@better-auth/sso 1.4.0-beta.2 → 1.4.0-beta.21

package/dist/index-C091fIpa.d.mts

@@ -0,0 +1,675 @@
+import { OAuth2Tokens, User } from "better-auth";
+import * as z from "zod/v4";
+import * as better_call0 from "better-call";
+
+//#region src/types.d.ts
+interface OIDCMapping {
+  id?: string | undefined;
+  email?: string | undefined;
+  emailVerified?: string | undefined;
+  name?: string | undefined;
+  image?: string | undefined;
+  extraFields?: Record<string, string> | undefined;
+}
+interface SAMLMapping {
+  id?: string | undefined;
+  email?: string | undefined;
+  emailVerified?: string | undefined;
+  name?: string | undefined;
+  firstName?: string | undefined;
+  lastName?: string | undefined;
+  extraFields?: Record<string, string> | undefined;
+}
+interface OIDCConfig {
+  issuer: string;
+  pkce: boolean;
+  clientId: string;
+  clientSecret: string;
+  authorizationEndpoint?: string | undefined;
+  discoveryEndpoint: string;
+  userInfoEndpoint?: string | undefined;
+  scopes?: string[] | undefined;
+  overrideUserInfo?: boolean | undefined;
+  tokenEndpoint?: string | undefined;
+  tokenEndpointAuthentication?: ("client_secret_post" | "client_secret_basic") | undefined;
+  jwksEndpoint?: string | undefined;
+  mapping?: OIDCMapping | undefined;
+}
+interface SAMLConfig {
+  issuer: string;
+  entryPoint: string;
+  cert: string;
+  callbackUrl: string;
+  audience?: string | undefined;
+  idpMetadata?: {
+    metadata?: string;
+    entityID?: string;
+    entityURL?: string;
+    redirectURL?: string;
+    cert?: string;
+    privateKey?: string;
+    privateKeyPass?: string;
+    isAssertionEncrypted?: boolean;
+    encPrivateKey?: string;
+    encPrivateKeyPass?: string;
+    singleSignOnService?: Array<{
+      Binding: string;
+      Location: string;
+    }>;
+  } | undefined;
+  spMetadata: {
+    metadata?: string | undefined;
+    entityID?: string | undefined;
+    binding?: string | undefined;
+    privateKey?: string | undefined;
+    privateKeyPass?: string | undefined;
+    isAssertionEncrypted?: boolean | undefined;
+    encPrivateKey?: string | undefined;
+    encPrivateKeyPass?: string | undefined;
+  };
+  wantAssertionsSigned?: boolean | undefined;
+  signatureAlgorithm?: string | undefined;
+  digestAlgorithm?: string | undefined;
+  identifierFormat?: string | undefined;
+  privateKey?: string | undefined;
+  decryptionPvk?: string | undefined;
+  additionalParams?: Record<string, any> | undefined;
+  mapping?: SAMLMapping | undefined;
+}
+type SSOProvider = {
+  issuer: string;
+  oidcConfig?: OIDCConfig | undefined;
+  samlConfig?: SAMLConfig | undefined;
+  userId: string;
+  providerId: string;
+  organizationId?: string | undefined;
+  domain: string;
+};
+interface SSOOptions {
+  /**
+   * custom function to provision a user when they sign in with an SSO provider.
+   */
+  provisionUser?: ((data: {
+    /**
+     * The user object from the database
+     */
+    user: User & Record<string, any>;
+    /**
+     * The user info object from the provider
+     */
+    userInfo: Record<string, any>;
+    /**
+     * The OAuth2 tokens from the provider
+     */
+    token?: OAuth2Tokens;
+    /**
+     * The SSO provider
+     */
+    provider: SSOProvider;
+  }) => Promise<void>) | undefined;
+  /**
+   * Organization provisioning options
+   */
+  organizationProvisioning?: {
+    disabled?: boolean;
+    defaultRole?: "member" | "admin";
+    getRole?: (data: {
+      /**
+       * The user object from the database
+       */
+      user: User & Record<string, any>;
+      /**
+       * The user info object from the provider
+       */
+      userInfo: Record<string, any>;
+      /**
+       * The OAuth2 tokens from the provider
+       */
+      token?: OAuth2Tokens;
+      /**
+       * The SSO provider
+       */
+      provider: SSOProvider;
+    }) => Promise<"member" | "admin">;
+  } | undefined;
+  /**
+   * Default SSO provider configurations for testing.
+   * These will take the precedence over the database providers.
+   */
+  defaultSSO?: Array<{
+    /**
+     * The domain to match for this default provider.
+     * This is only used to match incoming requests to this default provider.
+     */
+    domain: string;
+    /**
+     * The provider ID to use
+     */
+    providerId: string;
+    /**
+     * SAML configuration
+     */
+    samlConfig?: SAMLConfig;
+    /**
+     * OIDC configuration
+     */
+    oidcConfig?: OIDCConfig;
+  }> | undefined;
+  /**
+   * Override user info with the provider info.
+   * @default false
+   */
+  defaultOverrideUserInfo?: boolean | undefined;
+  /**
+   * Disable implicit sign up for new users. When set to true for the provider,
+   * sign-in need to be called with with requestSignUp as true to create new users.
+   */
+  disableImplicitSignUp?: boolean | undefined;
+  /**
+   * Configure the maximum number of SSO providers a user can register.
+   * You can also pass a function that returns a number.
+   * Set to 0 to disable SSO provider registration.
+   *
+   * @example
+   * ```ts
+   * providersLimit: async (user) => {
+   *   const plan = await getUserPlan(user);
+   *   return plan.name === "pro" ? 10 : 1;
+   * }
+   * ```
+   * @default 10
+   */
+  providersLimit?: (number | ((user: User) => Promise<number> | number)) | undefined;
+  /**
+   * Trust the email verified flag from the provider.
+   *
+   * ⚠️ Use this with caution — it can lead to account takeover if misused. Only enable it if users **cannot freely register new providers**. You can
+   * prevent that by using `disabledPaths` or other safeguards to block provider registration from the client.
+   *
+   * If you want to allow account linking for specific trusted providers, enable the `accountLinking` option in your auth config and specify those
+   * providers in the `trustedProviders` list.
+   * @default false
+   */
+  trustEmailVerified?: boolean | undefined;
+}
+//#endregion
+//#region src/routes/sso.d.ts
+declare const spMetadata: () => better_call0.StrictEndpoint<"/sso/saml2/sp/metadata", {
+  method: "GET";
+  query: z.ZodObject<{
+    providerId: z.ZodString;
+    format: z.ZodDefault<z.ZodEnum<{
+      xml: "xml";
+      json: "json";
+    }>>;
+  }, z.core.$strip>;
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+        };
+      };
+    };
+  };
+} & {
+  use: any[];
+}, Response>;
+declare const registerSSOProvider: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/register", {
+  method: "POST";
+  body: z.ZodObject<{
+    providerId: z.ZodString;
+    issuer: z.ZodString;
+    domain: z.ZodString;
+    oidcConfig: z.ZodOptional<z.ZodObject<{
+      clientId: z.ZodString;
+      clientSecret: z.ZodString;
+      authorizationEndpoint: z.ZodOptional<z.ZodString>;
+      tokenEndpoint: z.ZodOptional<z.ZodString>;
+      userInfoEndpoint: z.ZodOptional<z.ZodString>;
+      tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
+        client_secret_post: "client_secret_post";
+        client_secret_basic: "client_secret_basic";
+      }>>;
+      jwksEndpoint: z.ZodOptional<z.ZodString>;
+      discoveryEndpoint: z.ZodOptional<z.ZodString>;
+      scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      pkce: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+      mapping: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        emailVerified: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        image: z.ZodOptional<z.ZodString>;
+        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    samlConfig: z.ZodOptional<z.ZodObject<{
+      entryPoint: z.ZodString;
+      cert: z.ZodString;
+      callbackUrl: z.ZodString;
+      audience: z.ZodOptional<z.ZodString>;
+      idpMetadata: z.ZodOptional<z.ZodObject<{
+        metadata: z.ZodOptional<z.ZodString>;
+        entityID: z.ZodOptional<z.ZodString>;
+        cert: z.ZodOptional<z.ZodString>;
+        privateKey: z.ZodOptional<z.ZodString>;
+        privateKeyPass: z.ZodOptional<z.ZodString>;
+        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
+        encPrivateKey: z.ZodOptional<z.ZodString>;
+        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
+        singleSignOnService: z.ZodOptional<z.ZodArray<z.ZodObject<{
+          Binding: z.ZodString;
+          Location: z.ZodString;
+        }, z.core.$strip>>>;
+      }, z.core.$strip>>;
+      spMetadata: z.ZodObject<{
+        metadata: z.ZodOptional<z.ZodString>;
+        entityID: z.ZodOptional<z.ZodString>;
+        binding: z.ZodOptional<z.ZodString>;
+        privateKey: z.ZodOptional<z.ZodString>;
+        privateKeyPass: z.ZodOptional<z.ZodString>;
+        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
+        encPrivateKey: z.ZodOptional<z.ZodString>;
+        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>;
+      wantAssertionsSigned: z.ZodOptional<z.ZodBoolean>;
+      signatureAlgorithm: z.ZodOptional<z.ZodString>;
+      digestAlgorithm: z.ZodOptional<z.ZodString>;
+      identifierFormat: z.ZodOptional<z.ZodString>;
+      privateKey: z.ZodOptional<z.ZodString>;
+      decryptionPvk: z.ZodOptional<z.ZodString>;
+      additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      mapping: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        emailVerified: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        firstName: z.ZodOptional<z.ZodString>;
+        lastName: z.ZodOptional<z.ZodString>;
+        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    overrideUserInfo: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+  }, z.core.$strip>;
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    };
+  }>)[];
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  issuer: {
+                    type: string;
+                    format: string;
+                    description: string;
+                  };
+                  domain: {
+                    type: string;
+                    description: string;
+                  };
+                  oidcConfig: {
+                    type: string;
+                    properties: {
+                      issuer: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      pkce: {
+                        type: string;
+                        description: string;
+                      };
+                      clientId: {
+                        type: string;
+                        description: string;
+                      };
+                      clientSecret: {
+                        type: string;
+                        description: string;
+                      };
+                      authorizationEndpoint: {
+                        type: string;
+                        format: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      discoveryEndpoint: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      userInfoEndpoint: {
+                        type: string;
+                        format: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      scopes: {
+                        type: string;
+                        items: {
+                          type: string;
+                        };
+                        nullable: boolean;
+                        description: string;
+                      };
+                      tokenEndpoint: {
+                        type: string;
+                        format: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      tokenEndpointAuthentication: {
+                        type: string;
+                        enum: string[];
+                        nullable: boolean;
+                        description: string;
+                      };
+                      jwksEndpoint: {
+                        type: string;
+                        format: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      mapping: {
+                        type: string;
+                        nullable: boolean;
+                        properties: {
+                          id: {
+                            type: string;
+                            description: string;
+                          };
+                          email: {
+                            type: string;
+                            description: string;
+                          };
+                          emailVerified: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          name: {
+                            type: string;
+                            description: string;
+                          };
+                          image: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          extraFields: {
+                            type: string;
+                            additionalProperties: {
+                              type: string;
+                            };
+                            nullable: boolean;
+                            description: string;
+                          };
+                        };
+                        required: string[];
+                      };
+                    };
+                    required: string[];
+                    description: string;
+                  };
+                  organizationId: {
+                    type: string;
+                    nullable: boolean;
+                    description: string;
+                  };
+                  userId: {
+                    type: string;
+                    description: string;
+                  };
+                  providerId: {
+                    type: string;
+                    description: string;
+                  };
+                  redirectURI: {
+                    type: string;
+                    format: string;
+                    description: string;
+                  };
+                };
+                required: string[];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+} & {
+  use: any[];
+}, {
+  oidcConfig: OIDCConfig;
+  samlConfig: SAMLConfig;
+  redirectURI: string;
+  issuer: string;
+  userId: string;
+  providerId: string;
+  organizationId?: string | undefined;
+  domain: string;
+}>;
+declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sign-in/sso", {
+  method: "POST";
+  body: z.ZodObject<{
+    email: z.ZodOptional<z.ZodString>;
+    organizationSlug: z.ZodOptional<z.ZodString>;
+    providerId: z.ZodOptional<z.ZodString>;
+    domain: z.ZodOptional<z.ZodString>;
+    callbackURL: z.ZodString;
+    errorCallbackURL: z.ZodOptional<z.ZodString>;
+    newUserCallbackURL: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    loginHint: z.ZodOptional<z.ZodString>;
+    requestSignUp: z.ZodOptional<z.ZodBoolean>;
+    providerType: z.ZodOptional<z.ZodEnum<{
+      oidc: "oidc";
+      saml: "saml";
+    }>>;
+  }, z.core.$strip>;
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      requestBody: {
+        content: {
+          "application/json": {
+            schema: {
+              type: "object";
+              properties: {
+                email: {
+                  type: string;
+                  description: string;
+                };
+                issuer: {
+                  type: string;
+                  description: string;
+                };
+                providerId: {
+                  type: string;
+                  description: string;
+                };
+                callbackURL: {
+                  type: string;
+                  description: string;
+                };
+                errorCallbackURL: {
+                  type: string;
+                  description: string;
+                };
+                newUserCallbackURL: {
+                  type: string;
+                  description: string;
+                };
+                loginHint: {
+                  type: string;
+                  description: string;
+                };
+              };
+              required: string[];
+            };
+          };
+        };
+      };
+      responses: {
+        "200": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  url: {
+                    type: string;
+                    format: string;
+                    description: string;
+                  };
+                  redirect: {
+                    type: string;
+                    description: string;
+                    enum: boolean[];
+                  };
+                };
+                required: string[];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+} & {
+  use: any[];
+}, {
+  url: string;
+  redirect: boolean;
+}>;
+declare const callbackSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/callback/:providerId", {
+  method: "GET";
+  query: z.ZodObject<{
+    code: z.ZodOptional<z.ZodString>;
+    state: z.ZodString;
+    error: z.ZodOptional<z.ZodString>;
+    error_description: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  metadata: {
+    isAction: boolean;
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "302": {
+          description: string;
+        };
+      };
+    };
+  };
+} & {
+  use: any[];
+}, never>;
+declare const callbackSSOSAML: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/callback/:providerId", {
+  method: "POST";
+  body: z.ZodObject<{
+    SAMLResponse: z.ZodString;
+    RelayState: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  metadata: {
+    isAction: boolean;
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "302": {
+          description: string;
+        };
+        "400": {
+          description: string;
+        };
+        "401": {
+          description: string;
+        };
+      };
+    };
+  };
+} & {
+  use: any[];
+}, never>;
+declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
+  method: "POST";
+  params: z.ZodObject<{
+    providerId: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  body: z.ZodObject<{
+    SAMLResponse: z.ZodString;
+    RelayState: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  metadata: {
+    isAction: boolean;
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "302": {
+          description: string;
+        };
+      };
+    };
+  };
+} & {
+  use: any[];
+}, never>;
+//#endregion
+//#region src/index.d.ts
+type SSOEndpoints = {
+  spMetadata: ReturnType<typeof spMetadata>;
+  registerSSOProvider: ReturnType<typeof registerSSOProvider>;
+  signInSSO: ReturnType<typeof signInSSO>;
+  callbackSSO: ReturnType<typeof callbackSSO>;
+  callbackSSOSAML: ReturnType<typeof callbackSSOSAML>;
+  acsEndpoint: ReturnType<typeof acsEndpoint>;
+};
+declare function sso<O extends SSOOptions>(options?: O | undefined): {
+  id: "sso";
+  endpoints: SSOEndpoints;
+};
+//#endregion
+export { SSOProvider as a, SSOOptions as i, OIDCConfig as n, SAMLConfig as r, sso as t };