work (multi tenancy recipe points to right docs, user roles post sign up point to right docs)
• [x] Replace backend secrets properly
• [x] Replace slack bot (posts correctly to server error)
• [x] Check CLI example work
• [x] Check dev credentials flow work for google and apple
• [x] new app creation work
• [x] supertokens.com dashboard works fine

[nkshah2]

Golang SDK feedback:

• [x] multitenancy.CreateOrUpdateThirdPartyConfig should have skipVerification as optional - DONE
• [x] CHANGELOG should mention changes in APIInterface that are breaking for users who are overriding APIs - WAS ALREADY DONE
• [x] CHANGELOG mentions Adds optional param tenantId to GetUserCount which returns total count across all tenants if not passed. but tenant id is not optional - CHANGELOG is correct as we use pointers for optional params.
• [x] getUsersThatHaveRole Does not seem to be using tenantId in any way - DONE
• [x] FromUserInfoAPI in tpmodels.TypeUserInfoMap has an inline type declaration - DONE

  type TypeUserInfoMap struct {
  FromIdTokenPayload struct {
      UserId        string `json:"userId,omitempty"`
      Email         string `json:"email,omitempty"`
      EmailVerified string `json:"emailVerified,omitempty"`
  } `json:"fromIdTokenPayload,omitempty"`
  FromUserInfoAPI struct {
      UserId        string `json:"userId,omitempty"`
      Email         string `json:"email,omitempty"`
      EmailVerified string `json:"emailVerified,omitempty"`
  } `json:"fromUserInfoAPI,omitempty"`
  }

From a user's point of view this typing is very ugly

UserInfoMap: tpmodels.TypeUserInfoMap{
                                FromUserInfoAPI: struct{UserId string "json:\"userId,omitempty\""; Email string "json:\"email,omitempty\""; EmailVerified string "json:\"emailVerified,omitempty\""}{
                                    UserId:        "id",
                                    Email:         "email",
                                    EmailVerified: "email_verified",
                                },
                            },

We should declare another type which is then used for both FromUserInfoAPI and FromIdTokenPayload

• [x] CHANGELOG should mention a breaking change for UnknownUserIDError being renamed to UnknownUserIdError - DONE

Updated return type of GetEmailForUserId in the EmailVerification recipe config. It should now return OK, EmailDoesNotExistError or UnknownUserIDError as response.

Should be updated to rename UnknownUserIDError to UnknownUserIdError