I am trying to answer the same question as this commenter: Convert rules to action help
For certain flows I want to map either user.email or user.upn to a custom email claim in the ID token that my app uses in lieu of email in some cases. How do I access user.upn? I have been reading the documentation and it seems like the previous limitation has been removed but I still cannot find a clear way to access the UPN attribute.
function (user, context, callback) {
const namespace = "https://example.com/"
context.idToken[namespace + 'email'] = user.email || user.upn;
callback(null, user, context);
}