better_auth-sso 0.6.2 → 0.8.0

data/lib/better_auth/sso/linking/org_assignment.rb

@@ -66,9 +66,6 @@ module BetterAuth
 
         def organization_plugin?(ctx)
           context = ctx.context
-          return context.hasPlugin("organization") if context.respond_to?(:hasPlugin)
-          return context.has_plugin?("organization") if context.respond_to?(:has_plugin?)
-
           plugins = context.options.respond_to?(:plugins) ? context.options.plugins : []
           plugins.any? { |plugin| plugin.respond_to?(:id) && plugin.id == "organization" }
         end

data/lib/better_auth/sso/plugin/core.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    remove_method :sso if method_defined?(:sso) || private_method_defined?(:sso)
+    singleton_class.remove_method(:sso) if singleton_class.method_defined?(:sso) || singleton_class.private_method_defined?(:sso)
+
+    SSO_ERROR_CODES = {
+      "PROVIDER_NOT_FOUND" => "No provider found",
+      "INVALID_STATE" => "Invalid state",
+      "SAML_RESPONSE_REPLAYED" => "SAML response has already been used",
+      "SINGLE_LOGOUT_NOT_ENABLED" => "Single Logout is not enabled",
+      "INVALID_LOGOUT_REQUEST" => "Invalid LogoutRequest",
+      "INVALID_LOGOUT_RESPONSE" => "Invalid LogoutResponse",
+      "LOGOUT_FAILED_AT_IDP" => "Logout failed at IdP",
+      "IDP_SLO_NOT_SUPPORTED" => "IdP does not support Single Logout Service"
+    }.freeze
+
+    SSO_SAML_SIGNATURE_ALGORITHMS = {
+      "rsa-sha1" => "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
+      "rsa-sha256" => "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+      "rsa-sha384" => "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384",
+      "rsa-sha512" => "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512",
+      "ecdsa-sha256" => "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256",
+      "ecdsa-sha384" => "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384",
+      "ecdsa-sha512" => "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512",
+      "sha1" => "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
+      "sha256" => "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+      "sha384" => "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384",
+      "sha512" => "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"
+    }.freeze
+
+    SSO_SAML_DIGEST_ALGORITHMS = {
+      "sha1" => "http://www.w3.org/2000/09/xmldsig#sha1",
+      "sha256" => "http://www.w3.org/2001/04/xmlenc#sha256",
+      "sha384" => "http://www.w3.org/2001/04/xmldsig-more#sha384",
+      "sha512" => "http://www.w3.org/2001/04/xmlenc#sha512"
+    }.freeze
+
+    SSO_SAML_SECURE_SIGNATURE_ALGORITHMS = (SSO_SAML_SIGNATURE_ALGORITHMS.values - ["http://www.w3.org/2000/09/xmldsig#rsa-sha1"]).uniq.freeze
+    SSO_SAML_SECURE_DIGEST_ALGORITHMS = (SSO_SAML_DIGEST_ALGORITHMS.values - ["http://www.w3.org/2000/09/xmldsig#sha1"]).uniq.freeze
+    SSO_SAML_SECURE_KEY_ENCRYPTION_ALGORITHMS = %w[
+      http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p
+      http://www.w3.org/2009/xmlenc11#rsa-oaep
+    ].freeze
+    SSO_SAML_SECURE_DATA_ENCRYPTION_ALGORITHMS = %w[
+      http://www.w3.org/2001/04/xmlenc#aes128-cbc
+      http://www.w3.org/2001/04/xmlenc#aes192-cbc
+      http://www.w3.org/2001/04/xmlenc#aes256-cbc
+      http://www.w3.org/2009/xmlenc11#aes128-gcm
+      http://www.w3.org/2009/xmlenc11#aes192-gcm
+      http://www.w3.org/2009/xmlenc11#aes256-gcm
+    ].freeze
+    SSO_DEFAULT_MAX_SAML_RESPONSE_SIZE = 256 * 1024
+    SSO_DEFAULT_MAX_SAML_METADATA_SIZE = 100 * 1024
+    SSO_SAML_RELAY_STATE_KEY_PREFIX = "saml-relay-state:"
+    SSO_SAML_AUTHN_REQUEST_KEY_PREFIX = "saml-authn-request:"
+    SSO_DEFAULT_AUTHN_REQUEST_TTL_MS = 5 * 60 * 1000
+    SSO_SAML_USED_ASSERTION_KEY_PREFIX = "saml-used-assertion:"
+    SSO_DEFAULT_ASSERTION_TTL_MS = 15 * 60 * 1000
+    SSO_DEFAULT_CLOCK_SKEW_MS = 5 * 60 * 1000
+    SSO_SAML_SESSION_KEY_PREFIX = "saml-session:"
+    SSO_SAML_SESSION_BY_ID_KEY_PREFIX = "saml-session-by-id:"
+    SSO_SAML_LOGOUT_REQUEST_KEY_PREFIX = "saml-logout-request:"
+    SSO_SAML_STATUS_SUCCESS = "urn:oasis:names:tc:SAML:2.0:status:Success"
+    SSO_DEFAULT_LOGOUT_REQUEST_TTL_MS = 5 * 60 * 1000
+
+    def sso(options = {})
+      config = normalize_hash(options)
+      if defined?(BetterAuth::SSO::SAML) && defined?(BetterAuth::SSO::SAMLHooks)
+        config = BetterAuth::SSO::SAMLHooks.merge_options(BetterAuth::SSO::SAML.sso_options, config)
+      end
+      endpoints = BetterAuth::SSO::Routes::SSO.endpoints(config)
+      Plugin.new(
+        id: "sso",
+        init: ->(_ctx) { {options: {advanced: {disable_origin_check: ["/sso/saml2/callback", "/sso/saml2/sp/acs", "/sso/saml2/sp/slo"]}}} },
+        schema: BetterAuth::SSO::Routes::Schemas.plugin_schema(config),
+        endpoints: endpoints,
+        hooks: sso_hooks(config),
+        error_codes: SSO_ERROR_CODES,
+        options: config
+      )
+    end
+
+    def sso_hooks(config = {})
+      {
+        before: [
+          {
+            matcher: ->(ctx) { ctx.path == "/sign-out" },
+            handler: ->(ctx) { sso_before_sign_out(ctx, config) }
+          }
+        ],
+        after: [
+          {
+            matcher: ->(ctx) { ctx.path.to_s.match?(%r{\A/callback/[^/]+\z}) },
+            handler: ->(ctx) { sso_after_generic_callback(ctx, config) }
+          }
+        ]
+      }
+    end
+
+    def sso_before_sign_out(ctx, config = {})
+      return unless config.dig(:saml, :enable_single_logout)
+
+      token_cookie = ctx.context.auth_cookies[:session_token]
+      session_token = ctx.get_signed_cookie(token_cookie.name, ctx.context.secret)
+      return if session_token.to_s.empty?
+
+      lookup_key = "#{SSO_SAML_SESSION_BY_ID_KEY_PREFIX}#{session_token}"
+      session_lookup = ctx.context.internal_adapter.find_verification_value(lookup_key)
+      saml_session_key = session_lookup&.fetch("value", nil)
+      ctx.context.internal_adapter.delete_verification_by_identifier(saml_session_key) if saml_session_key
+      ctx.context.internal_adapter.delete_verification_by_identifier(lookup_key)
+      nil
+    rescue
+      nil
+    end
+
+    def sso_after_generic_callback(ctx, config = {})
+      new_session = ctx.context.new_session if ctx.context.respond_to?(:new_session)
+      return unless new_session && new_session[:user]
+      return unless defined?(BetterAuth::SSO::Linking::OrgAssignment)
+
+      BetterAuth::SSO::Linking::OrgAssignment.assign_organization_by_domain(
+        ctx,
+        user: new_session.fetch(:user),
+        provisioning_options: config[:organization_provisioning],
+        domain_verification: config[:domain_verification]
+      )
+      nil
+    end
+
+    def sso_schema(config = {})
+      BetterAuth::SSO::Routes::Schemas.plugin_schema(config)
+    end
+  end
+end

data/lib/better_auth/sso/plugin/endpoints.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def sso_saml_callback_endpoint(config)
+      Endpoint.new(path: "/sso/saml2/callback/:providerId", method: ["GET", "POST"], metadata: {allowed_media_types: ["application/json", "application/x-www-form-urlencoded"]}) do |ctx|
+        sso_handle_saml_response(ctx, config)
+      end
+    end
+
+    def sso_saml_acs_endpoint(config)
+      Endpoint.new(path: "/sso/saml2/sp/acs/:providerId", method: "POST", metadata: {allowed_media_types: ["application/json", "application/x-www-form-urlencoded"]}) do |ctx|
+        sso_handle_saml_response(ctx, config)
+      end
+    end
+
+    def sso_sp_metadata_endpoint(config = {})
+      Endpoint.new(path: "/sso/saml2/sp/metadata", method: "GET") do |ctx|
+        provider = sso_find_provider!(ctx, sso_fetch(ctx.query, :provider_id))
+        metadata = sso_sp_metadata_xml(ctx, provider, config)
+        if (ctx.query[:format] || ctx.query["format"]) == "json"
+          ctx.json({providerId: provider.fetch("providerId"), metadata: metadata})
+        else
+          ctx.set_header("content-type", "application/samlmetadata+xml")
+          ctx.json(metadata)
+        end
+      end
+    end
+
+    def sso_saml_slo_endpoint(config = {})
+      Endpoint.new(path: "/sso/saml2/sp/slo/:providerId", method: ["GET", "POST"], metadata: {allowed_media_types: ["application/json", "application/x-www-form-urlencoded"]}) do |ctx|
+        raise APIError.new("BAD_REQUEST", message: "Single Logout is not enabled") unless config.dig(:saml, :enable_single_logout)
+
+        provider = sso_find_provider!(ctx, sso_fetch(ctx.params, :provider_id))
+        relay_state = sso_fetch(ctx.body, :relay_state) || sso_fetch(ctx.query, :relay_state)
+        if sso_fetch(ctx.body, :saml_response) || sso_fetch(ctx.query, :saml_response)
+          raw_response = sso_fetch(ctx.body, :saml_response) || sso_fetch(ctx.query, :saml_response)
+          sso_validate_saml_slo_signature!(ctx, raw_response, "Invalid LogoutResponse") if config.dig(:saml, :want_logout_response_signed)
+          sso_process_saml_logout_response(ctx, raw_response)
+          Cookies.delete_session_cookie(ctx)
+          next sso_redirect(ctx, sso_safe_slo_redirect_url(ctx, relay_state, provider.fetch("providerId")))
+        end
+
+        raw_request = sso_fetch(ctx.body, :saml_request) || sso_fetch(ctx.query, :saml_request)
+        sso_validate_saml_slo_signature!(ctx, raw_request, "Invalid LogoutRequest") if config.dig(:saml, :want_logout_request_signed)
+        logout_request_data = sso_process_saml_logout_request(ctx, provider, raw_request)
+        in_response_to = logout_request_data[:id].to_s.empty? ? "" : " InResponseTo=\"#{CGI.escapeHTML(logout_request_data[:id].to_s)}\""
+        response = Base64.strict_encode64("<samlp:LogoutResponse xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"_#{BetterAuth::Crypto.random_string(32)}\"#{in_response_to} Version=\"2.0\" IssueInstant=\"#{Time.now.utc.iso8601}\" Destination=\"#{sso_saml_logout_destination(provider)}\"><samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status></samlp:LogoutResponse>")
+        if sso_fetch(ctx.body, :saml_request)
+          next sso_saml_post_form(sso_saml_logout_destination(provider), "SAMLResponse", response, relay_state)
+        end
+
+        query = {SAMLResponse: response, RelayState: relay_state}
+        query = sso_signed_saml_redirect_query(provider, query) if config.dig(:saml, :want_logout_response_signed)
+        sso_redirect(ctx, "#{sso_saml_logout_destination(provider)}?#{URI.encode_www_form(query)}")
+      end
+    end
+
+    def sso_initiate_slo_endpoint(config = {})
+      Endpoint.new(path: "/sso/saml2/logout/:providerId", method: "POST") do |ctx|
+        raise APIError.new("BAD_REQUEST", message: "Single Logout is not enabled") unless config.dig(:saml, :enable_single_logout)
+
+        session = Routes.current_session(ctx)
+        provider = sso_find_provider!(ctx, sso_fetch(ctx.params, :provider_id))
+        destination = sso_saml_logout_destination(provider)
+        if destination.to_s.empty?
+          raise APIError.new("BAD_REQUEST", message: "IdP does not support Single Logout Service")
+        end
+
+        relay_state = sso_fetch(ctx.body, :callback_url) || ctx.context.base_url
+        session_token = session.fetch(:session).fetch("token")
+        user_email = session.fetch(:user).fetch("email")
+        saml_session_key = ctx.context.internal_adapter.find_verification_value("#{SSO_SAML_SESSION_BY_ID_KEY_PREFIX}#{session_token}")&.fetch("value")
+        saml_session = saml_session_key && ctx.context.internal_adapter.find_verification_value(saml_session_key)
+        saml_record = saml_session ? JSON.parse(saml_session.fetch("value")) : {}
+        name_id = saml_record["nameId"] || user_email
+        session_index = saml_record["sessionIndex"]
+
+        request_id = "_#{BetterAuth::Crypto.random_string(32)}"
+        session_index_xml = session_index.to_s.empty? ? "" : "<samlp:SessionIndex>#{CGI.escapeHTML(session_index.to_s)}</samlp:SessionIndex>"
+        request = Base64.strict_encode64("<samlp:LogoutRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"#{request_id}\" Version=\"2.0\" IssueInstant=\"#{Time.now.utc.iso8601}\" Destination=\"#{CGI.escapeHTML(destination.to_s)}\"><saml:NameID>#{CGI.escapeHTML(name_id.to_s)}</saml:NameID>#{session_index_xml}</samlp:LogoutRequest>")
+        sso_store_saml_logout_request(ctx, provider, request_id, config)
+        ctx.context.internal_adapter.delete_verification_by_identifier(saml_session_key) if saml_session_key
+        ctx.context.internal_adapter.delete_verification_by_identifier("#{SSO_SAML_SESSION_BY_ID_KEY_PREFIX}#{session_token}")
+        ctx.context.internal_adapter.delete_session(session_token)
+        Cookies.delete_session_cookie(ctx)
+        query = {SAMLRequest: request, RelayState: relay_state}
+        query = sso_signed_saml_redirect_query(provider, query) if config.dig(:saml, :want_logout_request_signed)
+        sso_redirect(ctx, "#{destination}?#{URI.encode_www_form(query)}")
+      end
+    end
+
+    def sso_request_domain_verification_endpoint(config)
+      Endpoint.new(path: "/sso/request-domain-verification", method: "POST") do |ctx|
+        session = Routes.current_session(ctx)
+        provider = sso_find_provider!(ctx, normalize_hash(ctx.body)[:provider_id])
+        sso_authorize_domain_verification!(ctx, provider, session.fetch(:user).fetch("id"))
+        if provider.key?("domainVerified") && provider["domainVerified"]
+          raise APIError.new("CONFLICT", message: "Domain has already been verified", code: "DOMAIN_VERIFIED")
+        end
+
+        identifier = sso_domain_verification_identifier(config, provider.fetch("providerId"))
+        active = ctx.context.internal_adapter.find_verification_value(identifier)
+        if active && sso_future_time?(active.fetch("expiresAt"))
+          next ctx.json({domainVerificationToken: active.fetch("value")}, status: 201)
+        end
+
+        token = BetterAuth::Crypto.random_string(24)
+        ctx.context.internal_adapter.create_verification_value(identifier: identifier, value: token, expiresAt: Time.now + (7 * 24 * 60 * 60))
+        config.dig(:domain_verification, :request)&.call(provider: provider, token: token, context: ctx)
+        ctx.json({domainVerificationToken: token}, status: 201)
+      end
+    end
+
+    def sso_verify_domain_endpoint(config)
+      Endpoint.new(path: "/sso/verify-domain", method: "POST") do |ctx|
+        session = Routes.current_session(ctx)
+        provider = sso_find_provider!(ctx, normalize_hash(ctx.body)[:provider_id])
+        sso_authorize_domain_verification!(ctx, provider, session.fetch(:user).fetch("id"))
+        if provider.key?("domainVerified") && provider["domainVerified"]
+          raise APIError.new("CONFLICT", message: "Domain has already been verified", code: "DOMAIN_VERIFIED")
+        end
+
+        identifier = sso_domain_verification_identifier(config, provider.fetch("providerId"))
+        if identifier.length > 63
+          raise APIError.new("BAD_REQUEST", message: "Verification identifier exceeds the DNS label limit of 63 characters", code: "IDENTIFIER_TOO_LONG")
+        end
+        active = ctx.context.internal_adapter.find_verification_value(identifier)
+        if !active || !sso_future_time?(active.fetch("expiresAt"))
+          raise APIError.new("NOT_FOUND", message: "No pending domain verification exists", code: "NO_PENDING_VERIFICATION")
+        end
+
+        hostname = sso_hostname_from_domain(provider.fetch("domain"))
+        raise APIError.new("BAD_REQUEST", message: "Invalid domain", code: "INVALID_DOMAIN") if hostname.to_s.empty?
+
+        records = sso_resolve_txt_records("#{identifier}.#{hostname}", config)
+        expected = "#{identifier}=#{active.fetch("value")}"
+        unless sso_txt_record_exact_match?(records, expected)
+          raise APIError.new("BAD_GATEWAY", message: "Unable to verify domain ownership. Try again later", code: "DOMAIN_VERIFICATION_FAILED")
+        end
+
+        ctx.context.adapter.update(model: "ssoProvider", where: [{field: "id", value: provider.fetch("id")}], update: {domainVerified: true})
+        ctx.context.internal_adapter.delete_verification_by_identifier(identifier)
+        ctx.set_status(204)
+        nil
+      end
+    end
+  end
+end

data/lib/better_auth/sso/plugin/oidc_discovery.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def sso_discover_oidc_config(issuer:, fetch: nil, existing_config: nil, discovery_endpoint: nil, trusted_origin: nil, timeout: nil)
+      existing = normalize_hash(existing_config || {})
+      discovery_url = discovery_endpoint || existing[:discovery_endpoint] || "#{issuer.to_s.sub(%r{/+\z}, "")}/.well-known/openid-configuration"
+      if trusted_origin && !trusted_origin.call(discovery_url)
+        raise APIError.new("BAD_REQUEST", message: "OIDC discovery endpoint is not trusted")
+      end
+      document = if fetch
+        fetch.call(discovery_url)
+      else
+        uri = URI(discovery_url)
+        JSON.parse(Net::HTTP.get(uri))
+      end
+      document = normalize_hash(document)
+      valid = document[:issuer].to_s.sub(%r{/+\z}, "") == issuer.to_s.sub(%r{/+\z}, "") &&
+        !document[:authorization_endpoint].to_s.empty? &&
+        !document[:token_endpoint].to_s.empty? &&
+        !document[:jwks_uri].to_s.empty?
+      raise APIError.new("BAD_REQUEST", message: "Invalid OIDC discovery document") unless valid
+
+      authorization_endpoint = sso_normalize_discovery_url(document[:authorization_endpoint], issuer, trusted_origin)
+      token_endpoint = sso_normalize_discovery_url(document[:token_endpoint], issuer, trusted_origin)
+      jwks_endpoint = sso_normalize_discovery_url(document[:jwks_uri], issuer, trusted_origin)
+      user_info_endpoint = document[:userinfo_endpoint] && sso_normalize_discovery_url(document[:userinfo_endpoint], issuer, trusted_origin)
+      auth_methods = Array(document[:token_endpoint_auth_methods_supported])
+      token_endpoint_authentication = if existing[:token_endpoint_authentication]
+        existing[:token_endpoint_authentication]
+      elsif auth_methods.include?("client_secret_post") && !auth_methods.include?("client_secret_basic")
+        "client_secret_post"
+      else
+        "client_secret_basic"
+      end
+
+      {
+        issuer: existing[:issuer] || document[:issuer],
+        discovery_endpoint: existing[:discovery_endpoint] || discovery_url,
+        client_id: existing[:client_id],
+        authorization_endpoint: existing[:authorization_endpoint] || authorization_endpoint,
+        token_endpoint: existing[:token_endpoint] || token_endpoint,
+        jwks_endpoint: existing[:jwks_endpoint] || jwks_endpoint,
+        user_info_endpoint: existing[:user_info_endpoint] || user_info_endpoint,
+        token_endpoint_authentication: token_endpoint_authentication,
+        scopes_supported: existing[:scopes_supported] || document[:scopes_supported]
+      }.compact
+    rescue APIError
+      raise
+    rescue
+      raise APIError.new("BAD_REQUEST", message: "Invalid OIDC discovery document")
+    end
+
+    def sso_normalize_discovery_url(value, issuer, trusted_origin)
+      uri = URI(value.to_s)
+      normalized = if uri.absolute?
+        uri.to_s
+      else
+        issuer_uri = URI(issuer.to_s)
+        issuer_base = issuer_uri.to_s.sub(%r{/+\z}, "")
+        endpoint = value.to_s.sub(%r{\A/+}, "")
+        "#{issuer_base}/#{endpoint}"
+      end
+      if trusted_origin && !trusted_origin.call(normalized)
+        raise APIError.new("BAD_REQUEST", message: "OIDC discovery endpoint is not trusted")
+      end
+
+      normalized
+    rescue URI::InvalidURIError
+      raise APIError.new("BAD_REQUEST", message: "Invalid OIDC discovery document")
+    end
+  end
+end