One more question when using MFA the `create new session` ca

Question

One more question when using MFA the `create new session` call will get the `user id` from the latest recipe used in MFA flow is that right So how do I override the `user id` to contain the ID from the very first recipe in my MFA flow

execreate · Answer

For instance I am using Passwordless OTP as first factor and EmailPassword PhoneNumberPassword actually as the second factor I want my users to have the Passwordless recipe `user id` I can get that ID this way ```python passwordless user id = get user by phone number old session get access token payload get phoneNumber id ``` And then is it enough to pass that ID to `original implementation create new session` as `user id`

nkshah2 · Answer

Right one way to do this is to check if a session already exists when the PhonenumberPassword sign in up is called If it does exist then you can get the user id from the session

nkshah2 · Answer

You would need to override the api for this and then you pass the existing user id as user context when calling the original function

nkshah2 · Answer

Then in create new session the user id should be present in the user context you can then override that function and use the value from user context to set a user id for the session

nkshah2 · Answer

https supertokens com docs emailpassword advanced customizations user context

nkshah2 · Answer

If you need help with specifics we can get on call and I can help

execreate · Answer

Totally forgot about the user context thanks So I assume passing the desired user id into the `original implementation create new session` should be fine I think I m almost there with my implementation

nkshah2 · Answer

Yep that should work

execreate · Answer

One more question global claim validator `SecondFactorCompletedClaim validators has value True ` does not fail if token does not contain the claim at all is that right

nkshah2 · Answer

< KShivendu> can answer that better

rp · Answer

It will try and fetch the claim value from the second factor claim first and then based on that it will check if that claim is true or not

rp · Answer

The fetch value function on second factor claim returns false I think So if the claim is not defined it will first call the fetch value function which will set it to false and then it will check if the value is true or not in this case failing

execreate · Answer

< rp> Thanks a lot