@better-auth/sso 1.3.18 → 1.4.0-beta.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,17 +1,17 @@
1
1
 
2
- > @better-auth/sso@1.3.18 build /home/runner/work/better-auth/better-auth/packages/sso
2
+ > @better-auth/sso@1.4.0-beta.2 build /home/runner/work/better-auth/better-auth/packages/sso
3
3
  > unbuild
4
4
 
5
5
  [info] Automatically detected entries: src/index, src/client [esm] [cjs] [dts]
6
6
  [info] Building sso
7
7
  [success] Build succeeded for sso
8
- [log] dist/index.cjs (total size: 67.2 kB, chunk size: 67.2 kB, exports: sso)
8
+ [log] dist/index.cjs (total size: 66.4 kB, chunk size: 66.4 kB, exports: sso)
9
9
 
10
10
  [log] dist/client.cjs (total size: 141 B, chunk size: 141 B, exports: ssoClient)
11
11
 
12
- [log] dist/index.mjs (total size: 65.5 kB, chunk size: 65.5 kB, exports: sso)
12
+ [log] dist/index.mjs (total size: 64.7 kB, chunk size: 64.7 kB, exports: sso)
13
13
 
14
14
  [log] dist/client.mjs (total size: 117 B, chunk size: 117 B, exports: ssoClient)
15
15
 
16
- Σ Total dist size (byte size): 260 kB
16
+ Σ Total dist size (byte size): 258 kB
17
17
  [log]
package/dist/index.cjs CHANGED
@@ -76,18 +76,8 @@ const sso = (options) => {
76
76
  });
77
77
  }
78
78
  const parsedSamlConfig = JSON.parse(provider.samlConfig);
79
- const sp = parsedSamlConfig.spMetadata.metadata ? saml__namespace.ServiceProvider({
79
+ const sp = saml__namespace.ServiceProvider({
80
80
  metadata: parsedSamlConfig.spMetadata.metadata
81
- }) : saml__namespace.SPMetadata({
82
- entityID: parsedSamlConfig.spMetadata?.entityID || parsedSamlConfig.issuer,
83
- assertionConsumerService: [
84
- {
85
- Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
86
- Location: parsedSamlConfig.callbackUrl || `${ctx.context.baseURL}/sso/saml2/sp/acs/${provider.id}`
87
- }
88
- ],
89
- wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
90
- nameIDFormat: parsedSamlConfig.identifierFormat ? [parsedSamlConfig.identifierFormat] : void 0
91
81
  });
92
82
  return new Response(sp.getMetadata(), {
93
83
  headers: {
@@ -721,10 +711,10 @@ const sso = (options) => {
721
711
  allowCreate: true
722
712
  });
723
713
  const idp = saml__namespace.IdentityProvider({
724
- metadata: parsedSamlConfig.idpMetadata?.metadata,
725
- entityID: parsedSamlConfig.idpMetadata?.entityID,
726
- encryptCert: parsedSamlConfig.idpMetadata?.cert,
727
- singleSignOnService: parsedSamlConfig.idpMetadata?.singleSignOnService
714
+ metadata: parsedSamlConfig.idpMetadata.metadata,
715
+ entityID: parsedSamlConfig.idpMetadata.entityID,
716
+ encryptCert: parsedSamlConfig.idpMetadata.cert,
717
+ singleSignOnService: parsedSamlConfig.idpMetadata.singleSignOnService
728
718
  });
729
719
  const loginRequest = sp.createLoginRequest(
730
720
  idp,
@@ -1113,8 +1103,7 @@ const sso = (options) => {
1113
1103
  isAssertionEncrypted: spData?.isAssertionEncrypted || false,
1114
1104
  encPrivateKey: spData?.encPrivateKey,
1115
1105
  encPrivateKeyPass: spData?.encPrivateKeyPass,
1116
- wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
1117
- nameIDFormat: parsedSamlConfig.identifierFormat ? [parsedSamlConfig.identifierFormat] : void 0
1106
+ wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false
1118
1107
  });
1119
1108
  let parsedResponse;
1120
1109
  try {
@@ -1348,14 +1337,13 @@ const sso = (options) => {
1348
1337
  assertionConsumerService: [
1349
1338
  {
1350
1339
  Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
1351
- Location: parsedSamlConfig.callbackUrl || `${ctx.context.baseURL}/sso/saml2/sp/acs/${providerId}`
1340
+ Location: parsedSamlConfig.callbackUrl || `${ctx.context.baseURL}/sso/saml2/sp/acs`
1352
1341
  }
1353
1342
  ],
1354
1343
  wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
1355
1344
  metadata: parsedSamlConfig.spMetadata?.metadata,
1356
1345
  privateKey: parsedSamlConfig.spMetadata?.privateKey || parsedSamlConfig.privateKey,
1357
- privateKeyPass: parsedSamlConfig.spMetadata?.privateKeyPass,
1358
- nameIDFormat: parsedSamlConfig.identifierFormat ? [parsedSamlConfig.identifierFormat] : void 0
1346
+ privateKeyPass: parsedSamlConfig.spMetadata?.privateKeyPass
1359
1347
  });
1360
1348
  const idpData = parsedSamlConfig.idpMetadata;
1361
1349
  const idp = !idpData?.metadata ? saml__namespace.IdentityProvider({
package/dist/index.mjs CHANGED
@@ -59,18 +59,8 @@ const sso = (options) => {
59
59
  });
60
60
  }
61
61
  const parsedSamlConfig = JSON.parse(provider.samlConfig);
62
- const sp = parsedSamlConfig.spMetadata.metadata ? saml.ServiceProvider({
62
+ const sp = saml.ServiceProvider({
63
63
  metadata: parsedSamlConfig.spMetadata.metadata
64
- }) : saml.SPMetadata({
65
- entityID: parsedSamlConfig.spMetadata?.entityID || parsedSamlConfig.issuer,
66
- assertionConsumerService: [
67
- {
68
- Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
69
- Location: parsedSamlConfig.callbackUrl || `${ctx.context.baseURL}/sso/saml2/sp/acs/${provider.id}`
70
- }
71
- ],
72
- wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
73
- nameIDFormat: parsedSamlConfig.identifierFormat ? [parsedSamlConfig.identifierFormat] : void 0
74
64
  });
75
65
  return new Response(sp.getMetadata(), {
76
66
  headers: {
@@ -704,10 +694,10 @@ const sso = (options) => {
704
694
  allowCreate: true
705
695
  });
706
696
  const idp = saml.IdentityProvider({
707
- metadata: parsedSamlConfig.idpMetadata?.metadata,
708
- entityID: parsedSamlConfig.idpMetadata?.entityID,
709
- encryptCert: parsedSamlConfig.idpMetadata?.cert,
710
- singleSignOnService: parsedSamlConfig.idpMetadata?.singleSignOnService
697
+ metadata: parsedSamlConfig.idpMetadata.metadata,
698
+ entityID: parsedSamlConfig.idpMetadata.entityID,
699
+ encryptCert: parsedSamlConfig.idpMetadata.cert,
700
+ singleSignOnService: parsedSamlConfig.idpMetadata.singleSignOnService
711
701
  });
712
702
  const loginRequest = sp.createLoginRequest(
713
703
  idp,
@@ -1096,8 +1086,7 @@ const sso = (options) => {
1096
1086
  isAssertionEncrypted: spData?.isAssertionEncrypted || false,
1097
1087
  encPrivateKey: spData?.encPrivateKey,
1098
1088
  encPrivateKeyPass: spData?.encPrivateKeyPass,
1099
- wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
1100
- nameIDFormat: parsedSamlConfig.identifierFormat ? [parsedSamlConfig.identifierFormat] : void 0
1089
+ wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false
1101
1090
  });
1102
1091
  let parsedResponse;
1103
1092
  try {
@@ -1331,14 +1320,13 @@ const sso = (options) => {
1331
1320
  assertionConsumerService: [
1332
1321
  {
1333
1322
  Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
1334
- Location: parsedSamlConfig.callbackUrl || `${ctx.context.baseURL}/sso/saml2/sp/acs/${providerId}`
1323
+ Location: parsedSamlConfig.callbackUrl || `${ctx.context.baseURL}/sso/saml2/sp/acs`
1335
1324
  }
1336
1325
  ],
1337
1326
  wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
1338
1327
  metadata: parsedSamlConfig.spMetadata?.metadata,
1339
1328
  privateKey: parsedSamlConfig.spMetadata?.privateKey || parsedSamlConfig.privateKey,
1340
- privateKeyPass: parsedSamlConfig.spMetadata?.privateKeyPass,
1341
- nameIDFormat: parsedSamlConfig.identifierFormat ? [parsedSamlConfig.identifierFormat] : void 0
1329
+ privateKeyPass: parsedSamlConfig.spMetadata?.privateKeyPass
1342
1330
  });
1343
1331
  const idpData = parsedSamlConfig.idpMetadata;
1344
1332
  const idp = !idpData?.metadata ? saml.IdentityProvider({
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@better-auth/sso",
3
3
  "author": "Bereket Engida",
4
- "version": "1.3.18",
4
+ "version": "1.4.0-beta.2",
5
5
  "main": "dist/index.cjs",
6
6
  "license": "MIT",
7
7
  "keywords": [
@@ -58,15 +58,15 @@
58
58
  "body-parser": "^2.2.0",
59
59
  "express": "^5.1.0",
60
60
  "unbuild": "3.6.1",
61
- "better-auth": "^1.3.18"
61
+ "better-auth": "^1.4.0-beta.2"
62
62
  },
63
63
  "peerDependencies": {
64
- "better-auth": "1.3.18"
64
+ "better-auth": "1.4.0-beta.2"
65
65
  },
66
66
  "scripts": {
67
67
  "test": "vitest",
68
68
  "build": "unbuild",
69
- "dev": "unbuild --watch",
70
- "typecheck": "tsc --project tsconfig.json"
69
+ "typecheck": "tsc --noEmit",
70
+ "dev": "unbuild --watch"
71
71
  }
72
72
  }
package/src/index.ts CHANGED
@@ -252,7 +252,6 @@ export const sso = (options?: SSOOptions) => {
252
252
  },
253
253
  async (ctx) => {
254
254
  const provider = await ctx.context.adapter.findOne<{
255
- id: string;
256
255
  samlConfig: string;
257
256
  }>({
258
257
  model: "ssoProvider",
@@ -269,29 +268,10 @@ export const sso = (options?: SSOOptions) => {
269
268
  });
270
269
  }
271
270
 
272
- const parsedSamlConfig: SAMLConfig = JSON.parse(provider.samlConfig);
273
- const sp = parsedSamlConfig.spMetadata.metadata
274
- ? saml.ServiceProvider({
275
- metadata: parsedSamlConfig.spMetadata.metadata,
276
- })
277
- : saml.SPMetadata({
278
- entityID:
279
- parsedSamlConfig.spMetadata?.entityID ||
280
- parsedSamlConfig.issuer,
281
- assertionConsumerService: [
282
- {
283
- Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
284
- Location:
285
- parsedSamlConfig.callbackUrl ||
286
- `${ctx.context.baseURL}/sso/saml2/sp/acs/${provider.id}`,
287
- },
288
- ],
289
- wantMessageSigned:
290
- parsedSamlConfig.wantAssertionsSigned || false,
291
- nameIDFormat: parsedSamlConfig.identifierFormat
292
- ? [parsedSamlConfig.identifierFormat]
293
- : undefined,
294
- });
271
+ const parsedSamlConfig = JSON.parse(provider.samlConfig);
272
+ const sp = saml.ServiceProvider({
273
+ metadata: parsedSamlConfig.spMetadata.metadata,
274
+ });
295
275
  return new Response(sp.getMetadata(), {
296
276
  headers: {
297
277
  "Content-Type": "application/xml",
@@ -1094,7 +1074,7 @@ export const sso = (options?: SSOOptions) => {
1094
1074
  });
1095
1075
  }
1096
1076
  if (provider.samlConfig) {
1097
- const parsedSamlConfig: SAMLConfig =
1077
+ const parsedSamlConfig =
1098
1078
  typeof provider.samlConfig === "object"
1099
1079
  ? provider.samlConfig
1100
1080
  : JSON.parse(provider.samlConfig as unknown as string);
@@ -1104,11 +1084,11 @@ export const sso = (options?: SSOOptions) => {
1104
1084
  });
1105
1085
 
1106
1086
  const idp = saml.IdentityProvider({
1107
- metadata: parsedSamlConfig.idpMetadata?.metadata,
1108
- entityID: parsedSamlConfig.idpMetadata?.entityID,
1109
- encryptCert: parsedSamlConfig.idpMetadata?.cert,
1087
+ metadata: parsedSamlConfig.idpMetadata.metadata,
1088
+ entityID: parsedSamlConfig.idpMetadata.entityID,
1089
+ encryptCert: parsedSamlConfig.idpMetadata.cert,
1110
1090
  singleSignOnService:
1111
- parsedSamlConfig.idpMetadata?.singleSignOnService,
1091
+ parsedSamlConfig.idpMetadata.singleSignOnService,
1112
1092
  });
1113
1093
  const loginRequest = sp.createLoginRequest(
1114
1094
  idp,
@@ -1597,9 +1577,6 @@ export const sso = (options?: SSOOptions) => {
1597
1577
  encPrivateKey: spData?.encPrivateKey,
1598
1578
  encPrivateKeyPass: spData?.encPrivateKeyPass,
1599
1579
  wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
1600
- nameIDFormat: parsedSamlConfig.identifierFormat
1601
- ? [parsedSamlConfig.identifierFormat]
1602
- : undefined,
1603
1580
  });
1604
1581
 
1605
1582
  let parsedResponse: FlowResult;
@@ -1887,7 +1864,7 @@ export const sso = (options?: SSOOptions) => {
1887
1864
  Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
1888
1865
  Location:
1889
1866
  parsedSamlConfig.callbackUrl ||
1890
- `${ctx.context.baseURL}/sso/saml2/sp/acs/${providerId}`,
1867
+ `${ctx.context.baseURL}/sso/saml2/sp/acs`,
1891
1868
  },
1892
1869
  ],
1893
1870
  wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
@@ -1896,9 +1873,6 @@ export const sso = (options?: SSOOptions) => {
1896
1873
  parsedSamlConfig.spMetadata?.privateKey ||
1897
1874
  parsedSamlConfig.privateKey,
1898
1875
  privateKeyPass: parsedSamlConfig.spMetadata?.privateKeyPass,
1899
- nameIDFormat: parsedSamlConfig.identifierFormat
1900
- ? [parsedSamlConfig.identifierFormat]
1901
- : undefined,
1902
1876
  });
1903
1877
 
1904
1878
  // Update where we construct the IdP
package/src/saml.test.ts CHANGED
@@ -242,7 +242,7 @@ const certificate = `
242
242
  yyoWAJDUHiAmvFA=
243
243
  -----END CERTIFICATE-----
244
244
  `;
245
- const idpEncryptionKey = `
245
+ const idpEncyptionKey = `
246
246
  -----BEGIN RSA PRIVATE KEY-----
247
247
  Proc-Type: 4,ENCRYPTED
248
248
  DEK-Info: DES-EDE3-CBC,860FDB9F3BE14699
@@ -274,7 +274,7 @@ const idpEncryptionKey = `
274
274
  ISbutnQPUN5fsaIsgKDIV3T7n6519t6brobcW5bdigmf5ebFeZJ16/lYy6V77UM5
275
275
  -----END RSA PRIVATE KEY-----
276
276
  `;
277
- const spEncryptionKey = `
277
+ const spEncyptionKey = `
278
278
  -----BEGIN RSA PRIVATE KEY-----
279
279
  Proc-Type: 4,ENCRYPTED
280
280
  DEK-Info: DES-EDE3-CBC,860FDB9F3BE14699
@@ -698,7 +698,7 @@ describe("SAML SSO", async () => {
698
698
  privateKey: idpPrivateKey,
699
699
  privateKeyPass: "q9ALNhGT5EhfcRmp8Pg7e9zTQeP2x1bW",
700
700
  isAssertionEncrypted: true,
701
- encPrivateKey: idpEncryptionKey,
701
+ encPrivateKey: idpEncyptionKey,
702
702
  encPrivateKeyPass: "g7hGcRmp8PxT5QeP2q9Ehf1bWe9zTALN",
703
703
  },
704
704
  spMetadata: {
@@ -707,7 +707,7 @@ describe("SAML SSO", async () => {
707
707
  privateKey: spPrivateKey,
708
708
  privateKeyPass: "VHOSp5RUiBcrsjrcAuXFwU1NKCkGA8px",
709
709
  isAssertionEncrypted: true,
710
- encPrivateKey: spEncryptionKey,
710
+ encPrivateKey: spEncyptionKey,
711
711
  encPrivateKeyPass: "BXFNKpxrsjrCkGA8cAu5wUVHOSpci1RU",
712
712
  },
713
713
  identifierFormat:
@@ -754,7 +754,7 @@ describe("SAML SSO", async () => {
754
754
  privateKey: idpPrivateKey,
755
755
  privateKeyPass: "q9ALNhGT5EhfcRmp8Pg7e9zTQeP2x1bW",
756
756
  isAssertionEncrypted: true,
757
- encPrivateKey: idpEncryptionKey,
757
+ encPrivateKey: idpEncyptionKey,
758
758
  encPrivateKeyPass: "g7hGcRmp8PxT5QeP2q9Ehf1bWe9zTALN",
759
759
  },
760
760
  spMetadata: {
@@ -763,7 +763,7 @@ describe("SAML SSO", async () => {
763
763
  privateKey: spPrivateKey,
764
764
  privateKeyPass: "VHOSp5RUiBcrsjrcAuXFwU1NKCkGA8px",
765
765
  isAssertionEncrypted: true,
766
- encPrivateKey: spEncryptionKey,
766
+ encPrivateKey: spEncyptionKey,
767
767
  encPrivateKeyPass: "BXFNKpxrsjrCkGA8cAu5wUVHOSpci1RU",
768
768
  },
769
769
  identifierFormat:
@@ -782,69 +782,6 @@ describe("SAML SSO", async () => {
782
782
  expect(spMetadataRes.status).toBe(200);
783
783
  expect(spMetadataResResValue).toBe(spMetadata);
784
784
  });
785
- it("Should fetch sp metadata", async () => {
786
- const headers = await getAuthHeaders();
787
- await authClient.signIn.email(testUser, {
788
- throw: true,
789
- onSuccess: setCookieToHeader(headers),
790
- });
791
- const issuer = "http://localhost:8081";
792
- const provider = await auth.api.registerSSOProvider({
793
- body: {
794
- providerId: "saml-provider-1",
795
- issuer: issuer,
796
- domain: issuer,
797
- samlConfig: {
798
- entryPoint: mockIdP.metadataUrl,
799
- cert: certificate,
800
- callbackUrl: `${issuer}/api/sso/saml2/sp/acs`,
801
- wantAssertionsSigned: false,
802
- signatureAlgorithm: "sha256",
803
- digestAlgorithm: "sha256",
804
- idpMetadata: {
805
- metadata: idpMetadata,
806
- privateKey: idpPrivateKey,
807
- privateKeyPass: "q9ALNhGT5EhfcRmp8Pg7e9zTQeP2x1bW",
808
- isAssertionEncrypted: true,
809
- encPrivateKey: idpEncryptionKey,
810
- encPrivateKeyPass: "g7hGcRmp8PxT5QeP2q9Ehf1bWe9zTALN",
811
- },
812
- spMetadata: {
813
- binding: "post",
814
- privateKey: spPrivateKey,
815
- privateKeyPass: "VHOSp5RUiBcrsjrcAuXFwU1NKCkGA8px",
816
- isAssertionEncrypted: true,
817
- encPrivateKey: spEncryptionKey,
818
- encPrivateKeyPass: "BXFNKpxrsjrCkGA8cAu5wUVHOSpci1RU",
819
- },
820
- identifierFormat:
821
- "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
822
- },
823
- },
824
- headers,
825
- });
826
-
827
- const spMetadataRes = await auth.api.spMetadata({
828
- query: {
829
- providerId: provider.providerId,
830
- },
831
- });
832
- const spMetadataResResValue = await spMetadataRes.text();
833
- expect(spMetadataRes.status).toBe(200);
834
- expect(spMetadataResResValue).toBeDefined();
835
- expect(spMetadataResResValue).toContain(
836
- "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
837
- );
838
- expect(spMetadataResResValue).toContain(
839
- "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
840
- );
841
- expect(spMetadataResResValue).toContain(
842
- `<EntityDescriptor entityID="${issuer}"`,
843
- );
844
- expect(spMetadataResResValue).toContain(
845
- `Location="${issuer}/api/sso/saml2/sp/acs"`,
846
- );
847
- });
848
785
  it("should initiate SAML login and handle response", async () => {
849
786
  const headers = await getAuthHeaders();
850
787
  const res = await authClient.signIn.email(testUser, {
@@ -868,7 +805,7 @@ describe("SAML SSO", async () => {
868
805
  privateKey: idpPrivateKey,
869
806
  privateKeyPass: "q9ALNhGT5EhfcRmp8Pg7e9zTQeP2x1bW",
870
807
  isAssertionEncrypted: true,
871
- encPrivateKey: idpEncryptionKey,
808
+ encPrivateKey: idpEncyptionKey,
872
809
  encPrivateKeyPass: "g7hGcRmp8PxT5QeP2q9Ehf1bWe9zTALN",
873
810
  },
874
811
  spMetadata: {
@@ -877,7 +814,7 @@ describe("SAML SSO", async () => {
877
814
  privateKey: spPrivateKey,
878
815
  privateKeyPass: "VHOSp5RUiBcrsjrcAuXFwU1NKCkGA8px",
879
816
  isAssertionEncrypted: true,
880
- encPrivateKey: spEncryptionKey,
817
+ encPrivateKey: spEncyptionKey,
881
818
  encPrivateKeyPass: "BXFNKpxrsjrCkGA8cAu5wUVHOSpci1RU",
882
819
  },
883
820
  identifierFormat:
package/tsconfig.json CHANGED
@@ -1,14 +1,20 @@
1
1
  {
2
- "extends": "../../tsconfig.json",
3
2
  "compilerOptions": {
4
- "rootDir": "./src",
5
- "outDir": "./dist",
6
- "lib": ["esnext", "dom", "dom.iterable"]
3
+ "esModuleInterop": true,
4
+ "skipLibCheck": true,
5
+ "target": "es2022",
6
+ "allowJs": true,
7
+ "resolveJsonModule": true,
8
+ "module": "ESNext",
9
+ "noEmit": true,
10
+ "moduleResolution": "Bundler",
11
+ "moduleDetection": "force",
12
+ "isolatedModules": true,
13
+ "verbatimModuleSyntax": true,
14
+ "strict": true,
15
+ "noImplicitOverride": true,
16
+ "noFallthroughCasesInSwitch": true
7
17
  },
8
- "references": [
9
- {
10
- "path": "../better-auth/tsconfig.json"
11
- }
12
- ],
18
+ "exclude": ["node_modules", "dist"],
13
19
  "include": ["src"]
14
20
  }