@better-auth/sso 1.3.17 → 1.4.0-beta.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/.turbo/turbo-build.log +4 -4
  2. package/CHANGELOG.md +20 -0
  3. package/dist/index.cjs +165 -551
  4. package/dist/index.d.cts +39 -186
  5. package/dist/index.d.mts +39 -186
  6. package/dist/index.d.ts +39 -186
  7. package/dist/index.mjs +165 -551
  8. package/package.json +5 -5
  9. package/src/index.ts +225 -811
  10. package/src/oidc.test.ts +21 -84
  11. package/src/saml.test.ts +8 -163
  12. package/tsconfig.json +15 -9
package/dist/index.d.ts CHANGED
@@ -2,23 +2,6 @@ import * as better_call from 'better-call';
2
2
  import { User, OAuth2Tokens } from 'better-auth';
3
3
  import * as z from 'zod/v4';
4
4
 
5
- interface OIDCMapping {
6
- id?: string;
7
- email?: string;
8
- emailVerified?: string;
9
- name?: string;
10
- image?: string;
11
- extraFields?: Record<string, string>;
12
- }
13
- interface SAMLMapping {
14
- id?: string;
15
- email?: string;
16
- emailVerified?: string;
17
- name?: string;
18
- firstName?: string;
19
- lastName?: string;
20
- extraFields?: Record<string, string>;
21
- }
22
5
  interface OIDCConfig {
23
6
  issuer: string;
24
7
  pkce: boolean;
@@ -32,48 +15,29 @@ interface OIDCConfig {
32
15
  tokenEndpoint?: string;
33
16
  tokenEndpointAuthentication?: "client_secret_post" | "client_secret_basic";
34
17
  jwksEndpoint?: string;
35
- mapping?: OIDCMapping;
18
+ mapping?: {
19
+ id?: string;
20
+ email?: string;
21
+ emailVerified?: string;
22
+ name?: string;
23
+ image?: string;
24
+ extraFields?: Record<string, string>;
25
+ };
36
26
  }
37
27
  interface SAMLConfig {
38
28
  issuer: string;
39
29
  entryPoint: string;
40
- cert: string;
41
- callbackUrl: string;
42
- audience?: string;
43
- idpMetadata?: {
44
- metadata?: string;
45
- entityID?: string;
46
- entityURL?: string;
47
- redirectURL?: string;
48
- cert?: string;
49
- privateKey?: string;
50
- privateKeyPass?: string;
51
- isAssertionEncrypted?: boolean;
52
- encPrivateKey?: string;
53
- encPrivateKeyPass?: string;
54
- singleSignOnService?: Array<{
55
- Binding: string;
56
- Location: string;
57
- }>;
30
+ signingKey: string;
31
+ certificate: string;
32
+ attributeConsumingServiceIndex: number;
33
+ mapping?: {
34
+ id?: string;
35
+ email?: string;
36
+ name?: string;
37
+ firstName?: string;
38
+ lastName?: string;
39
+ extraFields?: Record<string, string>;
58
40
  };
59
- spMetadata: {
60
- metadata?: string;
61
- entityID?: string;
62
- binding?: string;
63
- privateKey?: string;
64
- privateKeyPass?: string;
65
- isAssertionEncrypted?: boolean;
66
- encPrivateKey?: string;
67
- encPrivateKeyPass?: string;
68
- };
69
- wantAssertionsSigned?: boolean;
70
- signatureAlgorithm?: string;
71
- digestAlgorithm?: string;
72
- identifierFormat?: string;
73
- privateKey?: string;
74
- decryptionPvk?: string;
75
- additionalParams?: Record<string, any>;
76
- mapping?: SAMLMapping;
77
41
  }
78
42
  interface SSOProvider {
79
43
  issuer: string;
@@ -130,29 +94,6 @@ interface SSOOptions {
130
94
  provider: SSOProvider;
131
95
  }) => Promise<"member" | "admin">;
132
96
  };
133
- /**
134
- * Default SSO provider configurations for testing.
135
- * These will take the precedence over the database providers.
136
- */
137
- defaultSSO?: Array<{
138
- /**
139
- * The domain to match for this default provider.
140
- * This is only used to match incoming requests to this default provider.
141
- */
142
- domain: string;
143
- /**
144
- * The provider ID to use
145
- */
146
- providerId: string;
147
- /**
148
- * SAML configuration
149
- */
150
- samlConfig?: SAMLConfig;
151
- /**
152
- * OIDC configuration
153
- */
154
- oidcConfig?: OIDCConfig;
155
- }>;
156
97
  /**
157
98
  * Override user info with the provider info.
158
99
  * @default false
@@ -257,22 +198,13 @@ declare const sso: (options?: SSOOptions) => {
257
198
  discoveryEndpoint?: string | undefined;
258
199
  scopes?: string[] | undefined;
259
200
  pkce?: boolean | undefined;
260
- mapping?: {
261
- id: string;
262
- email: string;
263
- name: string;
264
- emailVerified?: string | undefined;
265
- image?: string | undefined;
266
- extraFields?: Record<string, any> | undefined;
267
- } | undefined;
268
201
  } | undefined;
269
202
  samlConfig?: {
270
203
  entryPoint: string;
271
204
  cert: string;
272
205
  callbackUrl: string;
273
206
  spMetadata: {
274
- metadata?: string | undefined;
275
- entityID?: string | undefined;
207
+ metadata: string;
276
208
  binding?: string | undefined;
277
209
  privateKey?: string | undefined;
278
210
  privateKeyPass?: string | undefined;
@@ -282,18 +214,12 @@ declare const sso: (options?: SSOOptions) => {
282
214
  };
283
215
  audience?: string | undefined;
284
216
  idpMetadata?: {
285
- metadata?: string | undefined;
286
- entityID?: string | undefined;
287
- cert?: string | undefined;
217
+ metadata: string;
288
218
  privateKey?: string | undefined;
289
219
  privateKeyPass?: string | undefined;
290
220
  isAssertionEncrypted?: boolean | undefined;
291
221
  encPrivateKey?: string | undefined;
292
222
  encPrivateKeyPass?: string | undefined;
293
- singleSignOnService?: {
294
- Binding: string;
295
- Location: string;
296
- }[] | undefined;
297
223
  } | undefined;
298
224
  wantAssertionsSigned?: boolean | undefined;
299
225
  signatureAlgorithm?: string | undefined;
@@ -302,15 +228,14 @@ declare const sso: (options?: SSOOptions) => {
302
228
  privateKey?: string | undefined;
303
229
  decryptionPvk?: string | undefined;
304
230
  additionalParams?: Record<string, any> | undefined;
305
- mapping?: {
306
- id: string;
307
- email: string;
308
- name: string;
309
- emailVerified?: string | undefined;
310
- firstName?: string | undefined;
311
- lastName?: string | undefined;
312
- extraFields?: Record<string, any> | undefined;
313
- } | undefined;
231
+ } | undefined;
232
+ mapping?: {
233
+ id: string;
234
+ email: string;
235
+ name: string;
236
+ emailVerified?: string | undefined;
237
+ image?: string | undefined;
238
+ extraFields?: Record<string, any> | undefined;
314
239
  } | undefined;
315
240
  organizationId?: string | undefined;
316
241
  overrideUserInfo?: boolean | undefined;
@@ -373,14 +298,6 @@ declare const sso: (options?: SSOOptions) => {
373
298
  discoveryEndpoint: z.ZodOptional<z.ZodString>;
374
299
  scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
375
300
  pkce: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
376
- mapping: z.ZodOptional<z.ZodObject<{
377
- id: z.ZodString;
378
- email: z.ZodString;
379
- emailVerified: z.ZodOptional<z.ZodString>;
380
- name: z.ZodString;
381
- image: z.ZodOptional<z.ZodString>;
382
- extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
383
- }, z.core.$strip>>;
384
301
  }, z.core.$strip>>;
385
302
  samlConfig: z.ZodOptional<z.ZodObject<{
386
303
  entryPoint: z.ZodString;
@@ -388,22 +305,15 @@ declare const sso: (options?: SSOOptions) => {
388
305
  callbackUrl: z.ZodString;
389
306
  audience: z.ZodOptional<z.ZodString>;
390
307
  idpMetadata: z.ZodOptional<z.ZodObject<{
391
- metadata: z.ZodOptional<z.ZodString>;
392
- entityID: z.ZodOptional<z.ZodString>;
393
- cert: z.ZodOptional<z.ZodString>;
308
+ metadata: z.ZodString;
394
309
  privateKey: z.ZodOptional<z.ZodString>;
395
310
  privateKeyPass: z.ZodOptional<z.ZodString>;
396
311
  isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
397
312
  encPrivateKey: z.ZodOptional<z.ZodString>;
398
313
  encPrivateKeyPass: z.ZodOptional<z.ZodString>;
399
- singleSignOnService: z.ZodOptional<z.ZodArray<z.ZodObject<{
400
- Binding: z.ZodString;
401
- Location: z.ZodString;
402
- }, z.core.$strip>>>;
403
314
  }, z.core.$strip>>;
404
315
  spMetadata: z.ZodObject<{
405
- metadata: z.ZodOptional<z.ZodString>;
406
- entityID: z.ZodOptional<z.ZodString>;
316
+ metadata: z.ZodString;
407
317
  binding: z.ZodOptional<z.ZodString>;
408
318
  privateKey: z.ZodOptional<z.ZodString>;
409
319
  privateKeyPass: z.ZodOptional<z.ZodString>;
@@ -418,15 +328,14 @@ declare const sso: (options?: SSOOptions) => {
418
328
  privateKey: z.ZodOptional<z.ZodString>;
419
329
  decryptionPvk: z.ZodOptional<z.ZodString>;
420
330
  additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
421
- mapping: z.ZodOptional<z.ZodObject<{
422
- id: z.ZodString;
423
- email: z.ZodString;
424
- emailVerified: z.ZodOptional<z.ZodString>;
425
- name: z.ZodString;
426
- firstName: z.ZodOptional<z.ZodString>;
427
- lastName: z.ZodOptional<z.ZodString>;
428
- extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
429
- }, z.core.$strip>>;
331
+ }, z.core.$strip>>;
332
+ mapping: z.ZodOptional<z.ZodObject<{
333
+ id: z.ZodString;
334
+ email: z.ZodString;
335
+ emailVerified: z.ZodOptional<z.ZodString>;
336
+ name: z.ZodString;
337
+ image: z.ZodOptional<z.ZodString>;
338
+ extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
430
339
  }, z.core.$strip>>;
431
340
  organizationId: z.ZodOptional<z.ZodString>;
432
341
  overrideUserInfo: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
@@ -858,62 +767,6 @@ declare const sso: (options?: SSOOptions) => {
858
767
  };
859
768
  path: "/sso/saml2/callback/:providerId";
860
769
  };
861
- acsEndpoint: {
862
- <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
863
- body: {
864
- SAMLResponse: string;
865
- RelayState?: string | undefined;
866
- };
867
- } & {
868
- method?: "POST" | undefined;
869
- } & {
870
- query?: Record<string, any> | undefined;
871
- } & {
872
- params: {
873
- providerId: string;
874
- };
875
- } & {
876
- request?: Request;
877
- } & {
878
- headers?: HeadersInit;
879
- } & {
880
- asResponse?: boolean;
881
- returnHeaders?: boolean;
882
- use?: better_call.Middleware[];
883
- path?: string;
884
- } & {
885
- asResponse?: AsResponse | undefined;
886
- returnHeaders?: ReturnHeaders | undefined;
887
- }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
888
- headers: Headers;
889
- response: never;
890
- } : never>;
891
- options: {
892
- method: "POST";
893
- params: z.ZodObject<{
894
- providerId: z.ZodOptional<z.ZodString>;
895
- }, z.core.$strip>;
896
- body: z.ZodObject<{
897
- SAMLResponse: z.ZodString;
898
- RelayState: z.ZodOptional<z.ZodString>;
899
- }, z.core.$strip>;
900
- metadata: {
901
- isAction: boolean;
902
- openapi: {
903
- summary: string;
904
- description: string;
905
- responses: {
906
- "302": {
907
- description: string;
908
- };
909
- };
910
- };
911
- };
912
- } & {
913
- use: any[];
914
- };
915
- path: "/sso/saml2/sp/acs/:providerId";
916
- };
917
770
  };
918
771
  schema: {
919
772
  ssoProvider: {
@@ -956,4 +809,4 @@ declare const sso: (options?: SSOOptions) => {
956
809
  };
957
810
 
958
811
  export { sso };
959
- export type { OIDCConfig, OIDCMapping, SAMLConfig, SAMLMapping, SSOOptions, SSOProvider };
812
+ export type { OIDCConfig, SAMLConfig, SSOOptions, SSOProvider };