@better-auth/sso 1.3.0-beta.1 → 1.3.0-beta.11

package/.turbo/turbo-build.log

@@ -1,17 +1,17 @@
 
-> @better-auth/sso@1.3.0-beta.1 build /home/runner/work/better-auth/better-auth/packages/sso
+> @better-auth/sso@1.3.0-beta.11 build /home/runner/work/better-auth/better-auth/packages/sso
 > unbuild
 
 [info] Automatically detected entries: src/index, src/client [esm] [cjs] [dts]
 [info] Building sso
 [success] Build succeeded for sso
-[log]   dist/index.cjs (total size: 43.2 kB, chunk size: 43.2 kB, exports: sso)
+[log]   dist/index.cjs (total size: 45.3 kB, chunk size: 45.3 kB, exports: sso)
 
 [log]   dist/client.cjs (total size: 141 B, chunk size: 141 B, exports: ssoClient)
 
-[log]   dist/index.mjs (total size: 42.5 kB, chunk size: 42.5 kB, exports: sso)
+[log]   dist/index.mjs (total size: 43.9 kB, chunk size: 43.9 kB, exports: sso)
 
 [log]   dist/client.mjs (total size: 117 B, chunk size: 117 B, exports: ssoClient)
 
-Σ Total dist size (byte size): 238 kB
+Σ Total dist size (byte size): 199 kB
 [log]

package/dist/client.d.cts

@@ -1,7 +1,7 @@
 import { sso } from './index.cjs';
 import 'better-call';
 import 'better-auth';
-import 'zod';
+import 'zod/v4';
 
 declare const ssoClient: () => {
     id: "sso-client";

package/dist/client.d.mts

@@ -1,7 +1,7 @@
 import { sso } from './index.mjs';
 import 'better-call';
 import 'better-auth';
-import 'zod';
+import 'zod/v4';
 
 declare const ssoClient: () => {
     id: "sso-client";

package/dist/client.d.ts

@@ -1,7 +1,7 @@
 import { sso } from './index.js';
 import 'better-call';
 import 'better-auth';
-import 'zod';
+import 'zod/v4';
 
 declare const ssoClient: () => {
     id: "sso-client";

package/dist/index.cjs

@@ -4,7 +4,7 @@ const betterAuth = require('better-auth');
 const api = require('better-auth/api');
 const oauth2 = require('better-auth/oauth2');
 const plugins = require('better-auth/plugins');
-const zod = require('zod');
+const z = require('zod/v4');
 const saml = require('samlify');
 const fetch = require('@better-fetch/fetch');
 const jose = require('jose');
@@ -23,6 +23,7 @@ function _interopNamespaceCompat(e) {
 	return n;
 }
 
+const z__namespace = /*#__PURE__*/_interopNamespaceCompat(z);
 const saml__namespace = /*#__PURE__*/_interopNamespaceCompat(saml);
 
 const fastValidator = {
@@ -43,9 +44,9 @@ const sso = (options) => {
         "/sso/saml2/sp/metadata",
         {
           method: "GET",
-          query: zod.z.object({
-            providerId: zod.z.string(),
-            format: zod.z.enum(["xml", "json"]).default("xml")
+          query: z__namespace.object({
+            providerId: z__namespace.string(),
+            format: z__namespace.enum(["xml", "json"]).default("xml")
           }),
           metadata: {
             openapi: {
@@ -89,96 +90,102 @@ const sso = (options) => {
         "/sso/register",
         {
           method: "POST",
-          body: zod.z.object({
-            providerId: zod.z.string({
+          body: z__namespace.object({
+            providerId: z__namespace.string({}).meta({
               description: "The ID of the provider. This is used to identify the provider during login and callback"
             }),
-            issuer: zod.z.string({
+            issuer: z__namespace.string({}).meta({
               description: "The issuer of the provider"
             }),
-            domain: zod.z.string({
+            domain: z__namespace.string({}).meta({
               description: "The domain of the provider. This is used for email matching"
             }),
-            oidcConfig: zod.z.object({
-              clientId: zod.z.string({
+            oidcConfig: z__namespace.object({
+              clientId: z__namespace.string({}).meta({
                 description: "The client ID"
               }),
-              clientSecret: zod.z.string({
+              clientSecret: z__namespace.string({}).meta({
                 description: "The client secret"
               }),
-              authorizationEndpoint: zod.z.string({
+              authorizationEndpoint: z__namespace.string({}).meta({
                 description: "The authorization endpoint"
               }).optional(),
-              tokenEndpoint: zod.z.string({
+              tokenEndpoint: z__namespace.string({}).meta({
                 description: "The token endpoint"
               }).optional(),
-              userInfoEndpoint: zod.z.string({
+              userInfoEndpoint: z__namespace.string({}).meta({
                 description: "The user info endpoint"
               }).optional(),
-              tokenEndpointAuthentication: zod.z.enum(["client_secret_post", "client_secret_basic"]).optional(),
-              jwksEndpoint: zod.z.string({
+              tokenEndpointAuthentication: z__namespace.enum(["client_secret_post", "client_secret_basic"]).optional(),
+              jwksEndpoint: z__namespace.string({}).meta({
                 description: "The JWKS endpoint"
               }).optional(),
-              discoveryEndpoint: zod.z.string().optional(),
-              scopes: zod.z.array(zod.z.string(), {
+              discoveryEndpoint: z__namespace.string().optional(),
+              scopes: z__namespace.array(z__namespace.string(), {}).meta({
                 description: "The scopes to request. Defaults to ['openid', 'email', 'profile', 'offline_access']"
               }).optional(),
-              pkce: zod.z.boolean({
+              pkce: z__namespace.boolean({}).meta({
                 description: "Whether to use PKCE for the authorization flow"
               }).default(true).optional()
             }).optional(),
-            samlConfig: zod.z.object({
-              entryPoint: zod.z.string(),
-              cert: zod.z.string(),
-              callbackUrl: zod.z.string(),
-              audience: zod.z.string().optional(),
-              idpMetadata: zod.z.object({
-                metadata: zod.z.string(),
-                privateKey: zod.z.string().optional(),
-                privateKeyPass: zod.z.string().optional(),
-                isAssertionEncrypted: zod.z.boolean().optional(),
-                encPrivateKey: zod.z.string().optional(),
-                encPrivateKeyPass: zod.z.string().optional()
+            samlConfig: z__namespace.object({
+              entryPoint: z__namespace.string({}).meta({
+                description: "The entry point of the provider"
+              }),
+              cert: z__namespace.string({}).meta({
+                description: "The certificate of the provider"
+              }),
+              callbackUrl: z__namespace.string({}).meta({
+                description: "The callback URL of the provider"
+              }),
+              audience: z__namespace.string().optional(),
+              idpMetadata: z__namespace.object({
+                metadata: z__namespace.string(),
+                privateKey: z__namespace.string().optional(),
+                privateKeyPass: z__namespace.string().optional(),
+                isAssertionEncrypted: z__namespace.boolean().optional(),
+                encPrivateKey: z__namespace.string().optional(),
+                encPrivateKeyPass: z__namespace.string().optional()
               }).optional(),
-              spMetadata: zod.z.object({
-                metadata: zod.z.string(),
-                binding: zod.z.string().optional(),
-                privateKey: zod.z.string().optional(),
-                privateKeyPass: zod.z.string().optional(),
-                isAssertionEncrypted: zod.z.boolean().optional(),
-                encPrivateKey: zod.z.string().optional(),
-                encPrivateKeyPass: zod.z.string().optional()
+              spMetadata: z__namespace.object({
+                metadata: z__namespace.string(),
+                binding: z__namespace.string().optional(),
+                privateKey: z__namespace.string().optional(),
+                privateKeyPass: z__namespace.string().optional(),
+                isAssertionEncrypted: z__namespace.boolean().optional(),
+                encPrivateKey: z__namespace.string().optional(),
+                encPrivateKeyPass: z__namespace.string().optional()
               }),
-              wantAssertionsSigned: zod.z.boolean().optional(),
-              signatureAlgorithm: zod.z.string().optional(),
-              digestAlgorithm: zod.z.string().optional(),
-              identifierFormat: zod.z.string().optional(),
-              privateKey: zod.z.string().optional(),
-              decryptionPvk: zod.z.string().optional(),
-              additionalParams: zod.z.record(zod.z.string()).optional()
+              wantAssertionsSigned: z__namespace.boolean().optional(),
+              signatureAlgorithm: z__namespace.string().optional(),
+              digestAlgorithm: z__namespace.string().optional(),
+              identifierFormat: z__namespace.string().optional(),
+              privateKey: z__namespace.string().optional(),
+              decryptionPvk: z__namespace.string().optional(),
+              additionalParams: z__namespace.record(z__namespace.string(), z__namespace.any()).optional()
             }).optional(),
-            mapping: zod.z.object({
-              id: zod.z.string({
+            mapping: z__namespace.object({
+              id: z__namespace.string({}).meta({
                 description: "The field in the user info response that contains the id. Defaults to 'sub'"
               }),
-              email: zod.z.string({
+              email: z__namespace.string({}).meta({
                 description: "The field in the user info response that contains the email. Defaults to 'email'"
               }),
-              emailVerified: zod.z.string({
+              emailVerified: z__namespace.string({}).meta({
                 description: "The field in the user info response that contains whether the email is verified. defaults to 'email_verified'"
               }).optional(),
-              name: zod.z.string({
+              name: z__namespace.string({}).meta({
                 description: "The field in the user info response that contains the name. Defaults to 'name'"
               }),
-              image: zod.z.string({
+              image: z__namespace.string({}).meta({
                 description: "The field in the user info response that contains the image. Defaults to 'picture'"
               }).optional(),
-              extraFields: zod.z.record(zod.z.string()).optional()
+              extraFields: z__namespace.record(z__namespace.string(), z__namespace.any()).optional()
             }).optional(),
-            organizationId: zod.z.string({
+            organizationId: z__namespace.string({}).meta({
               description: "If organization plugin is enabled, the organization id to link the provider to"
             }).optional(),
-            overrideUserInfo: zod.z.boolean({
+            overrideUserInfo: z__namespace.boolean({}).meta({
               description: "Override user info with the provider info. Defaults to false"
             }).default(false).optional()
           }),
@@ -349,8 +356,27 @@ const sso = (options) => {
           }
         },
         async (ctx) => {
+          const user = ctx.context.session?.user;
+          if (!user) {
+            throw new api.APIError("UNAUTHORIZED");
+          }
+          const limit = typeof options?.providersLimit === "function" ? await options.providersLimit(user) : options?.providersLimit ?? 10;
+          if (!limit) {
+            throw new api.APIError("FORBIDDEN", {
+              message: "SSO provider registration is disabled"
+            });
+          }
+          const providers = await ctx.context.adapter.findMany({
+            model: "ssoProvider",
+            where: [{ field: "userId", value: user.id }]
+          });
+          if (providers.length >= limit) {
+            throw new api.APIError("FORBIDDEN", {
+              message: "You have reached the maximum number of SSO providers"
+            });
+          }
           const body = ctx.body;
-          const issuerValidator = zod.z.string().url();
+          const issuerValidator = z__namespace.string().url();
           if (issuerValidator.safeParse(body.issuer).error) {
             throw new api.APIError("BAD_REQUEST", {
               message: "Invalid issuer. Must be a valid URL"
@@ -413,35 +439,35 @@ const sso = (options) => {
         "/sign-in/sso",
         {
           method: "POST",
-          body: zod.z.object({
-            email: zod.z.string({
+          body: z__namespace.object({
+            email: z__namespace.string({}).meta({
               description: "The email address to sign in with. This is used to identify the issuer to sign in with. It's optional if the issuer is provided"
             }).optional(),
-            organizationSlug: zod.z.string({
+            organizationSlug: z__namespace.string({}).meta({
               description: "The slug of the organization to sign in with"
             }).optional(),
-            providerId: zod.z.string({
+            providerId: z__namespace.string({}).meta({
               description: "The ID of the provider to sign in with. This can be provided instead of email or issuer"
             }).optional(),
-            domain: zod.z.string({
+            domain: z__namespace.string({}).meta({
               description: "The domain of the provider."
             }).optional(),
-            callbackURL: zod.z.string({
+            callbackURL: z__namespace.string({}).meta({
               description: "The URL to redirect to after login"
             }),
-            errorCallbackURL: zod.z.string({
+            errorCallbackURL: z__namespace.string({}).meta({
               description: "The URL to redirect to after login"
             }).optional(),
-            newUserCallbackURL: zod.z.string({
+            newUserCallbackURL: z__namespace.string({}).meta({
               description: "The URL to redirect to after login if the user is new"
             }).optional(),
-            scopes: zod.z.array(zod.z.string(), {
+            scopes: z__namespace.array(z__namespace.string(), {}).meta({
               description: "Scopes to request from the provider."
             }).optional(),
-            requestSignUp: zod.z.boolean({
+            requestSignUp: z__namespace.boolean({}).meta({
               description: "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider"
             }).optional(),
-            providerType: zod.z.enum(["oidc", "saml"]).optional()
+            providerType: z__namespace.enum(["oidc", "saml"]).optional()
           }),
           metadata: {
             openapi: {
@@ -617,7 +643,9 @@ const sso = (options) => {
               });
             }
             return ctx.json({
-              url: loginRequest.context,
+              url: `${loginRequest.context}&RelayState=${encodeURIComponent(
+                body.callbackURL
+              )}`,
               redirect: true
             });
           }
@@ -630,11 +658,11 @@ const sso = (options) => {
         "/sso/callback/:providerId",
         {
           method: "GET",
-          query: zod.z.object({
-            code: zod.z.string().optional(),
-            state: zod.z.string(),
-            error: zod.z.string().optional(),
-            error_description: zod.z.string().optional()
+          query: z__namespace.object({
+            code: z__namespace.string().optional(),
+            state: z__namespace.string(),
+            error: z__namespace.string().optional(),
+            error_description: z__namespace.string().optional()
           }),
           metadata: {
             isAction: false,
@@ -876,9 +904,9 @@ const sso = (options) => {
         "/sso/saml2/callback/:providerId",
         {
           method: "POST",
-          body: zod.z.object({
-            SAMLResponse: zod.z.string(),
-            RelayState: zod.z.string().optional()
+          body: z__namespace.object({
+            SAMLResponse: z__namespace.string(),
+            RelayState: z__namespace.string().optional()
           }),
           metadata: {
             isAction: false,
@@ -945,11 +973,11 @@ const sso = (options) => {
                 extract.attributes[value]
               ])
             ),
-            id: attributes[mapping.id || "nameID"],
-            email: attributes[mapping.email || "nameID"],
+            id: attributes[mapping.id] || attributes["nameID"],
+            email: attributes[mapping.email] || attributes["nameID"] || attributes["email"],
             name: [
-              attributes[mapping.firstName || "givenName"],
-              attributes[mapping.lastName || "surname"]
+              attributes[mapping.firstName] || attributes["givenName"],
+              attributes[mapping.lastName] || attributes["surname"]
             ].filter(Boolean).join(" ") || parsedResponse.extract.attributes?.displayName,
             attributes: parsedResponse.extract.attributes
           };
@@ -1015,10 +1043,9 @@ const sso = (options) => {
           }
           let session = await ctx.context.internalAdapter.createSession(user.id, ctx);
           await cookies.setSessionCookie(ctx, { session, user });
-          return ctx.json({
-            redirect: true,
-            url: RelayState || `${parsedSamlConfig.issuer}/dashboard`
-          });
+          throw ctx.redirect(
+            RelayState || `${parsedSamlConfig.callbackUrl}` || `${parsedSamlConfig.issuer}`
+          );
         }
       )
     },