fix: Misc changes

src/main/java/io/supertokens/utils/Utils.java

@@ -337,12 +337,12 @@ public static JsonObject addLegacySigningKeyInfos(AppIdentifier appIdentifier, M
             TenantOrAppNotFoundException {
         if (Config.getConfig(appIdentifier.getAsPublicTenantIdentifier(), main).getAccessTokenSigningKeyDynamic()) {
             result.addProperty("jwtSigningPublicKey",
-                    new Utils.PubPriKey(SigningKeys.getInstance(main).getLatestIssuedDynamicKey().value).publicKey);
+                    new Utils.PubPriKey(SigningKeys.getInstance(appIdentifier, main).getLatestIssuedDynamicKey().value).publicKey);
             result.addProperty("jwtSigningPublicKeyExpiryTime",
-                    SigningKeys.getInstance(main).getDynamicSigningKeyExpiryTime());
+                    SigningKeys.getInstance(appIdentifier, main).getDynamicSigningKeyExpiryTime());
 
             if (addKeyList) {
-                List<KeyInfo> keys = SigningKeys.getInstance(main).getDynamicKeys();
+                List<KeyInfo> keys = SigningKeys.getInstance(appIdentifier, main).getDynamicKeys();
 
                 JsonArray jwtSigningPublicKeyListJSON = new JsonArray();
                 for (KeyInfo keyInfo : keys) {
@@ -356,7 +356,7 @@ public static JsonObject addLegacySigningKeyInfos(AppIdentifier appIdentifier, M
                 result.add("jwtSigningPublicKeyList", jwtSigningPublicKeyListJSON);
             }
         } else {
-            JWTSigningKeyInfo keyInfo = SigningKeys.getInstance(main)
+            JWTSigningKeyInfo keyInfo = SigningKeys.getInstance(appIdentifier, main)
                     .getStaticKeyForAlgorithm(JWTSigningKey.SupportedAlgorithms.RS256);
             result.addProperty("jwtSigningPublicKey", new Utils.PubPriKey(keyInfo.keyString).publicKey);
             result.addProperty("jwtSigningPublicKeyExpiryTime", 10L * 365 * 24 * 3600 * 1000);

src/main/java/io/supertokens/webserver/api/core/ConfigAPI.java

@@ -19,6 +19,9 @@
 import com.google.gson.JsonObject;
 import io.supertokens.Main;
 import io.supertokens.cliOptions.CLIOptions;
+import io.supertokens.multitenancy.exception.BadPermissionException;
+import io.supertokens.pluginInterface.multitenancy.TenantIdentifier;
+import io.supertokens.pluginInterface.multitenancy.exceptions.TenantOrAppNotFoundException;
 import io.supertokens.webserver.InputParser;
 import io.supertokens.webserver.WebserverAPI;
 
@@ -49,6 +52,15 @@ protected boolean checkAPIKey(HttpServletRequest req) {
     protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException, ServletException {
         String pid = InputParser.getQueryParamOrThrowError(req, "pid", false);
 
+        try {
+            TenantIdentifier tenantIdentifier = getTenantIdentifierWithStorageFromRequest(req);
+            if (!tenantIdentifier.equals(new TenantIdentifier(null, null, null))) {
+                throw new ServletException(new BadPermissionException("you can call this only from the base connection uri domain, public app and tenant"));
+            }
+        } catch (TenantOrAppNotFoundException e) {
+            throw new ServletException(e);
+        }
+
         if ((ProcessHandle.current().pid() + "").equals(pid)) {
             String path = CLIOptions.get(main).getConfigFilePath() == null
                     ? CLIOptions.get(main).getInstallationPath() + "config.yaml"

src/main/java/io/supertokens/webserver/api/emailpassword/SignInAPI.java

@@ -72,9 +72,7 @@ protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws I
             TenantIdentifierWithStorage tenantIdentifierWithStorage = getTenantIdentifierWithStorageFromRequest(req);
             UserInfo user = EmailPassword.signIn(tenantIdentifierWithStorage, super.main, normalisedEmail, password);
 
-            ActiveUsers.updateLastActive(main, user.id); // use the internal user id
-
-            ActiveUsers.updateLastActive(main, user.id); // use the internal user id
+            ActiveUsers.updateLastActive(tenantIdentifierWithStorage.toAppIdentifierWithStorage(), main, user.id); // use the internal user id
 
             // if a userIdMapping exists, pass the externalUserId to the response
             UserIdMapping userIdMapping = io.supertokens.useridmapping.UserIdMapping.getUserIdMapping(

src/main/java/io/supertokens/webserver/api/emailpassword/SignUpAPI.java

@@ -72,9 +72,7 @@ protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws I
         try {
             UserInfo user = EmailPassword.signUp(this.getTenantIdentifierWithStorageFromRequest(req), super.main, normalisedEmail, password);
 
-            ActiveUsers.updateLastActive(main, user.id);
-
-            ActiveUsers.updateLastActive(main, user.id);
+            ActiveUsers.updateLastActive(this.getAppIdentifierWithStorage(req), main, user.id);
 
             JsonObject result = new JsonObject();
             result.addProperty("status", "OK");

src/main/java/io/supertokens/webserver/api/passwordless/ConsumeCodeAPI.java

@@ -86,7 +86,7 @@ protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws I
                     deviceId, deviceIdHash,
                     userInputCode, linkCode);
 
-            ActiveUsers.updateLastActive(main, consumeCodeResponse.user.id);
+            ActiveUsers.updateLastActive(this.getAppIdentifierWithStorage(req), main, consumeCodeResponse.user.id);
 
             UserIdMapping userIdMapping = io.supertokens.useridmapping.UserIdMapping.getUserIdMapping(
                     this.getAppIdentifierWithStorage(req),

src/main/java/io/supertokens/webserver/api/session/VerifySessionAPI.java

@@ -95,9 +95,9 @@ protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws I
 
             if (!super.getVersionFromRequest(req).greaterThanOrEqualTo(SemVer.v2_21)) {
                 result.addProperty("jwtSigningPublicKey",
-                        new Utils.PubPriKey(SigningKeys.getInstance(main).getLatestIssuedDynamicKey().value).publicKey);
+                        new Utils.PubPriKey(SigningKeys.getInstance(appIdentifier, main).getLatestIssuedDynamicKey().value).publicKey);
                 result.addProperty("jwtSigningPublicKeyExpiryTime",
-                        SigningKeys.getInstance(main).getDynamicSigningKeyExpiryTime());
+                        SigningKeys.getInstance(appIdentifier, main).getDynamicSigningKeyExpiryTime());
 
                 Utils.addLegacySigningKeyInfos(appIdentifier, main, result,
                         super.getVersionFromRequest(req).betweenInclusive(SemVer.v2_9, SemVer.v2_21));
@@ -122,9 +122,9 @@ protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws I
 
                 if (!super.getVersionFromRequest(req).greaterThanOrEqualTo(SemVer.v2_21)) {
                     reply.addProperty("jwtSigningPublicKey", new Utils.PubPriKey(
-                            SigningKeys.getInstance(main).getLatestIssuedDynamicKey().value).publicKey);
+                            SigningKeys.getInstance(appIdentifier, main).getLatestIssuedDynamicKey().value).publicKey);
                     reply.addProperty("jwtSigningPublicKeyExpiryTime",
-                            SigningKeys.getInstance(main).getDynamicSigningKeyExpiryTime());
+                            SigningKeys.getInstance(appIdentifier, main).getDynamicSigningKeyExpiryTime());
 
                     Utils.addLegacySigningKeyInfos(this.getAppIdentifierWithStorage(req), main, reply,
                             super.getVersionFromRequest(req).betweenInclusive(SemVer.v2_9, SemVer.v2_21));

src/main/java/io/supertokens/webserver/api/thirdparty/SignInUpAPI.java

@@ -78,7 +78,7 @@ protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws I
                         thirdPartyId,
                         thirdPartyUserId, email, isEmailVerified);
 
-                ActiveUsers.updateLastActive(main, response.user.id);
+                ActiveUsers.updateLastActive(this.getAppIdentifierWithStorage(req), main, response.user.id);
 
                 JsonObject result = new JsonObject();
                 result.addProperty("status", "OK");