@better-auth/scim 1.7.0-beta.3 → 1.7.0-beta.4

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-CLqkeI3u.mjs";
+import { t as PACKAGE_VERSION } from "./version-5EiO_U3Z.mjs";
 //#region src/client.ts
 const scimClient = () => {
 	return {

package/dist/index.d.mts

@@ -22,13 +22,6 @@ type SCIMEmail = {
   primary?: boolean;
 };
 type SCIMOptions = {
-  /**
-   * SCIM provider ownership configuration. When enabled, each provider
-   * connection is linked to the user who generated its token.
-   */
-  providerOwnership?: {
-    enabled: boolean;
-  };
   /**
    * Minimum organization role(s) required for SCIM management operations
    * (generate-token, list/get/delete provider connections).
@@ -3415,10 +3408,6 @@ declare const scim: (options?: SCIMOptions) => {
   schema: {
     scimProvider: {
       fields: {
-        userId?: {
-          type: "string";
-          required: false;
-        } | undefined;
         providerId: {
           type: "string";
           required: true;
@@ -3433,6 +3422,10 @@ declare const scim: (options?: SCIMOptions) => {
           type: "string";
           required: false;
         };
+        userId: {
+          type: "string";
+          required: false;
+        };
       };
     };
   };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-CLqkeI3u.mjs";
+import { t as PACKAGE_VERSION } from "./version-5EiO_U3Z.mjs";
 import { base64Url } from "@better-auth/utils/base64";
 import { APIError, createAuthEndpoint, createAuthMiddleware, sessionMiddleware } from "better-auth/api";
 import { APIError as APIError$1, HIDE_METADATA } from "better-auth";
@@ -625,9 +625,6 @@ function resolveRequiredRoles(ctx, opts) {
 	const creatorRole = ctx.context.getPlugin("organization")?.options?.creatorRole;
 	return Array.from(new Set(["admin", creatorRole ?? "owner"]));
 }
-function isProviderOwnershipEnabled(opts) {
-	return opts.providerOwnership?.enabled ?? false;
-}
 async function getSCIMUserOrgMemberships(ctx, userId) {
 	const members = await ctx.context.adapter.findMany({
 		model: "member",
@@ -663,7 +660,7 @@ async function assertSCIMProviderAccess(ctx, userId, provider, requiredRole) {
 		const member = await findOrganizationMember(ctx, userId, provider.organizationId);
 		if (!member) throw new APIError("FORBIDDEN", { message: "You must be a member of the organization to access this provider" });
 		if (!hasRequiredRole(member.role, requiredRole)) throw new APIError("FORBIDDEN", { message: "Insufficient role for this operation" });
-	} else if (provider.userId && provider.userId !== userId) throw new APIError("FORBIDDEN", { message: "You must be the owner to access this provider" });
+	} else if (provider.userId !== userId) throw new APIError("FORBIDDEN", { message: "You must be the owner to access this provider" });
 }
 async function checkSCIMProviderAccess(ctx, userId, providerId, requiredRole) {
 	const provider = await ctx.context.adapter.findOne({
@@ -700,6 +697,15 @@ const generateSCIMToken = (opts) => createAuthEndpoint("/scim/generate-token", {
 	const user = ctx.context.session.user;
 	const requiredRole = resolveRequiredRoles(ctx, opts);
 	if (providerId.includes(":")) throw new APIError("BAD_REQUEST", { message: "Provider id contains forbidden characters" });
+	if (new Set([
+		"credential",
+		"email-otp",
+		"magic-link",
+		"phone-number",
+		"anonymous",
+		"siwe",
+		...Object.keys(ctx.context.options.socialProviders ?? {})
+	]).has(providerId)) throw new APIError("BAD_REQUEST", { message: "Provider id collides with a built-in account provider and cannot be used for SCIM" });
 	if (organizationId && !ctx.context.hasPlugin("organization")) throw new APIError("BAD_REQUEST", { message: "Restricting a token to an organization requires the organization plugin" });
 	let member = null;
 	if (organizationId) {
@@ -740,7 +746,7 @@ const generateSCIMToken = (opts) => createAuthEndpoint("/scim/generate-token", {
 			providerId,
 			organizationId,
 			scimToken: await storeSCIMToken(ctx, opts, baseToken),
-			...isProviderOwnershipEnabled(opts) ? { userId: user.id } : {}
+			userId: user.id
 		}
 	});
 	if (opts.afterSCIMTokenGenerated) await opts.afterSCIMTokenGenerated({
@@ -789,7 +795,7 @@ const listSCIMProviderConnections = (opts) => createAuthEndpoint("/scim/list-pro
 			const roles = orgMemberships.get(p.organizationId);
 			return roles ? !requiredRole.length || roles.some((role) => requiredRole.includes(role)) : false;
 		}
-		return p.userId === userId || !p.userId;
+		return p.userId === userId;
 	}).map((p) => normalizeSCIMProvider(p));
 	return ctx.json({ providers });
 });
@@ -1198,6 +1204,7 @@ const deleteSCIMUser = (authMiddleware) => createAuthEndpoint("/scim/v2/Users/:u
 		organizationId
 	});
 	if (!user) throw new SCIMAPIError("NOT_FOUND", { detail: "User not found" });
+	await ctx.context.internalAdapter.deleteUserSessions(userId);
 	await ctx.context.internalAdapter.deleteUser(userId);
 	ctx.setStatus(204);
 });
@@ -1440,7 +1447,6 @@ const scim = (options) => {
 		storeSCIMToken: "plain",
 		...options
 	};
-	const providerOwnershipEnabled = options?.providerOwnership?.enabled ?? false;
 	const authMiddleware = authMiddlewareFactory(opts);
 	return {
 		id: "scim",
@@ -1477,10 +1483,10 @@ const scim = (options) => {
 				type: "string",
 				required: false
 			},
-			...providerOwnershipEnabled ? { userId: {
+			userId: {
 				type: "string",
 				required: false
-			} } : {}
+			}
 		} } },
 		options
 	};

package/dist/{version-CLqkeI3u.mjs → version-5EiO_U3Z.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-beta.3";
+const PACKAGE_VERSION = "1.7.0-beta.4";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/scim",
-  "version": "1.7.0-beta.3",
+  "version": "1.7.0-beta.4",
   "description": "SCIM plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -54,14 +54,14 @@
   },
   "devDependencies": {
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-beta.3",
-    "@better-auth/sso": "1.7.0-beta.3"
+    "@better-auth/core": "1.7.0-beta.4",
+    "@better-auth/sso": "1.7.0-beta.4"
   },
   "peerDependencies": {
-    "@better-auth/utils": "0.4.0",
+    "@better-auth/utils": "0.4.1",
     "better-call": "1.3.5",
-    "better-auth": "^1.7.0-beta.3",
-    "@better-auth/core": "^1.7.0-beta.3"
+    "@better-auth/core": "^1.7.0-beta.4",
+    "better-auth": "^1.7.0-beta.4"
   },
   "scripts": {
     "build": "tsdown",