@better-auth/sso 1.5.0-beta.18 → 1.5.0-beta.19

package/README.md

@@ -0,0 +1,17 @@
+# Better Auth SSO Plugin
+
+Single Sign-On plugin for [Better Auth](https://www.better-auth.com) — add SAML and OIDC enterprise SSO to your application.
+
+## Installation
+
+```bash
+npm install @better-auth/sso
+```
+
+## Documentation
+
+For full documentation, visit [better-auth.com/docs/plugins/sso](https://www.better-auth.com/docs/plugins/sso).
+
+## License
+
+MIT

package/package.json

@@ -1,34 +1,37 @@
 {
   "name": "@better-auth/sso",
-  "author": "Bereket Engida",
-  "version": "1.5.0-beta.18",
+  "version": "1.5.0-beta.19",
+  "description": "SSO plugin for Better Auth",
   "type": "module",
-  "main": "dist/index.mjs",
-  "types": "dist/index.d.mts",
+  "license": "MIT",
   "homepage": "https://www.better-auth.com/docs/plugins/sso",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/better-auth/better-auth.git",
     "directory": "packages/sso"
   },
-  "license": "MIT",
+  "author": "Bereket Engida",
   "keywords": [
     "sso",
     "auth",
-    "sso",
     "saml",
     "oauth",
     "oidc",
     "openid",
     "openid connect",
-    "openid connect",
-    "single sign on"
+    "single sign on",
+    "typescript",
+    "better-auth"
   ],
   "publishConfig": {
     "access": "public"
   },
-  "module": "dist/index.mjs",
-  "description": "SSO plugin for Better Auth",
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.mjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
   "exports": {
     ".": {
       "dev-source": "./src/index.ts",
@@ -67,22 +70,22 @@
     "express": "^5.2.1",
     "oauth2-mock-server": "^8.2.1",
     "tsdown": "^0.20.3",
-    "@better-auth/core": "1.5.0-beta.18",
-    "better-auth": "1.5.0-beta.18"
+    "@better-auth/core": "1.5.0-beta.19",
+    "better-auth": "1.5.0-beta.19"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.3.1",
     "better-call": "1.3.2",
-    "@better-auth/core": "1.5.0-beta.18",
-    "better-auth": "1.5.0-beta.18"
+    "@better-auth/core": "1.5.0-beta.19",
+    "better-auth": "1.5.0-beta.19"
   },
   "scripts": {
-    "test": "vitest",
-    "coverage": "vitest run --coverage --coverage.provider=istanbul",
-    "lint:package": "publint run --strict",
-    "lint:types": "attw --profile esm-only --pack .",
     "build": "tsdown",
     "dev": "tsdown --watch",
-    "typecheck": "tsc --project tsconfig.json"
+    "lint:package": "publint run --strict",
+    "lint:types": "attw --profile esm-only --pack .",
+    "typecheck": "tsc --project tsconfig.json",
+    "test": "vitest",
+    "coverage": "vitest run --coverage --coverage.provider=istanbul"
   }
 }

package/.turbo/turbo-build.log

@@ -1,20 +0,0 @@
-
-> @better-auth/sso@1.5.0-beta.18 build /home/runner/work/better-auth/better-auth/packages/sso
-> tsdown
-
-ℹ tsdown v0.20.3 powered by rolldown v1.0.0-rc.3
-ℹ config file: /home/runner/work/better-auth/better-auth/packages/sso/tsdown.config.ts 
-ℹ entry: src/index.ts, src/client.ts
-ℹ tsconfig: tsconfig.json
-ℹ Build start
-ℹ dist/index.mjs             139.98 kB │ gzip: 27.81 kB
-ℹ dist/client.mjs              0.27 kB │ gzip:  0.21 kB
-ℹ dist/index.mjs.map         280.84 kB │ gzip: 53.93 kB
-ℹ dist/client.mjs.map          0.93 kB │ gzip:  0.50 kB
-ℹ dist/index.d.mts             3.79 kB │ gzip:  1.20 kB
-ℹ dist/client.d.mts            0.63 kB │ gzip:  0.36 kB
-ℹ dist/index-CbKvQr9M.d.mts   58.40 kB │ gzip: 10.28 kB
-ℹ 7 files, total: 484.83 kB
-[PLUGIN_TIMINGS] Warning: Your build spent significant time in plugin `rolldown-plugin-dts:generate`. See https://rolldown.rs/options/checks#plugintimings for more details.
-
-✔ Build complete in 34748ms

package/src/client.ts

@@ -1,29 +0,0 @@
-import type { BetterAuthClientPlugin } from "better-auth/client";
-import type { SSOPlugin } from "./index";
-
-interface SSOClientOptions {
-	domainVerification?:
-		| {
-				enabled: boolean;
-		  }
-		| undefined;
-}
-
-export const ssoClient = <CO extends SSOClientOptions>(
-	options?: CO | undefined,
-) => {
-	return {
-		id: "sso-client",
-		$InferServerPlugin: {} as SSOPlugin<{
-			domainVerification: {
-				enabled: CO["domainVerification"] extends { enabled: true }
-					? true
-					: false;
-			};
-		}>,
-		pathMethods: {
-			"/sso/providers": "GET",
-			"/sso/get-provider": "GET",
-		},
-	} satisfies BetterAuthClientPlugin;
-};

package/src/constants.ts

@@ -1,79 +0,0 @@
-/**
- * SAML Constants
- *
- * Centralized constants for SAML SSO functionality.
- */
-
-// ============================================================================
-// Key Prefixes (for verification table storage)
-// ============================================================================
-
-/** Prefix for AuthnRequest IDs used in InResponseTo validation */
-export const AUTHN_REQUEST_KEY_PREFIX = "saml-authn-request:";
-
-/** Prefix for used Assertion IDs used in replay protection */
-export const USED_ASSERTION_KEY_PREFIX = "saml-used-assertion:";
-
-/** Prefix for SAML session data (NameID + SessionIndex) for SLO */
-export const SAML_SESSION_KEY_PREFIX = "saml-session:";
-
-/** Prefix for reverse lookup of SAML session by Better Auth session ID */
-export const SAML_SESSION_BY_ID_PREFIX = "saml-session-by-id:";
-
-/** Prefix for LogoutRequest IDs used in SP-initiated SLO validation */
-export const LOGOUT_REQUEST_KEY_PREFIX = "saml-logout-request:";
-
-// ============================================================================
-// Time-To-Live (TTL) Defaults
-// ============================================================================
-
-/**
- * Default TTL for AuthnRequest records (5 minutes).
- * This should be sufficient for most IdPs while protecting against stale requests.
- */
-export const DEFAULT_AUTHN_REQUEST_TTL_MS = 5 * 60 * 1000;
-
-/**
- * Default TTL for used assertion records (15 minutes).
- * This should match the maximum expected NotOnOrAfter window plus clock skew.
- */
-export const DEFAULT_ASSERTION_TTL_MS = 15 * 60 * 1000;
-
-/**
- * Default TTL for LogoutRequest records (5 minutes).
- * Should be sufficient for IdP to process and respond.
- */
-export const DEFAULT_LOGOUT_REQUEST_TTL_MS = 5 * 60 * 1000;
-
-/**
- * Default clock skew tolerance (5 minutes).
- * Allows for minor time differences between IdP and SP servers.
- *
- * Accommodates:
- * - Network latency and processing time
- * - Clock synchronization differences (NTP drift)
- * - Distributed systems across timezones
- */
-export const DEFAULT_CLOCK_SKEW_MS = 5 * 60 * 1000;
-
-// ============================================================================
-// Size Limits (DoS Protection)
-// ============================================================================
-
-/**
- * Default maximum size for SAML responses (256 KB).
- * Protects against memory exhaustion from oversized SAML payloads.
- */
-export const DEFAULT_MAX_SAML_RESPONSE_SIZE = 256 * 1024;
-
-/**
- * Default maximum size for IdP metadata (100 KB).
- * Protects against oversized metadata documents.
- */
-export const DEFAULT_MAX_SAML_METADATA_SIZE = 100 * 1024;
-
-// ============================================================================
-// SAML Status Codes
-// ============================================================================
-
-export const SAML_STATUS_SUCCESS = "urn:oasis:names:tc:SAML:2.0:status:Success";