access token payload property is omitted when value is 'null'

🐛 Bug Report

I noticed that when I decode the access token payload a null value property is actually omitted. I expected it to keep the value null within the payload.

At the same time within the sessionData the null value exists in the payload (within the database).

const SuperTokenAccessTokenModel = zod.object({
  version: zod.literal('1'),
  superTokensUserId: zod.string(),
  /**
   * Supertokens for some reason omits externalUserId from the access token payload if it is null.
   */
  externalUserId: zod.optional(zod.union([zod.string(), zod.null()])),
  email: zod.string(),
});

Useful informations

SessionNode.init({
  override: {
    functions: originalImplementation => {
      return {
        ...originalImplementation,
        createNewSession: async function (input) {
          const user = await ThirdPartyEmailPasswordNode.getUserById(input.userId);

          if (!user) {
            throw new Error(
              `SuperTokens: Creating a new session failed. Could not find user with id ${input.userId}.`
            );
          }

          const externalUserId = user.thirdParty ? `${user.thirdParty.id}|${user.thirdParty.userId}` : null;

          input.accessTokenPayload = {
            version: '1',
            superTokensUserId: input.userId,
            externalUserId, // This is potentially null
            email: user.email,
          };

          input.sessionData = {
            version: '1',
            superTokensUserId: input.userId,
            externalUserId,
            email: user.email,
          };

          return originalImplementation.createNewSession(input);
        },
      };
    },
  },
})

[rishabhpoddar]

This should be fixed in version >= 3.16.2.

If you are using docker, then the tag is 3.16.

[rishabhpoddar]

That being said, you can continue to use updateAccessTokenPayload (though eventually that function will be removed) and we are also planning to add an argument to mergeIntoAccessTokenPayload which would allow you to add top level nulls. So it should all just work fine.