@better-auth/sso 1.3.0-beta.8 → 1.3.0

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { generateState } from 'better-auth';
 import { APIError, sessionMiddleware } from 'better-auth/api';
 import { parseState, validateAuthorizationCode, validateToken, handleOAuthUserInfo, createAuthorizationURL } from 'better-auth/oauth2';
 import { createAuthEndpoint } from 'better-auth/plugins';
-import { z } from 'zod';
+import * as z from 'zod/v4';
 import * as saml from 'samlify';
 import { betterFetch, BetterFetchError } from '@better-fetch/fetch';
 import { decodeJwt } from 'jose';
@@ -74,47 +74,53 @@ const sso = (options) => {
         {
           method: "POST",
           body: z.object({
-            providerId: z.string({
+            providerId: z.string({}).meta({
               description: "The ID of the provider. This is used to identify the provider during login and callback"
             }),
-            issuer: z.string({
+            issuer: z.string({}).meta({
               description: "The issuer of the provider"
             }),
-            domain: z.string({
+            domain: z.string({}).meta({
               description: "The domain of the provider. This is used for email matching"
             }),
             oidcConfig: z.object({
-              clientId: z.string({
+              clientId: z.string({}).meta({
                 description: "The client ID"
               }),
-              clientSecret: z.string({
+              clientSecret: z.string({}).meta({
                 description: "The client secret"
               }),
-              authorizationEndpoint: z.string({
+              authorizationEndpoint: z.string({}).meta({
                 description: "The authorization endpoint"
               }).optional(),
-              tokenEndpoint: z.string({
+              tokenEndpoint: z.string({}).meta({
                 description: "The token endpoint"
               }).optional(),
-              userInfoEndpoint: z.string({
+              userInfoEndpoint: z.string({}).meta({
                 description: "The user info endpoint"
               }).optional(),
               tokenEndpointAuthentication: z.enum(["client_secret_post", "client_secret_basic"]).optional(),
-              jwksEndpoint: z.string({
+              jwksEndpoint: z.string({}).meta({
                 description: "The JWKS endpoint"
               }).optional(),
               discoveryEndpoint: z.string().optional(),
-              scopes: z.array(z.string(), {
+              scopes: z.array(z.string(), {}).meta({
                 description: "The scopes to request. Defaults to ['openid', 'email', 'profile', 'offline_access']"
               }).optional(),
-              pkce: z.boolean({
+              pkce: z.boolean({}).meta({
                 description: "Whether to use PKCE for the authorization flow"
               }).default(true).optional()
             }).optional(),
             samlConfig: z.object({
-              entryPoint: z.string(),
-              cert: z.string(),
-              callbackUrl: z.string(),
+              entryPoint: z.string({}).meta({
+                description: "The entry point of the provider"
+              }),
+              cert: z.string({}).meta({
+                description: "The certificate of the provider"
+              }),
+              callbackUrl: z.string({}).meta({
+                description: "The callback URL of the provider"
+              }),
               audience: z.string().optional(),
               idpMetadata: z.object({
                 metadata: z.string(),
@@ -139,30 +145,30 @@ const sso = (options) => {
               identifierFormat: z.string().optional(),
               privateKey: z.string().optional(),
               decryptionPvk: z.string().optional(),
-              additionalParams: z.record(z.string()).optional()
+              additionalParams: z.record(z.string(), z.any()).optional()
             }).optional(),
             mapping: z.object({
-              id: z.string({
+              id: z.string({}).meta({
                 description: "The field in the user info response that contains the id. Defaults to 'sub'"
               }),
-              email: z.string({
+              email: z.string({}).meta({
                 description: "The field in the user info response that contains the email. Defaults to 'email'"
               }),
-              emailVerified: z.string({
+              emailVerified: z.string({}).meta({
                 description: "The field in the user info response that contains whether the email is verified. defaults to 'email_verified'"
               }).optional(),
-              name: z.string({
+              name: z.string({}).meta({
                 description: "The field in the user info response that contains the name. Defaults to 'name'"
               }),
-              image: z.string({
+              image: z.string({}).meta({
                 description: "The field in the user info response that contains the image. Defaults to 'picture'"
               }).optional(),
-              extraFields: z.record(z.string()).optional()
+              extraFields: z.record(z.string(), z.any()).optional()
             }).optional(),
-            organizationId: z.string({
+            organizationId: z.string({}).meta({
               description: "If organization plugin is enabled, the organization id to link the provider to"
             }).optional(),
-            overrideUserInfo: z.boolean({
+            overrideUserInfo: z.boolean({}).meta({
               description: "Override user info with the provider info. Defaults to false"
             }).default(false).optional()
           }),
@@ -333,6 +339,25 @@ const sso = (options) => {
           }
         },
         async (ctx) => {
+          const user = ctx.context.session?.user;
+          if (!user) {
+            throw new APIError("UNAUTHORIZED");
+          }
+          const limit = typeof options?.providersLimit === "function" ? await options.providersLimit(user) : options?.providersLimit ?? 10;
+          if (!limit) {
+            throw new APIError("FORBIDDEN", {
+              message: "SSO provider registration is disabled"
+            });
+          }
+          const providers = await ctx.context.adapter.findMany({
+            model: "ssoProvider",
+            where: [{ field: "userId", value: user.id }]
+          });
+          if (providers.length >= limit) {
+            throw new APIError("FORBIDDEN", {
+              message: "You have reached the maximum number of SSO providers"
+            });
+          }
           const body = ctx.body;
           const issuerValidator = z.string().url();
           if (issuerValidator.safeParse(body.issuer).error) {
@@ -398,31 +423,31 @@ const sso = (options) => {
         {
           method: "POST",
           body: z.object({
-            email: z.string({
+            email: z.string({}).meta({
               description: "The email address to sign in with. This is used to identify the issuer to sign in with. It's optional if the issuer is provided"
             }).optional(),
-            organizationSlug: z.string({
+            organizationSlug: z.string({}).meta({
               description: "The slug of the organization to sign in with"
             }).optional(),
-            providerId: z.string({
+            providerId: z.string({}).meta({
               description: "The ID of the provider to sign in with. This can be provided instead of email or issuer"
             }).optional(),
-            domain: z.string({
+            domain: z.string({}).meta({
               description: "The domain of the provider."
             }).optional(),
-            callbackURL: z.string({
+            callbackURL: z.string({}).meta({
               description: "The URL to redirect to after login"
             }),
-            errorCallbackURL: z.string({
+            errorCallbackURL: z.string({}).meta({
               description: "The URL to redirect to after login"
             }).optional(),
-            newUserCallbackURL: z.string({
+            newUserCallbackURL: z.string({}).meta({
               description: "The URL to redirect to after login if the user is new"
             }).optional(),
-            scopes: z.array(z.string(), {
+            scopes: z.array(z.string(), {}).meta({
               description: "Scopes to request from the provider."
             }).optional(),
-            requestSignUp: z.boolean({
+            requestSignUp: z.boolean({}).meta({
               description: "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider"
             }).optional(),
             providerType: z.enum(["oidc", "saml"]).optional()
@@ -601,7 +626,9 @@ const sso = (options) => {
               });
             }
             return ctx.json({
-              url: loginRequest.context,
+              url: `${loginRequest.context}&RelayState=${encodeURIComponent(
+                body.callbackURL
+              )}`,
               redirect: true
             });
           }
@@ -929,11 +956,11 @@ const sso = (options) => {
                 extract.attributes[value]
               ])
             ),
-            id: attributes[mapping.id || "nameID"],
-            email: attributes[mapping.email || "nameID"],
+            id: attributes[mapping.id] || attributes["nameID"],
+            email: attributes[mapping.email] || attributes["nameID"] || attributes["email"],
             name: [
-              attributes[mapping.firstName || "givenName"],
-              attributes[mapping.lastName || "surname"]
+              attributes[mapping.firstName] || attributes["givenName"],
+              attributes[mapping.lastName] || attributes["surname"]
             ].filter(Boolean).join(" ") || parsedResponse.extract.attributes?.displayName,
             attributes: parsedResponse.extract.attributes
           };
@@ -999,10 +1026,9 @@ const sso = (options) => {
           }
           let session = await ctx.context.internalAdapter.createSession(user.id, ctx);
           await setSessionCookie(ctx, { session, user });
-          return ctx.json({
-            redirect: true,
-            url: RelayState || `${parsedSamlConfig.issuer}/dashboard`
-          });
+          throw ctx.redirect(
+            RelayState || `${parsedSamlConfig.callbackUrl}` || `${parsedSamlConfig.issuer}`
+          );
         }
       )
     },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@better-auth/sso",
   "author": "Bereket Engida",
-  "version": "1.3.0-beta.8",
+  "version": "1.3.0",
   "main": "dist/index.cjs",
   "license": "MIT",
   "keywords": [
@@ -47,7 +47,7 @@
     "oauth2-mock-server": "^7.2.0",
     "samlify": "^2.10.0",
     "zod": "^3.24.1",
-    "better-auth": "^1.3.0-beta.8"
+    "better-auth": "^1.3.0"
   },
   "devDependencies": {
     "@types/body-parser": "^1.19.6",

package/src/index.ts

@@ -13,8 +13,9 @@ import {
 	validateAuthorizationCode,
 	validateToken,
 } from "better-auth/oauth2";
+
 import { createAuthEndpoint } from "better-auth/plugins";
-import { z } from "zod";
+import * as z from "zod/v4";
 import * as saml from "samlify";
 import type { BindingContext } from "samlify/types/src/entity";
 import { betterFetch, BetterFetchError } from "@better-fetch/fetch";
@@ -132,6 +133,21 @@ export interface SSOOptions {
 	 * sign-in need to be called with with requestSignUp as true to create new users.
 	 */
 	disableImplicitSignUp?: boolean;
+	/**
+	 * Configure the maximum number of SSO providers a user can register.
+	 * You can also pass a function that returns a number.
+	 * Set to 0 to disable SSO provider registration.
+	 *
+	 * @example
+	 * ```ts
+	 * providersLimit: async (user) => {
+	 *   const plan = await getUserPlan(user);
+	 *   return plan.name === "pro" ? 10 : 1;
+	 * }
+	 * ```
+	 * @default 10
+	 */
+	providersLimit?: number | ((user: User) => Promise<number> | number);
 }
 
 export const sso = (options?: SSOOptions) => {
@@ -192,37 +208,40 @@ export const sso = (options?: SSOOptions) => {
 				{
 					method: "POST",
 					body: z.object({
-						providerId: z.string({
+						providerId: z.string({}).meta({
 							description:
 								"The ID of the provider. This is used to identify the provider during login and callback",
 						}),
-						issuer: z.string({
+						issuer: z.string({}).meta({
 							description: "The issuer of the provider",
 						}),
-						domain: z.string({
+						domain: z.string({}).meta({
 							description:
 								"The domain of the provider. This is used for email matching",
 						}),
 						oidcConfig: z
 							.object({
-								clientId: z.string({
+								clientId: z.string({}).meta({
 									description: "The client ID",
 								}),
-								clientSecret: z.string({
+								clientSecret: z.string({}).meta({
 									description: "The client secret",
 								}),
 								authorizationEndpoint: z
-									.string({
+									.string({})
+									.meta({
 										description: "The authorization endpoint",
 									})
 									.optional(),
 								tokenEndpoint: z
-									.string({
+									.string({})
+									.meta({
 										description: "The token endpoint",
 									})
 									.optional(),
 								userInfoEndpoint: z
-									.string({
+									.string({})
+									.meta({
 										description: "The user info endpoint",
 									})
 									.optional(),
@@ -230,19 +249,22 @@ export const sso = (options?: SSOOptions) => {
 									.enum(["client_secret_post", "client_secret_basic"])
 									.optional(),
 								jwksEndpoint: z
-									.string({
+									.string({})
+									.meta({
 										description: "The JWKS endpoint",
 									})
 									.optional(),
 								discoveryEndpoint: z.string().optional(),
 								scopes: z
-									.array(z.string(), {
+									.array(z.string(), {})
+									.meta({
 										description:
 											"The scopes to request. Defaults to ['openid', 'email', 'profile', 'offline_access']",
 									})
 									.optional(),
 								pkce: z
-									.boolean({
+									.boolean({})
+									.meta({
 										description:
 											"Whether to use PKCE for the authorization flow",
 									})
@@ -252,9 +274,15 @@ export const sso = (options?: SSOOptions) => {
 							.optional(),
 						samlConfig: z
 							.object({
-								entryPoint: z.string(),
-								cert: z.string(),
-								callbackUrl: z.string(),
+								entryPoint: z.string({}).meta({
+									description: "The entry point of the provider",
+								}),
+								cert: z.string({}).meta({
+									description: "The certificate of the provider",
+								}),
+								callbackUrl: z.string({}).meta({
+									description: "The callback URL of the provider",
+								}),
 								audience: z.string().optional(),
 								idpMetadata: z
 									.object({
@@ -282,46 +310,50 @@ export const sso = (options?: SSOOptions) => {
 								identifierFormat: z.string().optional(),
 								privateKey: z.string().optional(),
 								decryptionPvk: z.string().optional(),
-								additionalParams: z.record(z.string()).optional(),
+								additionalParams: z.record(z.string(), z.any()).optional(),
 							})
 							.optional(),
 						mapping: z
 							.object({
-								id: z.string({
+								id: z.string({}).meta({
 									description:
 										"The field in the user info response that contains the id. Defaults to 'sub'",
 								}),
-								email: z.string({
+								email: z.string({}).meta({
 									description:
 										"The field in the user info response that contains the email. Defaults to 'email'",
 								}),
 								emailVerified: z
-									.string({
+									.string({})
+									.meta({
 										description:
 											"The field in the user info response that contains whether the email is verified. defaults to 'email_verified'",
 									})
 									.optional(),
-								name: z.string({
+								name: z.string({}).meta({
 									description:
 										"The field in the user info response that contains the name. Defaults to 'name'",
 								}),
 								image: z
-									.string({
+									.string({})
+									.meta({
 										description:
 											"The field in the user info response that contains the image. Defaults to 'picture'",
 									})
 									.optional(),
-								extraFields: z.record(z.string()).optional(),
+								extraFields: z.record(z.string(), z.any()).optional(),
 							})
 							.optional(),
 						organizationId: z
-							.string({
+							.string({})
+							.meta({
 								description:
 									"If organization plugin is enabled, the organization id to link the provider to",
 							})
 							.optional(),
 						overrideUserInfo: z
-							.boolean({
+							.boolean({})
+							.meta({
 								description:
 									"Override user info with the provider info. Defaults to false",
 							})
@@ -509,6 +541,33 @@ export const sso = (options?: SSOOptions) => {
 					},
 				},
 				async (ctx) => {
+					const user = ctx.context.session?.user;
+					if (!user) {
+						throw new APIError("UNAUTHORIZED");
+					}
+
+					const limit =
+						typeof options?.providersLimit === "function"
+							? await options.providersLimit(user)
+							: options?.providersLimit ?? 10;
+
+					if (!limit) {
+						throw new APIError("FORBIDDEN", {
+							message: "SSO provider registration is disabled",
+						});
+					}
+
+					const providers = await ctx.context.adapter.findMany({
+						model: "ssoProvider",
+						where: [{ field: "userId", value: user.id }],
+					});
+
+					if (providers.length >= limit) {
+						throw new APIError("FORBIDDEN", {
+							message: "You have reached the maximum number of SSO providers",
+						});
+					}
+
 					const body = ctx.body;
 					const issuerValidator = z.string().url();
 					if (issuerValidator.safeParse(body.issuer).error) {
@@ -589,48 +648,56 @@ export const sso = (options?: SSOOptions) => {
 					method: "POST",
 					body: z.object({
 						email: z
-							.string({
+							.string({})
+							.meta({
 								description:
 									"The email address to sign in with. This is used to identify the issuer to sign in with. It's optional if the issuer is provided",
 							})
 							.optional(),
 						organizationSlug: z
-							.string({
+							.string({})
+							.meta({
 								description: "The slug of the organization to sign in with",
 							})
 							.optional(),
 						providerId: z
-							.string({
+							.string({})
+							.meta({
 								description:
 									"The ID of the provider to sign in with. This can be provided instead of email or issuer",
 							})
 							.optional(),
 						domain: z
-							.string({
+							.string({})
+							.meta({
 								description: "The domain of the provider.",
 							})
 							.optional(),
-						callbackURL: z.string({
+						callbackURL: z.string({}).meta({
 							description: "The URL to redirect to after login",
 						}),
 						errorCallbackURL: z
-							.string({
+							.string({})
+							.meta({
 								description: "The URL to redirect to after login",
 							})
 							.optional(),
 						newUserCallbackURL: z
-							.string({
+							.string({})
+							.meta({
 								description:
 									"The URL to redirect to after login if the user is new",
 							})
 							.optional(),
 						scopes: z
-							.array(z.string(), {
+							.array(z.string(), {})
+							.meta({
 								description: "Scopes to request from the provider.",
 							})
 							.optional(),
 						requestSignUp: z
-							.boolean({
+							.boolean({})
+							.meta({
 								description:
 									"Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider",
 							})
@@ -830,7 +897,9 @@ export const sso = (options?: SSOOptions) => {
 							});
 						}
 						return ctx.json({
-							url: loginRequest.context,
+							url: `${loginRequest.context}&RelayState=${encodeURIComponent(
+								body.callbackURL,
+							)}`,
 							redirect: true,
 						});
 					}
@@ -1243,12 +1312,15 @@ export const sso = (options?: SSOOptions) => {
 								extract.attributes[value as string],
 							]),
 						),
-						id: attributes[mapping.id || "nameID"],
-						email: attributes[mapping.email || "nameID" || "email"],
+						id: attributes[mapping.id] || attributes["nameID"],
+						email:
+							attributes[mapping.email] ||
+							attributes["nameID"] ||
+							attributes["email"],
 						name:
 							[
-								attributes[mapping.firstName || "givenName"],
-								attributes[mapping.lastName || "surname"],
+								attributes[mapping.firstName] || attributes["givenName"],
+								attributes[mapping.lastName] || attributes["surname"],
 							]
 								.filter(Boolean)
 								.join(" ") || parsedResponse.extract.attributes?.displayName,
@@ -1328,10 +1400,11 @@ export const sso = (options?: SSOOptions) => {
 					let session: Session =
 						await ctx.context.internalAdapter.createSession(user.id, ctx);
 					await setSessionCookie(ctx, { session, user });
-					return ctx.json({
-						redirect: true,
-						url: RelayState || `${parsedSamlConfig.issuer}/dashboard`,
-					});
+					throw ctx.redirect(
+						RelayState ||
+							`${parsedSamlConfig.callbackUrl}` ||
+							`${parsedSamlConfig.issuer}`,
+					);
 				},
 			),
 		},

package/src/oidc.test.ts

@@ -307,7 +307,108 @@ describe("SSO disable implicit sign in", async () => {
 			userId: expect.any(String),
 		});
 	});
+	it("should not allow creating a provider if limit is set to 0", async () => {
+		const { auth, signInWithTestUser } = await getTestInstanceMemory({
+			plugins: [sso({ providersLimit: 0 })],
+		});
+		const { headers } = await signInWithTestUser();
+		await expect(
+			auth.api.registerSSOProvider({
+				body: {
+					issuer: server.issuer.url!,
+					domain: "localhost.com",
+					oidcConfig: {
+						clientId: "test",
+						clientSecret: "test",
+					},
+					providerId: "test",
+				},
+				headers,
+			}),
+		).rejects.toMatchObject({
+			status: "FORBIDDEN",
+			body: { message: "SSO provider registration is disabled" },
+		});
+	});
+	it("should not allow creating a provider if limit is reached", async () => {
+		const { auth, signInWithTestUser } = await getTestInstanceMemory({
+			plugins: [sso({ providersLimit: 1 })],
+		});
+		const { headers } = await signInWithTestUser();
+
+		await auth.api.registerSSOProvider({
+			body: {
+				issuer: server.issuer.url!,
+				domain: "localhost.com",
+				oidcConfig: {
+					clientId: "test",
+					clientSecret: "test",
+				},
+				providerId: "test-1",
+			},
+			headers,
+		});
+
+		await expect(
+			auth.api.registerSSOProvider({
+				body: {
+					issuer: server.issuer.url!,
+					domain: "localhost.com",
+					oidcConfig: {
+						clientId: "test",
+						clientSecret: "test",
+					},
+					providerId: "test-2",
+				},
+				headers,
+			}),
+		).rejects.toMatchObject({
+			status: "FORBIDDEN",
+			body: {
+				message: "You have reached the maximum number of SSO providers",
+			},
+		});
+	});
+
+	it("should not allow creating a provider if limit from function is reached", async () => {
+		const { auth, signInWithTestUser } = await getTestInstanceMemory({
+			plugins: [sso({ providersLimit: async () => 1 })],
+		});
+		const { headers } = await signInWithTestUser();
 
+		await auth.api.registerSSOProvider({
+			body: {
+				issuer: server.issuer.url!,
+				domain: "localhost.com",
+				oidcConfig: {
+					clientId: "test",
+					clientSecret: "test",
+				},
+				providerId: "test-1",
+			},
+			headers,
+		});
+
+		await expect(
+			auth.api.registerSSOProvider({
+				body: {
+					issuer: server.issuer.url!,
+					domain: "localhost.com",
+					oidcConfig: {
+						clientId: "test",
+						clientSecret: "test",
+					},
+					providerId: "test-2",
+				},
+				headers,
+			}),
+		).rejects.toMatchObject({
+			status: "FORBIDDEN",
+			body: {
+				message: "You have reached the maximum number of SSO providers",
+			},
+		});
+	});
 	it("should not create user with SSO provider when sign ups are disabled", async () => {
 		const res = await auth.api.signInSSO({
 			body: {