@better-auth/sso 1.4.6-beta.2 → 1.4.6-beta.3

package/.turbo/turbo-build.log

@@ -1,16 +1,16 @@
 
-> @better-auth/sso@1.4.6-beta.2 build /home/runner/work/better-auth/better-auth/packages/sso
+> @better-auth/sso@1.4.6-beta.3 build /home/runner/work/better-auth/better-auth/packages/sso
 > tsdown
 
-ℹ tsdown v0.16.6 powered by rolldown v1.0.0-beta.51
-ℹ Using tsdown config: /home/runner/work/better-auth/better-auth/packages/sso/tsdown.config.ts
+ℹ tsdown v0.17.0 powered by rolldown v1.0.0-beta.53
+ℹ config file: /home/runner/work/better-auth/better-auth/packages/sso/tsdown.config.ts 
 ℹ entry: src/index.ts, src/client.ts
 ℹ tsconfig: tsconfig.json
 ℹ Build start
-ℹ dist/index.mjs             58.49 kB │ gzip: 10.33 kB
+ℹ dist/index.mjs             58.73 kB │ gzip: 10.41 kB
 ℹ dist/client.mjs             0.15 kB │ gzip:  0.14 kB
-ℹ dist/client.d.mts           0.49 kB │ gzip:  0.29 kB
+ℹ dist/client.d.mts           0.49 kB │ gzip:  0.30 kB
 ℹ dist/index.d.mts            0.21 kB │ gzip:  0.15 kB
-ℹ dist/index-DCyJckhH.d.mts  25.42 kB │ gzip:  3.96 kB
-ℹ 5 files, total: 84.77 kB
-✔ Build complete in 11114ms
+ℹ dist/index-D-JmJR9N.d.mts  25.42 kB │ gzip:  3.95 kB
+ℹ 5 files, total: 85.01 kB
+✔ Build complete in 10982ms

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { t as SSOPlugin } from "./index-DCyJckhH.mjs";
+import { t as SSOPlugin } from "./index-D-JmJR9N.mjs";
 
 //#region src/client.d.ts
 interface SSOClientOptions {

package/dist/{index-DCyJckhH.d.mts → index-D-JmJR9N.d.mts}

@@ -1,6 +1,6 @@
 import * as z from "zod/v4";
 import { OAuth2Tokens, User } from "better-auth";
-import * as better_call7 from "better-call";
+import * as better_call0 from "better-call";
 
 //#region src/types.d.ts
 interface OIDCMapping {
@@ -240,7 +240,7 @@ interface SSOOptions {
 }
 //#endregion
 //#region src/routes/domain-verification.d.ts
-declare const requestDomainVerification: (options: SSOOptions) => better_call7.StrictEndpoint<"/sso/request-domain-verification", {
+declare const requestDomainVerification: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/request-domain-verification", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -262,7 +262,7 @@ declare const requestDomainVerification: (options: SSOOptions) => better_call7.S
       };
     };
   };
-  use: ((inputContext: better_call7.MiddlewareInputContext<better_call7.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -290,7 +290,7 @@ declare const requestDomainVerification: (options: SSOOptions) => better_call7.S
 }, {
   domainVerificationToken: string;
 }>;
-declare const verifyDomain: (options: SSOOptions) => better_call7.StrictEndpoint<"/sso/verify-domain", {
+declare const verifyDomain: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/verify-domain", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -315,7 +315,7 @@ declare const verifyDomain: (options: SSOOptions) => better_call7.StrictEndpoint
       };
     };
   };
-  use: ((inputContext: better_call7.MiddlewareInputContext<better_call7.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -343,7 +343,7 @@ declare const verifyDomain: (options: SSOOptions) => better_call7.StrictEndpoint
 }, void>;
 //#endregion
 //#region src/routes/sso.d.ts
-declare const spMetadata: () => better_call7.StrictEndpoint<"/sso/saml2/sp/metadata", {
+declare const spMetadata: () => better_call0.StrictEndpoint<"/sso/saml2/sp/metadata", {
   method: "GET";
   query: z.ZodObject<{
     providerId: z.ZodString;
@@ -367,7 +367,7 @@ declare const spMetadata: () => better_call7.StrictEndpoint<"/sso/saml2/sp/metad
 } & {
   use: any[];
 }, Response>;
-declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_call7.StrictEndpoint<"/sso/register", {
+declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_call0.StrictEndpoint<"/sso/register", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -445,7 +445,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
     organizationId: z.ZodOptional<z.ZodString>;
     overrideUserInfo: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
   }, z.core.$strip>;
-  use: ((inputContext: better_call7.MiddlewareInputContext<better_call7.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -637,7 +637,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
   domainVerified: boolean;
   domainVerificationToken: string;
 } & SSOProvider<O> : SSOProvider<O>>;
-declare const signInSSO: (options?: SSOOptions) => better_call7.StrictEndpoint<"/sign-in/sso", {
+declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sign-in/sso", {
   method: "POST";
   body: z.ZodObject<{
     email: z.ZodOptional<z.ZodString>;
@@ -733,7 +733,7 @@ declare const signInSSO: (options?: SSOOptions) => better_call7.StrictEndpoint<"
   url: string;
   redirect: boolean;
 }>;
-declare const callbackSSO: (options?: SSOOptions) => better_call7.StrictEndpoint<"/sso/callback/:providerId", {
+declare const callbackSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/callback/:providerId", {
   method: "GET";
   query: z.ZodObject<{
     code: z.ZodOptional<z.ZodString>;
@@ -758,7 +758,7 @@ declare const callbackSSO: (options?: SSOOptions) => better_call7.StrictEndpoint
 } & {
   use: any[];
 }, never>;
-declare const callbackSSOSAML: (options?: SSOOptions) => better_call7.StrictEndpoint<"/sso/saml2/callback/:providerId", {
+declare const callbackSSOSAML: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/callback/:providerId", {
   method: "POST";
   body: z.ZodObject<{
     SAMLResponse: z.ZodString;
@@ -787,7 +787,7 @@ declare const callbackSSOSAML: (options?: SSOOptions) => better_call7.StrictEndp
 } & {
   use: any[];
 }, never>;
-declare const acsEndpoint: (options?: SSOOptions) => better_call7.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
+declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
   method: "POST";
   params: z.ZodObject<{
     providerId: z.ZodOptional<z.ZodString>;

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { a as SSOOptions, i as SAMLConfig, n as sso, o as SSOProvider, r as OIDCConfig, t as SSOPlugin } from "./index-DCyJckhH.mjs";
+import { a as SSOOptions, i as SAMLConfig, n as sso, o as SSOProvider, r as OIDCConfig, t as SSOPlugin } from "./index-D-JmJR9N.mjs";
 export { OIDCConfig, SAMLConfig, SSOOptions, SSOPlugin, SSOProvider, sso };

package/dist/index.mjs

@@ -10,10 +10,11 @@ import { handleOAuthUserInfo } from "better-auth/oauth2";
 import { decodeJwt } from "jose";
 
 //#region src/routes/domain-verification.ts
+const domainVerificationBodySchema = z.object({ providerId: z.string() });
 const requestDomainVerification = (options) => {
 	return createAuthEndpoint("/sso/request-domain-verification", {
 		method: "POST",
-		body: z.object({ providerId: z.string() }),
+		body: domainVerificationBodySchema,
 		metadata: { openapi: {
 			summary: "Request a domain verification",
 			description: "Request a domain verification for the given SSO provider",
@@ -90,7 +91,7 @@ const requestDomainVerification = (options) => {
 const verifyDomain = (options) => {
 	return createAuthEndpoint("/sso/verify-domain", {
 		method: "POST",
-		body: z.object({ providerId: z.string() }),
+		body: domainVerificationBodySchema,
 		metadata: { openapi: {
 			summary: "Verify the provider domain ownership",
 			description: "Verify the provider domain ownership via DNS records",
@@ -208,13 +209,14 @@ function safeJsonParse(value) {
 	}
 	return null;
 }
+const spMetadataQuerySchema = z.object({
+	providerId: z.string(),
+	format: z.enum(["xml", "json"]).default("xml")
+});
 const spMetadata = () => {
 	return createAuthEndpoint("/sso/saml2/sp/metadata", {
 		method: "GET",
-		query: z.object({
-			providerId: z.string(),
-			format: z.enum(["xml", "json"]).default("xml")
-		}),
+		query: spMetadataQuerySchema,
 		metadata: { openapi: {
 			operationId: "getSSOServiceProviderMetadata",
 			summary: "Get Service Provider metadata",
@@ -244,82 +246,83 @@ const spMetadata = () => {
 		return new Response(sp.getMetadata(), { headers: { "Content-Type": "application/xml" } });
 	});
 };
+const ssoProviderBodySchema = z.object({
+	providerId: z.string({}).meta({ description: "The ID of the provider. This is used to identify the provider during login and callback" }),
+	issuer: z.string({}).meta({ description: "The issuer of the provider" }),
+	domain: z.string({}).meta({ description: "The domain of the provider. This is used for email matching" }),
+	oidcConfig: z.object({
+		clientId: z.string({}).meta({ description: "The client ID" }),
+		clientSecret: z.string({}).meta({ description: "The client secret" }),
+		authorizationEndpoint: z.string({}).meta({ description: "The authorization endpoint" }).optional(),
+		tokenEndpoint: z.string({}).meta({ description: "The token endpoint" }).optional(),
+		userInfoEndpoint: z.string({}).meta({ description: "The user info endpoint" }).optional(),
+		tokenEndpointAuthentication: z.enum(["client_secret_post", "client_secret_basic"]).optional(),
+		jwksEndpoint: z.string({}).meta({ description: "The JWKS endpoint" }).optional(),
+		discoveryEndpoint: z.string().optional(),
+		scopes: z.array(z.string(), {}).meta({ description: "The scopes to request. Defaults to ['openid', 'email', 'profile', 'offline_access']" }).optional(),
+		pkce: z.boolean({}).meta({ description: "Whether to use PKCE for the authorization flow" }).default(true).optional(),
+		mapping: z.object({
+			id: z.string({}).meta({ description: "Field mapping for user ID (defaults to 'sub')" }),
+			email: z.string({}).meta({ description: "Field mapping for email (defaults to 'email')" }),
+			emailVerified: z.string({}).meta({ description: "Field mapping for email verification (defaults to 'email_verified')" }).optional(),
+			name: z.string({}).meta({ description: "Field mapping for name (defaults to 'name')" }),
+			image: z.string({}).meta({ description: "Field mapping for image (defaults to 'picture')" }).optional(),
+			extraFields: z.record(z.string(), z.any()).optional()
+		}).optional()
+	}).optional(),
+	samlConfig: z.object({
+		entryPoint: z.string({}).meta({ description: "The entry point of the provider" }),
+		cert: z.string({}).meta({ description: "The certificate of the provider" }),
+		callbackUrl: z.string({}).meta({ description: "The callback URL of the provider" }),
+		audience: z.string().optional(),
+		idpMetadata: z.object({
+			metadata: z.string().optional(),
+			entityID: z.string().optional(),
+			cert: z.string().optional(),
+			privateKey: z.string().optional(),
+			privateKeyPass: z.string().optional(),
+			isAssertionEncrypted: z.boolean().optional(),
+			encPrivateKey: z.string().optional(),
+			encPrivateKeyPass: z.string().optional(),
+			singleSignOnService: z.array(z.object({
+				Binding: z.string().meta({ description: "The binding type for the SSO service" }),
+				Location: z.string().meta({ description: "The URL for the SSO service" })
+			})).optional().meta({ description: "Single Sign-On service configuration" })
+		}).optional(),
+		spMetadata: z.object({
+			metadata: z.string().optional(),
+			entityID: z.string().optional(),
+			binding: z.string().optional(),
+			privateKey: z.string().optional(),
+			privateKeyPass: z.string().optional(),
+			isAssertionEncrypted: z.boolean().optional(),
+			encPrivateKey: z.string().optional(),
+			encPrivateKeyPass: z.string().optional()
+		}),
+		wantAssertionsSigned: z.boolean().optional(),
+		signatureAlgorithm: z.string().optional(),
+		digestAlgorithm: z.string().optional(),
+		identifierFormat: z.string().optional(),
+		privateKey: z.string().optional(),
+		decryptionPvk: z.string().optional(),
+		additionalParams: z.record(z.string(), z.any()).optional(),
+		mapping: z.object({
+			id: z.string({}).meta({ description: "Field mapping for user ID (defaults to 'nameID')" }),
+			email: z.string({}).meta({ description: "Field mapping for email (defaults to 'email')" }),
+			emailVerified: z.string({}).meta({ description: "Field mapping for email verification" }).optional(),
+			name: z.string({}).meta({ description: "Field mapping for name (defaults to 'displayName')" }),
+			firstName: z.string({}).meta({ description: "Field mapping for first name (defaults to 'givenName')" }).optional(),
+			lastName: z.string({}).meta({ description: "Field mapping for last name (defaults to 'surname')" }).optional(),
+			extraFields: z.record(z.string(), z.any()).optional()
+		}).optional()
+	}).optional(),
+	organizationId: z.string({}).meta({ description: "If organization plugin is enabled, the organization id to link the provider to" }).optional(),
+	overrideUserInfo: z.boolean({}).meta({ description: "Override user info with the provider info. Defaults to false" }).default(false).optional()
+});
 const registerSSOProvider = (options) => {
 	return createAuthEndpoint("/sso/register", {
 		method: "POST",
-		body: z.object({
-			providerId: z.string({}).meta({ description: "The ID of the provider. This is used to identify the provider during login and callback" }),
-			issuer: z.string({}).meta({ description: "The issuer of the provider" }),
-			domain: z.string({}).meta({ description: "The domain of the provider. This is used for email matching" }),
-			oidcConfig: z.object({
-				clientId: z.string({}).meta({ description: "The client ID" }),
-				clientSecret: z.string({}).meta({ description: "The client secret" }),
-				authorizationEndpoint: z.string({}).meta({ description: "The authorization endpoint" }).optional(),
-				tokenEndpoint: z.string({}).meta({ description: "The token endpoint" }).optional(),
-				userInfoEndpoint: z.string({}).meta({ description: "The user info endpoint" }).optional(),
-				tokenEndpointAuthentication: z.enum(["client_secret_post", "client_secret_basic"]).optional(),
-				jwksEndpoint: z.string({}).meta({ description: "The JWKS endpoint" }).optional(),
-				discoveryEndpoint: z.string().optional(),
-				scopes: z.array(z.string(), {}).meta({ description: "The scopes to request. Defaults to ['openid', 'email', 'profile', 'offline_access']" }).optional(),
-				pkce: z.boolean({}).meta({ description: "Whether to use PKCE for the authorization flow" }).default(true).optional(),
-				mapping: z.object({
-					id: z.string({}).meta({ description: "Field mapping for user ID (defaults to 'sub')" }),
-					email: z.string({}).meta({ description: "Field mapping for email (defaults to 'email')" }),
-					emailVerified: z.string({}).meta({ description: "Field mapping for email verification (defaults to 'email_verified')" }).optional(),
-					name: z.string({}).meta({ description: "Field mapping for name (defaults to 'name')" }),
-					image: z.string({}).meta({ description: "Field mapping for image (defaults to 'picture')" }).optional(),
-					extraFields: z.record(z.string(), z.any()).optional()
-				}).optional()
-			}).optional(),
-			samlConfig: z.object({
-				entryPoint: z.string({}).meta({ description: "The entry point of the provider" }),
-				cert: z.string({}).meta({ description: "The certificate of the provider" }),
-				callbackUrl: z.string({}).meta({ description: "The callback URL of the provider" }),
-				audience: z.string().optional(),
-				idpMetadata: z.object({
-					metadata: z.string().optional(),
-					entityID: z.string().optional(),
-					cert: z.string().optional(),
-					privateKey: z.string().optional(),
-					privateKeyPass: z.string().optional(),
-					isAssertionEncrypted: z.boolean().optional(),
-					encPrivateKey: z.string().optional(),
-					encPrivateKeyPass: z.string().optional(),
-					singleSignOnService: z.array(z.object({
-						Binding: z.string().meta({ description: "The binding type for the SSO service" }),
-						Location: z.string().meta({ description: "The URL for the SSO service" })
-					})).optional().meta({ description: "Single Sign-On service configuration" })
-				}).optional(),
-				spMetadata: z.object({
-					metadata: z.string().optional(),
-					entityID: z.string().optional(),
-					binding: z.string().optional(),
-					privateKey: z.string().optional(),
-					privateKeyPass: z.string().optional(),
-					isAssertionEncrypted: z.boolean().optional(),
-					encPrivateKey: z.string().optional(),
-					encPrivateKeyPass: z.string().optional()
-				}),
-				wantAssertionsSigned: z.boolean().optional(),
-				signatureAlgorithm: z.string().optional(),
-				digestAlgorithm: z.string().optional(),
-				identifierFormat: z.string().optional(),
-				privateKey: z.string().optional(),
-				decryptionPvk: z.string().optional(),
-				additionalParams: z.record(z.string(), z.any()).optional(),
-				mapping: z.object({
-					id: z.string({}).meta({ description: "Field mapping for user ID (defaults to 'nameID')" }),
-					email: z.string({}).meta({ description: "Field mapping for email (defaults to 'email')" }),
-					emailVerified: z.string({}).meta({ description: "Field mapping for email verification" }).optional(),
-					name: z.string({}).meta({ description: "Field mapping for name (defaults to 'displayName')" }),
-					firstName: z.string({}).meta({ description: "Field mapping for first name (defaults to 'givenName')" }).optional(),
-					lastName: z.string({}).meta({ description: "Field mapping for last name (defaults to 'surname')" }).optional(),
-					extraFields: z.record(z.string(), z.any()).optional()
-				}).optional()
-			}).optional(),
-			organizationId: z.string({}).meta({ description: "If organization plugin is enabled, the organization id to link the provider to" }).optional(),
-			overrideUserInfo: z.boolean({}).meta({ description: "Override user info with the provider info. Defaults to false" }).default(false).optional()
-		}),
+		body: ssoProviderBodySchema,
 		use: [sessionMiddleware],
 		metadata: { openapi: {
 			operationId: "registerSSOProvider",
@@ -592,22 +595,23 @@ const registerSSOProvider = (options) => {
 		});
 	});
 };
+const signInSSOBodySchema = z.object({
+	email: z.string({}).meta({ description: "The email address to sign in with. This is used to identify the issuer to sign in with. It's optional if the issuer is provided" }).optional(),
+	organizationSlug: z.string({}).meta({ description: "The slug of the organization to sign in with" }).optional(),
+	providerId: z.string({}).meta({ description: "The ID of the provider to sign in with. This can be provided instead of email or issuer" }).optional(),
+	domain: z.string({}).meta({ description: "The domain of the provider." }).optional(),
+	callbackURL: z.string({}).meta({ description: "The URL to redirect to after login" }),
+	errorCallbackURL: z.string({}).meta({ description: "The URL to redirect to after login" }).optional(),
+	newUserCallbackURL: z.string({}).meta({ description: "The URL to redirect to after login if the user is new" }).optional(),
+	scopes: z.array(z.string(), {}).meta({ description: "Scopes to request from the provider." }).optional(),
+	loginHint: z.string({}).meta({ description: "Login hint to send to the identity provider (e.g., email or identifier). If supported, will be sent as 'login_hint'." }).optional(),
+	requestSignUp: z.boolean({}).meta({ description: "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider" }).optional(),
+	providerType: z.enum(["oidc", "saml"]).optional()
+});
 const signInSSO = (options) => {
 	return createAuthEndpoint("/sign-in/sso", {
 		method: "POST",
-		body: z.object({
-			email: z.string({}).meta({ description: "The email address to sign in with. This is used to identify the issuer to sign in with. It's optional if the issuer is provided" }).optional(),
-			organizationSlug: z.string({}).meta({ description: "The slug of the organization to sign in with" }).optional(),
-			providerId: z.string({}).meta({ description: "The ID of the provider to sign in with. This can be provided instead of email or issuer" }).optional(),
-			domain: z.string({}).meta({ description: "The domain of the provider." }).optional(),
-			callbackURL: z.string({}).meta({ description: "The URL to redirect to after login" }),
-			errorCallbackURL: z.string({}).meta({ description: "The URL to redirect to after login" }).optional(),
-			newUserCallbackURL: z.string({}).meta({ description: "The URL to redirect to after login if the user is new" }).optional(),
-			scopes: z.array(z.string(), {}).meta({ description: "Scopes to request from the provider." }).optional(),
-			loginHint: z.string({}).meta({ description: "Login hint to send to the identity provider (e.g., email or identifier). If supported, will be sent as 'login_hint'." }).optional(),
-			requestSignUp: z.boolean({}).meta({ description: "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider" }).optional(),
-			providerType: z.enum(["oidc", "saml"]).optional()
-		}),
+		body: signInSSOBodySchema,
 		metadata: { openapi: {
 			operationId: "signInWithSSO",
 			summary: "Sign in with SSO provider",
@@ -781,15 +785,16 @@ const signInSSO = (options) => {
 		throw new APIError("BAD_REQUEST", { message: "Invalid SSO provider" });
 	});
 };
+const callbackSSOQuerySchema = z.object({
+	code: z.string().optional(),
+	state: z.string(),
+	error: z.string().optional(),
+	error_description: z.string().optional()
+});
 const callbackSSO = (options) => {
 	return createAuthEndpoint("/sso/callback/:providerId", {
 		method: "GET",
-		query: z.object({
-			code: z.string().optional(),
-			state: z.string(),
-			error: z.string().optional(),
-			error_description: z.string().optional()
-		}),
+		query: callbackSSOQuerySchema,
 		allowedMediaTypes: ["application/x-www-form-urlencoded", "application/json"],
 		metadata: {
 			isAction: false,
@@ -966,13 +971,14 @@ const callbackSSO = (options) => {
 		throw ctx.redirect(toRedirectTo);
 	});
 };
+const callbackSSOSAMLBodySchema = z.object({
+	SAMLResponse: z.string(),
+	RelayState: z.string().optional()
+});
 const callbackSSOSAML = (options) => {
 	return createAuthEndpoint("/sso/saml2/callback/:providerId", {
 		method: "POST",
-		body: z.object({
-			SAMLResponse: z.string(),
-			RelayState: z.string().optional()
-		}),
+		body: callbackSSOSAMLBodySchema,
 		metadata: {
 			isAction: false,
 			allowedMediaTypes: ["application/x-www-form-urlencoded", "application/json"],
@@ -1186,14 +1192,16 @@ const callbackSSOSAML = (options) => {
 		throw ctx.redirect(callbackUrl);
 	});
 };
+const acsEndpointParamsSchema = z.object({ providerId: z.string().optional() });
+const acsEndpointBodySchema = z.object({
+	SAMLResponse: z.string(),
+	RelayState: z.string().optional()
+});
 const acsEndpoint = (options) => {
 	return createAuthEndpoint("/sso/saml2/sp/acs/:providerId", {
 		method: "POST",
-		params: z.object({ providerId: z.string().optional() }),
-		body: z.object({
-			SAMLResponse: z.string(),
-			RelayState: z.string().optional()
-		}),
+		params: acsEndpointParamsSchema,
+		body: acsEndpointBodySchema,
 		metadata: {
 			isAction: false,
 			allowedMediaTypes: ["application/x-www-form-urlencoded", "application/json"],

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@better-auth/sso",
   "author": "Bereket Engida",
-  "version": "1.4.6-beta.2",
+  "version": "1.4.6-beta.3",
   "type": "module",
   "main": "dist/index.mjs",
   "homepage": "https://www.better-auth.com/docs/plugins/sso",
@@ -64,11 +64,11 @@
     "body-parser": "^2.2.1",
     "express": "^5.1.0",
     "oauth2-mock-server": "^8.2.0",
-    "tsdown": "^0.16.0",
-    "better-auth": "1.4.6-beta.2"
+    "tsdown": "^0.17.0",
+    "better-auth": "1.4.6-beta.3"
   },
   "peerDependencies": {
-    "better-auth": "1.4.6-beta.2"
+    "better-auth": "1.4.6-beta.3"
   },
   "scripts": {
     "test": "vitest",

package/src/routes/domain-verification.ts

@@ -8,14 +8,16 @@ import { generateRandomString } from "better-auth/crypto";
 import * as z from "zod/v4";
 import type { SSOOptions, SSOProvider } from "../types";
 
+const domainVerificationBodySchema = z.object({
+	providerId: z.string(),
+});
+
 export const requestDomainVerification = (options: SSOOptions) => {
 	return createAuthEndpoint(
 		"/sso/request-domain-verification",
 		{
 			method: "POST",
-			body: z.object({
-				providerId: z.string(),
-			}),
+			body: domainVerificationBodySchema,
 			metadata: {
 				openapi: {
 					summary: "Request a domain verification",
@@ -127,9 +129,7 @@ export const verifyDomain = (options: SSOOptions) => {
 		"/sso/verify-domain",
 		{
 			method: "POST",
-			body: z.object({
-				providerId: z.string(),
-			}),
+			body: domainVerificationBodySchema,
 			metadata: {
 				openapi: {
 					summary: "Verify the provider domain ownership",

package/src/routes/sso.ts

@@ -52,15 +52,17 @@ function safeJsonParse<T>(value: string | T | null | undefined): T | null {
 	return null;
 }
 
+const spMetadataQuerySchema = z.object({
+	providerId: z.string(),
+	format: z.enum(["xml", "json"]).default("xml"),
+});
+
 export const spMetadata = () => {
 	return createAuthEndpoint(
 		"/sso/saml2/sp/metadata",
 		{
 			method: "GET",
-			query: z.object({
-				providerId: z.string(),
-				format: z.enum(["xml", "json"]).default("xml"),
-			}),
+			query: spMetadataQuerySchema,
 			metadata: {
 				openapi: {
 					operationId: "getSSOServiceProviderMetadata",
@@ -128,213 +130,211 @@ export const spMetadata = () => {
 	);
 };
 
-export const registerSSOProvider = <O extends SSOOptions>(options: O) => {
-	return createAuthEndpoint(
-		"/sso/register",
-		{
-			method: "POST",
-			body: z.object({
-				providerId: z.string({}).meta({
-					description:
-						"The ID of the provider. This is used to identify the provider during login and callback",
-				}),
-				issuer: z.string({}).meta({
-					description: "The issuer of the provider",
-				}),
-				domain: z.string({}).meta({
+const ssoProviderBodySchema = z.object({
+	providerId: z.string({}).meta({
+		description:
+			"The ID of the provider. This is used to identify the provider during login and callback",
+	}),
+	issuer: z.string({}).meta({
+		description: "The issuer of the provider",
+	}),
+	domain: z.string({}).meta({
+		description: "The domain of the provider. This is used for email matching",
+	}),
+	oidcConfig: z
+		.object({
+			clientId: z.string({}).meta({
+				description: "The client ID",
+			}),
+			clientSecret: z.string({}).meta({
+				description: "The client secret",
+			}),
+			authorizationEndpoint: z
+				.string({})
+				.meta({
+					description: "The authorization endpoint",
+				})
+				.optional(),
+			tokenEndpoint: z
+				.string({})
+				.meta({
+					description: "The token endpoint",
+				})
+				.optional(),
+			userInfoEndpoint: z
+				.string({})
+				.meta({
+					description: "The user info endpoint",
+				})
+				.optional(),
+			tokenEndpointAuthentication: z
+				.enum(["client_secret_post", "client_secret_basic"])
+				.optional(),
+			jwksEndpoint: z
+				.string({})
+				.meta({
+					description: "The JWKS endpoint",
+				})
+				.optional(),
+			discoveryEndpoint: z.string().optional(),
+			scopes: z
+				.array(z.string(), {})
+				.meta({
 					description:
-						"The domain of the provider. This is used for email matching",
-				}),
-				oidcConfig: z
-					.object({
-						clientId: z.string({}).meta({
-							description: "The client ID",
-						}),
-						clientSecret: z.string({}).meta({
-							description: "The client secret",
-						}),
-						authorizationEndpoint: z
-							.string({})
-							.meta({
-								description: "The authorization endpoint",
-							})
-							.optional(),
-						tokenEndpoint: z
-							.string({})
-							.meta({
-								description: "The token endpoint",
-							})
-							.optional(),
-						userInfoEndpoint: z
-							.string({})
-							.meta({
-								description: "The user info endpoint",
-							})
-							.optional(),
-						tokenEndpointAuthentication: z
-							.enum(["client_secret_post", "client_secret_basic"])
-							.optional(),
-						jwksEndpoint: z
-							.string({})
-							.meta({
-								description: "The JWKS endpoint",
-							})
-							.optional(),
-						discoveryEndpoint: z.string().optional(),
-						scopes: z
-							.array(z.string(), {})
-							.meta({
-								description:
-									"The scopes to request. Defaults to ['openid', 'email', 'profile', 'offline_access']",
-							})
-							.optional(),
-						pkce: z
-							.boolean({})
-							.meta({
-								description: "Whether to use PKCE for the authorization flow",
-							})
-							.default(true)
-							.optional(),
-						mapping: z
-							.object({
-								id: z.string({}).meta({
-									description: "Field mapping for user ID (defaults to 'sub')",
-								}),
-								email: z.string({}).meta({
-									description: "Field mapping for email (defaults to 'email')",
+						"The scopes to request. Defaults to ['openid', 'email', 'profile', 'offline_access']",
+				})
+				.optional(),
+			pkce: z
+				.boolean({})
+				.meta({
+					description: "Whether to use PKCE for the authorization flow",
+				})
+				.default(true)
+				.optional(),
+			mapping: z
+				.object({
+					id: z.string({}).meta({
+						description: "Field mapping for user ID (defaults to 'sub')",
+					}),
+					email: z.string({}).meta({
+						description: "Field mapping for email (defaults to 'email')",
+					}),
+					emailVerified: z
+						.string({})
+						.meta({
+							description:
+								"Field mapping for email verification (defaults to 'email_verified')",
+						})
+						.optional(),
+					name: z.string({}).meta({
+						description: "Field mapping for name (defaults to 'name')",
+					}),
+					image: z
+						.string({})
+						.meta({
+							description: "Field mapping for image (defaults to 'picture')",
+						})
+						.optional(),
+					extraFields: z.record(z.string(), z.any()).optional(),
+				})
+				.optional(),
+		})
+		.optional(),
+	samlConfig: z
+		.object({
+			entryPoint: z.string({}).meta({
+				description: "The entry point of the provider",
+			}),
+			cert: z.string({}).meta({
+				description: "The certificate of the provider",
+			}),
+			callbackUrl: z.string({}).meta({
+				description: "The callback URL of the provider",
+			}),
+			audience: z.string().optional(),
+			idpMetadata: z
+				.object({
+					metadata: z.string().optional(),
+					entityID: z.string().optional(),
+					cert: z.string().optional(),
+					privateKey: z.string().optional(),
+					privateKeyPass: z.string().optional(),
+					isAssertionEncrypted: z.boolean().optional(),
+					encPrivateKey: z.string().optional(),
+					encPrivateKeyPass: z.string().optional(),
+					singleSignOnService: z
+						.array(
+							z.object({
+								Binding: z.string().meta({
+									description: "The binding type for the SSO service",
 								}),
-								emailVerified: z
-									.string({})
-									.meta({
-										description:
-											"Field mapping for email verification (defaults to 'email_verified')",
-									})
-									.optional(),
-								name: z.string({}).meta({
-									description: "Field mapping for name (defaults to 'name')",
+								Location: z.string().meta({
+									description: "The URL for the SSO service",
 								}),
-								image: z
-									.string({})
-									.meta({
-										description:
-											"Field mapping for image (defaults to 'picture')",
-									})
-									.optional(),
-								extraFields: z.record(z.string(), z.any()).optional(),
-							})
-							.optional(),
-					})
-					.optional(),
-				samlConfig: z
-					.object({
-						entryPoint: z.string({}).meta({
-							description: "The entry point of the provider",
-						}),
-						cert: z.string({}).meta({
-							description: "The certificate of the provider",
-						}),
-						callbackUrl: z.string({}).meta({
-							description: "The callback URL of the provider",
-						}),
-						audience: z.string().optional(),
-						idpMetadata: z
-							.object({
-								metadata: z.string().optional(),
-								entityID: z.string().optional(),
-								cert: z.string().optional(),
-								privateKey: z.string().optional(),
-								privateKeyPass: z.string().optional(),
-								isAssertionEncrypted: z.boolean().optional(),
-								encPrivateKey: z.string().optional(),
-								encPrivateKeyPass: z.string().optional(),
-								singleSignOnService: z
-									.array(
-										z.object({
-											Binding: z.string().meta({
-												description: "The binding type for the SSO service",
-											}),
-											Location: z.string().meta({
-												description: "The URL for the SSO service",
-											}),
-										}),
-									)
-									.optional()
-									.meta({
-										description: "Single Sign-On service configuration",
-									}),
-							})
-							.optional(),
-						spMetadata: z.object({
-							metadata: z.string().optional(),
-							entityID: z.string().optional(),
-							binding: z.string().optional(),
-							privateKey: z.string().optional(),
-							privateKeyPass: z.string().optional(),
-							isAssertionEncrypted: z.boolean().optional(),
-							encPrivateKey: z.string().optional(),
-							encPrivateKeyPass: z.string().optional(),
+							}),
+						)
+						.optional()
+						.meta({
+							description: "Single Sign-On service configuration",
 						}),
-						wantAssertionsSigned: z.boolean().optional(),
-						signatureAlgorithm: z.string().optional(),
-						digestAlgorithm: z.string().optional(),
-						identifierFormat: z.string().optional(),
-						privateKey: z.string().optional(),
-						decryptionPvk: z.string().optional(),
-						additionalParams: z.record(z.string(), z.any()).optional(),
-						mapping: z
-							.object({
-								id: z.string({}).meta({
-									description:
-										"Field mapping for user ID (defaults to 'nameID')",
-								}),
-								email: z.string({}).meta({
-									description: "Field mapping for email (defaults to 'email')",
-								}),
-								emailVerified: z
-									.string({})
-									.meta({
-										description: "Field mapping for email verification",
-									})
-									.optional(),
-								name: z.string({}).meta({
-									description:
-										"Field mapping for name (defaults to 'displayName')",
-								}),
-								firstName: z
-									.string({})
-									.meta({
-										description:
-											"Field mapping for first name (defaults to 'givenName')",
-									})
-									.optional(),
-								lastName: z
-									.string({})
-									.meta({
-										description:
-											"Field mapping for last name (defaults to 'surname')",
-									})
-									.optional(),
-								extraFields: z.record(z.string(), z.any()).optional(),
-							})
-							.optional(),
-					})
-					.optional(),
-				organizationId: z
-					.string({})
-					.meta({
-						description:
-							"If organization plugin is enabled, the organization id to link the provider to",
-					})
-					.optional(),
-				overrideUserInfo: z
-					.boolean({})
-					.meta({
-						description:
-							"Override user info with the provider info. Defaults to false",
-					})
-					.default(false)
-					.optional(),
+				})
+				.optional(),
+			spMetadata: z.object({
+				metadata: z.string().optional(),
+				entityID: z.string().optional(),
+				binding: z.string().optional(),
+				privateKey: z.string().optional(),
+				privateKeyPass: z.string().optional(),
+				isAssertionEncrypted: z.boolean().optional(),
+				encPrivateKey: z.string().optional(),
+				encPrivateKeyPass: z.string().optional(),
 			}),
+			wantAssertionsSigned: z.boolean().optional(),
+			signatureAlgorithm: z.string().optional(),
+			digestAlgorithm: z.string().optional(),
+			identifierFormat: z.string().optional(),
+			privateKey: z.string().optional(),
+			decryptionPvk: z.string().optional(),
+			additionalParams: z.record(z.string(), z.any()).optional(),
+			mapping: z
+				.object({
+					id: z.string({}).meta({
+						description: "Field mapping for user ID (defaults to 'nameID')",
+					}),
+					email: z.string({}).meta({
+						description: "Field mapping for email (defaults to 'email')",
+					}),
+					emailVerified: z
+						.string({})
+						.meta({
+							description: "Field mapping for email verification",
+						})
+						.optional(),
+					name: z.string({}).meta({
+						description: "Field mapping for name (defaults to 'displayName')",
+					}),
+					firstName: z
+						.string({})
+						.meta({
+							description:
+								"Field mapping for first name (defaults to 'givenName')",
+						})
+						.optional(),
+					lastName: z
+						.string({})
+						.meta({
+							description:
+								"Field mapping for last name (defaults to 'surname')",
+						})
+						.optional(),
+					extraFields: z.record(z.string(), z.any()).optional(),
+				})
+				.optional(),
+		})
+		.optional(),
+	organizationId: z
+		.string({})
+		.meta({
+			description:
+				"If organization plugin is enabled, the organization id to link the provider to",
+		})
+		.optional(),
+	overrideUserInfo: z
+		.boolean({})
+		.meta({
+			description:
+				"Override user info with the provider info. Defaults to false",
+		})
+		.default(false)
+		.optional(),
+});
+
+export const registerSSOProvider = <O extends SSOOptions>(options: O) => {
+	return createAuthEndpoint(
+		"/sso/register",
+		{
+			method: "POST",
+			body: ssoProviderBodySchema,
 			use: [sessionMiddleware],
 			metadata: {
 				openapi: {
@@ -699,76 +699,77 @@ export const registerSSOProvider = <O extends SSOOptions>(options: O) => {
 	);
 };
 
+const signInSSOBodySchema = z.object({
+	email: z
+		.string({})
+		.meta({
+			description:
+				"The email address to sign in with. This is used to identify the issuer to sign in with. It's optional if the issuer is provided",
+		})
+		.optional(),
+	organizationSlug: z
+		.string({})
+		.meta({
+			description: "The slug of the organization to sign in with",
+		})
+		.optional(),
+	providerId: z
+		.string({})
+		.meta({
+			description:
+				"The ID of the provider to sign in with. This can be provided instead of email or issuer",
+		})
+		.optional(),
+	domain: z
+		.string({})
+		.meta({
+			description: "The domain of the provider.",
+		})
+		.optional(),
+	callbackURL: z.string({}).meta({
+		description: "The URL to redirect to after login",
+	}),
+	errorCallbackURL: z
+		.string({})
+		.meta({
+			description: "The URL to redirect to after login",
+		})
+		.optional(),
+	newUserCallbackURL: z
+		.string({})
+		.meta({
+			description: "The URL to redirect to after login if the user is new",
+		})
+		.optional(),
+	scopes: z
+		.array(z.string(), {})
+		.meta({
+			description: "Scopes to request from the provider.",
+		})
+		.optional(),
+	loginHint: z
+		.string({})
+		.meta({
+			description:
+				"Login hint to send to the identity provider (e.g., email or identifier). If supported, will be sent as 'login_hint'.",
+		})
+		.optional(),
+	requestSignUp: z
+		.boolean({})
+		.meta({
+			description:
+				"Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider",
+		})
+		.optional(),
+	providerType: z.enum(["oidc", "saml"]).optional(),
+});
+
 export const signInSSO = (options?: SSOOptions) => {
 	return createAuthEndpoint(
 		"/sign-in/sso",
 		{
 			method: "POST",
-			body: z.object({
-				email: z
-					.string({})
-					.meta({
-						description:
-							"The email address to sign in with. This is used to identify the issuer to sign in with. It's optional if the issuer is provided",
-					})
-					.optional(),
-				organizationSlug: z
-					.string({})
-					.meta({
-						description: "The slug of the organization to sign in with",
-					})
-					.optional(),
-				providerId: z
-					.string({})
-					.meta({
-						description:
-							"The ID of the provider to sign in with. This can be provided instead of email or issuer",
-					})
-					.optional(),
-				domain: z
-					.string({})
-					.meta({
-						description: "The domain of the provider.",
-					})
-					.optional(),
-				callbackURL: z.string({}).meta({
-					description: "The URL to redirect to after login",
-				}),
-				errorCallbackURL: z
-					.string({})
-					.meta({
-						description: "The URL to redirect to after login",
-					})
-					.optional(),
-				newUserCallbackURL: z
-					.string({})
-					.meta({
-						description:
-							"The URL to redirect to after login if the user is new",
-					})
-					.optional(),
-				scopes: z
-					.array(z.string(), {})
-					.meta({
-						description: "Scopes to request from the provider.",
-					})
-					.optional(),
-				loginHint: z
-					.string({})
-					.meta({
-						description:
-							"Login hint to send to the identity provider (e.g., email or identifier). If supported, will be sent as 'login_hint'.",
-					})
-					.optional(),
-				requestSignUp: z
-					.boolean({})
-					.meta({
-						description:
-							"Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider",
-					})
-					.optional(),
-				providerType: z.enum(["oidc", "saml"]).optional(),
-			}),
+			body: signInSSOBodySchema,
 			metadata: {
 				openapi: {
 					operationId: "signInWithSSO",
@@ -1101,17 +1102,19 @@ export const signInSSO = (options?: SSOOptions) => {
 	);
 };
 
+const callbackSSOQuerySchema = z.object({
+	code: z.string().optional(),
+	state: z.string(),
+	error: z.string().optional(),
+	error_description: z.string().optional(),
+});
+
 export const callbackSSO = (options?: SSOOptions) => {
 	return createAuthEndpoint(
 		"/sso/callback/:providerId",
 		{
 			method: "GET",
-			query: z.object({
-				code: z.string().optional(),
-				state: z.string(),
-				error: z.string().optional(),
-				error_description: z.string().optional(),
-			}),
+			query: callbackSSOQuerySchema,
 			allowedMediaTypes: [
 				"application/x-www-form-urlencoded",
 				"application/json",
@@ -1468,15 +1471,17 @@ export const callbackSSO = (options?: SSOOptions) => {
 	);
 };
 
+const callbackSSOSAMLBodySchema = z.object({
+	SAMLResponse: z.string(),
+	RelayState: z.string().optional(),
+});
+
 export const callbackSSOSAML = (options?: SSOOptions) => {
 	return createAuthEndpoint(
 		"/sso/saml2/callback/:providerId",
 		{
 			method: "POST",
-			body: z.object({
-				SAMLResponse: z.string(),
-				RelayState: z.string().optional(),
-			}),
+			body: callbackSSOSAMLBodySchema,
 			metadata: {
 				isAction: false,
 				allowedMediaTypes: [
@@ -1815,18 +1820,22 @@ export const callbackSSOSAML = (options?: SSOOptions) => {
 	);
 };
 
+const acsEndpointParamsSchema = z.object({
+	providerId: z.string().optional(),
+});
+
+const acsEndpointBodySchema = z.object({
+	SAMLResponse: z.string(),
+	RelayState: z.string().optional(),
+});
+
 export const acsEndpoint = (options?: SSOOptions) => {
 	return createAuthEndpoint(
 		"/sso/saml2/sp/acs/:providerId",
 		{
 			method: "POST",
-			params: z.object({
-				providerId: z.string().optional(),
-			}),
-			body: z.object({
-				SAMLResponse: z.string(),
-				RelayState: z.string().optional(),
-			}),
+			params: acsEndpointParamsSchema,
+			body: acsEndpointBodySchema,
 			metadata: {
 				isAction: false,
 				allowedMediaTypes: [