@better-auth/sso 1.4.8-beta.3 → 1.4.8-beta.4

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @better-auth/sso@1.4.8-beta.3 build /home/runner/work/better-auth/better-auth/packages/sso
+> @better-auth/sso@1.4.8-beta.4 build /home/runner/work/better-auth/better-auth/packages/sso
 > tsdown
 
 ℹ tsdown v0.17.2 powered by rolldown v1.0.0-beta.53
@@ -7,10 +7,10 @@
 ℹ entry: src/index.ts, src/client.ts
 ℹ tsconfig: tsconfig.json
 ℹ Build start
-ℹ dist/index.mjs             92.45 kB │ gzip: 18.08 kB
+ℹ dist/index.mjs             92.65 kB │ gzip: 18.13 kB
 ℹ dist/client.mjs             0.15 kB │ gzip:  0.14 kB
 ℹ dist/index.d.mts            1.48 kB │ gzip:  0.51 kB
 ℹ dist/client.d.mts           0.49 kB │ gzip:  0.30 kB
 ℹ dist/index-DNWhGQW-.d.mts  42.86 kB │ gzip:  8.79 kB
-ℹ 5 files, total: 137.43 kB
-✔ Build complete in 11758ms
+ℹ 5 files, total: 137.63 kB
+✔ Build complete in 11934ms

package/dist/index.mjs

@@ -55,17 +55,22 @@ async function assignOrganizationFromProvider(ctx, options) {
 * (e.g., Google OAuth with @acme.com email gets added to Acme's org).
 */
 async function assignOrganizationByDomain(ctx, options) {
-	const { user, provisioningOptions } = options;
+	const { user, provisioningOptions, domainVerification } = options;
 	if (provisioningOptions?.disabled) return;
 	if (!ctx.context.options.plugins?.find((plugin) => plugin.id === "organization")) return;
 	const domain = user.email.split("@")[1];
 	if (!domain) return;
+	const whereClause = [{
+		field: "domain",
+		value: domain
+	}];
+	if (domainVerification?.enabled) whereClause.push({
+		field: "domainVerified",
+		value: true
+	});
 	const ssoProvider = await ctx.context.adapter.findOne({
 		model: "ssoProvider",
-		where: [{
-			field: "domain",
-			value: domain
-		}]
+		where: whereClause
 	});
 	if (!ssoProvider || !ssoProvider.organizationId) return;
 	if (await ctx.context.adapter.findOne({
@@ -2203,7 +2208,8 @@ function sso(options) {
 				if (!ctx.context.options.plugins?.find((plugin) => plugin.id === "organization")) return;
 				await assignOrganizationByDomain(ctx, {
 					user: newSession.user,
-					provisioningOptions: options?.organizationProvisioning
+					provisioningOptions: options?.organizationProvisioning,
+					domainVerification: options?.domainVerification
 				});
 			})
 		}] },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@better-auth/sso",
   "author": "Bereket Engida",
-  "version": "1.4.8-beta.3",
+  "version": "1.4.8-beta.4",
   "type": "module",
   "main": "dist/index.mjs",
   "types": "dist/index.d.mts",
@@ -66,10 +66,10 @@
     "express": "^5.1.0",
     "oauth2-mock-server": "^8.2.0",
     "tsdown": "^0.17.2",
-    "better-auth": "1.4.8-beta.3"
+    "better-auth": "1.4.8-beta.4"
   },
   "peerDependencies": {
-    "better-auth": "1.4.8-beta.3"
+    "better-auth": "1.4.8-beta.4"
   },
   "scripts": {
     "test": "vitest",

package/src/index.ts

@@ -156,6 +156,7 @@ export function sso<O extends SSOOptions>(options?: O | undefined): any {
 						await assignOrganizationByDomain(ctx, {
 							user: newSession.user,
 							provisioningOptions: options?.organizationProvisioning,
+							domainVerification: options?.domainVerification,
 						});
 					}),
 				},

package/src/linking/org-assignment.test.ts

@@ -0,0 +1,325 @@
+import type { GenericEndpointContext, User } from "better-auth";
+import { betterAuth } from "better-auth";
+import { memoryAdapter } from "better-auth/adapters/memory";
+import { organization } from "better-auth/plugins";
+import { describe, expect, it } from "vitest";
+import { sso } from "..";
+import { assignOrganizationByDomain } from "./org-assignment";
+
+describe("assignOrganizationByDomain", () => {
+	const createTestContext = () => {
+		const data = {
+			user: [] as User[],
+			session: [] as { id: string }[],
+			account: [] as { id: string }[],
+			ssoProvider: [] as {
+				id: string;
+				providerId: string;
+				issuer: string;
+				domain: string;
+				domainVerified: boolean;
+				organizationId: string | null;
+				userId: string;
+			}[],
+			member: [] as {
+				id: string;
+				organizationId: string;
+				userId: string;
+				role: string;
+				createdAt: Date;
+			}[],
+			organization: [] as {
+				id: string;
+				name: string;
+				slug: string;
+				createdAt: Date;
+			}[],
+		};
+
+		const memory = memoryAdapter(data);
+
+		const auth = betterAuth({
+			database: memory,
+			baseURL: "http://localhost:3000",
+			emailAndPassword: {
+				enabled: true,
+			},
+			plugins: [
+				sso({
+					domainVerification: {
+						enabled: true,
+					},
+				}),
+				organization(),
+			],
+		});
+
+		const createContext = async () => {
+			const context = await auth.$context;
+			return { context } as Partial<GenericEndpointContext>;
+		};
+
+		return { auth, data, createContext };
+	};
+
+	const createUser = (overrides: Partial<User> = {}): User => ({
+		id: "user-1",
+		email: "alice@example.com",
+		name: "Alice",
+		emailVerified: true,
+		createdAt: new Date(),
+		updatedAt: new Date(),
+		...overrides,
+	});
+
+	const createOrg = (
+		overrides: Partial<{ id: string; name: string; slug: string }> = {},
+	) => ({
+		id: "org-1",
+		name: "Test Org",
+		slug: "test-org",
+		createdAt: new Date(),
+		...overrides,
+	});
+
+	const createProvider = (
+		overrides: Partial<{
+			id: string;
+			providerId: string;
+			issuer: string;
+			domain: string;
+			domainVerified: boolean;
+			organizationId: string | null;
+			userId: string;
+		}> = {},
+	) => ({
+		id: "provider-1",
+		providerId: "test-provider",
+		issuer: "https://idp.example.com",
+		domain: "example.com",
+		domainVerified: false,
+		organizationId: "org-1" as string | null,
+		userId: "user-1",
+		...overrides,
+	});
+
+	it("should NOT assign user to org when provider domain is unverified", async () => {
+		const { data, createContext } = createTestContext();
+
+		data.organization.push(createOrg());
+		data.ssoProvider.push(createProvider({ domainVerified: false }));
+
+		const user = createUser();
+		data.user.push(user);
+
+		const ctx = (await createContext()) as GenericEndpointContext;
+		await assignOrganizationByDomain(ctx, {
+			user,
+			domainVerification: { enabled: true },
+		});
+
+		const members = data.member.filter((m) => m.userId === user.id);
+		expect(members).toHaveLength(0);
+	});
+
+	it("should assign user to org when provider domain is verified", async () => {
+		const { data, createContext } = createTestContext();
+
+		const org = createOrg();
+		data.organization.push(org);
+		data.ssoProvider.push(
+			createProvider({ domainVerified: true, organizationId: org.id }),
+		);
+
+		const user = createUser();
+		data.user.push(user);
+
+		const ctx = (await createContext()) as GenericEndpointContext;
+		await assignOrganizationByDomain(ctx, {
+			user,
+			domainVerification: { enabled: true },
+		});
+
+		const members = data.member.filter((m) => m.userId === user.id);
+		expect(members).toHaveLength(1);
+		expect(members[0]?.organizationId).toBe(org.id);
+		expect(members[0]?.role).toBe("member");
+	});
+
+	it("should NOT assign user when email domain does not match any provider", async () => {
+		const { data, createContext } = createTestContext();
+
+		data.organization.push(createOrg());
+		data.ssoProvider.push(createProvider({ domainVerified: true }));
+
+		const user = createUser({ email: "alice@other-domain.com" });
+		data.user.push(user);
+
+		const ctx = (await createContext()) as GenericEndpointContext;
+		await assignOrganizationByDomain(ctx, {
+			user,
+			domainVerification: { enabled: true },
+		});
+
+		const members = data.member.filter((m) => m.userId === user.id);
+		expect(members).toHaveLength(0);
+	});
+
+	it("should NOT assign user when provider has no organizationId", async () => {
+		const { data, createContext } = createTestContext();
+
+		data.ssoProvider.push(
+			createProvider({ domainVerified: true, organizationId: null }),
+		);
+
+		const user = createUser();
+		data.user.push(user);
+
+		const ctx = (await createContext()) as GenericEndpointContext;
+		await assignOrganizationByDomain(ctx, {
+			user,
+			domainVerification: { enabled: true },
+		});
+
+		const members = data.member.filter((m) => m.userId === user.id);
+		expect(members).toHaveLength(0);
+	});
+
+	it("should NOT assign user when provider has no domainVerified field (verification enabled)", async () => {
+		const { data, createContext } = createTestContext();
+
+		const org = createOrg();
+		data.organization.push(org);
+
+		data.ssoProvider.push({
+			id: "provider-1",
+			providerId: "test-provider",
+			issuer: "https://idp.example.com",
+			domain: "example.com",
+			organizationId: org.id,
+			userId: "user-1",
+		} as {
+			id: string;
+			providerId: string;
+			issuer: string;
+			domain: string;
+			domainVerified: boolean;
+			organizationId: string | null;
+			userId: string;
+		});
+
+		const user = createUser();
+		data.user.push(user);
+
+		const ctx = (await createContext()) as GenericEndpointContext;
+		await assignOrganizationByDomain(ctx, {
+			user,
+			domainVerification: { enabled: true },
+		});
+
+		const members = data.member.filter((m) => m.userId === user.id);
+		expect(members).toHaveLength(0);
+	});
+
+	it("should assign user when verification is disabled (no domainVerified check)", async () => {
+		const { data, createContext } = createTestContext();
+
+		const org = createOrg();
+		data.organization.push(org);
+		data.ssoProvider.push(
+			createProvider({ domainVerified: false, organizationId: org.id }),
+		);
+
+		const user = createUser();
+		data.user.push(user);
+
+		const ctx = (await createContext()) as GenericEndpointContext;
+		await assignOrganizationByDomain(ctx, {
+			user,
+			domainVerification: { enabled: false },
+		});
+
+		const members = data.member.filter((m) => m.userId === user.id);
+		expect(members).toHaveLength(1);
+		expect(members[0]?.organizationId).toBe(org.id);
+	});
+
+	it("should NOT assign user when already a member of the org", async () => {
+		const { data, createContext } = createTestContext();
+
+		const org = createOrg();
+		data.organization.push(org);
+		data.ssoProvider.push(
+			createProvider({ domainVerified: true, organizationId: org.id }),
+		);
+
+		const user = createUser();
+		data.user.push(user);
+
+		data.member.push({
+			id: "member-1",
+			organizationId: org.id,
+			userId: user.id,
+			role: "admin",
+			createdAt: new Date(),
+		});
+
+		const ctx = (await createContext()) as GenericEndpointContext;
+		await assignOrganizationByDomain(ctx, {
+			user,
+			domainVerification: { enabled: true },
+		});
+
+		const members = data.member.filter((m) => m.userId === user.id);
+		expect(members).toHaveLength(1);
+		expect(members[0]?.role).toBe("admin");
+	});
+
+	it("should only find verified provider when multiple providers claim same domain", async () => {
+		const { data, createContext } = createTestContext();
+
+		const legitOrg = createOrg({
+			id: "legit-org",
+			name: "Legit Org",
+			slug: "legit-org",
+		});
+		const attackerOrg = createOrg({
+			id: "attacker-org",
+			name: "Attacker Org",
+			slug: "attacker-org",
+		});
+		data.organization.push(legitOrg, attackerOrg);
+
+		data.ssoProvider.push(
+			createProvider({
+				id: "attacker-provider",
+				providerId: "attacker-provider",
+				issuer: "https://attacker.com",
+				domainVerified: false,
+				organizationId: attackerOrg.id,
+			}),
+		);
+
+		data.ssoProvider.push(
+			createProvider({
+				id: "legit-provider",
+				providerId: "legit-provider",
+				domainVerified: true,
+				organizationId: legitOrg.id,
+			}),
+		);
+
+		const user = createUser();
+		data.user.push(user);
+
+		const ctx = (await createContext()) as GenericEndpointContext;
+		await assignOrganizationByDomain(ctx, {
+			user,
+			domainVerification: { enabled: true },
+		});
+
+		const members = data.member.filter((m) => m.userId === user.id);
+		expect(members).toHaveLength(1);
+		expect(members[0]?.organizationId).toBe(legitOrg.id);
+	});
+});

package/src/linking/org-assignment.ts

@@ -82,6 +82,9 @@ export async function assignOrganizationFromProvider(
 export interface AssignOrganizationByDomainOptions {
 	user: User;
 	provisioningOptions?: OrganizationProvisioningOptions;
+	domainVerification?: {
+		enabled?: boolean;
+	};
 }
 
 /**
@@ -96,7 +99,7 @@ export async function assignOrganizationByDomain(
 	ctx: GenericEndpointContext,
 	options: AssignOrganizationByDomainOptions,
 ): Promise<void> {
-	const { user, provisioningOptions } = options;
+	const { user, provisioningOptions, domainVerification } = options;
 
 	if (provisioningOptions?.disabled) {
 		return;
@@ -115,11 +118,19 @@ export async function assignOrganizationByDomain(
 		return;
 	}
 
+	const whereClause: { field: string; value: string | boolean }[] = [
+		{ field: "domain", value: domain },
+	];
+
+	if (domainVerification?.enabled) {
+		whereClause.push({ field: "domainVerified", value: true });
+	}
+
 	const ssoProvider = await ctx.context.adapter.findOne<
 		SSOProvider<SSOOptions>
 	>({
 		model: "ssoProvider",
-		where: [{ field: "domain", value: domain }],
+		where: whereClause,
 	});
 
 	if (!ssoProvider || !ssoProvider.organizationId) {