@better-auth/sso 1.6.19 → 1.6.21

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BBOVUjFi.mjs";
+import { t as PACKAGE_VERSION } from "./version-CSXTsU_C.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/index.mjs

@@ -1,10 +1,11 @@
-import { t as PACKAGE_VERSION } from "./version-BBOVUjFi.mjs";
+import { t as PACKAGE_VERSION } from "./version-CSXTsU_C.mjs";
 import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
 import { getHostname } from "tldts";
 import { generateRandomString } from "better-auth/crypto";
 import * as z from "zod";
+import { getCurrentAdapter, runWithTransaction } from "@better-auth/core/context";
 import { classifyHost, isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { BetterFetchError, betterFetch } from "@better-fetch/fetch";
 import { base64 } from "@better-auth/utils/base64";
@@ -80,8 +81,10 @@ function safeJsonParse(value) {
 * Checks if a domain matches any domain in a comma-separated list.
 */
 const domainMatches = (searchDomain, domainList) => {
-	const search = searchDomain.toLowerCase();
-	return domainList.split(",").map((d) => d.trim().toLowerCase()).filter(Boolean).some((d) => search === d || search.endsWith(`.${d}`));
+	const search = searchDomain.trim().toLowerCase();
+	const domains = parseProviderDomains(domainList);
+	if (!search || !domains) return false;
+	return domains.some((domain) => search === domain || search.endsWith(`.${domain}`));
 };
 /**
 * Strictly parse a provider-supplied email-verification claim.
@@ -118,6 +121,24 @@ function normalizePem(key) {
 function getHostnameFromDomain(domain) {
 	return getHostname(domain) || null;
 }
+/**
+* Normalize a provider `domain` value to the email domains it authorizes.
+*
+* TODO(next): replace the serialized provider.domain string with a canonical
+* domains array and reject URL/path-shaped values at register/update once main
+* and next provider schemas are reconciled.
+*/
+function parseProviderDomains(domain) {
+	const entries = domain.split(",").map((entry) => entry.trim()).filter(Boolean);
+	if (entries.length === 0) return null;
+	const domains = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		const parsedDomain = getHostnameFromDomain(entry)?.toLowerCase();
+		if (!parsedDomain) return null;
+		domains.add(parsedDomain);
+	}
+	return [...domains];
+}
 function maskClientId(clientId) {
 	if (clientId.length <= 4) return "****";
 	return `****${clientId.slice(-4)}`;
@@ -970,6 +991,119 @@ function validateSingleAssertion(samlResponse) {
 	});
 }
 //#endregion
+//#region src/saml/response-binding.ts
+const SAML_HTTP_POST_BINDING = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+const SAML_BEARER_CONFIRMATION_METHOD = "urn:oasis:names:tc:SAML:2.0:cm:bearer";
+function toNode(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	return value;
+}
+function toNodeArray(value) {
+	if (Array.isArray(value)) return value.map(toNode).filter((node) => !!node);
+	const node = toNode(value);
+	return node ? [node] : [];
+}
+function firstNode(value) {
+	return toNodeArray(value)[0] ?? null;
+}
+function toStringArray(value) {
+	if (typeof value === "string") return [value];
+	if (Array.isArray(value)) return value.flatMap(toStringArray);
+	const text = toNode(value)?.["#text"];
+	return typeof text === "string" ? [text] : [];
+}
+function toStringSet(values) {
+	return new Set(values.filter((value) => !!value));
+}
+function parseSAMLContent(samlContent) {
+	try {
+		const parsed = toNode(xmlParser.parse(samlContent));
+		if (parsed) return parsed;
+	} catch {}
+	throw new APIError("BAD_REQUEST", {
+		message: "SAML response XML could not be parsed",
+		code: "SAML_RESPONSE_INVALID_XML"
+	});
+}
+function getSAMLPostAssertionConsumerServiceUrls(metadata) {
+	if (!metadata) return [];
+	try {
+		const locations = toNodeArray(findNode(toNode(xmlParser.parse(metadata)), "SPSSODescriptor")).flatMap((descriptor) => toNodeArray(descriptor.AssertionConsumerService).filter((service) => service["@_Binding"] === SAML_HTTP_POST_BINDING).map((service) => service["@_Location"]).filter((location) => typeof location === "string" && !!location));
+		return [...new Set(locations)];
+	} catch {
+		return [];
+	}
+}
+function hasSAMLEncryptedAssertion(samlContent) {
+	try {
+		return countAllNodes(xmlParser.parse(samlContent), "EncryptedAssertion") > 0;
+	} catch {
+		return false;
+	}
+}
+function getResponseNode(parsed) {
+	return firstNode(parsed.Response);
+}
+function getAssertionNode(parsed, response) {
+	const assertion = firstNode(response?.Assertion) ?? firstNode(parsed.Assertion);
+	if (assertion) return assertion;
+	throw new APIError("BAD_REQUEST", {
+		message: "SAML response is missing an assertion",
+		code: "SAML_ASSERTION_MISSING"
+	});
+}
+function getAudienceRestrictionGroups(assertion) {
+	return toNodeArray(firstNode(assertion.Conditions)?.AudienceRestriction).map((restriction) => toStringArray(restriction.Audience).filter(Boolean));
+}
+function validateAudienceRestrictions(assertion, expectedAudiences) {
+	const audienceGroups = getAudienceRestrictionGroups(assertion);
+	if (audienceGroups.length === 0 || audienceGroups.every((group) => !group.length)) throw new APIError("BAD_REQUEST", {
+		message: "SAML assertion is missing an AudienceRestriction",
+		code: "SAML_AUDIENCE_MISSING"
+	});
+	if (audienceGroups.some((group) => !group.some((audience) => expectedAudiences.has(audience)))) throw new APIError("BAD_REQUEST", {
+		message: "SAML assertion audience does not match this Service Provider",
+		code: "SAML_AUDIENCE_MISMATCH"
+	});
+}
+function getBearerSubjectConfirmationData(assertion) {
+	return toNodeArray(firstNode(assertion.Subject)?.SubjectConfirmation).filter((confirmation) => confirmation["@_Method"] === SAML_BEARER_CONFIRMATION_METHOD).map((confirmation) => firstNode(confirmation.SubjectConfirmationData)).filter((data) => !!data);
+}
+function validateBearerRecipient(assertion, expectedRecipients) {
+	const confirmationData = getBearerSubjectConfirmationData(assertion);
+	if (!confirmationData.length) throw new APIError("BAD_REQUEST", {
+		message: "SAML assertion is missing bearer SubjectConfirmationData",
+		code: "SAML_BEARER_CONFIRMATION_MISSING"
+	});
+	const recipients = confirmationData.map((data) => data["@_Recipient"]).filter((recipient) => typeof recipient === "string");
+	if (!recipients.length) throw new APIError("BAD_REQUEST", {
+		message: "SAML bearer SubjectConfirmationData is missing a Recipient",
+		code: "SAML_RECIPIENT_MISSING"
+	});
+	if (!recipients.some((recipient) => expectedRecipients.has(recipient))) throw new APIError("BAD_REQUEST", {
+		message: "SAML bearer SubjectConfirmationData Recipient does not match this Service Provider",
+		code: "SAML_RECIPIENT_MISMATCH"
+	});
+}
+function validateResponseDestination(response, expectedRecipients) {
+	const destination = response?.["@_Destination"];
+	if (typeof destination !== "string" || !destination) return;
+	if (!expectedRecipients.has(destination)) throw new APIError("BAD_REQUEST", {
+		message: "SAML response Destination does not match this Service Provider",
+		code: "SAML_DESTINATION_MISMATCH"
+	});
+}
+function validateSAMLResponseBinding(samlContent, options) {
+	const expectedAudiences = toStringSet(options.expectedAudiences);
+	const expectedRecipients = toStringSet(options.expectedRecipients);
+	const parsed = parseSAMLContent(samlContent);
+	const response = getResponseNode(parsed);
+	const assertion = getAssertionNode(parsed, response);
+	validateAudienceRestrictions(assertion, expectedAudiences);
+	validateBearerRecipient(assertion, expectedRecipients);
+	validateResponseDestination(response, expectedRecipients);
+}
+//#endregion
 //#region src/routes/schemas.ts
 const oidcMappingSchema = z.object({
 	id: z.string().optional(),
@@ -1050,6 +1184,46 @@ const updateSSOProviderBodySchema = z.object({
 //#endregion
 //#region src/routes/providers.ts
 const ADMIN_ROLES = ["owner", "admin"];
+const OIDC_IDENTITY_BOUNDARY_FIELDS = [
+	"authorizationEndpoint",
+	"clientId",
+	"discoveryEndpoint",
+	"jwksEndpoint",
+	"tokenEndpoint",
+	"userInfoEndpoint"
+];
+const SAML_IDENTITY_BOUNDARY_FIELDS = [
+	"audience",
+	"callbackUrl",
+	"entryPoint",
+	"identifierFormat"
+];
+const SAML_IDP_BOUNDARY_FIELDS = [
+	"metadata",
+	"entityID",
+	"singleSignOnService"
+];
+const SAML_SP_BOUNDARY_FIELDS = ["metadata", "entityID"];
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stableStringify(value) {
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	if (isRecord(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
+	return JSON.stringify(value) ?? String(value);
+}
+function identityValueChanged(current, updated) {
+	return stableStringify(current) !== stableStringify(updated);
+}
+function hasChangedField(current, updated, fields) {
+	return fields.some((field) => identityValueChanged(current?.[field], updated?.[field]));
+}
+function oidcIdentityBoundaryChanged(current, updated) {
+	return hasChangedField(current, updated, OIDC_IDENTITY_BOUNDARY_FIELDS) || identityValueChanged(current.mapping?.id, updated.mapping?.id);
+}
+function samlIdentityBoundaryChanged(current, updated) {
+	return hasChangedField(current, updated, SAML_IDENTITY_BOUNDARY_FIELDS) || identityValueChanged(current.mapping?.id, updated.mapping?.id) || hasChangedField(current.idpMetadata, updated.idpMetadata, SAML_IDP_BOUNDARY_FIELDS) || hasChangedField(current.spMetadata, updated.spMetadata, SAML_SP_BOUNDARY_FIELDS);
+}
 function hasOrgAdminRole(member) {
 	return member.role.split(",").some((r) => ADMIN_ROLES.includes(r.trim()));
 }
@@ -1271,6 +1445,7 @@ const updateSSOProvider = (options) => {
 		if (!issuer && !domain && !samlConfig && !oidcConfig) throw new APIError("BAD_REQUEST", { message: "No fields provided for update" });
 		const existingProvider = await checkProviderAccess(ctx, providerId);
 		const updateData = {};
+		let providerIdentityBoundaryChanged = body.issuer !== void 0 && body.issuer !== existingProvider.issuer;
 		if (body.issuer !== void 0) updateData.issuer = body.issuer;
 		if (body.domain !== void 0) {
 			updateData.domain = body.domain;
@@ -1287,6 +1462,7 @@ const updateSSOProvider = (options) => {
 			}, options?.saml?.algorithms);
 			const currentSamlConfig = parseAndValidateConfig(existingProvider.samlConfig, "SAML");
 			const updatedSamlConfig = mergeSAMLConfig(currentSamlConfig, body.samlConfig, updateData.issuer || currentSamlConfig.issuer || existingProvider.issuer);
+			if (samlIdentityBoundaryChanged(currentSamlConfig, updatedSamlConfig)) providerIdentityBoundaryChanged = true;
 			updateData.samlConfig = JSON.stringify(updatedSamlConfig);
 		}
 		if (body.oidcConfig) {
@@ -1298,8 +1474,18 @@ const updateSSOProvider = (options) => {
 			}
 			const currentOidcConfig = parseAndValidateConfig(existingProvider.oidcConfig, "OIDC");
 			const updatedOidcConfig = mergeOIDCConfig(currentOidcConfig, body.oidcConfig, updateData.issuer || currentOidcConfig.issuer || existingProvider.issuer);
+			if (oidcIdentityBoundaryChanged(currentOidcConfig, updatedOidcConfig)) providerIdentityBoundaryChanged = true;
 			updateData.oidcConfig = JSON.stringify(updatedOidcConfig);
 		}
+		if (providerIdentityBoundaryChanged) {
+			if (await ctx.context.adapter.findOne({
+				model: "account",
+				where: [{
+					field: "providerId",
+					value: providerId
+				}]
+			})) throw new APIError("CONFLICT", { message: "Cannot change SSO provider identity fields while linked accounts exist" });
+		}
 		await ctx.context.adapter.update({
 			model: "ssoProvider",
 			where: [{
@@ -1337,12 +1523,22 @@ const deleteSSOProvider = () => {
 	}, async (ctx) => {
 		const { providerId } = ctx.body;
 		await checkProviderAccess(ctx, providerId);
-		await ctx.context.adapter.delete({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: providerId
-			}]
+		await runWithTransaction(ctx.context.adapter, async () => {
+			const trx = await getCurrentAdapter(ctx.context.adapter);
+			await trx.deleteMany({
+				model: "account",
+				where: [{
+					field: "providerId",
+					value: providerId
+				}]
+			});
+			await trx.delete({
+				model: "ssoProvider",
+				where: [{
+					field: "providerId",
+					value: providerId
+				}]
+			});
 		});
 		return ctx.json({ success: true });
 	});
@@ -1424,7 +1620,6 @@ const verifyDomain = (options) => {
 			message: "No pending domain verification exists",
 			code: "NO_PENDING_VERIFICATION"
 		});
-		let records = [];
 		let dns;
 		try {
 			dns = await import("node:dns/promises");
@@ -1435,20 +1630,28 @@ const verifyDomain = (options) => {
 				code: "DOMAIN_VERIFICATION_FAILED"
 			});
 		}
-		const hostname = getHostnameFromDomain(provider.domain);
-		if (!hostname) throw new APIError("BAD_REQUEST", {
+		const domains = parseProviderDomains(provider.domain);
+		if (!domains) throw new APIError("BAD_REQUEST", {
 			message: "Invalid domain",
 			code: "INVALID_DOMAIN"
 		});
-		try {
-			records = (await dns.resolveTxt(`${identifier}.${hostname}`)).flat();
-		} catch (error) {
-			ctx.context.logger.warn("DNS resolution failure while validating domain ownership", error);
+		for (const domain of domains) {
+			let records = [];
+			try {
+				records = (await dns.resolveTxt(`${identifier}.${domain}`)).map((record) => record.join(""));
+			} catch (error) {
+				ctx.context.logger.warn(`DNS resolution failure while validating domain ownership for ${domain}`, error);
+			}
+			const verificationValue = activeVerification.value;
+			const verificationRecord = `${activeVerification.identifier}=${verificationValue}`;
+			if (!records.find((record) => {
+				const normalizedRecord = record.trim();
+				return normalizedRecord === verificationRecord || normalizedRecord === verificationValue;
+			})) throw new APIError("BAD_GATEWAY", {
+				message: `Unable to verify domain ownership for ${domain}. Try again later`,
+				code: "DOMAIN_VERIFICATION_FAILED"
+			});
 		}
-		if (!records.find((record) => record.includes(`${activeVerification.identifier}=${activeVerification.value}`))) throw new APIError("BAD_GATEWAY", {
-			message: "Unable to verify domain ownership. Try again later",
-			code: "DOMAIN_VERIFICATION_FAILED"
-		});
 		await ctx.context.adapter.update({
 			model: "ssoProvider",
 			where: [{
@@ -1600,7 +1803,17 @@ function escapeHtml(str) {
 	if (!str) return "";
 	return String(str).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+function isSAMLPostBindingLocation(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return false;
+	}
+	return url.protocol === "http:" || url.protocol === "https:";
+}
 function createSAMLPostForm(action, samlParam, samlValue, relayState) {
+	if (!isSAMLPostBindingLocation(action)) throw new APIError("BAD_REQUEST", { message: "SAML POST binding location must be an absolute http or https URL" });
 	const safeAction = escapeHtml(action);
 	const safeSamlParam = escapeHtml(samlParam);
 	const safeSamlValue = escapeHtml(samlValue);
@@ -1679,6 +1892,28 @@ function getSafeRedirectUrl(url, callbackPath, appOrigin, isTrustedOrigin) {
 	}
 	return url;
 }
+function buildSAMLRedirectUrl(url, params) {
+	const searchParams = new URLSearchParams(params);
+	return `${url}${url.includes("?") ? "&" : "?"}${searchParams.toString()}`;
+}
+function toArray(value) {
+	if (Array.isArray(value)) return value;
+	return value ? [value] : [];
+}
+function getExpectedSAMLRecipients(config, baseURL, providerId, currentCallbackPath, assertionConsumerServiceUrl) {
+	const configuredPostAssertionConsumerServiceUrls = getSAMLPostAssertionConsumerServiceUrls(config.spMetadata?.metadata);
+	return [
+		currentCallbackPath,
+		`${baseURL}/sso/saml2/sp/acs/${providerId}`,
+		...configuredPostAssertionConsumerServiceUrls,
+		...toArray(assertionConsumerServiceUrl)
+	];
+}
+async function getSAMLResponseBindingContent(sp, samlContent) {
+	if (!hasSAMLEncryptedAssertion(samlContent)) return samlContent;
+	const [decryptedContent] = await saml.SamlLib.decryptAssertion(sp, samlContent);
+	return decryptedContent;
+}
 /**
 * Extracts the Assertion ID from a SAML response XML.
 * Used for replay protection per SAML 2.0 Core section 2.3.3.
@@ -1747,12 +1982,47 @@ async function processSAMLResponse(ctx, params, options) {
 		});
 	}
 	const { extract } = parsedResponse;
+	const samlContent = parsedResponse.samlContent;
 	validateSAMLAlgorithms(parsedResponse, options?.saml?.algorithms);
 	validateSAMLTimestamp(extract.conditions, {
 		clockSkew: options?.saml?.clockSkew,
 		requireTimestamps: options?.saml?.requireTimestamps,
 		logger: ctx.context.logger
 	});
+	const expectedAudiences = [sp.entityMeta.getEntityID(), parsedSamlConfig.audience];
+	const assertionConsumerServiceUrl = sp.entityMeta.getAssertionConsumerService(SAML_HTTP_POST_BINDING);
+	const expectedRecipients = getExpectedSAMLRecipients(parsedSamlConfig, ctx.context.baseURL, providerId, currentCallbackPath, assertionConsumerServiceUrl);
+	let samlBindingContent;
+	try {
+		samlBindingContent = await getSAMLResponseBindingContent(sp, samlContent);
+		validateSAMLResponseBinding(samlBindingContent, {
+			expectedAudiences,
+			expectedRecipients
+		});
+	} catch (error) {
+		if (isAPIError(error)) {
+			ctx.context.logger.error("SAML response binding validation failed", {
+				providerId,
+				code: error.body?.code,
+				expectedAudiences: expectedAudiences.filter(Boolean),
+				expectedRecipients: expectedRecipients.filter(Boolean)
+			});
+			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+				error: "invalid_saml_response",
+				error_description: error.body?.message || error.message || "Invalid SAML response"
+			}));
+		}
+		ctx.context.logger.error("SAML response binding validation failed", {
+			providerId,
+			error,
+			expectedAudiences: expectedAudiences.filter(Boolean),
+			expectedRecipients: expectedRecipients.filter(Boolean)
+		});
+		throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+			error: "invalid_saml_response",
+			error_description: "SAML response binding could not be validated"
+		}));
+	}
 	const inResponseTo = extract.inResponseTo;
 	if (options?.saml?.enableInResponseToValidation !== false) {
 		const allowIdpInitiated = options?.saml?.allowIdpInitiated !== false;
@@ -1769,7 +2039,10 @@ async function processSAMLResponse(ctx, params, options) {
 					inResponseTo,
 					providerId
 				});
-				throw ctx.redirect(`${samlRedirectUrl}?error=invalid_saml_response&error_description=Unknown+or+expired+request+ID`);
+				throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+					error: "invalid_saml_response",
+					error_description: "Unknown or expired request ID"
+				}));
 			}
 			if (storedRequest.providerId !== providerId) {
 				ctx.context.logger.error("SAML InResponseTo validation failed: provider mismatch", {
@@ -1777,15 +2050,20 @@ async function processSAMLResponse(ctx, params, options) {
 					expectedProvider: storedRequest.providerId,
 					actualProvider: providerId
 				});
-				throw ctx.redirect(`${samlRedirectUrl}?error=invalid_saml_response&error_description=Provider+mismatch`);
+				throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+					error: "invalid_saml_response",
+					error_description: "Provider mismatch"
+				}));
 			}
 		} else if (!allowIdpInitiated) {
 			ctx.context.logger.error("SAML IdP-initiated SSO rejected: InResponseTo missing and allowIdpInitiated is false", { providerId });
-			throw ctx.redirect(`${samlRedirectUrl}?error=unsolicited_response&error_description=IdP-initiated+SSO+not+allowed`);
+			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+				error: "unsolicited_response",
+				error_description: "IdP-initiated SSO not allowed"
+			}));
 		}
 	}
-	const samlContent = parsedResponse.samlContent;
-	const assertionId = samlContent ? extractAssertionId(samlContent) : null;
+	const assertionId = extractAssertionId(samlBindingContent);
 	if (assertionId) {
 		const issuer = idp.entityMeta.getEntityID();
 		const conditions = extract.conditions;
@@ -1807,7 +2085,10 @@ async function processSAMLResponse(ctx, params, options) {
 				issuer,
 				providerId
 			});
-			throw ctx.redirect(`${samlRedirectUrl}?error=replay_detected&error_description=SAML+assertion+has+already+been+used`);
+			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+				error: "replay_detected",
+				error_description: "SAML assertion has already been used"
+			}));
 		}
 	} else ctx.context.logger.warn("Could not extract assertion ID for replay protection", { providerId });
 	const attributes = extract.attributes || {};
@@ -1856,15 +2137,13 @@ async function processSAMLResponse(ctx, params, options) {
 			trustProviderByName: false
 		});
 	} catch (e) {
-		if (isAPIError(e) && e.body?.code) {
-			const params = new URLSearchParams({ error: e.body.code });
-			if (e.body.message) params.set("error_description", e.body.message);
-			const sep = errorUrl.includes("?") ? "&" : "?";
-			throw ctx.redirect(`${errorUrl}${sep}${params.toString()}`);
-		}
+		if (isAPIError(e) && e.body?.code) throw ctx.redirect(buildSAMLRedirectUrl(errorUrl, {
+			error: e.body.code,
+			...e.body.message ? { error_description: e.body.message } : {}
+		}));
 		throw e;
 	}
-	if (result.error) throw ctx.redirect(`${callbackUrl}?error=${result.error.split(" ").join("_")}`);
+	if (result.error) throw ctx.redirect(buildSAMLRedirectUrl(callbackUrl, { error: result.error.split(" ").join("_") }));
 	const { session, user } = result.data;
 	if (options?.provisionUser && (result.isRegister || options.provisionUserOnEveryLogin)) await options.provisionUser({
 		user,
@@ -1912,6 +2191,14 @@ async function processSAMLResponse(ctx, params, options) {
 }
 //#endregion
 //#region src/routes/sso.ts
+const BUILT_IN_ACCOUNT_PROVIDER_IDS = [
+	"credential",
+	"email-otp",
+	"magic-link",
+	"phone-number",
+	"anonymous",
+	"siwe"
+];
 /**
 * Builds the OIDC redirect URI. Uses the shared `redirectURI` option
 * when set, otherwise falls back to `/sso/callback/:providerId`.
@@ -2245,13 +2532,27 @@ const registerSSOProvider = (options) => {
 			if (ctx.context.hasPlugin("organization") && !hasOrgAdminRole(member)) throw new APIError("FORBIDDEN", { message: "You must be an organization owner or admin to register SSO providers" });
 		}
 		if (new Set([
-			"credential",
+			...BUILT_IN_ACCOUNT_PROVIDER_IDS,
+			...Object.keys(ctx.context.options.socialProviders ?? {}),
 			...ctx.context.socialProviders.map((p) => p.id),
-			...ctx.context.trustedProviders
+			...ctx.context.trustedProviders,
+			...options?.defaultSSO?.map((p) => p.providerId) ?? []
 		]).has(body.providerId)) {
 			ctx.context.logger.warn(`SSO provider registration rejected for reserved providerId: ${body.providerId}`);
 			throw new APIError("UNPROCESSABLE_ENTITY", { message: "This providerId is reserved and cannot be used for an SSO provider" });
 		}
+		if (ctx.context.hasPlugin("scim")) {
+			if (await ctx.context.adapter.findOne({
+				model: "scimProvider",
+				where: [{
+					field: "providerId",
+					value: body.providerId
+				}]
+			})) {
+				ctx.context.logger.warn(`SSO provider registration rejected for SCIM providerId: ${body.providerId}`);
+				throw new APIError("UNPROCESSABLE_ENTITY", { message: "This providerId is already used by a SCIM provider and cannot be used for an SSO provider" });
+			}
+		}
 		if (await ctx.context.adapter.findOne({
 			model: "ssoProvider",
 			where: [{
@@ -2479,7 +2780,7 @@ const signInSSO = (options) => {
 		});
 		let provider = null;
 		if (options?.defaultSSO?.length) {
-			const matchingDefault = providerId ? options.defaultSSO.find((defaultProvider) => defaultProvider.providerId === providerId) : options.defaultSSO.find((defaultProvider) => defaultProvider.domain === domain);
+			const matchingDefault = providerId ? options.defaultSSO.find((defaultProvider) => defaultProvider.providerId === providerId) : options.defaultSSO.find((defaultProvider) => domain && domainMatches(domain, defaultProvider.domain));
 			if (matchingDefault) provider = {
 				issuer: matchingDefault.samlConfig?.issuer || matchingDefault.oidcConfig?.issuer || "",
 				providerId: matchingDefault.providerId,

package/dist/{version-BBOVUjFi.mjs → version-CSXTsU_C.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.6.19";
+const PACKAGE_VERSION = "1.6.21";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.6.19",
+  "version": "1.6.21",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -65,20 +65,20 @@
   "devDependencies": {
     "@types/body-parser": "^1.19.6",
     "@types/express": "^5.0.6",
-    "better-call": "1.3.6",
+    "better-call": "1.3.7",
     "body-parser": "^2.2.2",
     "express": "^5.2.1",
     "oauth2-mock-server": "^8.2.2",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.6.19",
-    "better-auth": "1.6.19"
+    "@better-auth/core": "1.6.21",
+    "better-auth": "1.6.21"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
-    "better-call": "1.3.6",
-    "@better-auth/core": "^1.6.19",
-    "better-auth": "^1.6.19"
+    "better-call": "1.3.7",
+    "@better-auth/core": "^1.6.21",
+    "better-auth": "^1.6.21"
   },
   "scripts": {
     "build": "tsdown",