fix: fixes storage handling for non-auth recipes

CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres
 to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [8.0.0] - 2024-03-04
+
+### Breaking changes
+
+- The following app specific APIs return a 403 when not called using `public` tenant
+  - GET `/recipe/accountlinking/user/primary/check`
+  - GET `/recipe/accountlinking/user/link/check`
+  - POST `/recipe/accountlinking/user/primary`
+  - POST `/recipe/accountlinking/user/link`
+  - POST `/recipe/accountlinking/user/unlink`
+  - GET `/users/count/active`
+  - POST `/user/remove`
+  - GET `/ee/featureflag`
+  - GET `/user/id`
+  - PUT `/ee/license`
+  - DELETE `/ee/license`
+  - GET `/ee/license`
+  - GET `/requests/stats`
+  - GET `/recipe/user` when querying by `userId`
+  - GET `/recipe/jwt/jwks`
+  - POST `/recipe/jwt`
+
+### Fixes
+
+- Fixes issue with non-auth recipe related storage handling
+
 ## [7.0.18] - 2024-02-19
 
 - Fixes vulnerabilities in dependencies

build.gradle

@@ -19,7 +19,7 @@ compileTestJava { options.encoding = "UTF-8" }
 //    }
 //}
 
-version = "7.0.18"
+version = "8.0.0"
 
 
 repositories {

src/main/java/io/supertokens/webserver/WebserverAPI.java

@@ -378,20 +378,6 @@ protected StorageAndUserIdMapping enforcePublicTenantAndGetStorageAndUserIdMappi
         }
     }
 
-    protected StorageAndUserIdMapping getStorageAndUserIdMappingForAppSpecificApiWithoutEnforcingPublicTenant(
-            HttpServletRequest req, String userId, UserIdType userIdType)
-            throws StorageQueryException, TenantOrAppNotFoundException, ServletException,
-            BadPermissionException {
-        AppIdentifier appIdentifier = getAppIdentifierWithoutVerifying(req);
-        Storage[] storages = StorageLayer.getStoragesForApp(main, appIdentifier);
-        try {
-            return StorageLayer.findStorageAndUserIdMappingForUser(
-                    appIdentifier, storages, userId, userIdType);
-        } catch (UnknownUserIdException e) {
-            return new StorageAndUserIdMapping(getTenantStorage(req), null);
-        }
-    }
-
     protected boolean checkIPAccess(HttpServletRequest req, HttpServletResponse resp)
             throws TenantOrAppNotFoundException, ServletException, IOException {
         CoreConfig config = Config.getConfig(getTenantIdentifierWithoutVerifying(req), main);

src/main/java/io/supertokens/webserver/api/session/SessionRemoveAPI.java

@@ -113,10 +113,18 @@ protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws I
                 String[] sessionHandlesRevoked;
 
                 if (revokeAcrossAllTenants) {
+                    // when revokeAcrossAllTenants is true, and given that the backend SDK might pass tenant id
+                    // we do not want to enfore public tenant here but behave as if this is an app specific API
                     AppIdentifier appIdentifier = getAppIdentifier(req);
-                    StorageAndUserIdMapping storageAndUserIdMapping = getStorageAndUserIdMappingForAppSpecificApiWithoutEnforcingPublicTenant(
-                            req, userId, UserIdType.ANY);
-
+                    Storage[] storages = StorageLayer.getStoragesForApp(main, appIdentifier);
+                    StorageAndUserIdMapping storageAndUserIdMapping = null;
+                    try {
+                        storageAndUserIdMapping = StorageLayer.findStorageAndUserIdMappingForUser(
+                                appIdentifier, storages, userId, UserIdType.ANY);
+                    } catch (UnknownUserIdException e) {
+                        storageAndUserIdMapping = new StorageAndUserIdMapping(getTenantStorage(req), null);
+                    }
+                    storage = storageAndUserIdMapping.storage;
                     sessionHandlesRevoked = Session.revokeAllSessionsForUser(
                             main, appIdentifier, storageAndUserIdMapping.storage, userId, revokeSessionsForLinkedAccounts);
                 } else {
@@ -149,7 +157,7 @@ protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws I
                 }
                 result.add("sessionHandlesRevoked", sessionHandlesRevokedJSON);
                 super.sendJsonResponse(200, result, resp);
-            } catch (StorageQueryException | TenantOrAppNotFoundException | BadPermissionException e) {
+            } catch (StorageQueryException | TenantOrAppNotFoundException e) {
                 throw new ServletException(e);
             }
         } else {

src/main/java/io/supertokens/webserver/api/session/SessionUserAPI.java

@@ -24,11 +24,13 @@
 import io.supertokens.multitenancy.exception.BadPermissionException;
 import io.supertokens.pluginInterface.RECIPE_ID;
 import io.supertokens.pluginInterface.Storage;
+import io.supertokens.pluginInterface.emailpassword.exceptions.UnknownUserIdException;
 import io.supertokens.pluginInterface.exceptions.StorageQueryException;
 import io.supertokens.pluginInterface.multitenancy.AppIdentifier;
 import io.supertokens.pluginInterface.multitenancy.TenantIdentifier;
 import io.supertokens.pluginInterface.multitenancy.exceptions.TenantOrAppNotFoundException;
 import io.supertokens.session.Session;
+import io.supertokens.storageLayer.StorageLayer;
 import io.supertokens.useridmapping.UserIdType;
 import io.supertokens.webserver.InputParser;
 import io.supertokens.webserver.WebserverAPI;
@@ -75,10 +77,17 @@ protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IO
             String[] sessionHandles;
 
             if (fetchAcrossAllTenants) {
+                // when fetchAcrossAllTenants is true, and given that the backend SDK might pass tenant id
+                // we do not want to enfore public tenant here but behave as if this is an app specific API
                 AppIdentifier appIdentifier = getAppIdentifier(req);
-                StorageAndUserIdMapping storageAndUserIdMapping =
-                        getStorageAndUserIdMappingForAppSpecificApiWithoutEnforcingPublicTenant(req, userId,
-                                UserIdType.ANY);
+                Storage[] storages = StorageLayer.getStoragesForApp(main, appIdentifier);
+                StorageAndUserIdMapping storageAndUserIdMapping = null;
+                try {
+                    storageAndUserIdMapping = StorageLayer.findStorageAndUserIdMappingForUser(
+                            appIdentifier, storages, userId, UserIdType.ANY);
+                } catch (UnknownUserIdException e) {
+                    storageAndUserIdMapping = new StorageAndUserIdMapping(getTenantStorage(req), null);
+                }
                 sessionHandles = Session.getAllNonExpiredSessionHandlesForUser(
                         main, appIdentifier, storageAndUserIdMapping.storage, userId,
                         fetchSessionsForAllLinkedAccounts);
@@ -98,7 +107,7 @@ protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IO
             result.add("sessionHandles", arr);
             super.sendJsonResponse(200, result, resp);
 
-        } catch (StorageQueryException | TenantOrAppNotFoundException | BadPermissionException e) {
+        } catch (StorageQueryException | TenantOrAppNotFoundException e) {
             throw new ServletException(e);
         }
     }

src/test/java/io/supertokens/test/multitenant/api/TestPermissionChecks.java

@@ -1022,32 +1022,32 @@ public void testPermissionsForDeleteTenant() throws Exception {
                 new TestCase(
                         new TenantIdentifier(null, null, "t1"),
                         new TenantIdentifier(null, null, "t2"),
-                        "Only the public tenantId is allowed to delete a tenant"
+                        "Only public tenantId can call this app specific API"
                 ),
                 new TestCase(
                         new TenantIdentifier(null, null, "t1"),
                         new TenantIdentifier(null, null, "t1"),
-                        "Only the public tenantId is allowed to delete a tenant"
+                        "Only public tenantId can call this app specific API"
                 ),
                 new TestCase(
                         new TenantIdentifier(null, "a1", "t1"),
                         new TenantIdentifier(null, "a1", "t2"),
-                        "Only the public tenantId is allowed to delete a tenant"
+                        "Only public tenantId can call this app specific API"
                 ),
                 new TestCase(
                         new TenantIdentifier(null, "a1", "t1"),
                         new TenantIdentifier(null, "a1", "t1"),
-                        "Only the public tenantId is allowed to delete a tenant"
+                        "Only public tenantId can call this app specific API"
                 ),
                 new TestCase(
                         new TenantIdentifier("127.0.0.1", "a1", "t1"),
                         new TenantIdentifier("127.0.0.1", "a1", "t2"),
-                        "Only the public tenantId is allowed to delete a tenant"
+                        "Only public tenantId can call this app specific API"
                 ),
                 new TestCase(
                         new TenantIdentifier("127.0.0.1", "a1", "t1"),
                         new TenantIdentifier("127.0.0.1", "a1", "t1"),
-                        "Only the public tenantId is allowed to delete a tenant"
+                        "Only public tenantId can call this app specific API"
                 ),
                 new TestCase(
                         new TenantIdentifier(null, null, null),

src/test/java/io/supertokens/test/userRoles/UserRolesStorageTest.java

@@ -119,8 +119,7 @@ public void testDeletingARoleWhileItIsBeingRemovedFromAUser() throws Exception {
             }
             // delete the role
             try {
-                boolean wasRoleDeleted = storage.deleteAllUserRoleAssociationsForRole(new AppIdentifier(null, null), role);
-                wasRoleDeleted = storage.deleteRole(new AppIdentifier(null, null), role) || wasRoleDeleted;
+                boolean wasRoleDeleted = storage.deleteRole(new AppIdentifier(null, null), role);
                 r2_success.set(wasRoleDeleted);
             } catch (StorageQueryException e) {
                 // should not come here