@better-auth/sso 1.4.0-beta.19 → 1.4.0-beta.20

package/dist/index-D8XmWYZn.d.mts

@@ -1,694 +0,0 @@
-import { OAuth2Tokens, User } from "better-auth";
-import * as z from "zod/v4";
-import * as better_call0 from "better-call";
-
-//#region src/index.d.ts
-interface OIDCMapping {
-  id?: string | undefined;
-  email?: string | undefined;
-  emailVerified?: string | undefined;
-  name?: string | undefined;
-  image?: string | undefined;
-  extraFields?: Record<string, string> | undefined;
-}
-interface SAMLMapping {
-  id?: string | undefined;
-  email?: string | undefined;
-  emailVerified?: string | undefined;
-  name?: string | undefined;
-  firstName?: string | undefined;
-  lastName?: string | undefined;
-  extraFields?: Record<string, string> | undefined;
-}
-interface OIDCConfig {
-  issuer: string;
-  pkce: boolean;
-  clientId: string;
-  clientSecret: string;
-  authorizationEndpoint?: string | undefined;
-  discoveryEndpoint: string;
-  userInfoEndpoint?: string | undefined;
-  scopes?: string[] | undefined;
-  overrideUserInfo?: boolean | undefined;
-  tokenEndpoint?: string | undefined;
-  tokenEndpointAuthentication?: ("client_secret_post" | "client_secret_basic") | undefined;
-  jwksEndpoint?: string | undefined;
-  mapping?: OIDCMapping | undefined;
-}
-interface SAMLConfig {
-  issuer: string;
-  entryPoint: string;
-  cert: string;
-  callbackUrl: string;
-  audience?: string | undefined;
-  idpMetadata?: {
-    metadata?: string;
-    entityID?: string;
-    entityURL?: string;
-    redirectURL?: string;
-    cert?: string;
-    privateKey?: string;
-    privateKeyPass?: string;
-    isAssertionEncrypted?: boolean;
-    encPrivateKey?: string;
-    encPrivateKeyPass?: string;
-    singleSignOnService?: Array<{
-      Binding: string;
-      Location: string;
-    }>;
-  } | undefined;
-  spMetadata: {
-    metadata?: string | undefined;
-    entityID?: string | undefined;
-    binding?: string | undefined;
-    privateKey?: string | undefined;
-    privateKeyPass?: string | undefined;
-    isAssertionEncrypted?: boolean | undefined;
-    encPrivateKey?: string | undefined;
-    encPrivateKeyPass?: string | undefined;
-  };
-  wantAssertionsSigned?: boolean | undefined;
-  signatureAlgorithm?: string | undefined;
-  digestAlgorithm?: string | undefined;
-  identifierFormat?: string | undefined;
-  privateKey?: string | undefined;
-  decryptionPvk?: string | undefined;
-  additionalParams?: Record<string, any> | undefined;
-  mapping?: SAMLMapping | undefined;
-}
-interface SSOProvider {
-  issuer: string;
-  oidcConfig?: OIDCConfig | undefined;
-  samlConfig?: SAMLConfig | undefined;
-  userId: string;
-  providerId: string;
-  organizationId?: string | undefined;
-}
-interface SSOOptions {
-  /**
-   * custom function to provision a user when they sign in with an SSO provider.
-   */
-  provisionUser?: ((data: {
-    /**
-     * The user object from the database
-     */
-    user: User & Record<string, any>;
-    /**
-     * The user info object from the provider
-     */
-    userInfo: Record<string, any>;
-    /**
-     * The OAuth2 tokens from the provider
-     */
-    token?: OAuth2Tokens;
-    /**
-     * The SSO provider
-     */
-    provider: SSOProvider;
-  }) => Promise<void>) | undefined;
-  /**
-   * Organization provisioning options
-   */
-  organizationProvisioning?: {
-    disabled?: boolean;
-    defaultRole?: "member" | "admin";
-    getRole?: (data: {
-      /**
-       * The user object from the database
-       */
-      user: User & Record<string, any>;
-      /**
-       * The user info object from the provider
-       */
-      userInfo: Record<string, any>;
-      /**
-       * The OAuth2 tokens from the provider
-       */
-      token?: OAuth2Tokens;
-      /**
-       * The SSO provider
-       */
-      provider: SSOProvider;
-    }) => Promise<"member" | "admin">;
-  } | undefined;
-  /**
-   * Default SSO provider configurations for testing.
-   * These will take the precedence over the database providers.
-   */
-  defaultSSO?: Array<{
-    /**
-     * The domain to match for this default provider.
-     * This is only used to match incoming requests to this default provider.
-     */
-    domain: string;
-    /**
-     * The provider ID to use
-     */
-    providerId: string;
-    /**
-     * SAML configuration
-     */
-    samlConfig?: SAMLConfig;
-    /**
-     * OIDC configuration
-     */
-    oidcConfig?: OIDCConfig;
-  }> | undefined;
-  /**
-   * Override user info with the provider info.
-   * @default false
-   */
-  defaultOverrideUserInfo?: boolean | undefined;
-  /**
-   * Disable implicit sign up for new users. When set to true for the provider,
-   * sign-in need to be called with with requestSignUp as true to create new users.
-   */
-  disableImplicitSignUp?: boolean | undefined;
-  /**
-   * Configure the maximum number of SSO providers a user can register.
-   * You can also pass a function that returns a number.
-   * Set to 0 to disable SSO provider registration.
-   *
-   * @example
-   * ```ts
-   * providersLimit: async (user) => {
-   *   const plan = await getUserPlan(user);
-   *   return plan.name === "pro" ? 10 : 1;
-   * }
-   * ```
-   * @default 10
-   */
-  providersLimit?: (number | ((user: User) => Promise<number> | number)) | undefined;
-  /**
-   * Trust the email verified flag from the provider.
-   *
-   * ⚠️ Use this with caution — it can lead to account takeover if misused. Only enable it if users **cannot freely register new providers**. You can
-   * prevent that by using `disabledPaths` or other safeguards to block provider registration from the client.
-   *
-   * If you want to allow account linking for specific trusted providers, enable the `accountLinking` option in your auth config and specify those
-   * providers in the `trustedProviders` list.
-   * @default false
-   */
-  trustEmailVerified?: boolean | undefined;
-}
-declare const sso: (options?: SSOOptions | undefined) => {
-  id: "sso";
-  endpoints: {
-    spMetadata: better_call0.StrictEndpoint<"/sso/saml2/sp/metadata", {
-      method: "GET";
-      query: z.ZodObject<{
-        providerId: z.ZodString;
-        format: z.ZodDefault<z.ZodEnum<{
-          xml: "xml";
-          json: "json";
-        }>>;
-      }, z.core.$strip>;
-      metadata: {
-        openapi: {
-          summary: string;
-          description: string;
-          responses: {
-            "200": {
-              description: string;
-            };
-          };
-        };
-      };
-    } & {
-      use: any[];
-    }, Response>;
-    registerSSOProvider: better_call0.StrictEndpoint<"/sso/register", {
-      method: "POST";
-      body: z.ZodObject<{
-        providerId: z.ZodString;
-        issuer: z.ZodString;
-        domain: z.ZodString;
-        oidcConfig: z.ZodOptional<z.ZodObject<{
-          clientId: z.ZodString;
-          clientSecret: z.ZodString;
-          authorizationEndpoint: z.ZodOptional<z.ZodString>;
-          tokenEndpoint: z.ZodOptional<z.ZodString>;
-          userInfoEndpoint: z.ZodOptional<z.ZodString>;
-          tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
-            client_secret_post: "client_secret_post";
-            client_secret_basic: "client_secret_basic";
-          }>>;
-          jwksEndpoint: z.ZodOptional<z.ZodString>;
-          discoveryEndpoint: z.ZodOptional<z.ZodString>;
-          scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-          pkce: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-          mapping: z.ZodOptional<z.ZodObject<{
-            id: z.ZodString;
-            email: z.ZodString;
-            emailVerified: z.ZodOptional<z.ZodString>;
-            name: z.ZodString;
-            image: z.ZodOptional<z.ZodString>;
-            extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-          }, z.core.$strip>>;
-        }, z.core.$strip>>;
-        samlConfig: z.ZodOptional<z.ZodObject<{
-          entryPoint: z.ZodString;
-          cert: z.ZodString;
-          callbackUrl: z.ZodString;
-          audience: z.ZodOptional<z.ZodString>;
-          idpMetadata: z.ZodOptional<z.ZodObject<{
-            metadata: z.ZodOptional<z.ZodString>;
-            entityID: z.ZodOptional<z.ZodString>;
-            cert: z.ZodOptional<z.ZodString>;
-            privateKey: z.ZodOptional<z.ZodString>;
-            privateKeyPass: z.ZodOptional<z.ZodString>;
-            isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-            encPrivateKey: z.ZodOptional<z.ZodString>;
-            encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-            singleSignOnService: z.ZodOptional<z.ZodArray<z.ZodObject<{
-              Binding: z.ZodString;
-              Location: z.ZodString;
-            }, z.core.$strip>>>;
-          }, z.core.$strip>>;
-          spMetadata: z.ZodObject<{
-            metadata: z.ZodOptional<z.ZodString>;
-            entityID: z.ZodOptional<z.ZodString>;
-            binding: z.ZodOptional<z.ZodString>;
-            privateKey: z.ZodOptional<z.ZodString>;
-            privateKeyPass: z.ZodOptional<z.ZodString>;
-            isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-            encPrivateKey: z.ZodOptional<z.ZodString>;
-            encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-          }, z.core.$strip>;
-          wantAssertionsSigned: z.ZodOptional<z.ZodBoolean>;
-          signatureAlgorithm: z.ZodOptional<z.ZodString>;
-          digestAlgorithm: z.ZodOptional<z.ZodString>;
-          identifierFormat: z.ZodOptional<z.ZodString>;
-          privateKey: z.ZodOptional<z.ZodString>;
-          decryptionPvk: z.ZodOptional<z.ZodString>;
-          additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-          mapping: z.ZodOptional<z.ZodObject<{
-            id: z.ZodString;
-            email: z.ZodString;
-            emailVerified: z.ZodOptional<z.ZodString>;
-            name: z.ZodString;
-            firstName: z.ZodOptional<z.ZodString>;
-            lastName: z.ZodOptional<z.ZodString>;
-            extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-          }, z.core.$strip>>;
-        }, z.core.$strip>>;
-        organizationId: z.ZodOptional<z.ZodString>;
-        overrideUserInfo: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-      }, z.core.$strip>;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
-        session: {
-          session: Record<string, any> & {
-            id: string;
-            createdAt: Date;
-            updatedAt: Date;
-            userId: string;
-            expiresAt: Date;
-            token: string;
-            ipAddress?: string | null | undefined;
-            userAgent?: string | null | undefined;
-          };
-          user: Record<string, any> & {
-            id: string;
-            createdAt: Date;
-            updatedAt: Date;
-            email: string;
-            emailVerified: boolean;
-            name: string;
-            image?: string | null | undefined;
-          };
-        };
-      }>)[];
-      metadata: {
-        openapi: {
-          summary: string;
-          description: string;
-          responses: {
-            "200": {
-              description: string;
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object";
-                    properties: {
-                      issuer: {
-                        type: string;
-                        format: string;
-                        description: string;
-                      };
-                      domain: {
-                        type: string;
-                        description: string;
-                      };
-                      oidcConfig: {
-                        type: string;
-                        properties: {
-                          issuer: {
-                            type: string;
-                            format: string;
-                            description: string;
-                          };
-                          pkce: {
-                            type: string;
-                            description: string;
-                          };
-                          clientId: {
-                            type: string;
-                            description: string;
-                          };
-                          clientSecret: {
-                            type: string;
-                            description: string;
-                          };
-                          authorizationEndpoint: {
-                            type: string;
-                            format: string;
-                            nullable: boolean;
-                            description: string;
-                          };
-                          discoveryEndpoint: {
-                            type: string;
-                            format: string;
-                            description: string;
-                          };
-                          userInfoEndpoint: {
-                            type: string;
-                            format: string;
-                            nullable: boolean;
-                            description: string;
-                          };
-                          scopes: {
-                            type: string;
-                            items: {
-                              type: string;
-                            };
-                            nullable: boolean;
-                            description: string;
-                          };
-                          tokenEndpoint: {
-                            type: string;
-                            format: string;
-                            nullable: boolean;
-                            description: string;
-                          };
-                          tokenEndpointAuthentication: {
-                            type: string;
-                            enum: string[];
-                            nullable: boolean;
-                            description: string;
-                          };
-                          jwksEndpoint: {
-                            type: string;
-                            format: string;
-                            nullable: boolean;
-                            description: string;
-                          };
-                          mapping: {
-                            type: string;
-                            nullable: boolean;
-                            properties: {
-                              id: {
-                                type: string;
-                                description: string;
-                              };
-                              email: {
-                                type: string;
-                                description: string;
-                              };
-                              emailVerified: {
-                                type: string;
-                                nullable: boolean;
-                                description: string;
-                              };
-                              name: {
-                                type: string;
-                                description: string;
-                              };
-                              image: {
-                                type: string;
-                                nullable: boolean;
-                                description: string;
-                              };
-                              extraFields: {
-                                type: string;
-                                additionalProperties: {
-                                  type: string;
-                                };
-                                nullable: boolean;
-                                description: string;
-                              };
-                            };
-                            required: string[];
-                          };
-                        };
-                        required: string[];
-                        description: string;
-                      };
-                      organizationId: {
-                        type: string;
-                        nullable: boolean;
-                        description: string;
-                      };
-                      userId: {
-                        type: string;
-                        description: string;
-                      };
-                      providerId: {
-                        type: string;
-                        description: string;
-                      };
-                      redirectURI: {
-                        type: string;
-                        format: string;
-                        description: string;
-                      };
-                    };
-                    required: string[];
-                  };
-                };
-              };
-            };
-          };
-        };
-      };
-    } & {
-      use: any[];
-    }, {
-      oidcConfig: OIDCConfig;
-      samlConfig: SAMLConfig;
-      redirectURI: string;
-      issuer: string;
-      userId: string;
-      providerId: string;
-      organizationId?: string | undefined;
-    }>;
-    signInSSO: better_call0.StrictEndpoint<"/sign-in/sso", {
-      method: "POST";
-      body: z.ZodObject<{
-        email: z.ZodOptional<z.ZodString>;
-        organizationSlug: z.ZodOptional<z.ZodString>;
-        providerId: z.ZodOptional<z.ZodString>;
-        domain: z.ZodOptional<z.ZodString>;
-        callbackURL: z.ZodString;
-        errorCallbackURL: z.ZodOptional<z.ZodString>;
-        newUserCallbackURL: z.ZodOptional<z.ZodString>;
-        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        loginHint: z.ZodOptional<z.ZodString>;
-        requestSignUp: z.ZodOptional<z.ZodBoolean>;
-        providerType: z.ZodOptional<z.ZodEnum<{
-          oidc: "oidc";
-          saml: "saml";
-        }>>;
-      }, z.core.$strip>;
-      metadata: {
-        openapi: {
-          summary: string;
-          description: string;
-          requestBody: {
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object";
-                  properties: {
-                    email: {
-                      type: string;
-                      description: string;
-                    };
-                    issuer: {
-                      type: string;
-                      description: string;
-                    };
-                    providerId: {
-                      type: string;
-                      description: string;
-                    };
-                    callbackURL: {
-                      type: string;
-                      description: string;
-                    };
-                    errorCallbackURL: {
-                      type: string;
-                      description: string;
-                    };
-                    newUserCallbackURL: {
-                      type: string;
-                      description: string;
-                    };
-                    loginHint: {
-                      type: string;
-                      description: string;
-                    };
-                  };
-                  required: string[];
-                };
-              };
-            };
-          };
-          responses: {
-            "200": {
-              description: string;
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object";
-                    properties: {
-                      url: {
-                        type: string;
-                        format: string;
-                        description: string;
-                      };
-                      redirect: {
-                        type: string;
-                        description: string;
-                        enum: boolean[];
-                      };
-                    };
-                    required: string[];
-                  };
-                };
-              };
-            };
-          };
-        };
-      };
-    } & {
-      use: any[];
-    }, {
-      url: string;
-      redirect: boolean;
-    }>;
-    callbackSSO: better_call0.StrictEndpoint<"/sso/callback/:providerId", {
-      method: "GET";
-      query: z.ZodObject<{
-        code: z.ZodOptional<z.ZodString>;
-        state: z.ZodString;
-        error: z.ZodOptional<z.ZodString>;
-        error_description: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>;
-      metadata: {
-        isAction: boolean;
-        openapi: {
-          summary: string;
-          description: string;
-          responses: {
-            "302": {
-              description: string;
-            };
-          };
-        };
-      };
-    } & {
-      use: any[];
-    }, never>;
-    callbackSSOSAML: better_call0.StrictEndpoint<"/sso/saml2/callback/:providerId", {
-      method: "POST";
-      body: z.ZodObject<{
-        SAMLResponse: z.ZodString;
-        RelayState: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>;
-      metadata: {
-        isAction: boolean;
-        openapi: {
-          summary: string;
-          description: string;
-          responses: {
-            "302": {
-              description: string;
-            };
-            "400": {
-              description: string;
-            };
-            "401": {
-              description: string;
-            };
-          };
-        };
-      };
-    } & {
-      use: any[];
-    }, never>;
-    acsEndpoint: better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
-      method: "POST";
-      params: z.ZodObject<{
-        providerId: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>;
-      body: z.ZodObject<{
-        SAMLResponse: z.ZodString;
-        RelayState: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>;
-      metadata: {
-        isAction: boolean;
-        openapi: {
-          summary: string;
-          description: string;
-          responses: {
-            "302": {
-              description: string;
-            };
-          };
-        };
-      };
-    } & {
-      use: any[];
-    }, never>;
-  };
-  schema: {
-    ssoProvider: {
-      fields: {
-        issuer: {
-          type: "string";
-          required: true;
-        };
-        oidcConfig: {
-          type: "string";
-          required: false;
-        };
-        samlConfig: {
-          type: "string";
-          required: false;
-        };
-        userId: {
-          type: "string";
-          references: {
-            model: string;
-            field: string;
-          };
-        };
-        providerId: {
-          type: "string";
-          required: true;
-          unique: true;
-        };
-        organizationId: {
-          type: "string";
-          required: false;
-        };
-        domain: {
-          type: "string";
-          required: true;
-        };
-      };
-    };
-  };
-};
-//#endregion
-export { SSOOptions as a, SAMLMapping as i, OIDCMapping as n, SSOProvider as o, SAMLConfig as r, sso as s, OIDCConfig as t };