@better-auth/sso 1.7.0-beta.6 → 1.7.0-beta.8

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BTlyLl-N.mjs";
+import { t as PACKAGE_VERSION } from "./version-DPq9tYZW.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BTlyLl-N.mjs";
+import { t as PACKAGE_VERSION } from "./version-DPq9tYZW.mjs";
 import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
@@ -15,7 +15,7 @@ import { parseInputData, toZodSchema } from "better-auth/db";
 import { isAPIError } from "@better-auth/core/utils/is-api-error";
 import { HIDE_METADATA, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, authorizationCodeRequest, createAuthorizationURL, createPrivateKeyJwtClientAssertionGetter, generateGenericState, generateState, getOAuth2Tokens, parseGenericState, parseState } from "better-auth";
 import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
-import { additionalAuthorizationParamsSchema, signInWithOAuthIdentity } from "better-auth/oauth2";
+import { additionalAuthorizationParamsSchema, handleOAuthUserInfo } from "better-auth/oauth2";
 import * as samlifyNamespace from "samlify";
 import samlifyDefault from "samlify";
 //#region src/constants.ts
@@ -2098,16 +2098,19 @@ async function processSAMLResponse(ctx, params, options) {
 	const errorUrl = relayState?.errorURL || samlRedirectUrl;
 	let result;
 	try {
-		result = await signInWithOAuthIdentity(ctx, {
+		result = await handleOAuthUserInfo(ctx, {
 			userInfo: {
 				email: userInfo.email,
 				name: userInfo.name || userInfo.email,
 				id: userInfo.id,
 				emailVerified: userInfo.emailVerified
 			},
-			providerId,
-			accountId: userInfo.id,
-			tokens: {},
+			account: {
+				providerId,
+				accountId: userInfo.id,
+				accessToken: "",
+				refreshToken: ""
+			},
 			callbackURL: postAuthRedirect,
 			disableSignUp: options?.disableImplicitSignUp,
 			source: {
@@ -2743,16 +2746,10 @@ const signInSSO = (options) => {
 				throw error;
 			}
 			if (!config.authorizationEndpoint) throw new APIError("BAD_REQUEST", { message: "Invalid OIDC configuration. Authorization URL not found." });
-			const requestedScopes = ctx.body.scopes || config.scopes || [
-				"openid",
-				"email",
-				"profile",
-				"offline_access"
-			];
 			if (options?.redirectURI?.trim()) await addOAuthServerContext({ ssoProviderId: provider.providerId });
-			const state = await generateState(ctx, { requestedScopes });
+			const state = await generateState(ctx);
 			const redirectURI = getOIDCRedirectURI(ctx.context.baseURL, provider.providerId, options);
-			const { url: authorizationURL } = await createAuthorizationURL({
+			const authorizationURL = await createAuthorizationURL({
 				id: provider.issuer,
 				options: {
 					clientId: config.clientId,
@@ -2761,7 +2758,12 @@ const signInSSO = (options) => {
 				redirectURI,
 				state: state.state,
 				codeVerifier: config.pkce ? state.codeVerifier : void 0,
-				scopes: requestedScopes,
+				scopes: ctx.body.scopes || config.scopes || [
+					"openid",
+					"email",
+					"profile",
+					"offline_access"
+				],
 				loginHint: ctx.body.loginHint || email,
 				authorizationEndpoint: config.authorizationEndpoint,
 				additionalParams: ctx.body.additionalParams
@@ -2840,7 +2842,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 		const errorURL = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
 		throw ctx.redirect(`${errorURL}?error=invalid_state`);
 	}
-	const { callbackURL, errorURL, newUserURL, requestSignUp, requestedScopes } = stateData;
+	const { callbackURL, errorURL, newUserURL, requestSignUp } = stateData;
 	const redirectOIDCError = (error, description) => {
 		const baseURL = errorURL || callbackURL;
 		const params = new URLSearchParams({
@@ -2967,7 +2969,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 	const isTrustedProvider = "domainVerified" in provider && provider.domainVerified === true && validateEmailDomain(userInfo.email, provider.domain);
 	let linked;
 	try {
-		linked = await signInWithOAuthIdentity(ctx, {
+		linked = await handleOAuthUserInfo(ctx, {
 			userInfo: {
 				email: userInfo.email,
 				name: userInfo.name || "",
@@ -2975,10 +2977,16 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 				image: userInfo.image,
 				emailVerified: options?.trustEmailVerified ? userInfo.emailVerified || false : false
 			},
-			providerId: provider.providerId,
-			accountId: userInfo.id,
-			tokens: tokenResponse,
-			requestedScopes,
+			account: {
+				idToken: tokenResponse.idToken,
+				accessToken: tokenResponse.accessToken,
+				refreshToken: tokenResponse.refreshToken,
+				accountId: userInfo.id,
+				providerId: provider.providerId,
+				accessTokenExpiresAt: tokenResponse.accessTokenExpiresAt,
+				refreshTokenExpiresAt: tokenResponse.refreshTokenExpiresAt,
+				scope: tokenResponse.scopes?.join(",")
+			},
 			callbackURL,
 			disableSignUp: options?.disableImplicitSignUp && !requestSignUp,
 			overrideUserInfo: config.overrideUserInfo,
@@ -3109,14 +3117,9 @@ async function bounceIfIdpInitiated(ctx, options, providerId) {
 		return;
 	}
 	if (options?.redirectURI?.trim()) await addOAuthServerContext({ ssoProviderId: provider.providerId });
-	const state = await generateState(ctx, { requestedScopes: config.scopes || [
-		"openid",
-		"email",
-		"profile",
-		"offline_access"
-	] });
+	const state = await generateState(ctx);
 	const redirectURI = getOIDCRedirectURI(ctx.context.baseURL, provider.providerId, options);
-	const { url: authorizationURL } = await createAuthorizationURL({
+	const authorizationURL = await createAuthorizationURL({
 		id: provider.issuer,
 		options: {
 			clientId: config.clientId,

package/dist/{version-BTlyLl-N.mjs → version-DPq9tYZW.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-beta.6";
+const PACKAGE_VERSION = "1.7.0-beta.8";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.7.0-beta.6",
+  "version": "1.7.0-beta.8",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -70,15 +70,15 @@
     "express": "^5.2.1",
     "oauth2-mock-server": "^8.2.2",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-beta.6",
-    "better-auth": "1.7.0-beta.6"
+    "@better-auth/core": "1.7.0-beta.8",
+    "better-auth": "1.7.0-beta.8"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
     "better-call": "1.3.6",
-    "@better-auth/core": "^1.7.0-beta.6",
-    "better-auth": "^1.7.0-beta.6"
+    "@better-auth/core": "^1.7.0-beta.8",
+    "better-auth": "^1.7.0-beta.8"
   },
   "scripts": {
     "build": "tsdown",