@better-auth/sso 1.4.4-beta.1 → 1.4.4-beta.2

package/.turbo/turbo-build.log

@@ -1,8 +1,8 @@
 
-> @better-auth/sso@1.4.4-beta.1 build /home/runner/work/better-auth/better-auth/packages/sso
+> @better-auth/sso@1.4.4-beta.2 build /home/runner/work/better-auth/better-auth/packages/sso
 > tsdown
 
-ℹ tsdown v0.16.6 powered by rolldown v1.0.0-beta.51
+ℹ tsdown v0.16.5 powered by rolldown v1.0.0-beta.50
 ℹ Using tsdown config: /home/runner/work/better-auth/better-auth/packages/sso/tsdown.config.ts
 ℹ entry: src/index.ts, src/client.ts
 ℹ tsconfig: tsconfig.json
@@ -11,6 +11,6 @@
 ℹ dist/client.mjs             0.15 kB │ gzip:  0.14 kB
 ℹ dist/client.d.mts           0.49 kB │ gzip:  0.30 kB
 ℹ dist/index.d.mts            0.21 kB │ gzip:  0.15 kB
-ℹ dist/index-B7qWG1sd.d.mts   8.55 kB │ gzip:  2.37 kB
-ℹ 5 files, total: 67.90 kB
-✔ Build complete in 16543ms
+ℹ dist/index-D-JmJR9N.d.mts  25.42 kB │ gzip:  3.95 kB
+ℹ 5 files, total: 84.77 kB
+✔ Build complete in 12025ms

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { t as SSOPlugin } from "./index-B7qWG1sd.mjs";
+import { t as SSOPlugin } from "./index-D-JmJR9N.mjs";
 
 //#region src/client.d.ts
 interface SSOClientOptions {

package/dist/index-D-JmJR9N.d.mts

@@ -0,0 +1,853 @@
+import * as z from "zod/v4";
+import { OAuth2Tokens, User } from "better-auth";
+import * as better_call0 from "better-call";
+
+//#region src/types.d.ts
+interface OIDCMapping {
+  id?: string | undefined;
+  email?: string | undefined;
+  emailVerified?: string | undefined;
+  name?: string | undefined;
+  image?: string | undefined;
+  extraFields?: Record<string, string> | undefined;
+}
+interface SAMLMapping {
+  id?: string | undefined;
+  email?: string | undefined;
+  emailVerified?: string | undefined;
+  name?: string | undefined;
+  firstName?: string | undefined;
+  lastName?: string | undefined;
+  extraFields?: Record<string, string> | undefined;
+}
+interface OIDCConfig {
+  issuer: string;
+  pkce: boolean;
+  clientId: string;
+  clientSecret: string;
+  authorizationEndpoint?: string | undefined;
+  discoveryEndpoint: string;
+  userInfoEndpoint?: string | undefined;
+  scopes?: string[] | undefined;
+  overrideUserInfo?: boolean | undefined;
+  tokenEndpoint?: string | undefined;
+  tokenEndpointAuthentication?: ("client_secret_post" | "client_secret_basic") | undefined;
+  jwksEndpoint?: string | undefined;
+  mapping?: OIDCMapping | undefined;
+}
+interface SAMLConfig {
+  issuer: string;
+  entryPoint: string;
+  cert: string;
+  callbackUrl: string;
+  audience?: string | undefined;
+  idpMetadata?: {
+    metadata?: string;
+    entityID?: string;
+    entityURL?: string;
+    redirectURL?: string;
+    cert?: string;
+    privateKey?: string;
+    privateKeyPass?: string;
+    isAssertionEncrypted?: boolean;
+    encPrivateKey?: string;
+    encPrivateKeyPass?: string;
+    singleSignOnService?: Array<{
+      Binding: string;
+      Location: string;
+    }>;
+  } | undefined;
+  spMetadata: {
+    metadata?: string | undefined;
+    entityID?: string | undefined;
+    binding?: string | undefined;
+    privateKey?: string | undefined;
+    privateKeyPass?: string | undefined;
+    isAssertionEncrypted?: boolean | undefined;
+    encPrivateKey?: string | undefined;
+    encPrivateKeyPass?: string | undefined;
+  };
+  wantAssertionsSigned?: boolean | undefined;
+  signatureAlgorithm?: string | undefined;
+  digestAlgorithm?: string | undefined;
+  identifierFormat?: string | undefined;
+  privateKey?: string | undefined;
+  decryptionPvk?: string | undefined;
+  additionalParams?: Record<string, any> | undefined;
+  mapping?: SAMLMapping | undefined;
+}
+type BaseSSOProvider = {
+  issuer: string;
+  oidcConfig?: OIDCConfig | undefined;
+  samlConfig?: SAMLConfig | undefined;
+  userId: string;
+  providerId: string;
+  organizationId?: string | undefined;
+  domain: string;
+};
+type SSOProvider<O extends SSOOptions> = O["domainVerification"] extends {
+  enabled: true;
+} ? {
+  domainVerified: boolean;
+} & BaseSSOProvider : BaseSSOProvider;
+interface SSOOptions {
+  /**
+   * custom function to provision a user when they sign in with an SSO provider.
+   */
+  provisionUser?: ((data: {
+    /**
+     * The user object from the database
+     */
+    user: User & Record<string, any>;
+    /**
+     * The user info object from the provider
+     */
+    userInfo: Record<string, any>;
+    /**
+     * The OAuth2 tokens from the provider
+     */
+    token?: OAuth2Tokens;
+    /**
+     * The SSO provider
+     */
+    provider: SSOProvider<SSOOptions>;
+  }) => Promise<void>) | undefined;
+  /**
+   * Organization provisioning options
+   */
+  organizationProvisioning?: {
+    disabled?: boolean;
+    defaultRole?: "member" | "admin";
+    getRole?: (data: {
+      /**
+       * The user object from the database
+       */
+      user: User & Record<string, any>;
+      /**
+       * The user info object from the provider
+       */
+      userInfo: Record<string, any>;
+      /**
+       * The OAuth2 tokens from the provider
+       */
+      token?: OAuth2Tokens;
+      /**
+       * The SSO provider
+       */
+      provider: SSOProvider<SSOOptions>;
+    }) => Promise<"member" | "admin">;
+  } | undefined;
+  /**
+   * Default SSO provider configurations for testing.
+   * These will take the precedence over the database providers.
+   */
+  defaultSSO?: Array<{
+    /**
+     * The domain to match for this default provider.
+     * This is only used to match incoming requests to this default provider.
+     */
+    domain: string;
+    /**
+     * The provider ID to use
+     */
+    providerId: string;
+    /**
+     * SAML configuration
+     */
+    samlConfig?: SAMLConfig;
+    /**
+     * OIDC configuration
+     */
+    oidcConfig?: OIDCConfig;
+  }> | undefined;
+  /**
+   * Override user info with the provider info.
+   * @default false
+   */
+  defaultOverrideUserInfo?: boolean | undefined;
+  /**
+   * Disable implicit sign up for new users. When set to true for the provider,
+   * sign-in need to be called with with requestSignUp as true to create new users.
+   */
+  disableImplicitSignUp?: boolean | undefined;
+  /**
+   * The model name for the SSO provider table. Defaults to "ssoProvider".
+   */
+  modelName?: string;
+  /**
+   * Map fields
+   *
+   * @example
+   * ```ts
+   * {
+   *  samlConfig: "saml_config"
+   * }
+   * ```
+   */
+  fields?: {
+    issuer?: string | undefined;
+    oidcConfig?: string | undefined;
+    samlConfig?: string | undefined;
+    userId?: string | undefined;
+    providerId?: string | undefined;
+    organizationId?: string | undefined;
+    domain?: string | undefined;
+  };
+  /**
+   * Configure the maximum number of SSO providers a user can register.
+   * You can also pass a function that returns a number.
+   * Set to 0 to disable SSO provider registration.
+   *
+   * @example
+   * ```ts
+   * providersLimit: async (user) => {
+   *   const plan = await getUserPlan(user);
+   *   return plan.name === "pro" ? 10 : 1;
+   * }
+   * ```
+   * @default 10
+   */
+  providersLimit?: (number | ((user: User) => Promise<number> | number)) | undefined;
+  /**
+   * Trust the email verified flag from the provider.
+   *
+   * ⚠️ Use this with caution — it can lead to account takeover if misused. Only enable it if users **cannot freely register new providers**. You can
+   * prevent that by using `disabledPaths` or other safeguards to block provider registration from the client.
+   *
+   * If you want to allow account linking for specific trusted providers, enable the `accountLinking` option in your auth config and specify those
+   * providers in the `trustedProviders` list.
+   * @default false
+   */
+  trustEmailVerified?: boolean | undefined;
+  /**
+   * Enable domain verification on SSO providers
+   *
+   * When this option is enabled, new SSO providers will require the associated domain to be verified by the owner
+   * prior to allowing sign-ins.
+   */
+  domainVerification?: {
+    /**
+     * Enables or disables the domain verification feature
+     */
+    enabled?: boolean;
+    /**
+     * Prefix used to generate the domain verification token
+     *
+     * @default "better-auth-token-"
+     */
+    tokenPrefix?: string;
+  };
+}
+//#endregion
+//#region src/routes/domain-verification.d.ts
+declare const requestDomainVerification: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/request-domain-verification", {
+  method: "POST";
+  body: z.ZodObject<{
+    providerId: z.ZodString;
+  }, z.core.$strip>;
+  metadata: {
+    openapi: {
+      summary: string;
+      description: string;
+      responses: {
+        "404": {
+          description: string;
+        };
+        "409": {
+          description: string;
+        };
+        "201": {
+          description: string;
+        };
+      };
+    };
+  };
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    };
+  }>)[];
+} & {
+  use: any[];
+}, {
+  domainVerificationToken: string;
+}>;
+declare const verifyDomain: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/verify-domain", {
+  method: "POST";
+  body: z.ZodObject<{
+    providerId: z.ZodString;
+  }, z.core.$strip>;
+  metadata: {
+    openapi: {
+      summary: string;
+      description: string;
+      responses: {
+        "404": {
+          description: string;
+        };
+        "409": {
+          description: string;
+        };
+        "502": {
+          description: string;
+        };
+        "204": {
+          description: string;
+        };
+      };
+    };
+  };
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    };
+  }>)[];
+} & {
+  use: any[];
+}, void>;
+//#endregion
+//#region src/routes/sso.d.ts
+declare const spMetadata: () => better_call0.StrictEndpoint<"/sso/saml2/sp/metadata", {
+  method: "GET";
+  query: z.ZodObject<{
+    providerId: z.ZodString;
+    format: z.ZodDefault<z.ZodEnum<{
+      xml: "xml";
+      json: "json";
+    }>>;
+  }, z.core.$strip>;
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+        };
+      };
+    };
+  };
+} & {
+  use: any[];
+}, Response>;
+declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_call0.StrictEndpoint<"/sso/register", {
+  method: "POST";
+  body: z.ZodObject<{
+    providerId: z.ZodString;
+    issuer: z.ZodString;
+    domain: z.ZodString;
+    oidcConfig: z.ZodOptional<z.ZodObject<{
+      clientId: z.ZodString;
+      clientSecret: z.ZodString;
+      authorizationEndpoint: z.ZodOptional<z.ZodString>;
+      tokenEndpoint: z.ZodOptional<z.ZodString>;
+      userInfoEndpoint: z.ZodOptional<z.ZodString>;
+      tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
+        client_secret_post: "client_secret_post";
+        client_secret_basic: "client_secret_basic";
+      }>>;
+      jwksEndpoint: z.ZodOptional<z.ZodString>;
+      discoveryEndpoint: z.ZodOptional<z.ZodString>;
+      scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      pkce: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+      mapping: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        emailVerified: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        image: z.ZodOptional<z.ZodString>;
+        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    samlConfig: z.ZodOptional<z.ZodObject<{
+      entryPoint: z.ZodString;
+      cert: z.ZodString;
+      callbackUrl: z.ZodString;
+      audience: z.ZodOptional<z.ZodString>;
+      idpMetadata: z.ZodOptional<z.ZodObject<{
+        metadata: z.ZodOptional<z.ZodString>;
+        entityID: z.ZodOptional<z.ZodString>;
+        cert: z.ZodOptional<z.ZodString>;
+        privateKey: z.ZodOptional<z.ZodString>;
+        privateKeyPass: z.ZodOptional<z.ZodString>;
+        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
+        encPrivateKey: z.ZodOptional<z.ZodString>;
+        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
+        singleSignOnService: z.ZodOptional<z.ZodArray<z.ZodObject<{
+          Binding: z.ZodString;
+          Location: z.ZodString;
+        }, z.core.$strip>>>;
+      }, z.core.$strip>>;
+      spMetadata: z.ZodObject<{
+        metadata: z.ZodOptional<z.ZodString>;
+        entityID: z.ZodOptional<z.ZodString>;
+        binding: z.ZodOptional<z.ZodString>;
+        privateKey: z.ZodOptional<z.ZodString>;
+        privateKeyPass: z.ZodOptional<z.ZodString>;
+        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
+        encPrivateKey: z.ZodOptional<z.ZodString>;
+        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>;
+      wantAssertionsSigned: z.ZodOptional<z.ZodBoolean>;
+      signatureAlgorithm: z.ZodOptional<z.ZodString>;
+      digestAlgorithm: z.ZodOptional<z.ZodString>;
+      identifierFormat: z.ZodOptional<z.ZodString>;
+      privateKey: z.ZodOptional<z.ZodString>;
+      decryptionPvk: z.ZodOptional<z.ZodString>;
+      additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      mapping: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        emailVerified: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        firstName: z.ZodOptional<z.ZodString>;
+        lastName: z.ZodOptional<z.ZodString>;
+        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    overrideUserInfo: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+  }, z.core.$strip>;
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+    session: {
+      session: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined;
+        userAgent?: string | null | undefined;
+      };
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    };
+  }>)[];
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "200": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  issuer: {
+                    type: string;
+                    format: string;
+                    description: string;
+                  };
+                  domain: {
+                    type: string;
+                    description: string;
+                  };
+                  domainVerified: {
+                    type: string;
+                    description: string;
+                  };
+                  domainVerificationToken: {
+                    type: string;
+                    description: string;
+                  };
+                  oidcConfig: {
+                    type: string;
+                    properties: {
+                      issuer: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      pkce: {
+                        type: string;
+                        description: string;
+                      };
+                      clientId: {
+                        type: string;
+                        description: string;
+                      };
+                      clientSecret: {
+                        type: string;
+                        description: string;
+                      };
+                      authorizationEndpoint: {
+                        type: string;
+                        format: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      discoveryEndpoint: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      userInfoEndpoint: {
+                        type: string;
+                        format: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      scopes: {
+                        type: string;
+                        items: {
+                          type: string;
+                        };
+                        nullable: boolean;
+                        description: string;
+                      };
+                      tokenEndpoint: {
+                        type: string;
+                        format: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      tokenEndpointAuthentication: {
+                        type: string;
+                        enum: string[];
+                        nullable: boolean;
+                        description: string;
+                      };
+                      jwksEndpoint: {
+                        type: string;
+                        format: string;
+                        nullable: boolean;
+                        description: string;
+                      };
+                      mapping: {
+                        type: string;
+                        nullable: boolean;
+                        properties: {
+                          id: {
+                            type: string;
+                            description: string;
+                          };
+                          email: {
+                            type: string;
+                            description: string;
+                          };
+                          emailVerified: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          name: {
+                            type: string;
+                            description: string;
+                          };
+                          image: {
+                            type: string;
+                            nullable: boolean;
+                            description: string;
+                          };
+                          extraFields: {
+                            type: string;
+                            additionalProperties: {
+                              type: string;
+                            };
+                            nullable: boolean;
+                            description: string;
+                          };
+                        };
+                        required: string[];
+                      };
+                    };
+                    required: string[];
+                    description: string;
+                  };
+                  organizationId: {
+                    type: string;
+                    nullable: boolean;
+                    description: string;
+                  };
+                  userId: {
+                    type: string;
+                    description: string;
+                  };
+                  providerId: {
+                    type: string;
+                    description: string;
+                  };
+                  redirectURI: {
+                    type: string;
+                    format: string;
+                    description: string;
+                  };
+                };
+                required: string[];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+} & {
+  use: any[];
+}, O["domainVerification"] extends {
+  enabled: true;
+} ? {
+  domainVerified: boolean;
+  domainVerificationToken: string;
+} & SSOProvider<O> : SSOProvider<O>>;
+declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sign-in/sso", {
+  method: "POST";
+  body: z.ZodObject<{
+    email: z.ZodOptional<z.ZodString>;
+    organizationSlug: z.ZodOptional<z.ZodString>;
+    providerId: z.ZodOptional<z.ZodString>;
+    domain: z.ZodOptional<z.ZodString>;
+    callbackURL: z.ZodString;
+    errorCallbackURL: z.ZodOptional<z.ZodString>;
+    newUserCallbackURL: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    loginHint: z.ZodOptional<z.ZodString>;
+    requestSignUp: z.ZodOptional<z.ZodBoolean>;
+    providerType: z.ZodOptional<z.ZodEnum<{
+      oidc: "oidc";
+      saml: "saml";
+    }>>;
+  }, z.core.$strip>;
+  metadata: {
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      requestBody: {
+        content: {
+          "application/json": {
+            schema: {
+              type: "object";
+              properties: {
+                email: {
+                  type: string;
+                  description: string;
+                };
+                issuer: {
+                  type: string;
+                  description: string;
+                };
+                providerId: {
+                  type: string;
+                  description: string;
+                };
+                callbackURL: {
+                  type: string;
+                  description: string;
+                };
+                errorCallbackURL: {
+                  type: string;
+                  description: string;
+                };
+                newUserCallbackURL: {
+                  type: string;
+                  description: string;
+                };
+                loginHint: {
+                  type: string;
+                  description: string;
+                };
+              };
+              required: string[];
+            };
+          };
+        };
+      };
+      responses: {
+        "200": {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  url: {
+                    type: string;
+                    format: string;
+                    description: string;
+                  };
+                  redirect: {
+                    type: string;
+                    description: string;
+                    enum: boolean[];
+                  };
+                };
+                required: string[];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+} & {
+  use: any[];
+}, {
+  url: string;
+  redirect: boolean;
+}>;
+declare const callbackSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/callback/:providerId", {
+  method: "GET";
+  query: z.ZodObject<{
+    code: z.ZodOptional<z.ZodString>;
+    state: z.ZodString;
+    error: z.ZodOptional<z.ZodString>;
+    error_description: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  allowedMediaTypes: string[];
+  metadata: {
+    isAction: false;
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "302": {
+          description: string;
+        };
+      };
+    };
+  };
+} & {
+  use: any[];
+}, never>;
+declare const callbackSSOSAML: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/callback/:providerId", {
+  method: "POST";
+  body: z.ZodObject<{
+    SAMLResponse: z.ZodString;
+    RelayState: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  metadata: {
+    isAction: false;
+    allowedMediaTypes: string[];
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "302": {
+          description: string;
+        };
+        "400": {
+          description: string;
+        };
+        "401": {
+          description: string;
+        };
+      };
+    };
+  };
+} & {
+  use: any[];
+}, never>;
+declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
+  method: "POST";
+  params: z.ZodObject<{
+    providerId: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  body: z.ZodObject<{
+    SAMLResponse: z.ZodString;
+    RelayState: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  metadata: {
+    isAction: false;
+    allowedMediaTypes: string[];
+    openapi: {
+      operationId: string;
+      summary: string;
+      description: string;
+      responses: {
+        "302": {
+          description: string;
+        };
+      };
+    };
+  };
+} & {
+  use: any[];
+}, never>;
+//#endregion
+//#region src/index.d.ts
+type DomainVerificationEndpoints = {
+  requestDomainVerification: ReturnType<typeof requestDomainVerification>;
+  verifyDomain: ReturnType<typeof verifyDomain>;
+};
+type SSOEndpoints<O extends SSOOptions> = {
+  spMetadata: ReturnType<typeof spMetadata>;
+  registerSSOProvider: ReturnType<typeof registerSSOProvider<O>>;
+  signInSSO: ReturnType<typeof signInSSO>;
+  callbackSSO: ReturnType<typeof callbackSSO>;
+  callbackSSOSAML: ReturnType<typeof callbackSSOSAML>;
+  acsEndpoint: ReturnType<typeof acsEndpoint>;
+};
+type SSOPlugin<O extends SSOOptions> = {
+  id: "sso";
+  endpoints: SSOEndpoints<O> & (O extends {
+    domainVerification: {
+      enabled: true;
+    };
+  } ? DomainVerificationEndpoints : {});
+};
+declare function sso<O extends SSOOptions & {
+  domainVerification?: {
+    enabled: true;
+  };
+}>(options?: O | undefined): {
+  id: "sso";
+  endpoints: SSOEndpoints<O> & DomainVerificationEndpoints;
+  schema: any;
+  options: O;
+};
+declare function sso<O extends SSOOptions>(options?: O | undefined): {
+  id: "sso";
+  endpoints: SSOEndpoints<O>;
+};
+//#endregion
+export { SSOOptions as a, SAMLConfig as i, sso as n, SSOProvider as o, OIDCConfig as r, SSOPlugin as t };

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { a as SSOOptions, i as SAMLConfig, n as sso, o as SSOProvider, r as OIDCConfig, t as SSOPlugin } from "./index-B7qWG1sd.mjs";
+import { a as SSOOptions, i as SAMLConfig, n as sso, o as SSOProvider, r as OIDCConfig, t as SSOPlugin } from "./index-D-JmJR9N.mjs";
 export { OIDCConfig, SAMLConfig, SSOOptions, SSOPlugin, SSOProvider, sso };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@better-auth/sso",
   "author": "Bereket Engida",
-  "version": "1.4.4-beta.1",
+  "version": "1.4.4-beta.2",
   "type": "module",
   "main": "dist/index.mjs",
   "homepage": "https://www.better-auth.com/docs/plugins/sso",
@@ -60,19 +60,18 @@
   "devDependencies": {
     "@types/body-parser": "^1.19.6",
     "@types/express": "^5.0.5",
-    "better-call": "1.1.1",
-    "body-parser": "^2.2.1",
+    "better-call": "1.1.3",
+    "body-parser": "^2.2.0",
     "express": "^5.1.0",
-    "oauth2-mock-server": "^8.2.0",
-    "tsdown": "^0.16.6",
-    "better-auth": "1.4.4-beta.1"
+    "oauth2-mock-server": "^7.2.1",
+    "tsdown": "^0.16.0",
+    "better-auth": "1.4.4-beta.2"
   },
   "peerDependencies": {
-    "better-auth": "1.4.4-beta.1"
+    "better-auth": "1.4.4-beta.2"
   },
   "scripts": {
     "test": "vitest",
-    "lint:package": "publint run --strict",
     "build": "tsdown",
     "dev": "tsdown --watch",
     "typecheck": "tsc --project tsconfig.json"

package/dist/index-B7qWG1sd.d.mts

@@ -1,288 +0,0 @@
-import { OAuth2Tokens, User } from "better-auth";
-
-//#region src/types.d.ts
-interface OIDCMapping {
-  id?: string | undefined;
-  email?: string | undefined;
-  emailVerified?: string | undefined;
-  name?: string | undefined;
-  image?: string | undefined;
-  extraFields?: Record<string, string> | undefined;
-}
-interface SAMLMapping {
-  id?: string | undefined;
-  email?: string | undefined;
-  emailVerified?: string | undefined;
-  name?: string | undefined;
-  firstName?: string | undefined;
-  lastName?: string | undefined;
-  extraFields?: Record<string, string> | undefined;
-}
-interface OIDCConfig {
-  issuer: string;
-  pkce: boolean;
-  clientId: string;
-  clientSecret: string;
-  authorizationEndpoint?: string | undefined;
-  discoveryEndpoint: string;
-  userInfoEndpoint?: string | undefined;
-  scopes?: string[] | undefined;
-  overrideUserInfo?: boolean | undefined;
-  tokenEndpoint?: string | undefined;
-  tokenEndpointAuthentication?: ("client_secret_post" | "client_secret_basic") | undefined;
-  jwksEndpoint?: string | undefined;
-  mapping?: OIDCMapping | undefined;
-}
-interface SAMLConfig {
-  issuer: string;
-  entryPoint: string;
-  cert: string;
-  callbackUrl: string;
-  audience?: string | undefined;
-  idpMetadata?: {
-    metadata?: string;
-    entityID?: string;
-    entityURL?: string;
-    redirectURL?: string;
-    cert?: string;
-    privateKey?: string;
-    privateKeyPass?: string;
-    isAssertionEncrypted?: boolean;
-    encPrivateKey?: string;
-    encPrivateKeyPass?: string;
-    singleSignOnService?: Array<{
-      Binding: string;
-      Location: string;
-    }>;
-  } | undefined;
-  spMetadata: {
-    metadata?: string | undefined;
-    entityID?: string | undefined;
-    binding?: string | undefined;
-    privateKey?: string | undefined;
-    privateKeyPass?: string | undefined;
-    isAssertionEncrypted?: boolean | undefined;
-    encPrivateKey?: string | undefined;
-    encPrivateKeyPass?: string | undefined;
-  };
-  wantAssertionsSigned?: boolean | undefined;
-  signatureAlgorithm?: string | undefined;
-  digestAlgorithm?: string | undefined;
-  identifierFormat?: string | undefined;
-  privateKey?: string | undefined;
-  decryptionPvk?: string | undefined;
-  additionalParams?: Record<string, any> | undefined;
-  mapping?: SAMLMapping | undefined;
-}
-type BaseSSOProvider = {
-  issuer: string;
-  oidcConfig?: OIDCConfig | undefined;
-  samlConfig?: SAMLConfig | undefined;
-  userId: string;
-  providerId: string;
-  organizationId?: string | undefined;
-  domain: string;
-};
-type SSOProvider<O extends SSOOptions> = O["domainVerification"] extends {
-  enabled: true;
-} ? {
-  domainVerified: boolean;
-} & BaseSSOProvider : BaseSSOProvider;
-interface SSOOptions {
-  /**
-   * custom function to provision a user when they sign in with an SSO provider.
-   */
-  provisionUser?: ((data: {
-    /**
-     * The user object from the database
-     */
-    user: User & Record<string, any>;
-    /**
-     * The user info object from the provider
-     */
-    userInfo: Record<string, any>;
-    /**
-     * The OAuth2 tokens from the provider
-     */
-    token?: OAuth2Tokens;
-    /**
-     * The SSO provider
-     */
-    provider: SSOProvider<SSOOptions>;
-  }) => Promise<void>) | undefined;
-  /**
-   * Organization provisioning options
-   */
-  organizationProvisioning?: {
-    disabled?: boolean;
-    defaultRole?: "member" | "admin";
-    getRole?: (data: {
-      /**
-       * The user object from the database
-       */
-      user: User & Record<string, any>;
-      /**
-       * The user info object from the provider
-       */
-      userInfo: Record<string, any>;
-      /**
-       * The OAuth2 tokens from the provider
-       */
-      token?: OAuth2Tokens;
-      /**
-       * The SSO provider
-       */
-      provider: SSOProvider<SSOOptions>;
-    }) => Promise<"member" | "admin">;
-  } | undefined;
-  /**
-   * Default SSO provider configurations for testing.
-   * These will take the precedence over the database providers.
-   */
-  defaultSSO?: Array<{
-    /**
-     * The domain to match for this default provider.
-     * This is only used to match incoming requests to this default provider.
-     */
-    domain: string;
-    /**
-     * The provider ID to use
-     */
-    providerId: string;
-    /**
-     * SAML configuration
-     */
-    samlConfig?: SAMLConfig;
-    /**
-     * OIDC configuration
-     */
-    oidcConfig?: OIDCConfig;
-  }> | undefined;
-  /**
-   * Override user info with the provider info.
-   * @default false
-   */
-  defaultOverrideUserInfo?: boolean | undefined;
-  /**
-   * Disable implicit sign up for new users. When set to true for the provider,
-   * sign-in need to be called with with requestSignUp as true to create new users.
-   */
-  disableImplicitSignUp?: boolean | undefined;
-  /**
-   * The model name for the SSO provider table. Defaults to "ssoProvider".
-   */
-  modelName?: string;
-  /**
-   * Map fields
-   *
-   * @example
-   * ```ts
-   * {
-   *  samlConfig: "saml_config"
-   * }
-   * ```
-   */
-  fields?: {
-    issuer?: string | undefined;
-    oidcConfig?: string | undefined;
-    samlConfig?: string | undefined;
-    userId?: string | undefined;
-    providerId?: string | undefined;
-    organizationId?: string | undefined;
-    domain?: string | undefined;
-  };
-  /**
-   * Configure the maximum number of SSO providers a user can register.
-   * You can also pass a function that returns a number.
-   * Set to 0 to disable SSO provider registration.
-   *
-   * @example
-   * ```ts
-   * providersLimit: async (user) => {
-   *   const plan = await getUserPlan(user);
-   *   return plan.name === "pro" ? 10 : 1;
-   * }
-   * ```
-   * @default 10
-   */
-  providersLimit?: (number | ((user: User) => Promise<number> | number)) | undefined;
-  /**
-   * Trust the email verified flag from the provider.
-   *
-   * ⚠️ Use this with caution — it can lead to account takeover if misused. Only enable it if users **cannot freely register new providers**. You can
-   * prevent that by using `disabledPaths` or other safeguards to block provider registration from the client.
-   *
-   * If you want to allow account linking for specific trusted providers, enable the `accountLinking` option in your auth config and specify those
-   * providers in the `trustedProviders` list.
-   * @default false
-   */
-  trustEmailVerified?: boolean | undefined;
-  /**
-   * Enable domain verification on SSO providers
-   *
-   * When this option is enabled, new SSO providers will require the associated domain to be verified by the owner
-   * prior to allowing sign-ins.
-   */
-  domainVerification?: {
-    /**
-     * Enables or disables the domain verification feature
-     */
-    enabled?: boolean;
-    /**
-     * Prefix used to generate the domain verification token
-     *
-     * @default "better-auth-token-"
-     */
-    tokenPrefix?: string;
-  };
-}
-//#endregion
-//#region src/routes/domain-verification.d.ts
-declare const requestDomainVerification: (options: SSOOptions) => any;
-declare const verifyDomain: (options: SSOOptions) => any;
-//#endregion
-//#region src/routes/sso.d.ts
-declare const spMetadata: () => any;
-declare const registerSSOProvider: <O extends SSOOptions>(options: O) => any;
-declare const signInSSO: (options?: SSOOptions) => any;
-declare const callbackSSO: (options?: SSOOptions) => any;
-declare const callbackSSOSAML: (options?: SSOOptions) => any;
-declare const acsEndpoint: (options?: SSOOptions) => any;
-//#endregion
-//#region src/index.d.ts
-type DomainVerificationEndpoints = {
-  requestDomainVerification: ReturnType<typeof requestDomainVerification>;
-  verifyDomain: ReturnType<typeof verifyDomain>;
-};
-type SSOEndpoints<O extends SSOOptions> = {
-  spMetadata: ReturnType<typeof spMetadata>;
-  registerSSOProvider: ReturnType<typeof registerSSOProvider<O>>;
-  signInSSO: ReturnType<typeof signInSSO>;
-  callbackSSO: ReturnType<typeof callbackSSO>;
-  callbackSSOSAML: ReturnType<typeof callbackSSOSAML>;
-  acsEndpoint: ReturnType<typeof acsEndpoint>;
-};
-type SSOPlugin<O extends SSOOptions> = {
-  id: "sso";
-  endpoints: SSOEndpoints<O> & (O extends {
-    domainVerification: {
-      enabled: true;
-    };
-  } ? DomainVerificationEndpoints : {});
-};
-declare function sso<O extends SSOOptions & {
-  domainVerification?: {
-    enabled: true;
-  };
-}>(options?: O | undefined): {
-  id: "sso";
-  endpoints: SSOEndpoints<O> & DomainVerificationEndpoints;
-  schema: any;
-  options: O;
-};
-declare function sso<O extends SSOOptions>(options?: O | undefined): {
-  id: "sso";
-  endpoints: SSOEndpoints<O>;
-};
-//#endregion
-export { SSOOptions as a, SAMLConfig as i, sso as n, SSOProvider as o, OIDCConfig as r, SSOPlugin as t };