@better-auth/sso 1.6.25 → 1.6.27

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { t as SSOPlugin } from "./index-P-Jf_8P1.mjs";
+import { t as SSOPlugin } from "./index-LIqblgm9.mjs";
 //#region src/client.d.ts
 interface SSOClientOptions {
   domainVerification?: {

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-Bbx2FRPo.mjs";
+import { t as PACKAGE_VERSION } from "./version-B4oCeoTU.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-P-Jf_8P1.d.mts → index-LIqblgm9.d.mts}

@@ -457,7 +457,7 @@ declare const requestDomainVerification: (options: SSOOptions) => import("better
       };
     };
   };
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -479,7 +479,7 @@ declare const requestDomainVerification: (options: SSOOptions) => import("better
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
 }, {
   domainVerificationToken: string;
 }>;
@@ -508,7 +508,7 @@ declare const verifyDomain: (options: SSOOptions) => import("better-call").Stric
       };
     };
   };
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -530,13 +530,13 @@ declare const verifyDomain: (options: SSOOptions) => import("better-call").Stric
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
 }, void>;
 //#endregion
 //#region src/routes/providers.d.ts
 declare const listSSOProviders: () => import("better-call").StrictEndpoint<"/sso/providers", {
   method: "GET";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -558,7 +558,7 @@ declare const listSSOProviders: () => import("better-call").StrictEndpoint<"/sso
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   metadata: {
     openapi: {
       operationId: string;
@@ -614,7 +614,7 @@ declare const listSSOProviders: () => import("better-call").StrictEndpoint<"/sso
 }>;
 declare const getSSOProvider: () => import("better-call").StrictEndpoint<"/sso/get-provider", {
   method: "GET";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -636,7 +636,7 @@ declare const getSSOProvider: () => import("better-call").StrictEndpoint<"/sso/g
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   query: z.ZodObject<{
     providerId: z.ZodString;
   }, z.core.$strip>;
@@ -699,7 +699,7 @@ declare const getSSOProvider: () => import("better-call").StrictEndpoint<"/sso/g
 }>;
 declare const updateSSOProvider: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/update-provider", {
   method: "POST";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -721,7 +721,7 @@ declare const updateSSOProvider: (options: SSOOptions) => import("better-call").
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   body: z.ZodObject<{
     issuer: z.ZodOptional<z.ZodString>;
     domain: z.ZodOptional<z.ZodString>;
@@ -858,7 +858,7 @@ declare const updateSSOProvider: (options: SSOOptions) => import("better-call").
 }>;
 declare const deleteSSOProvider: () => import("better-call").StrictEndpoint<"/sso/delete-provider", {
   method: "POST";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -880,7 +880,7 @@ declare const deleteSSOProvider: () => import("better-call").StrictEndpoint<"/ss
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   body: z.ZodObject<{
     providerId: z.ZodString;
   }, z.core.$strip>;
@@ -1030,7 +1030,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import(
     organizationId: z.ZodOptional<z.ZodString>;
     overrideUserInfo: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
   }, z.core.$strip>;
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1052,7 +1052,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import(
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   metadata: {
     openapi: {
       operationId: string;
@@ -1450,7 +1450,7 @@ declare const initiateSLO: (options?: SSOOptions) => import("better-call").Stric
   body: z.ZodObject<{
     callbackURL: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1472,7 +1472,7 @@ declare const initiateSLO: (options?: SSOOptions) => import("better-call").Stric
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   metadata: {
     readonly scope: "server";
   };

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as DataEncryptionAlgorithm, C as TimestampValidationOptions, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as SAMLConditions, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as DEFAULT_MAX_SAML_METADATA_SIZE, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as validateSAMLTimestamp, x as DEFAULT_MAX_SAML_RESPONSE_SIZE, y as DEFAULT_CLOCK_SKEW_MS } from "./index-P-Jf_8P1.mjs";
+import { A as DataEncryptionAlgorithm, C as TimestampValidationOptions, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as SAMLConditions, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as DEFAULT_MAX_SAML_METADATA_SIZE, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as validateSAMLTimestamp, x as DEFAULT_MAX_SAML_RESPONSE_SIZE, y as DEFAULT_CLOCK_SKEW_MS } from "./index-LIqblgm9.mjs";
 export { type AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, type DeprecatedAlgorithmBehavior, DigestAlgorithm, type DiscoverOIDCConfigParams, DiscoveryError, type DiscoveryErrorCode, type HydratedOIDCConfig, KeyEncryptionAlgorithm, type OIDCConfig, type OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, type RequiredDiscoveryField, type SAMLConditions, type SAMLConfig, type SSOOptions, SSOPlugin, type SSOProvider, SignatureAlgorithm, type TimestampValidationOptions, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-Bbx2FRPo.mjs";
+import { t as PACKAGE_VERSION } from "./version-B4oCeoTU.mjs";
 import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
@@ -147,98 +147,127 @@ function maskClientId(clientId) {
 }
 //#endregion
 //#region src/linking/org-assignment.ts
-/**
-* Assigns a user to an organization based on the SSO provider's organizationId.
-* Used in SSO flows (OIDC, SAML) where the provider is already linked to an org.
-*/
-async function assignOrganizationFromProvider(ctx, options) {
-	const { user, profile, provider, token, provisioningOptions } = options;
-	if (!provider.organizationId) return;
-	if (provisioningOptions?.disabled) return;
-	if (!ctx.context.hasPlugin("organization")) return;
+function getEmailDomain(email) {
+	const parts = email.trim().toLowerCase().split("@");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
+	const domain = parts[1];
+	if (domain.includes("/") || domain.includes("\\") || domain.includes(":")) return null;
+	const normalizedDomains = parseProviderDomains(domain);
+	if (!normalizedDomains || normalizedDomains.length !== 1) return null;
+	return normalizedDomains[0] ?? null;
+}
+async function findVerifiedDomainProviders(ctx, domain) {
+	return (await ctx.context.adapter.findMany({
+		model: "ssoProvider",
+		where: [{
+			field: "domainVerified",
+			value: true
+		}]
+	})).filter((provider) => domainMatches(domain, provider.domain));
+}
+async function assignOrganization(ctx, options) {
+	if (options.provisioningOptions?.disabled) return "provisioning-disabled";
+	if (!ctx.context.hasPlugin("organization")) return "ineligible-source";
+	let user;
+	let provider;
+	let organizationId;
+	let userInfo;
+	let token;
+	if (options.reason === "provider-bound") {
+		if (!options.provider.organizationId) return "no-target";
+		user = options.user;
+		provider = options.provider;
+		organizationId = options.provider.organizationId;
+		userInfo = options.profile.rawAttributes || {};
+		token = options.token;
+	} else {
+		if (!options.domainVerification?.enabled) return "provisioning-disabled";
+		const canonicalUser = await ctx.context.internalAdapter.findUserById(options.user.id);
+		if (!canonicalUser) {
+			ctx.context.logger.error("Unable to assign SSO organization membership because the canonical user was not found", { userId: options.user.id });
+			return "ineligible-source";
+		}
+		if (!canonicalUser.emailVerified) return "unverified-identity";
+		const domain = getEmailDomain(canonicalUser.email);
+		if (!domain) return "unverified-identity";
+		const matchingProviders = (await findVerifiedDomainProviders(ctx, domain)).filter((matchingProvider) => Boolean(matchingProvider.organizationId));
+		if (new Set(matchingProviders.map((matchingProvider) => matchingProvider.organizationId)).size > 1) {
+			ctx.context.logger.warn("Skipped SSO organization provisioning because a verified domain maps to multiple organizations", {
+				domain,
+				userId: canonicalUser.id
+			});
+			return "ambiguous-target";
+		}
+		if (matchingProviders.length === 0) return "no-target";
+		matchingProviders.sort((left, right) => left.providerId.localeCompare(right.providerId));
+		const selectedProvider = matchingProviders[0];
+		if (!selectedProvider) return "no-target";
+		user = canonicalUser;
+		provider = selectedProvider;
+		organizationId = selectedProvider.organizationId;
+		userInfo = {};
+		token = void 0;
+	}
 	if (await ctx.context.adapter.findOne({
 		model: "member",
 		where: [{
 			field: "organizationId",
-			value: provider.organizationId
+			value: organizationId
 		}, {
 			field: "userId",
 			value: user.id
 		}]
-	})) return;
-	const role = provisioningOptions?.getRole ? await provisioningOptions.getRole({
+	})) return "already-member";
+	if (await ctx.context.adapter.findOne({
+		model: "invitation",
+		where: [
+			{
+				field: "organizationId",
+				value: organizationId
+			},
+			{
+				field: "email",
+				value: user.email.toLowerCase()
+			},
+			{
+				field: "status",
+				value: "pending"
+			}
+		]
+	})) return "invitation-pending";
+	const role = options.provisioningOptions?.getRole ? await options.provisioningOptions.getRole({
 		user,
-		userInfo: profile.rawAttributes || {},
+		userInfo,
 		token,
 		provider
-	}) : provisioningOptions?.defaultRole || "member";
+	}) : options.provisioningOptions?.defaultRole || "member";
 	await ctx.context.adapter.create({
 		model: "member",
 		data: {
-			organizationId: provider.organizationId,
+			organizationId,
 			userId: user.id,
 			role,
 			createdAt: /* @__PURE__ */ new Date()
 		}
 	});
+	return "assigned";
 }
 /**
-* Assigns a user to an organization based on their email domain.
-* Looks up SSO providers that match the user's email domain and assigns
-* the user to the associated organization.
-*
-* This enables domain-based org assignment for non-SSO sign-in methods
-* (e.g., Google OAuth with @acme.com email gets added to Acme's org).
+* Assigns a user to the organization explicitly bound to an SSO provider.
 */
-async function assignOrganizationByDomain(ctx, options) {
-	const { user, provisioningOptions, domainVerification } = options;
-	if (provisioningOptions?.disabled) return;
-	if (!ctx.context.hasPlugin("organization")) return;
-	const domain = user.email.split("@")[1];
-	if (!domain) return;
-	const whereClause = [{
-		field: "domain",
-		value: domain
-	}];
-	if (domainVerification?.enabled) whereClause.push({
-		field: "domainVerified",
-		value: true
-	});
-	let ssoProvider = await ctx.context.adapter.findOne({
-		model: "ssoProvider",
-		where: whereClause
+async function assignOrganizationFromProvider(ctx, options) {
+	await assignOrganization(ctx, {
+		reason: "provider-bound",
+		...options
 	});
-	if (!ssoProvider) ssoProvider = (await ctx.context.adapter.findMany({
-		model: "ssoProvider",
-		where: domainVerification?.enabled ? [{
-			field: "domainVerified",
-			value: true
-		}] : []
-	})).find((p) => domainMatches(domain, p.domain)) ?? null;
-	if (!ssoProvider || !ssoProvider.organizationId) return;
-	if (await ctx.context.adapter.findOne({
-		model: "member",
-		where: [{
-			field: "organizationId",
-			value: ssoProvider.organizationId
-		}, {
-			field: "userId",
-			value: user.id
-		}]
-	})) return;
-	const role = provisioningOptions?.getRole ? await provisioningOptions.getRole({
-		user,
-		userInfo: {},
-		provider: ssoProvider
-	}) : provisioningOptions?.defaultRole || "member";
-	await ctx.context.adapter.create({
-		model: "member",
-		data: {
-			organizationId: ssoProvider.organizationId,
-			userId: user.id,
-			role,
-			createdAt: /* @__PURE__ */ new Date()
-		}
+}
+/**
+* Assigns a verified user to the organization for their verified email domain.
+*/
+async function assignOrganizationByDomain(ctx, options) {
+	await assignOrganization(ctx, {
+		reason: "verified-domain",
+		...options
 	});
 }
 //#endregion
@@ -1555,6 +1584,23 @@ const deleteSSOProvider = () => {
 const DNS_LABEL_MAX_LENGTH = 63;
 const DEFAULT_TOKEN_PREFIX = "better-auth-token";
 const domainVerificationBodySchema = z.object({ providerId: z.string() });
+async function completeDomainVerification(adapter, provider) {
+	if (!await adapter.incrementOne({
+		model: "ssoProvider",
+		where: [{
+			field: "id",
+			value: provider.id
+		}, {
+			field: "domain",
+			value: provider.domain
+		}],
+		increment: {},
+		set: { domainVerified: true }
+	})) throw new APIError("CONFLICT", {
+		code: "SSO_PROVIDER_CHANGED",
+		message: "SSO provider changed while domain verification was in progress. Reload the provider and try again"
+	});
+}
 function getVerificationIdentifier(options, providerId) {
 	return `_${options.domainVerification?.tokenPrefix || DEFAULT_TOKEN_PREFIX}-${providerId}`;
 }
@@ -1604,7 +1650,7 @@ const verifyDomain = (options) => {
 			description: "Verify the provider domain ownership via DNS records",
 			responses: {
 				"404": { description: "Provider not found" },
-				"409": { description: "Domain has already been verified or no pending verification exists" },
+				"409": { description: "Domain has already been verified, or the provider changed while verification was in progress" },
 				"502": { description: "Unable to verify domain ownership due to upstream validator error" },
 				"204": { description: "Domain ownership was verified" }
 			}
@@ -1659,14 +1705,7 @@ const verifyDomain = (options) => {
 				code: "DOMAIN_VERIFICATION_FAILED"
 			});
 		}
-		await ctx.context.adapter.update({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: provider.providerId
-			}],
-			update: { domainVerified: true }
-		});
+		await completeDomainVerification(ctx.context.adapter, provider);
 		ctx.setStatus(204);
 	});
 };

package/dist/{version-Bbx2FRPo.mjs → version-B4oCeoTU.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.6.25";
+const PACKAGE_VERSION = "1.6.27";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.6.25",
+  "version": "1.6.27",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -65,20 +65,20 @@
   "devDependencies": {
     "@types/body-parser": "^1.19.6",
     "@types/express": "^5.0.6",
-    "better-call": "1.3.7",
-    "body-parser": "^2.2.2",
+    "better-call": "1.4.0",
+    "body-parser": "^2.3.0",
     "express": "^5.2.1",
     "oauth2-mock-server": "^8.2.2",
     "tsdown": "0.22.7",
-    "@better-auth/core": "1.6.25",
-    "better-auth": "1.6.25"
+    "@better-auth/core": "1.6.27",
+    "better-auth": "1.6.27"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
-    "better-call": "1.3.7",
-    "better-auth": "^1.6.25",
-    "@better-auth/core": "^1.6.25"
+    "better-call": "1.4.0",
+    "@better-auth/core": "^1.6.27",
+    "better-auth": "^1.6.27"
   },
   "scripts": {
     "build": "tsdown",