better_auth-sso 0.7.0 → 0.10.0

data/lib/better_auth/sso/plugin/core.rb

@@ -0,0 +1,322 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    remove_method :sso if method_defined?(:sso) || private_method_defined?(:sso)
+    singleton_class.remove_method(:sso) if singleton_class.method_defined?(:sso) || singleton_class.private_method_defined?(:sso)
+
+    SSO_ERROR_CODES = {
+      "PROVIDER_NOT_FOUND" => "No provider found",
+      "INVALID_STATE" => "Invalid state",
+      "SAML_RESPONSE_REPLAYED" => "SAML response has already been used",
+      "SINGLE_LOGOUT_NOT_ENABLED" => "Single Logout is not enabled",
+      "INVALID_LOGOUT_REQUEST" => "Invalid LogoutRequest",
+      "INVALID_LOGOUT_RESPONSE" => "Invalid LogoutResponse",
+      "LOGOUT_FAILED_AT_IDP" => "Logout failed at IdP",
+      "IDP_SLO_NOT_SUPPORTED" => "IdP does not support Single Logout Service"
+    }.freeze
+
+    SSO_SAML_SIGNATURE_ALGORITHMS = {
+      "rsa-sha1" => "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
+      "rsa-sha256" => "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+      "rsa-sha384" => "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384",
+      "rsa-sha512" => "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512",
+      "ecdsa-sha256" => "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256",
+      "ecdsa-sha384" => "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384",
+      "ecdsa-sha512" => "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512",
+      "sha1" => "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
+      "sha256" => "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+      "sha384" => "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384",
+      "sha512" => "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"
+    }.freeze
+
+    SSO_SAML_DIGEST_ALGORITHMS = {
+      "sha1" => "http://www.w3.org/2000/09/xmldsig#sha1",
+      "sha256" => "http://www.w3.org/2001/04/xmlenc#sha256",
+      "sha384" => "http://www.w3.org/2001/04/xmldsig-more#sha384",
+      "sha512" => "http://www.w3.org/2001/04/xmlenc#sha512"
+    }.freeze
+
+    SSO_SAML_SECURE_SIGNATURE_ALGORITHMS = (SSO_SAML_SIGNATURE_ALGORITHMS.values - ["http://www.w3.org/2000/09/xmldsig#rsa-sha1"]).uniq.freeze
+    SSO_SAML_SECURE_DIGEST_ALGORITHMS = (SSO_SAML_DIGEST_ALGORITHMS.values - ["http://www.w3.org/2000/09/xmldsig#sha1"]).uniq.freeze
+    SSO_SAML_SECURE_KEY_ENCRYPTION_ALGORITHMS = %w[
+      http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p
+      http://www.w3.org/2009/xmlenc11#rsa-oaep
+    ].freeze
+    SSO_SAML_SECURE_DATA_ENCRYPTION_ALGORITHMS = %w[
+      http://www.w3.org/2001/04/xmlenc#aes128-cbc
+      http://www.w3.org/2001/04/xmlenc#aes192-cbc
+      http://www.w3.org/2001/04/xmlenc#aes256-cbc
+      http://www.w3.org/2009/xmlenc11#aes128-gcm
+      http://www.w3.org/2009/xmlenc11#aes192-gcm
+      http://www.w3.org/2009/xmlenc11#aes256-gcm
+    ].freeze
+    SSO_DEFAULT_MAX_SAML_RESPONSE_SIZE = 256 * 1024
+    SSO_DEFAULT_MAX_SAML_METADATA_SIZE = 100 * 1024
+    SSO_SAML_RELAY_STATE_KEY_PREFIX = "saml-relay-state:"
+    SSO_SAML_AUTHN_REQUEST_KEY_PREFIX = "saml-authn-request:"
+    SSO_DEFAULT_AUTHN_REQUEST_TTL_MS = 5 * 60 * 1000
+    SSO_SAML_USED_ASSERTION_KEY_PREFIX = "saml-used-assertion:"
+    SSO_DEFAULT_ASSERTION_TTL_MS = 15 * 60 * 1000
+    SSO_DEFAULT_CLOCK_SKEW_MS = 5 * 60 * 1000
+    SSO_SAML_SESSION_KEY_PREFIX = "saml-session:"
+    SSO_SAML_SESSION_BY_ID_KEY_PREFIX = "saml-session-by-id:"
+    SSO_SAML_LOGOUT_REQUEST_KEY_PREFIX = "saml-logout-request:"
+    SSO_SAML_STATUS_SUCCESS = "urn:oasis:names:tc:SAML:2.0:status:Success"
+    SSO_DEFAULT_LOGOUT_REQUEST_TTL_MS = 5 * 60 * 1000
+    SSO_DEFAULT_OIDC_HTTP_TIMEOUT = 10
+    SSO_DEFAULT_OIDC_HTTP_MAX_BODY_SIZE = 1024 * 1024
+    SSO_OIDC_PKCE_VERIFIER_KEY_PREFIX = "oidc-pkce-verifier:"
+
+    def sso(options = {})
+      config = normalize_hash(options)
+      if defined?(BetterAuth::SSO::SAML) && defined?(BetterAuth::SSO::SAMLHooks)
+        config = BetterAuth::SSO::SAMLHooks.merge_options(BetterAuth::SSO::SAML.sso_options, config)
+      end
+      endpoints = BetterAuth::SSO::Routes::SSO.endpoints(config)
+      Plugin.new(
+        id: "sso",
+        init: ->(_ctx) { {options: {advanced: {disable_origin_check: ["/sso/saml2/callback", "/sso/saml2/sp/acs", "/sso/saml2/sp/slo"]}}} },
+        schema: BetterAuth::SSO::Routes::Schemas.plugin_schema(config),
+        endpoints: endpoints,
+        hooks: sso_hooks(config),
+        error_codes: SSO_ERROR_CODES,
+        options: config
+      )
+    end
+
+    def sso_hooks(config = {})
+      {
+        before: [
+          {
+            matcher: ->(ctx) { ctx.path == "/sign-out" },
+            handler: ->(ctx) { sso_before_sign_out(ctx, config) }
+          }
+        ],
+        after: [
+          {
+            matcher: ->(ctx) { ctx.path.to_s.match?(%r{\A/callback/[^/]+\z}) },
+            handler: ->(ctx) { sso_after_generic_callback(ctx, config) }
+          }
+        ]
+      }
+    end
+
+    def sso_before_sign_out(ctx, config = {})
+      return unless config.dig(:saml, :enable_single_logout)
+
+      token_cookie = ctx.context.auth_cookies[:session_token]
+      session_token = ctx.get_signed_cookie(token_cookie.name, ctx.context.secret)
+      return if session_token.to_s.empty?
+
+      lookup_key = "#{SSO_SAML_SESSION_BY_ID_KEY_PREFIX}#{session_token}"
+      session_lookup = ctx.context.internal_adapter.find_verification_value(lookup_key)
+      saml_session_key = session_lookup&.fetch("value", nil)
+      ctx.context.internal_adapter.delete_verification_by_identifier(saml_session_key) if saml_session_key
+      ctx.context.internal_adapter.delete_verification_by_identifier(lookup_key)
+      nil
+    rescue
+      nil
+    end
+
+    def sso_after_generic_callback(ctx, config = {})
+      new_session = ctx.context.new_session if ctx.context.respond_to?(:new_session)
+      return unless new_session && new_session[:user]
+      return unless defined?(BetterAuth::SSO::Linking::OrgAssignment)
+
+      BetterAuth::SSO::Linking::OrgAssignment.assign_organization_by_domain(
+        ctx,
+        user: new_session.fetch(:user),
+        provisioning_options: config[:organization_provisioning],
+        domain_verification: config[:domain_verification]
+      )
+      nil
+    end
+
+    def sso_schema(config = {})
+      BetterAuth::SSO::Routes::Schemas.plugin_schema(config)
+    end
+
+    def sso_openapi_for(route)
+      {
+        register_provider: sso_register_provider_openapi,
+        sign_in: sso_sign_in_openapi,
+        saml_callback: sso_saml_callback_openapi,
+        saml_acs: sso_saml_acs_openapi,
+        saml_slo: sso_saml_slo_openapi,
+        initiate_slo: sso_initiate_slo_openapi,
+        update_provider: sso_update_provider_openapi,
+        delete_provider: sso_delete_provider_openapi
+      }.fetch(route)
+    end
+
+    def sso_register_provider_openapi
+      {
+        openapi: {
+          description: "Register an SSO provider",
+          requestBody: OpenAPI.json_request_body(sso_provider_body_schema(required_fields: ["provider_id", "issuer", "domain"])),
+          responses: {
+            "200" => OpenAPI.json_response("SSO provider registered", sso_provider_response_schema)
+          }
+        }
+      }
+    end
+
+    def sso_sign_in_openapi
+      {
+        openapi: {
+          description: "Start an SSO sign-in flow",
+          requestBody: OpenAPI.json_request_body(
+            OpenAPI.object_schema(
+              {
+                provider_id: {type: "string", description: "SSO provider ID"},
+                domain: {type: "string", description: "Email domain used to select a provider"},
+                provider_type: {type: "string", enum: ["oidc", "saml"], description: "Preferred provider protocol"},
+                callback_url: {type: "string", description: "URL to redirect to after successful sign-in"},
+                error_callback_url: {type: "string", description: "URL to redirect to on sign-in error"},
+                new_user_callback_url: {type: "string", description: "URL to redirect to for new users"},
+                request_sign_up: {type: "boolean", description: "Whether the flow is requesting sign-up"}
+              }
+            )
+          ),
+          responses: {
+            "200" => OpenAPI.json_response("SSO sign-in URL", OpenAPI.object_schema({url: {type: "string"}, redirect: {type: "boolean"}}, required: ["url", "redirect"]))
+          }
+        }
+      }
+    end
+
+    def sso_saml_callback_openapi
+      {
+        openapi: {
+          description: "Handle a SAML identity provider callback",
+          requestBody: OpenAPI.json_request_body(sso_saml_message_schema, required: false),
+          responses: {
+            "200" => OpenAPI.json_response("SAML callback handled", {type: "object", additionalProperties: true})
+          }
+        }
+      }
+    end
+
+    def sso_saml_acs_openapi
+      {
+        openapi: {
+          description: "Handle a SAML assertion consumer service response",
+          requestBody: OpenAPI.json_request_body(sso_saml_message_schema, required: false),
+          responses: {
+            "200" => OpenAPI.json_response("SAML response handled", {type: "object", additionalProperties: true})
+          }
+        }
+      }
+    end
+
+    def sso_saml_slo_openapi
+      {
+        openapi: {
+          description: "Handle SAML single logout",
+          requestBody: OpenAPI.json_request_body(sso_saml_message_schema, required: false),
+          responses: {
+            "200" => OpenAPI.json_response("SAML single logout handled", {type: "object", additionalProperties: true})
+          }
+        }
+      }
+    end
+
+    def sso_initiate_slo_openapi
+      {
+        openapi: {
+          description: "Initiate SAML single logout",
+          requestBody: OpenAPI.json_request_body(
+            OpenAPI.object_schema(
+              {
+                callback_url: {type: "string", description: "URL to return to after logout"}
+              }
+            ),
+            required: false
+          ),
+          responses: {
+            "200" => OpenAPI.json_response("SAML logout initiated", {type: "object", additionalProperties: true})
+          }
+        }
+      }
+    end
+
+    def sso_update_provider_openapi
+      {
+        openapi: {
+          description: "Update an SSO provider",
+          requestBody: OpenAPI.json_request_body(sso_provider_body_schema(required_fields: [])),
+          responses: {
+            "200" => OpenAPI.json_response("SSO provider updated", sso_provider_response_schema)
+          }
+        }
+      }
+    end
+
+    def sso_delete_provider_openapi
+      {
+        openapi: {
+          description: "Delete an SSO provider",
+          requestBody: OpenAPI.json_request_body(
+            OpenAPI.object_schema(
+              {
+                provider_id: {type: "string", description: "SSO provider ID"}
+              }
+            )
+          ),
+          responses: {
+            "200" => OpenAPI.json_response("SSO provider deleted", OpenAPI.success_response_schema)
+          }
+        }
+      }
+    end
+
+    def sso_provider_body_schema(required_fields:)
+      OpenAPI.object_schema(
+        {
+          provider_id: {type: "string", description: "SSO provider ID"},
+          issuer: {type: "string", description: "SSO provider issuer URL"},
+          domain: {type: "string", description: "Email domain for the provider"},
+          oidc_config: {type: "object", additionalProperties: true, description: "OIDC provider configuration"},
+          saml_config: {type: "object", additionalProperties: true, description: "SAML provider configuration"},
+          organization_id: {type: "string", description: "Organization ID for this provider"},
+          override_user_info: {type: "boolean", description: "Whether to override OIDC user info with ID token claims"}
+        },
+        required: required_fields
+      )
+    end
+
+    def sso_provider_response_schema
+      OpenAPI.object_schema(
+        {
+          id: {type: "string"},
+          providerId: {type: "string"},
+          issuer: {type: "string"},
+          domain: {type: "string"},
+          oidcConfig: {type: ["object", "null"], additionalProperties: true},
+          samlConfig: {type: ["object", "null"], additionalProperties: true},
+          userId: {type: "string"},
+          organizationId: {type: ["string", "null"]},
+          domainVerified: {type: "boolean"},
+          redirectURI: {type: "string"},
+          domainVerificationToken: {type: "string"}
+        }
+      )
+    end
+
+    def sso_saml_message_schema
+      OpenAPI.object_schema(
+        {
+          SAMLResponse: {type: "string", description: "SAML response"},
+          SAMLRequest: {type: "string", description: "SAML logout request"},
+          RelayState: {type: "string", description: "SAML relay state"},
+          saml_response: {type: "string", description: "SAML response"},
+          saml_request: {type: "string", description: "SAML logout request"},
+          relay_state: {type: "string", description: "SAML relay state"}
+        }
+      )
+    end
+  end
+end

data/lib/better_auth/sso/plugin/endpoints.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def sso_saml_callback_endpoint(config)
+      Endpoint.new(path: "/sso/saml2/callback/:providerId", method: ["GET", "POST"], metadata: sso_openapi_for(:saml_callback).merge(allowed_media_types: ["application/json", "application/x-www-form-urlencoded"])) do |ctx|
+        sso_handle_saml_response(ctx, config)
+      end
+    end
+
+    def sso_saml_acs_endpoint(config)
+      Endpoint.new(path: "/sso/saml2/sp/acs/:providerId", method: "POST", metadata: sso_openapi_for(:saml_acs).merge(allowed_media_types: ["application/json", "application/x-www-form-urlencoded"])) do |ctx|
+        sso_handle_saml_response(ctx, config)
+      end
+    end
+
+    def sso_sp_metadata_endpoint(config = {})
+      Endpoint.new(path: "/sso/saml2/sp/metadata", method: "GET") do |ctx|
+        provider = sso_find_provider!(ctx, sso_fetch(ctx.query, :provider_id))
+        metadata = sso_sp_metadata_xml(ctx, provider, config)
+        if (ctx.query[:format] || ctx.query["format"]) == "json"
+          ctx.json({providerId: provider.fetch("providerId"), metadata: metadata})
+        else
+          ctx.set_header("content-type", "application/samlmetadata+xml")
+          ctx.json(metadata)
+        end
+      end
+    end
+
+    def sso_saml_slo_endpoint(config = {})
+      Endpoint.new(path: "/sso/saml2/sp/slo/:providerId", method: ["GET", "POST"], metadata: sso_openapi_for(:saml_slo).merge(allowed_media_types: ["application/json", "application/x-www-form-urlencoded"])) do |ctx|
+        raise APIError.new("BAD_REQUEST", message: "Single Logout is not enabled") unless config.dig(:saml, :enable_single_logout)
+
+        provider = sso_find_provider!(ctx, sso_fetch(ctx.params, :provider_id))
+        relay_state = sso_fetch(ctx.body, :relay_state) || sso_fetch(ctx.query, :relay_state)
+        if sso_fetch(ctx.body, :saml_response) || sso_fetch(ctx.query, :saml_response)
+          raw_response = sso_fetch(ctx.body, :saml_response) || sso_fetch(ctx.query, :saml_response)
+          sso_validate_saml_slo_signature!(ctx, raw_response, "Invalid LogoutResponse") if config.dig(:saml, :want_logout_response_signed)
+          sso_process_saml_logout_response(ctx, raw_response)
+          Cookies.delete_session_cookie(ctx)
+          next sso_redirect(ctx, sso_safe_slo_redirect_url(ctx, relay_state, provider.fetch("providerId")))
+        end
+
+        raw_request = sso_fetch(ctx.body, :saml_request) || sso_fetch(ctx.query, :saml_request)
+        raise APIError.new("BAD_REQUEST", message: "Invalid LogoutRequest") if raw_request.to_s.empty?
+
+        sso_validate_saml_slo_signature!(ctx, raw_request, "Invalid LogoutRequest") if config.dig(:saml, :want_logout_request_signed)
+        logout_request_data = sso_process_saml_logout_request(ctx, provider, raw_request)
+        in_response_to = logout_request_data[:id].to_s.empty? ? "" : " InResponseTo=\"#{CGI.escapeHTML(logout_request_data[:id].to_s)}\""
+        response = Base64.strict_encode64("<samlp:LogoutResponse xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"_#{BetterAuth::Crypto.random_string(32)}\"#{in_response_to} Version=\"2.0\" IssueInstant=\"#{Time.now.utc.iso8601}\" Destination=\"#{sso_saml_logout_destination(provider)}\"><samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status></samlp:LogoutResponse>")
+        if sso_fetch(ctx.body, :saml_request)
+          next sso_saml_post_form(sso_saml_logout_destination(provider), "SAMLResponse", response, relay_state)
+        end
+
+        query = {SAMLResponse: response, RelayState: relay_state}
+        query = sso_signed_saml_redirect_query(provider, query) if config.dig(:saml, :want_logout_response_signed)
+        sso_redirect(ctx, "#{sso_saml_logout_destination(provider)}?#{URI.encode_www_form(query)}")
+      end
+    end
+
+    def sso_initiate_slo_endpoint(config = {})
+      Endpoint.new(path: "/sso/saml2/logout/:providerId", method: "POST", metadata: sso_openapi_for(:initiate_slo)) do |ctx|
+        raise APIError.new("BAD_REQUEST", message: "Single Logout is not enabled") unless config.dig(:saml, :enable_single_logout)
+
+        session = Routes.current_session(ctx)
+        provider = sso_find_provider!(ctx, sso_fetch(ctx.params, :provider_id))
+        destination = sso_saml_logout_destination(provider)
+        if destination.to_s.empty?
+          raise APIError.new("BAD_REQUEST", message: "IdP does not support Single Logout Service")
+        end
+
+        relay_state = sso_fetch(ctx.body, :callback_url) || ctx.context.base_url
+        session_token = session.fetch(:session).fetch("token")
+        user_email = session.fetch(:user).fetch("email")
+        saml_session_key = ctx.context.internal_adapter.find_verification_value("#{SSO_SAML_SESSION_BY_ID_KEY_PREFIX}#{session_token}")&.fetch("value")
+        saml_session = saml_session_key && ctx.context.internal_adapter.find_verification_value(saml_session_key)
+        saml_record = saml_session ? JSON.parse(saml_session.fetch("value")) : {}
+        name_id = saml_record["nameId"] || user_email
+        session_index = saml_record["sessionIndex"]
+
+        request_id = "_#{BetterAuth::Crypto.random_string(32)}"
+        session_index_xml = session_index.to_s.empty? ? "" : "<samlp:SessionIndex>#{CGI.escapeHTML(session_index.to_s)}</samlp:SessionIndex>"
+        request = Base64.strict_encode64("<samlp:LogoutRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"#{request_id}\" Version=\"2.0\" IssueInstant=\"#{Time.now.utc.iso8601}\" Destination=\"#{CGI.escapeHTML(destination.to_s)}\"><saml:NameID>#{CGI.escapeHTML(name_id.to_s)}</saml:NameID>#{session_index_xml}</samlp:LogoutRequest>")
+        sso_store_saml_logout_request(ctx, provider, request_id, config)
+        ctx.context.internal_adapter.delete_verification_by_identifier(saml_session_key) if saml_session_key
+        ctx.context.internal_adapter.delete_verification_by_identifier("#{SSO_SAML_SESSION_BY_ID_KEY_PREFIX}#{session_token}")
+        ctx.context.internal_adapter.delete_session(session_token)
+        Cookies.delete_session_cookie(ctx)
+        query = {SAMLRequest: request, RelayState: relay_state}
+        query = sso_signed_saml_redirect_query(provider, query) if config.dig(:saml, :want_logout_request_signed)
+        sso_redirect(ctx, "#{destination}?#{URI.encode_www_form(query)}")
+      end
+    end
+
+    def sso_request_domain_verification_endpoint(config)
+      Endpoint.new(path: "/sso/request-domain-verification", method: "POST") do |ctx|
+        session = Routes.current_session(ctx)
+        provider = sso_find_provider!(ctx, normalize_hash(ctx.body)[:provider_id])
+        sso_authorize_domain_verification!(ctx, provider, session.fetch(:user).fetch("id"))
+        if provider.key?("domainVerified") && provider["domainVerified"]
+          raise APIError.new("CONFLICT", message: "Domain has already been verified", code: "DOMAIN_VERIFIED")
+        end
+
+        identifier = sso_domain_verification_identifier(config, provider.fetch("providerId"))
+        active = ctx.context.internal_adapter.find_verification_value(identifier)
+        if active && sso_future_time?(active.fetch("expiresAt"))
+          next ctx.json({domainVerificationToken: active.fetch("value")}, status: 201)
+        end
+
+        token = BetterAuth::Crypto.random_string(24)
+        ctx.context.internal_adapter.create_verification_value(identifier: identifier, value: token, expiresAt: Time.now + (7 * 24 * 60 * 60))
+        config.dig(:domain_verification, :request)&.call(provider: provider, token: token, context: ctx)
+        ctx.json({domainVerificationToken: token}, status: 201)
+      end
+    end
+
+    def sso_verify_domain_endpoint(config)
+      Endpoint.new(path: "/sso/verify-domain", method: "POST") do |ctx|
+        session = Routes.current_session(ctx)
+        provider = sso_find_provider!(ctx, normalize_hash(ctx.body)[:provider_id])
+        sso_authorize_domain_verification!(ctx, provider, session.fetch(:user).fetch("id"))
+        if provider.key?("domainVerified") && provider["domainVerified"]
+          raise APIError.new("CONFLICT", message: "Domain has already been verified", code: "DOMAIN_VERIFIED")
+        end
+
+        identifier = sso_domain_verification_identifier(config, provider.fetch("providerId"))
+        if identifier.length > 63
+          raise APIError.new("BAD_REQUEST", message: "Verification identifier exceeds the DNS label limit of 63 characters", code: "IDENTIFIER_TOO_LONG")
+        end
+        active = ctx.context.internal_adapter.find_verification_value(identifier)
+        if !active || !sso_future_time?(active.fetch("expiresAt"))
+          raise APIError.new("NOT_FOUND", message: "No pending domain verification exists", code: "NO_PENDING_VERIFICATION")
+        end
+
+        hostname = sso_hostname_from_domain(provider.fetch("domain"))
+        raise APIError.new("BAD_REQUEST", message: "Invalid domain", code: "INVALID_DOMAIN") if hostname.to_s.empty?
+
+        records = sso_resolve_txt_records("#{identifier}.#{hostname}", config)
+        expected = "#{identifier}=#{active.fetch("value")}"
+        unless sso_txt_record_exact_match?(records, expected)
+          raise APIError.new("BAD_GATEWAY", message: "Unable to verify domain ownership. Try again later", code: "DOMAIN_VERIFICATION_FAILED")
+        end
+
+        ctx.context.adapter.update(model: "ssoProvider", where: [{field: "id", value: provider.fetch("id")}], update: {domainVerified: true})
+        ctx.context.internal_adapter.delete_verification_by_identifier(identifier)
+        ctx.set_status(204)
+        nil
+      end
+    end
+  end
+end

data/lib/better_auth/sso/plugin/oidc_discovery.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def sso_discover_oidc_config(issuer:, fetch: nil, existing_config: nil, discovery_endpoint: nil, trusted_origin: nil, timeout: nil)
+      wrapped_fetch = sso_oidc_discovery_fetcher(fetch)
+      BetterAuth::SSO::OIDC::Discovery.discover_oidc_config(
+        issuer: issuer,
+        fetch: wrapped_fetch,
+        existing_config: existing_config,
+        discovery_endpoint: discovery_endpoint,
+        trusted_origin: trusted_origin,
+        timeout: timeout || SSO_DEFAULT_OIDC_HTTP_TIMEOUT
+      )
+    rescue BetterAuth::SSO::OIDC::DiscoveryError => error
+      raise BetterAuth::SSO::OIDC::Errors.api_error(error)
+    end
+
+    def sso_oidc_discovery_fetcher(fetch)
+      return nil unless fetch
+
+      ->(url, timeout: nil) do
+        accepts_keywords = fetch.parameters.any? { |kind, name| kind == :keyrest || (kind == :key && name == :timeout) }
+        accepts_keywords ? fetch.call(url, timeout: timeout) : fetch.call(url)
+      end
+    end
+
+    def sso_normalize_discovery_url(value, issuer, trusted_origin)
+      BetterAuth::SSO::OIDC::Discovery.normalize_url("url", value, issuer, trusted_origin)
+    rescue BetterAuth::SSO::OIDC::DiscoveryError => error
+      raise BetterAuth::SSO::OIDC::Errors.api_error(error)
+    end
+  end
+end