I found an edge case in our Auth0 to SuperTokens migration.
Users that do not yet exist within SuperTokens might have forgotten their passwords. So we need a way for creating their supertokens account upon doing a password reset request 🤔
What I have in mind is the following:
1. Overwrite
getUsersByEmail
2. Do a RPC call to our services/auth0 for checking whether an email/password user with a given email exists
3. if he does not exist use
originalImplementation.emailPasswordSignUp
for creating the user with a random password
4. return that newly created user from the
getUsersByEmail
function
I think one problem here is that
getUsersByEmail
is not exclusively used by the reset password functionality - I can observe that function being called for a basic login attempt as well. 🤔
As I workaround I figured out that using the
userContext
might work - though it seems a bit like an hacky attempt.
...
async getUsersByEmail(input) {
// In case this does not happen as part of the reset password token flow we just use the default implementation.
if (
input.userContext?.['_default']?.['request']?.['original']?.['url'] !==
'/api/auth/user/password/reset/token'
) {
return originalImplementation.getUsersByEmail(input);
}
...
Does that seem reasonable? Are there any better alternatives? Did anyone do something similar before?