@better-auth/sso 1.7.0-beta.4 → 1.7.0-beta.6

package/dist/client.d.mts

@@ -1,10 +1,18 @@
-import { t as SSOPlugin } from "./index-DCkGGu_2.mjs";
+import { t as SSOPlugin } from "./index-DsajaS2F.mjs";
+import { DBFieldAttribute } from "better-auth/db";
 
 //#region src/client.d.ts
 interface SSOClientOptions {
   domainVerification?: {
     enabled: boolean;
   } | undefined;
+  schema?: {
+    ssoProvider?: {
+      additionalFields?: {
+        [key: string]: DBFieldAttribute;
+      };
+    };
+  } | undefined;
 }
 declare const ssoClient: <CO extends SSOClientOptions>(options?: CO | undefined) => {
   id: "sso-client";
@@ -15,6 +23,7 @@ declare const ssoClient: <CO extends SSOClientOptions>(options?: CO | undefined)
         enabled: true;
       } ? true : false;
     };
+    schema: CO["schema"];
   }>;
   pathMethods: {
     "/sso/providers": "GET";

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-5EiO_U3Z.mjs";
+import { t as PACKAGE_VERSION } from "./version-BTlyLl-N.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-DCkGGu_2.d.mts → index-DsajaS2F.d.mts}

@@ -1,6 +1,7 @@
 import { APIError } from "better-auth/api";
 import * as z from "zod";
-import { Awaitable, BetterAuthPlugin, OAuth2Tokens, User } from "better-auth";
+import { DBFieldAttribute, FieldAttributeToObject, InferAdditionalFieldsFromPluginOptions, RemoveFieldsWithReturnedFalse } from "better-auth/db";
+import { Awaitable, OAuth2Tokens, User } from "better-auth";
 import * as better_call0 from "better-call";
 
 //#region src/saml/algorithms.d.ts
@@ -172,11 +173,32 @@ type BaseSSOProvider = {
   organizationId?: string | undefined;
   domain: string;
 };
+type SSOProviderAdditionalFields<O extends SSOOptions, IsClientSide extends boolean> = O["schema"] extends {
+  ssoProvider?: {
+    additionalFields: infer Field extends Record<string, DBFieldAttribute>;
+  };
+} ? IsClientSide extends true ? FieldAttributeToObject<RemoveFieldsWithReturnedFalse<Field>> : FieldAttributeToObject<Field> : {};
+type SSOProviderAdditionalFieldsInput<O extends SSOOptions, IsClientSide extends boolean = true> = InferAdditionalFieldsFromPluginOptions<"ssoProvider", O, IsClientSide>;
+type InferSSOProvider<O extends SSOOptions, IsClientSide extends boolean = true> = (O["domainVerification"] extends {
+  enabled: true;
+} ? {
+  domainVerified: boolean;
+} & BaseSSOProvider : BaseSSOProvider) & SSOProviderAdditionalFields<O, IsClientSide>;
 type SSOProvider<O extends SSOOptions> = O["domainVerification"] extends {
   enabled: true;
 } ? {
   domainVerified: boolean;
-} & BaseSSOProvider : BaseSSOProvider;
+} & BaseSSOProvider & SSOProviderAdditionalFields<O, false> : BaseSSOProvider & SSOProviderAdditionalFields<O, false>;
+type SSOProviderSchema<O extends SSOOptions> = {
+  ssoProvider: {
+    modelName: string;
+    fields: Record<string, DBFieldAttribute> & (O["schema"] extends {
+      ssoProvider?: {
+        additionalFields: infer Field extends Record<string, DBFieldAttribute>;
+      };
+    } ? Field : {});
+  };
+};
 interface SSOOptions {
   /**
    * custom function to provision a user when they sign in with an SSO provider.
@@ -298,6 +320,25 @@ interface SSOOptions {
     organizationId?: string | undefined;
     domain?: string | undefined;
   };
+  /**
+   * The schema for the SSO plugin.
+   */
+  schema?: {
+    ssoProvider?: {
+      modelName?: string | undefined;
+      fields?: {
+        issuer?: string | undefined;
+        oidcConfig?: string | undefined;
+        samlConfig?: string | undefined;
+        userId?: string | undefined;
+        providerId?: string | undefined;
+        organizationId?: string | undefined;
+        domain?: string | undefined;
+        domainVerified?: string | undefined;
+      };
+      additionalFields?: { [key in string]: DBFieldAttribute };
+    };
+  } | undefined;
   /**
    * Configure the maximum number of SSO providers a user can register.
    * You can also pass a function that returns a number.
@@ -605,7 +646,7 @@ type ParsedCert = ReturnType<typeof parseCertificate>;
 type SanitizedCert = ParsedCert | {
   error: string;
 };
-declare const listSSOProviders: () => better_call0.StrictEndpoint<"/sso/providers", {
+declare const listSSOProviders: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/providers", {
   method: "GET";
   use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
     session: {
@@ -674,7 +715,7 @@ declare const listSSOProviders: () => better_call0.StrictEndpoint<"/sso/provider
     spMetadataUrl: string;
   }[];
 }>;
-declare const getSSOProvider: () => better_call0.StrictEndpoint<"/sso/get-provider", {
+declare const getSSOProvider: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/get-provider", {
   method: "GET";
   use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
     session: {
@@ -976,87 +1017,7 @@ declare const spMetadata: (options?: SSOOptions) => better_call0.StrictEndpoint<
 declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_call0.StrictEndpoint<"/sso/register", {
   method: "POST";
   body: z.ZodObject<{
-    providerId: z.ZodString;
-    issuer: z.ZodString;
-    domain: z.ZodString;
-    oidcConfig: z.ZodOptional<z.ZodObject<{
-      clientId: z.ZodString;
-      clientSecret: z.ZodOptional<z.ZodString>;
-      authorizationEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpoint: z.ZodOptional<z.ZodString>;
-      userInfoEndpoint: z.ZodOptional<z.ZodString>;
-      tokenEndpointAuthentication: z.ZodOptional<z.ZodEnum<{
-        client_secret_post: "client_secret_post";
-        client_secret_basic: "client_secret_basic";
-        private_key_jwt: "private_key_jwt";
-      }>>;
-      privateKeyId: z.ZodOptional<z.ZodString>;
-      privateKeyAlgorithm: z.ZodOptional<z.ZodString>;
-      jwksEndpoint: z.ZodOptional<z.ZodString>;
-      discoveryEndpoint: z.ZodOptional<z.ZodString>;
-      skipDiscovery: z.ZodOptional<z.ZodBoolean>;
-      scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-      pkce: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-      overrideUserInfo: z.ZodOptional<z.ZodBoolean>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodString;
-        email: z.ZodString;
-        emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
-        image: z.ZodOptional<z.ZodString>;
-        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    samlConfig: z.ZodOptional<z.ZodObject<{
-      entryPoint: z.ZodString;
-      cert: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
-      audience: z.ZodOptional<z.ZodString>;
-      idpMetadata: z.ZodOptional<z.ZodObject<{
-        metadata: z.ZodOptional<z.ZodString>;
-        entityID: z.ZodOptional<z.ZodString>;
-        cert: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        privateKeyPass: z.ZodOptional<z.ZodString>;
-        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-        encPrivateKey: z.ZodOptional<z.ZodString>;
-        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-        singleSignOnService: z.ZodOptional<z.ZodArray<z.ZodObject<{
-          Binding: z.ZodString;
-          Location: z.ZodString;
-        }, z.core.$strip>>>;
-        singleLogoutService: z.ZodOptional<z.ZodArray<z.ZodObject<{
-          Binding: z.ZodString;
-          Location: z.ZodString;
-        }, z.core.$strip>>>;
-      }, z.core.$strip>>;
-      spMetadata: z.ZodOptional<z.ZodObject<{
-        metadata: z.ZodOptional<z.ZodString>;
-        entityID: z.ZodOptional<z.ZodString>;
-        binding: z.ZodOptional<z.ZodString>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        privateKeyPass: z.ZodOptional<z.ZodString>;
-        isAssertionEncrypted: z.ZodOptional<z.ZodBoolean>;
-        encPrivateKey: z.ZodOptional<z.ZodString>;
-        encPrivateKeyPass: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>>;
-      wantAssertionsSigned: z.ZodOptional<z.ZodBoolean>;
-      authnRequestsSigned: z.ZodOptional<z.ZodBoolean>;
-      signatureAlgorithm: z.ZodOptional<z.ZodString>;
-      digestAlgorithm: z.ZodOptional<z.ZodString>;
-      identifierFormat: z.ZodOptional<z.ZodString>;
-      privateKey: z.ZodOptional<z.ZodString>;
-      mapping: z.ZodOptional<z.ZodObject<{
-        id: z.ZodString;
-        email: z.ZodString;
-        emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
-        firstName: z.ZodOptional<z.ZodString>;
-        lastName: z.ZodOptional<z.ZodString>;
-        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    organizationId: z.ZodOptional<z.ZodString>;
-    overrideUserInfo: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    [x: string]: z.ZodOptional<z.ZodAny>;
   }, z.core.$strip>;
   use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
     session: {
@@ -1082,6 +1043,9 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
     };
   }>)[];
   metadata: {
+    $Infer: {
+      body: Record<string, any> & SSOProviderAdditionalFieldsInput<O>;
+    };
     openapi: {
       operationId: string;
       summary: string;
@@ -1248,14 +1212,14 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
   redirectURI: string;
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
-} & Omit<SSOProvider<O>, "oidcConfig" | "samlConfig"> & {
+} & Omit<InferSSOProvider<O>, "oidcConfig" | "samlConfig"> & {
   domainVerified: boolean;
   domainVerificationToken: string;
 } : {
   redirectURI: string;
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
-} & Omit<SSOProvider<O>, "oidcConfig" | "samlConfig">>;
+} & Omit<InferSSOProvider<O>, "oidcConfig" | "samlConfig">>;
 declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sign-in/sso", {
   method: "POST";
   body: z.ZodObject<{
@@ -1430,7 +1394,7 @@ declare const callbackSSOShared: (options?: SSOOptions) => better_call0.StrictEn
   allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
 }, void>;
 declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
-  method: ("POST" | "GET")[];
+  method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLResponse: z.ZodString;
     RelayState: z.ZodOptional<z.ZodString>;
@@ -1460,7 +1424,7 @@ declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint
   };
 }, never>;
 declare const sloEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
-  method: ("POST" | "GET")[];
+  method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLRequest: z.ZodOptional<z.ZodString>;
     SAMLResponse: z.ZodOptional<z.ZodString>;
@@ -1630,7 +1594,7 @@ interface OIDCDiscoveryDocument {
 /**
  * Error codes for OIDC discovery operations.
  */
-type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */ | "discovery_invalid_url" /** OIDC endpoint URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */ | "discovery_private_host" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
+type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */ | "discovery_invalid_url" /** OIDC endpoint URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */ | "discovery_private_host" /** Server-side OIDC endpoint fetch received an HTTP redirect response */ | "oidc_endpoint_redirect" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
 /**
  * Custom error class for OIDC discovery failures.
  * Can be caught and mapped to APIError at the edge.
@@ -1745,7 +1709,7 @@ declare function validateDiscoveryUrl(url: string, isTrustedOrigin: DiscoverOIDC
  * @returns The parsed discovery document
  * @throws DiscoveryError on network errors, timeouts, or invalid responses
  */
-declare function fetchDiscoveryDocument(url: string, timeout?: number): Promise<OIDCDiscoveryDocument>;
+declare function fetchDiscoveryDocument(url: string, timeout?: number, isTrustedOrigin?: (url: string) => boolean): Promise<OIDCDiscoveryDocument>;
 /**
  * Validate a discovery document.
  *
@@ -1836,6 +1800,11 @@ type SSOPlugin<O extends SSOOptions> = {
       enabled: true;
     };
   } ? DomainVerificationEndpoints : {});
+  schema: SSOProviderSchema<O>;
+  $Infer: {
+    SSOProvider: InferSSOProvider<O>;
+  };
+  options: NoInfer<O>;
 };
 declare function sso<O extends SSOOptions & {
   domainVerification?: {
@@ -1845,13 +1814,20 @@ declare function sso<O extends SSOOptions & {
   id: "sso";
   version: string;
   endpoints: SSOEndpoints<O> & DomainVerificationEndpoints;
-  schema: NonNullable<BetterAuthPlugin["schema"]>;
+  schema: SSOProviderSchema<O>;
+  $Infer: {
+    SSOProvider: InferSSOProvider<O>;
+  };
   options: NoInfer<O>;
 };
 declare function sso<O extends SSOOptions>(options?: O | undefined): {
   id: "sso";
   version: string;
   endpoints: SSOEndpoints<O>;
+  schema: SSOProviderSchema<O>;
+  $Infer: {
+    SSOProvider: InferSSOProvider<O>;
+  };
   options: NoInfer<O>;
 };
 //#endregion

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as DataEncryptionAlgorithm, C as DEFAULT_MAX_SAML_METADATA_SIZE, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as DEFAULT_CLOCK_SKEW_MS, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as DEFAULT_MAX_SAML_RESPONSE_SIZE, x as validateSAMLTimestamp, y as SAMLConditions } from "./index-DCkGGu_2.mjs";
+import { A as DataEncryptionAlgorithm, C as DEFAULT_MAX_SAML_METADATA_SIZE, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as DEFAULT_CLOCK_SKEW_MS, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as DEFAULT_MAX_SAML_RESPONSE_SIZE, x as validateSAMLTimestamp, y as SAMLConditions } from "./index-DsajaS2F.mjs";
 export { AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DeprecatedAlgorithmBehavior, DigestAlgorithm, DiscoverOIDCConfigParams, DiscoveryError, DiscoveryErrorCode, HydratedOIDCConfig, KeyEncryptionAlgorithm, OIDCConfig, OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, RequiredDiscoveryField, SAMLConditions, SAMLConfig, SSOOptions, SSOPlugin, SSOProvider, SignatureAlgorithm, TimestampValidationOptions, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };