@better-auth/sso 1.5.1 → 1.5.3

package/dist/index.mjs

@@ -270,31 +270,16 @@ const requestDomainVerification = (options) => {
 			code: "DOMAIN_VERIFIED"
 		});
 		const identifier = getVerificationIdentifier(options, provider.providerId);
-		const activeVerification = await ctx.context.adapter.findOne({
-			model: "verification",
-			where: [{
-				field: "identifier",
-				value: identifier
-			}, {
-				field: "expiresAt",
-				value: /* @__PURE__ */ new Date(),
-				operator: "gt"
-			}]
-		});
-		if (activeVerification) {
+		const activeVerification = await ctx.context.internalAdapter.findVerificationValue(identifier);
+		if (activeVerification && new Date(activeVerification.expiresAt) > /* @__PURE__ */ new Date()) {
 			ctx.setStatus(201);
 			return ctx.json({ domainVerificationToken: activeVerification.value });
 		}
 		const domainVerificationToken = generateRandomString(24);
-		await ctx.context.adapter.create({
-			model: "verification",
-			data: {
-				identifier,
-				createdAt: /* @__PURE__ */ new Date(),
-				updatedAt: /* @__PURE__ */ new Date(),
-				value: domainVerificationToken,
-				expiresAt: new Date(Date.now() + 3600 * 24 * 7 * 1e3)
-			}
+		await ctx.context.internalAdapter.createVerificationValue({
+			identifier,
+			value: domainVerificationToken,
+			expiresAt: new Date(Date.now() + 3600 * 24 * 7 * 1e3)
 		});
 		ctx.setStatus(201);
 		return ctx.json({ domainVerificationToken });
@@ -353,18 +338,8 @@ const verifyDomain = (options) => {
 			message: `Verification identifier exceeds the DNS label limit of ${DNS_LABEL_MAX_LENGTH} characters`,
 			code: "IDENTIFIER_TOO_LONG"
 		});
-		const activeVerification = await ctx.context.adapter.findOne({
-			model: "verification",
-			where: [{
-				field: "identifier",
-				value: identifier
-			}, {
-				field: "expiresAt",
-				value: /* @__PURE__ */ new Date(),
-				operator: "gt"
-			}]
-		});
-		if (!activeVerification) throw new APIError("NOT_FOUND", {
+		const activeVerification = await ctx.context.internalAdapter.findVerificationValue(identifier);
+		if (!activeVerification || new Date(activeVerification.expiresAt) <= /* @__PURE__ */ new Date()) throw new APIError("NOT_FOUND", {
 			message: "No pending domain verification exists",
 			code: "NO_PENDING_VERIFICATION"
 		});
@@ -2030,15 +2005,10 @@ const registerSSOProvider = (options) => {
 		if (options?.domainVerification?.enabled) {
 			domainVerified = false;
 			domainVerificationToken = generateRandomString(24);
-			await ctx.context.adapter.create({
-				model: "verification",
-				data: {
-					identifier: getVerificationIdentifier(options, provider.providerId),
-					createdAt: /* @__PURE__ */ new Date(),
-					updatedAt: /* @__PURE__ */ new Date(),
-					value: domainVerificationToken,
-					expiresAt: new Date(Date.now() + 3600 * 24 * 7 * 1e3)
-				}
+			await ctx.context.internalAdapter.createVerificationValue({
+				identifier: getVerificationIdentifier(options, provider.providerId),
+				value: domainVerificationToken,
+				expiresAt: new Date(Date.now() + 3600 * 24 * 7 * 1e3)
 			});
 		}
 		const result = {
@@ -2374,7 +2344,20 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 	});
 	if (!tokenResponse) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=token_response_not_found`);
 	let userInfo = null;
-	if (tokenResponse.idToken) {
+	const mapping = config.mapping || {};
+	if (config.userInfoEndpoint) {
+		const userInfoResponse = await betterFetch(config.userInfoEndpoint, { headers: { Authorization: `Bearer ${tokenResponse.accessToken}` } });
+		if (userInfoResponse.error) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=${userInfoResponse.error.message}`);
+		const rawUserInfo = userInfoResponse.data;
+		userInfo = {
+			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, rawUserInfo[value]])),
+			id: rawUserInfo[mapping.id || "sub"],
+			email: rawUserInfo[mapping.email || "email"],
+			emailVerified: options?.trustEmailVerified ? rawUserInfo[mapping.emailVerified || "email_verified"] : false,
+			name: rawUserInfo[mapping.name || "name"],
+			image: rawUserInfo[mapping.image || "picture"]
+		};
+	} else if (tokenResponse.idToken) {
 		const idToken = decodeJwt(tokenResponse.idToken);
 		if (!config.jwksEndpoint) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=jwks_endpoint_not_found`);
 		const verified = await validateToken(tokenResponse.idToken, config.jwksEndpoint, {
@@ -2385,7 +2368,6 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 			return null;
 		});
 		if (!verified) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=token_not_verified`);
-		const mapping = config.mapping || {};
 		userInfo = {
 			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, verified.payload[value]])),
 			id: idToken[mapping.id || "sub"],
@@ -2394,13 +2376,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 			name: idToken[mapping.name || "name"],
 			image: idToken[mapping.image || "picture"]
 		};
-	}
-	if (!userInfo) {
-		if (!config.userInfoEndpoint) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=user_info_endpoint_not_found`);
-		const userInfoResponse = await betterFetch(config.userInfoEndpoint, { headers: { Authorization: `Bearer ${tokenResponse.accessToken}` } });
-		if (userInfoResponse.error) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=${userInfoResponse.error.message}`);
-		userInfo = userInfoResponse.data;
-	}
+	} else throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=user_info_endpoint_not_found`);
 	if (!userInfo.email || !userInfo.id) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=missing_user_info`);
 	const isTrustedProvider = "domainVerified" in provider && provider.domainVerified === true && validateEmailDomain(userInfo.email, provider.domain);
 	const linked = await handleOAuthUserInfo(ctx, {