@better-auth/sso 1.6.26 → 1.6.28

package/dist/client.d.mts

@@ -1,4 +1,5 @@
-import { t as SSOPlugin } from "./index-P-Jf_8P1.mjs";
+import { t as SSOPlugin } from "./index-CMcY1z4e.mjs";
+
 //#region src/client.d.ts
 interface SSOClientOptions {
   domainVerification?: {

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-CPj5-4mL.mjs";
+import { t as PACKAGE_VERSION } from "./version-6ZHwEASO.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-P-Jf_8P1.d.mts → index-CMcY1z4e.d.mts}

@@ -1,6 +1,8 @@
 import { APIError } from "better-auth/api";
 import * as z from "zod";
 import { Awaitable, BetterAuthPlugin, OAuth2Tokens, User } from "better-auth";
+import * as _$better_call0 from "better-call";
+
 //#region src/saml/algorithms.d.ts
 declare const SignatureAlgorithm: {
   readonly RSA_SHA1: "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
@@ -435,7 +437,7 @@ interface SSOOptions {
 }
 //#endregion
 //#region src/routes/domain-verification.d.ts
-declare const requestDomainVerification: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/request-domain-verification", {
+declare const requestDomainVerification: (options: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/request-domain-verification", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -457,7 +459,7 @@ declare const requestDomainVerification: (options: SSOOptions) => import("better
       };
     };
   };
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -479,11 +481,11 @@ declare const requestDomainVerification: (options: SSOOptions) => import("better
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
 }, {
   domainVerificationToken: string;
 }>;
-declare const verifyDomain: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/verify-domain", {
+declare const verifyDomain: (options: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/verify-domain", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -508,7 +510,7 @@ declare const verifyDomain: (options: SSOOptions) => import("better-call").Stric
       };
     };
   };
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -530,13 +532,13 @@ declare const verifyDomain: (options: SSOOptions) => import("better-call").Stric
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
 }, void>;
 //#endregion
 //#region src/routes/providers.d.ts
-declare const listSSOProviders: () => import("better-call").StrictEndpoint<"/sso/providers", {
+declare const listSSOProviders: () => _$better_call0.StrictEndpoint<"/sso/providers", {
   method: "GET";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -558,7 +560,7 @@ declare const listSSOProviders: () => import("better-call").StrictEndpoint<"/sso
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   metadata: {
     openapi: {
       operationId: string;
@@ -612,9 +614,9 @@ declare const listSSOProviders: () => import("better-call").StrictEndpoint<"/sso
     spMetadataUrl: string;
   }[];
 }>;
-declare const getSSOProvider: () => import("better-call").StrictEndpoint<"/sso/get-provider", {
+declare const getSSOProvider: () => _$better_call0.StrictEndpoint<"/sso/get-provider", {
   method: "GET";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -636,7 +638,7 @@ declare const getSSOProvider: () => import("better-call").StrictEndpoint<"/sso/g
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   query: z.ZodObject<{
     providerId: z.ZodString;
   }, z.core.$strip>;
@@ -697,9 +699,9 @@ declare const getSSOProvider: () => import("better-call").StrictEndpoint<"/sso/g
   } | undefined;
   spMetadataUrl: string;
 }>;
-declare const updateSSOProvider: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/update-provider", {
+declare const updateSSOProvider: (options: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/update-provider", {
   method: "POST";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -721,7 +723,7 @@ declare const updateSSOProvider: (options: SSOOptions) => import("better-call").
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   body: z.ZodObject<{
     issuer: z.ZodOptional<z.ZodString>;
     domain: z.ZodOptional<z.ZodString>;
@@ -856,9 +858,9 @@ declare const updateSSOProvider: (options: SSOOptions) => import("better-call").
   } | undefined;
   spMetadataUrl: string;
 }>;
-declare const deleteSSOProvider: () => import("better-call").StrictEndpoint<"/sso/delete-provider", {
+declare const deleteSSOProvider: () => _$better_call0.StrictEndpoint<"/sso/delete-provider", {
   method: "POST";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -880,7 +882,7 @@ declare const deleteSSOProvider: () => import("better-call").StrictEndpoint<"/ss
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   body: z.ZodObject<{
     providerId: z.ZodString;
   }, z.core.$strip>;
@@ -927,7 +929,7 @@ interface SAMLConditions {
 declare function validateSAMLTimestamp(conditions: SAMLConditions | undefined, options?: TimestampValidationOptions): void;
 //#endregion
 //#region src/routes/sso.d.ts
-declare const spMetadata: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/metadata", {
+declare const spMetadata: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/sp/metadata", {
   method: "GET";
   query: z.ZodObject<{
     providerId: z.ZodString;
@@ -949,7 +951,7 @@ declare const spMetadata: (options?: SSOOptions) => import("better-call").Strict
     };
   };
 }, Response>;
-declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import("better-call").StrictEndpoint<"/sso/register", {
+declare const registerSSOProvider: <O extends SSOOptions>(options: O) => _$better_call0.StrictEndpoint<"/sso/register", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -1030,7 +1032,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import(
     organizationId: z.ZodOptional<z.ZodString>;
     overrideUserInfo: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
   }, z.core.$strip>;
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1052,7 +1054,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import(
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   metadata: {
     openapi: {
       operationId: string;
@@ -1228,7 +1230,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import(
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
 } & Omit<SSOProvider<O>, "oidcConfig" | "samlConfig">>;
-declare const signInSSO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sign-in/sso", {
+declare const signInSSO: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sign-in/sso", {
   method: "POST";
   body: z.ZodObject<{
     email: z.ZodOptional<z.ZodString>;
@@ -1322,7 +1324,7 @@ declare const signInSSO: (options?: SSOOptions) => import("better-call").StrictE
   url: string;
   redirect: boolean;
 }>;
-declare const callbackSSO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback/:providerId", {
+declare const callbackSSO: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/callback/:providerId", {
   method: "GET";
   query: z.ZodObject<{
     code: z.ZodOptional<z.ZodString>;
@@ -1350,7 +1352,7 @@ declare const callbackSSO: (options?: SSOOptions) => import("better-call").Stric
  * Used when `options.redirectURI` is set — the `providerId` is read from
  * the OAuth state instead of the URL path.
  */
-declare const callbackSSOShared: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback", {
+declare const callbackSSOShared: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/callback", {
   metadata: {
     openapi: {
       operationId: string;
@@ -1373,7 +1375,7 @@ declare const callbackSSOShared: (options?: SSOOptions) => import("better-call")
   }, z.core.$strip>;
   allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
 }, void>;
-declare const callbackSSOSAML: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/callback/:providerId", {
+declare const callbackSSOSAML: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/callback/:providerId", {
   method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLResponse: z.ZodString;
@@ -1403,7 +1405,7 @@ declare const callbackSSOSAML: (options?: SSOOptions) => import("better-call").S
     scope: "server";
   };
 }, never>;
-declare const acsEndpoint: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
+declare const acsEndpoint: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
   method: "POST";
   body: z.ZodObject<{
     SAMLResponse: z.ZodString;
@@ -1424,7 +1426,7 @@ declare const acsEndpoint: (options?: SSOOptions) => import("better-call").Stric
     scope: "server";
   };
 }, never>;
-declare const sloEndpoint: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
+declare const sloEndpoint: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
   method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLRequest: z.ZodOptional<z.ZodString>;
@@ -1445,12 +1447,12 @@ declare const sloEndpoint: (options?: SSOOptions) => import("better-call").Stric
     scope: "server";
   };
 }, void | Response>;
-declare const initiateSLO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/logout/:providerId", {
+declare const initiateSLO: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/logout/:providerId", {
   method: "POST";
   body: z.ZodObject<{
     callbackURL: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1472,7 +1474,7 @@ declare const initiateSLO: (options?: SSOOptions) => import("better-call").Stric
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   metadata: {
     readonly scope: "server";
   };
@@ -1575,27 +1577,7 @@ interface OIDCDiscoveryDocument {
 /**
  * Error codes for OIDC discovery operations.
  */
-type DiscoveryErrorCode =
-/** Request to discovery endpoint timed out */
-"discovery_timeout" |
-/** Discovery endpoint returned 404 or similar */
-"discovery_not_found" |
-/** Discovery endpoint returned invalid JSON */
-"discovery_invalid_json" |
-/** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */
-"discovery_invalid_url" |
-/** OIDC endpoint URL is not trusted by the trusted origins configuration */
-"discovery_untrusted_origin" |
-/** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */
-"discovery_private_host" |
-/** Discovery document issuer doesn't match configured issuer */
-"issuer_mismatch" |
-/** Discovery document is missing required fields */
-"discovery_incomplete" |
-/** IdP only advertises token auth methods that Better Auth doesn't currently support */
-"unsupported_token_auth_method" |
-/** Catch-all for unexpected errors */
-"discovery_unexpected_error";
+type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */ | "discovery_invalid_url" /** OIDC endpoint URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */ | "discovery_private_host" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
 /**
  * Custom error class for OIDC discovery failures.
  * Can be caught and mapped to APIError at the edge.

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as DataEncryptionAlgorithm, C as TimestampValidationOptions, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as SAMLConditions, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as DEFAULT_MAX_SAML_METADATA_SIZE, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as validateSAMLTimestamp, x as DEFAULT_MAX_SAML_RESPONSE_SIZE, y as DEFAULT_CLOCK_SKEW_MS } from "./index-P-Jf_8P1.mjs";
-export { type AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, type DeprecatedAlgorithmBehavior, DigestAlgorithm, type DiscoverOIDCConfigParams, DiscoveryError, type DiscoveryErrorCode, type HydratedOIDCConfig, KeyEncryptionAlgorithm, type OIDCConfig, type OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, type RequiredDiscoveryField, type SAMLConditions, type SAMLConfig, type SSOOptions, SSOPlugin, type SSOProvider, SignatureAlgorithm, type TimestampValidationOptions, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };
+import { A as DataEncryptionAlgorithm, C as TimestampValidationOptions, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as SAMLConditions, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as DEFAULT_MAX_SAML_METADATA_SIZE, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as validateSAMLTimestamp, x as DEFAULT_MAX_SAML_RESPONSE_SIZE, y as DEFAULT_CLOCK_SKEW_MS } from "./index-CMcY1z4e.mjs";
+export { AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DeprecatedAlgorithmBehavior, DigestAlgorithm, DiscoverOIDCConfigParams, DiscoveryError, DiscoveryErrorCode, HydratedOIDCConfig, KeyEncryptionAlgorithm, OIDCConfig, OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, RequiredDiscoveryField, SAMLConditions, SAMLConfig, SSOOptions, SSOPlugin, SSOProvider, SignatureAlgorithm, TimestampValidationOptions, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-CPj5-4mL.mjs";
+import { t as PACKAGE_VERSION } from "./version-6ZHwEASO.mjs";
 import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
@@ -147,98 +147,127 @@ function maskClientId(clientId) {
 }
 //#endregion
 //#region src/linking/org-assignment.ts
-/**
-* Assigns a user to an organization based on the SSO provider's organizationId.
-* Used in SSO flows (OIDC, SAML) where the provider is already linked to an org.
-*/
-async function assignOrganizationFromProvider(ctx, options) {
-	const { user, profile, provider, token, provisioningOptions } = options;
-	if (!provider.organizationId) return;
-	if (provisioningOptions?.disabled) return;
-	if (!ctx.context.hasPlugin("organization")) return;
+function getEmailDomain(email) {
+	const parts = email.trim().toLowerCase().split("@");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
+	const domain = parts[1];
+	if (domain.includes("/") || domain.includes("\\") || domain.includes(":")) return null;
+	const normalizedDomains = parseProviderDomains(domain);
+	if (!normalizedDomains || normalizedDomains.length !== 1) return null;
+	return normalizedDomains[0] ?? null;
+}
+async function findVerifiedDomainProviders(ctx, domain) {
+	return (await ctx.context.adapter.findMany({
+		model: "ssoProvider",
+		where: [{
+			field: "domainVerified",
+			value: true
+		}]
+	})).filter((provider) => domainMatches(domain, provider.domain));
+}
+async function assignOrganization(ctx, options) {
+	if (options.provisioningOptions?.disabled) return "provisioning-disabled";
+	if (!ctx.context.hasPlugin("organization")) return "ineligible-source";
+	let user;
+	let provider;
+	let organizationId;
+	let userInfo;
+	let token;
+	if (options.reason === "provider-bound") {
+		if (!options.provider.organizationId) return "no-target";
+		user = options.user;
+		provider = options.provider;
+		organizationId = options.provider.organizationId;
+		userInfo = options.profile.rawAttributes || {};
+		token = options.token;
+	} else {
+		if (!options.domainVerification?.enabled) return "provisioning-disabled";
+		const canonicalUser = await ctx.context.internalAdapter.findUserById(options.user.id);
+		if (!canonicalUser) {
+			ctx.context.logger.error("Unable to assign SSO organization membership because the canonical user was not found", { userId: options.user.id });
+			return "ineligible-source";
+		}
+		if (!canonicalUser.emailVerified) return "unverified-identity";
+		const domain = getEmailDomain(canonicalUser.email);
+		if (!domain) return "unverified-identity";
+		const matchingProviders = (await findVerifiedDomainProviders(ctx, domain)).filter((matchingProvider) => Boolean(matchingProvider.organizationId));
+		if (new Set(matchingProviders.map((matchingProvider) => matchingProvider.organizationId)).size > 1) {
+			ctx.context.logger.warn("Skipped SSO organization provisioning because a verified domain maps to multiple organizations", {
+				domain,
+				userId: canonicalUser.id
+			});
+			return "ambiguous-target";
+		}
+		if (matchingProviders.length === 0) return "no-target";
+		matchingProviders.sort((left, right) => left.providerId.localeCompare(right.providerId));
+		const selectedProvider = matchingProviders[0];
+		if (!selectedProvider) return "no-target";
+		user = canonicalUser;
+		provider = selectedProvider;
+		organizationId = selectedProvider.organizationId;
+		userInfo = {};
+		token = void 0;
+	}
 	if (await ctx.context.adapter.findOne({
 		model: "member",
 		where: [{
 			field: "organizationId",
-			value: provider.organizationId
+			value: organizationId
 		}, {
 			field: "userId",
 			value: user.id
 		}]
-	})) return;
-	const role = provisioningOptions?.getRole ? await provisioningOptions.getRole({
+	})) return "already-member";
+	if (await ctx.context.adapter.findOne({
+		model: "invitation",
+		where: [
+			{
+				field: "organizationId",
+				value: organizationId
+			},
+			{
+				field: "email",
+				value: user.email.toLowerCase()
+			},
+			{
+				field: "status",
+				value: "pending"
+			}
+		]
+	})) return "invitation-pending";
+	const role = options.provisioningOptions?.getRole ? await options.provisioningOptions.getRole({
 		user,
-		userInfo: profile.rawAttributes || {},
+		userInfo,
 		token,
 		provider
-	}) : provisioningOptions?.defaultRole || "member";
+	}) : options.provisioningOptions?.defaultRole || "member";
 	await ctx.context.adapter.create({
 		model: "member",
 		data: {
-			organizationId: provider.organizationId,
+			organizationId,
 			userId: user.id,
 			role,
 			createdAt: /* @__PURE__ */ new Date()
 		}
 	});
+	return "assigned";
 }
 /**
-* Assigns a user to an organization based on their email domain.
-* Looks up SSO providers that match the user's email domain and assigns
-* the user to the associated organization.
-*
-* This enables domain-based org assignment for non-SSO sign-in methods
-* (e.g., Google OAuth with @acme.com email gets added to Acme's org).
+* Assigns a user to the organization explicitly bound to an SSO provider.
 */
-async function assignOrganizationByDomain(ctx, options) {
-	const { user, provisioningOptions, domainVerification } = options;
-	if (provisioningOptions?.disabled) return;
-	if (!ctx.context.hasPlugin("organization")) return;
-	const domain = user.email.split("@")[1];
-	if (!domain) return;
-	const whereClause = [{
-		field: "domain",
-		value: domain
-	}];
-	if (domainVerification?.enabled) whereClause.push({
-		field: "domainVerified",
-		value: true
-	});
-	let ssoProvider = await ctx.context.adapter.findOne({
-		model: "ssoProvider",
-		where: whereClause
+async function assignOrganizationFromProvider(ctx, options) {
+	await assignOrganization(ctx, {
+		reason: "provider-bound",
+		...options
 	});
-	if (!ssoProvider) ssoProvider = (await ctx.context.adapter.findMany({
-		model: "ssoProvider",
-		where: domainVerification?.enabled ? [{
-			field: "domainVerified",
-			value: true
-		}] : []
-	})).find((p) => domainMatches(domain, p.domain)) ?? null;
-	if (!ssoProvider || !ssoProvider.organizationId) return;
-	if (await ctx.context.adapter.findOne({
-		model: "member",
-		where: [{
-			field: "organizationId",
-			value: ssoProvider.organizationId
-		}, {
-			field: "userId",
-			value: user.id
-		}]
-	})) return;
-	const role = provisioningOptions?.getRole ? await provisioningOptions.getRole({
-		user,
-		userInfo: {},
-		provider: ssoProvider
-	}) : provisioningOptions?.defaultRole || "member";
-	await ctx.context.adapter.create({
-		model: "member",
-		data: {
-			organizationId: ssoProvider.organizationId,
-			userId: user.id,
-			role,
-			createdAt: /* @__PURE__ */ new Date()
-		}
+}
+/**
+* Assigns a verified user to the organization for their verified email domain.
+*/
+async function assignOrganizationByDomain(ctx, options) {
+	await assignOrganization(ctx, {
+		reason: "verified-domain",
+		...options
 	});
 }
 //#endregion
@@ -1555,6 +1584,23 @@ const deleteSSOProvider = () => {
 const DNS_LABEL_MAX_LENGTH = 63;
 const DEFAULT_TOKEN_PREFIX = "better-auth-token";
 const domainVerificationBodySchema = z.object({ providerId: z.string() });
+async function completeDomainVerification(adapter, provider) {
+	if (!await adapter.incrementOne({
+		model: "ssoProvider",
+		where: [{
+			field: "id",
+			value: provider.id
+		}, {
+			field: "domain",
+			value: provider.domain
+		}],
+		increment: {},
+		set: { domainVerified: true }
+	})) throw new APIError("CONFLICT", {
+		code: "SSO_PROVIDER_CHANGED",
+		message: "SSO provider changed while domain verification was in progress. Reload the provider and try again"
+	});
+}
 function getVerificationIdentifier(options, providerId) {
 	return `_${options.domainVerification?.tokenPrefix || DEFAULT_TOKEN_PREFIX}-${providerId}`;
 }
@@ -1604,7 +1650,7 @@ const verifyDomain = (options) => {
 			description: "Verify the provider domain ownership via DNS records",
 			responses: {
 				"404": { description: "Provider not found" },
-				"409": { description: "Domain has already been verified or no pending verification exists" },
+				"409": { description: "Domain has already been verified, or the provider changed while verification was in progress" },
 				"502": { description: "Unable to verify domain ownership due to upstream validator error" },
 				"204": { description: "Domain ownership was verified" }
 			}
@@ -1659,14 +1705,7 @@ const verifyDomain = (options) => {
 				code: "DOMAIN_VERIFICATION_FAILED"
 			});
 		}
-		await ctx.context.adapter.update({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: provider.providerId
-			}],
-			update: { domainVerified: true }
-		});
+		await completeDomainVerification(ctx.context.adapter, provider);
 		ctx.setStatus(204);
 	});
 };
@@ -2577,13 +2616,13 @@ const registerSSOProvider = (options) => {
 			if (!member) throw new APIError("BAD_REQUEST", { message: "You are not a member of the organization" });
 			if (ctx.context.hasPlugin("organization") && !hasOrgAdminRole(member)) throw new APIError("FORBIDDEN", { message: "You must be an organization owner or admin to register SSO providers" });
 		}
-		if ((/* @__PURE__ */ new Set([
+		if (new Set([
 			...BUILT_IN_ACCOUNT_PROVIDER_IDS,
 			...Object.keys(ctx.context.options.socialProviders ?? {}),
 			...ctx.context.socialProviders.map((p) => p.id),
 			...ctx.context.trustedProviders,
 			...options?.defaultSSO?.map((p) => p.providerId) ?? []
-		])).has(body.providerId)) {
+		]).has(body.providerId)) {
 			ctx.context.logger.warn(`SSO provider registration rejected for reserved providerId: ${body.providerId}`);
 			throw new APIError("UNPROCESSABLE_ENTITY", { message: "This providerId is reserved and cannot be used for an SSO provider" });
 		}

package/dist/{version-CPj5-4mL.mjs → version-6ZHwEASO.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.6.26";
+const PACKAGE_VERSION = "1.6.28";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.6.26",
+  "version": "1.6.28",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -65,20 +65,20 @@
   "devDependencies": {
     "@types/body-parser": "^1.19.6",
     "@types/express": "^5.0.6",
-    "better-call": "1.3.7",
+    "better-call": "1.4.0",
     "body-parser": "^2.3.0",
     "express": "^5.2.1",
     "oauth2-mock-server": "^8.2.2",
-    "tsdown": "0.22.7",
-    "@better-auth/core": "1.6.26",
-    "better-auth": "1.6.26"
+    "tsdown": "0.21.10",
+    "@better-auth/core": "1.6.28",
+    "better-auth": "1.6.28"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
-    "better-call": "1.3.7",
-    "@better-auth/core": "^1.6.26",
-    "better-auth": "^1.6.26"
+    "better-call": "1.4.0",
+    "@better-auth/core": "^1.6.28",
+    "better-auth": "^1.6.28"
   },
   "scripts": {
     "build": "tsdown",