@better-auth/sso 1.5.1 → 1.5.2

package/dist/index.mjs

@@ -2374,7 +2374,20 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 	});
 	if (!tokenResponse) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=token_response_not_found`);
 	let userInfo = null;
-	if (tokenResponse.idToken) {
+	const mapping = config.mapping || {};
+	if (config.userInfoEndpoint) {
+		const userInfoResponse = await betterFetch(config.userInfoEndpoint, { headers: { Authorization: `Bearer ${tokenResponse.accessToken}` } });
+		if (userInfoResponse.error) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=${userInfoResponse.error.message}`);
+		const rawUserInfo = userInfoResponse.data;
+		userInfo = {
+			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, rawUserInfo[value]])),
+			id: rawUserInfo[mapping.id || "sub"],
+			email: rawUserInfo[mapping.email || "email"],
+			emailVerified: options?.trustEmailVerified ? rawUserInfo[mapping.emailVerified || "email_verified"] : false,
+			name: rawUserInfo[mapping.name || "name"],
+			image: rawUserInfo[mapping.image || "picture"]
+		};
+	} else if (tokenResponse.idToken) {
 		const idToken = decodeJwt(tokenResponse.idToken);
 		if (!config.jwksEndpoint) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=jwks_endpoint_not_found`);
 		const verified = await validateToken(tokenResponse.idToken, config.jwksEndpoint, {
@@ -2385,7 +2398,6 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 			return null;
 		});
 		if (!verified) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=token_not_verified`);
-		const mapping = config.mapping || {};
 		userInfo = {
 			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, verified.payload[value]])),
 			id: idToken[mapping.id || "sub"],
@@ -2394,13 +2406,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 			name: idToken[mapping.name || "name"],
 			image: idToken[mapping.image || "picture"]
 		};
-	}
-	if (!userInfo) {
-		if (!config.userInfoEndpoint) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=user_info_endpoint_not_found`);
-		const userInfoResponse = await betterFetch(config.userInfoEndpoint, { headers: { Authorization: `Bearer ${tokenResponse.accessToken}` } });
-		if (userInfoResponse.error) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=${userInfoResponse.error.message}`);
-		userInfo = userInfoResponse.data;
-	}
+	} else throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=user_info_endpoint_not_found`);
 	if (!userInfo.email || !userInfo.id) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=missing_user_info`);
 	const isTrustedProvider = "domainVerified" in provider && provider.domainVerified === true && validateEmailDomain(userInfo.email, provider.domain);
 	const linked = await handleOAuthUserInfo(ctx, {