@better-auth/sso 1.7.0-beta.8 → 1.7.0-rc.0

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { t as SSOPlugin } from "./index-DsajaS2F.mjs";
+import { t as SSOPlugin } from "./index-A_DJ_AqL.mjs";
 import { DBFieldAttribute } from "better-auth/db";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-DPq9tYZW.mjs";
+import { t as PACKAGE_VERSION } from "./version-BDD29zmX.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-DsajaS2F.d.mts → index-A_DJ_AqL.d.mts}

@@ -113,6 +113,11 @@ interface SAMLConfig {
    */
   cert?: string | string[];
   audience?: string | undefined;
+  /**
+   * Provider-level post-auth redirect URL for IdP-initiated or fallback SAML
+   * flows when no RelayState callback URL is available.
+   */
+  callbackUrl?: string | undefined;
   idpMetadata?: {
     metadata?: string;
     entityID?: string;
@@ -851,6 +856,7 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
       entryPoint: z.ZodOptional<z.ZodString>;
       cert: z.ZodOptional<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
       audience: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      callbackUrl: z.ZodOptional<z.ZodOptional<z.ZodString>>;
       idpMetadata: z.ZodOptional<z.ZodOptional<z.ZodObject<{
         metadata: z.ZodOptional<z.ZodString>;
         entityID: z.ZodOptional<z.ZodString>;

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as DataEncryptionAlgorithm, C as DEFAULT_MAX_SAML_METADATA_SIZE, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as DEFAULT_CLOCK_SKEW_MS, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as DEFAULT_MAX_SAML_RESPONSE_SIZE, x as validateSAMLTimestamp, y as SAMLConditions } from "./index-DsajaS2F.mjs";
+import { A as DataEncryptionAlgorithm, C as DEFAULT_MAX_SAML_METADATA_SIZE, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as DEFAULT_CLOCK_SKEW_MS, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as DEFAULT_MAX_SAML_RESPONSE_SIZE, x as validateSAMLTimestamp, y as SAMLConditions } from "./index-A_DJ_AqL.mjs";
 export { AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DeprecatedAlgorithmBehavior, DigestAlgorithm, DiscoverOIDCConfigParams, DiscoveryError, DiscoveryErrorCode, HydratedOIDCConfig, KeyEncryptionAlgorithm, OIDCConfig, OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, RequiredDiscoveryField, SAMLConditions, SAMLConfig, SSOOptions, SSOPlugin, SSOProvider, SignatureAlgorithm, TimestampValidationOptions, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };

package/dist/index.mjs

@@ -1,10 +1,11 @@
-import { t as PACKAGE_VERSION } from "./version-DPq9tYZW.mjs";
+import { t as PACKAGE_VERSION } from "./version-BDD29zmX.mjs";
 import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
 import { getHostname } from "tldts";
 import { generateRandomString } from "better-auth/crypto";
 import * as z from "zod";
+import { getCurrentAdapter, runWithTransaction } from "@better-auth/core/context";
 import { filterOutputFields } from "@better-auth/core/utils/db";
 import { classifyHost, isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { betterFetch } from "@better-fetch/fetch";
@@ -82,8 +83,10 @@ function safeJsonParse(value) {
 * Checks if a domain matches any domain in a comma-separated list.
 */
 const domainMatches = (searchDomain, domainList) => {
-	const search = searchDomain.toLowerCase();
-	return domainList.split(",").map((d) => d.trim().toLowerCase()).filter(Boolean).some((d) => search === d || search.endsWith(`.${d}`));
+	const search = searchDomain.trim().toLowerCase();
+	const domains = parseProviderDomains(domainList);
+	if (!search || !domains) return false;
+	return domains.some((domain) => search === domain || search.endsWith(`.${domain}`));
 };
 /**
 * Strictly parse a provider-supplied email-verification claim.
@@ -120,6 +123,24 @@ function normalizePem(key) {
 function getHostnameFromDomain(domain) {
 	return getHostname(domain) || null;
 }
+/**
+* Normalize a provider `domain` value to the email domains it authorizes.
+*
+* TODO(next): replace the serialized provider.domain string with a canonical
+* domains array and reject URL/path-shaped values at register/update once main
+* and next provider schemas are reconciled.
+*/
+function parseProviderDomains(domain) {
+	const entries = domain.split(",").map((entry) => entry.trim()).filter(Boolean);
+	if (entries.length === 0) return null;
+	const domains = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		const parsedDomain = getHostnameFromDomain(entry)?.toLowerCase();
+		if (!parsedDomain) return null;
+		domains.add(parsedDomain);
+	}
+	return [...domains];
+}
 function maskClientId(clientId) {
 	if (clientId.length <= 4) return "****";
 	return `****${clientId.slice(-4)}`;
@@ -1083,6 +1104,119 @@ function validateCertSources(config) {
 	if (!hasMetadataXml && !hasExplicitCert) throw APIError.from("BAD_REQUEST", SAML_ERROR_CODES.CERT_SOURCE_MISSING);
 }
 //#endregion
+//#region src/saml/response-binding.ts
+const SAML_HTTP_POST_BINDING = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+const SAML_BEARER_CONFIRMATION_METHOD = "urn:oasis:names:tc:SAML:2.0:cm:bearer";
+function toNode(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	return value;
+}
+function toNodeArray(value) {
+	if (Array.isArray(value)) return value.map(toNode).filter((node) => !!node);
+	const node = toNode(value);
+	return node ? [node] : [];
+}
+function firstNode(value) {
+	return toNodeArray(value)[0] ?? null;
+}
+function toStringArray(value) {
+	if (typeof value === "string") return [value];
+	if (Array.isArray(value)) return value.flatMap(toStringArray);
+	const text = toNode(value)?.["#text"];
+	return typeof text === "string" ? [text] : [];
+}
+function toStringSet(values) {
+	return new Set(values.filter((value) => !!value));
+}
+function parseSAMLContent(samlContent) {
+	try {
+		const parsed = toNode(xmlParser.parse(samlContent));
+		if (parsed) return parsed;
+	} catch {}
+	throw new APIError("BAD_REQUEST", {
+		message: "SAML response XML could not be parsed",
+		code: "SAML_RESPONSE_INVALID_XML"
+	});
+}
+function getSAMLPostAssertionConsumerServiceUrls(metadata) {
+	if (!metadata) return [];
+	try {
+		const locations = toNodeArray(findNode(toNode(xmlParser.parse(metadata)), "SPSSODescriptor")).flatMap((descriptor) => toNodeArray(descriptor.AssertionConsumerService).filter((service) => service["@_Binding"] === SAML_HTTP_POST_BINDING).map((service) => service["@_Location"]).filter((location) => typeof location === "string" && !!location));
+		return [...new Set(locations)];
+	} catch {
+		return [];
+	}
+}
+function hasSAMLEncryptedAssertion(samlContent) {
+	try {
+		return countAllNodes(xmlParser.parse(samlContent), "EncryptedAssertion") > 0;
+	} catch {
+		return false;
+	}
+}
+function getResponseNode(parsed) {
+	return firstNode(parsed.Response);
+}
+function getAssertionNode(parsed, response) {
+	const assertion = firstNode(response?.Assertion) ?? firstNode(parsed.Assertion);
+	if (assertion) return assertion;
+	throw new APIError("BAD_REQUEST", {
+		message: "SAML response is missing an assertion",
+		code: "SAML_ASSERTION_MISSING"
+	});
+}
+function getAudienceRestrictionGroups(assertion) {
+	return toNodeArray(firstNode(assertion.Conditions)?.AudienceRestriction).map((restriction) => toStringArray(restriction.Audience).filter(Boolean));
+}
+function validateAudienceRestrictions(assertion, expectedAudiences) {
+	const audienceGroups = getAudienceRestrictionGroups(assertion);
+	if (audienceGroups.length === 0 || audienceGroups.every((group) => !group.length)) throw new APIError("BAD_REQUEST", {
+		message: "SAML assertion is missing an AudienceRestriction",
+		code: "SAML_AUDIENCE_MISSING"
+	});
+	if (audienceGroups.some((group) => !group.some((audience) => expectedAudiences.has(audience)))) throw new APIError("BAD_REQUEST", {
+		message: "SAML assertion audience does not match this Service Provider",
+		code: "SAML_AUDIENCE_MISMATCH"
+	});
+}
+function getBearerSubjectConfirmationData(assertion) {
+	return toNodeArray(firstNode(assertion.Subject)?.SubjectConfirmation).filter((confirmation) => confirmation["@_Method"] === SAML_BEARER_CONFIRMATION_METHOD).map((confirmation) => firstNode(confirmation.SubjectConfirmationData)).filter((data) => !!data);
+}
+function validateBearerRecipient(assertion, expectedRecipients) {
+	const confirmationData = getBearerSubjectConfirmationData(assertion);
+	if (!confirmationData.length) throw new APIError("BAD_REQUEST", {
+		message: "SAML assertion is missing bearer SubjectConfirmationData",
+		code: "SAML_BEARER_CONFIRMATION_MISSING"
+	});
+	const recipients = confirmationData.map((data) => data["@_Recipient"]).filter((recipient) => typeof recipient === "string");
+	if (!recipients.length) throw new APIError("BAD_REQUEST", {
+		message: "SAML bearer SubjectConfirmationData is missing a Recipient",
+		code: "SAML_RECIPIENT_MISSING"
+	});
+	if (!recipients.some((recipient) => expectedRecipients.has(recipient))) throw new APIError("BAD_REQUEST", {
+		message: "SAML bearer SubjectConfirmationData Recipient does not match this Service Provider",
+		code: "SAML_RECIPIENT_MISMATCH"
+	});
+}
+function validateResponseDestination(response, expectedRecipients) {
+	const destination = response?.["@_Destination"];
+	if (typeof destination !== "string" || !destination) return;
+	if (!expectedRecipients.has(destination)) throw new APIError("BAD_REQUEST", {
+		message: "SAML response Destination does not match this Service Provider",
+		code: "SAML_DESTINATION_MISMATCH"
+	});
+}
+function validateSAMLResponseBinding(samlContent, options) {
+	const expectedAudiences = toStringSet(options.expectedAudiences);
+	const expectedRecipients = toStringSet(options.expectedRecipients);
+	const parsed = parseSAMLContent(samlContent);
+	const response = getResponseNode(parsed);
+	const assertion = getAssertionNode(parsed, response);
+	validateAudienceRestrictions(assertion, expectedAudiences);
+	validateBearerRecipient(assertion, expectedRecipients);
+	validateResponseDestination(response, expectedRecipients);
+}
+//#endregion
 //#region src/saml/response-validation.ts
 function errorRedirectUrl(base, error, description) {
 	try {
@@ -1236,6 +1370,7 @@ const samlConfigSchema = z.object({
 	entryPoint: z.string().url().meta({ description: "The IdP SSO URL (entry point)" }),
 	cert: signingCertSchema.meta({ description: "IdP signing certificate(s). Pass a single PEM string or an array for rolling rotation. Omit when `idpMetadata.metadata` XML carries the certs. When both this and `idpMetadata.cert` are set, `idpMetadata.cert` wins." }).optional(),
 	audience: z.string().optional(),
+	callbackUrl: z.string().refine((url) => !url.includes("#"), { message: "callbackUrl must not contain a fragment" }).optional(),
 	idpMetadata: z.object({
 		metadata: z.string().optional(),
 		entityID: z.string().optional(),
@@ -1299,6 +1434,84 @@ function getUpdateSSOProviderBodySchema(options) {
 //#endregion
 //#region src/routes/providers.ts
 const ADMIN_ROLES = ["owner", "admin"];
+const OIDC_IDENTITY_BOUNDARY_FIELDS = [
+	"authorizationEndpoint",
+	"clientId",
+	"discoveryEndpoint",
+	"jwksEndpoint",
+	"tokenEndpoint",
+	"userInfoEndpoint"
+];
+const SAML_IDENTITY_BOUNDARY_FIELDS = [
+	"audience",
+	"callbackUrl",
+	"entryPoint",
+	"identifierFormat"
+];
+const SAML_IDP_BOUNDARY_FIELDS = [
+	"metadata",
+	"entityID",
+	"singleSignOnService"
+];
+const SAML_SP_BOUNDARY_FIELDS = ["metadata", "entityID"];
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stableStringify(value) {
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	if (isRecord(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
+	return JSON.stringify(value) ?? String(value);
+}
+function identityValueChanged(current, updated) {
+	return stableStringify(current) !== stableStringify(updated);
+}
+function hasChangedField(current, updated, fields) {
+	return fields.some((field) => identityValueChanged(current?.[field], updated?.[field]));
+}
+function oidcIdentityBoundaryChanged(current, updated) {
+	return hasChangedField(current, updated, OIDC_IDENTITY_BOUNDARY_FIELDS) || identityValueChanged(current.mapping?.id, updated.mapping?.id);
+}
+function samlIdentityBoundaryChanged(current, updated) {
+	return hasChangedField(current, updated, SAML_IDENTITY_BOUNDARY_FIELDS) || identityValueChanged(current.mapping?.id, updated.mapping?.id) || hasChangedField(current.idpMetadata, updated.idpMetadata, SAML_IDP_BOUNDARY_FIELDS) || hasChangedField(current.spMetadata, updated.spMetadata, SAML_SP_BOUNDARY_FIELDS);
+}
+function parseConfigSnapshot(config, configType) {
+	if (!config) return;
+	if (typeof config === "string") return parseAndValidateConfig(config, configType);
+	return config;
+}
+function ssoProviderIdentityBoundaryChanged(current, updated) {
+	if (identityValueChanged(current.issuer, updated.issuer)) return true;
+	const currentSamlConfig = parseConfigSnapshot(current.samlConfig, "SAML");
+	const updatedSamlConfig = parseConfigSnapshot(updated.samlConfig, "SAML");
+	if (currentSamlConfig && (!updatedSamlConfig || samlIdentityBoundaryChanged(currentSamlConfig, updatedSamlConfig))) return true;
+	const currentOidcConfig = parseConfigSnapshot(current.oidcConfig, "OIDC");
+	const updatedOidcConfig = parseConfigSnapshot(updated.oidcConfig, "OIDC");
+	return Boolean(currentOidcConfig && (!updatedOidcConfig || oidcIdentityBoundaryChanged(currentOidcConfig, updatedOidcConfig)));
+}
+async function lockSSOProviderRow(adapter, providerId) {
+	return (await getCurrentAdapter(adapter)).update({
+		model: "ssoProvider",
+		where: [{
+			field: "providerId",
+			value: providerId
+		}],
+		update: { providerId }
+	});
+}
+async function lockSSOProviderForAccountLink(ctx, provider) {
+	const lockedProvider = await lockSSOProviderRow(ctx.context.adapter, provider.providerId);
+	if (!lockedProvider) {
+		if (provider.userId === "default") return;
+		throw new APIError("CONFLICT", {
+			code: "SSO_PROVIDER_CHANGED",
+			message: "SSO provider changed while account linking was in progress"
+		});
+	}
+	if (ssoProviderIdentityBoundaryChanged(provider, lockedProvider)) throw new APIError("CONFLICT", {
+		code: "SSO_PROVIDER_CHANGED",
+		message: "SSO provider changed while account linking was in progress"
+	});
+}
 function getSSOProviderAdditionalFields(options) {
 	return options?.schema?.ssoProvider?.additionalFields ?? {};
 }
@@ -1494,6 +1707,7 @@ function mergeSAMLConfig(current, updates, issuer) {
 		idpMetadata: updates.idpMetadata ?? current.idpMetadata,
 		mapping: updates.mapping ?? current.mapping,
 		audience: updates.audience ?? current.audience,
+		callbackUrl: updates.callbackUrl ?? current.callbackUrl,
 		wantAssertionsSigned: updates.wantAssertionsSigned ?? current.wantAssertionsSigned,
 		authnRequestsSigned: updates.authnRequestsSigned ?? current.authnRequestsSigned,
 		identifierFormat: updates.identifierFormat ?? current.identifierFormat,
@@ -1542,56 +1756,74 @@ const updateSSOProvider = (options) => {
 		const { issuer, domain, samlConfig, oidcConfig } = body;
 		const additionalFields = parseSSOProviderAdditionalFields(options, body, "update");
 		if (!issuer && !domain && !samlConfig && !oidcConfig && Object.keys(additionalFields).length === 0) throw new APIError("BAD_REQUEST", { message: "No fields provided for update" });
-		const existingProvider = await checkProviderAccess(ctx, providerId);
-		const updateData = { ...additionalFields };
-		if (body.issuer !== void 0) updateData.issuer = body.issuer;
-		if (body.domain !== void 0) {
-			updateData.domain = body.domain;
-			if (body.domain !== existingProvider.domain) updateData.domainVerified = false;
-		}
-		if (body.samlConfig) {
-			if (body.samlConfig.idpMetadata?.metadata) {
-				const maxMetadataSize = options?.saml?.maxMetadataSize ?? 102400;
-				if (new TextEncoder().encode(body.samlConfig.idpMetadata.metadata).length > maxMetadataSize) throw new APIError("BAD_REQUEST", { message: `IdP metadata exceeds maximum allowed size (${maxMetadataSize} bytes)` });
+		await checkProviderAccess(ctx, providerId);
+		const fullProvider = await runWithTransaction(ctx.context.adapter, async () => {
+			const trx = await getCurrentAdapter(ctx.context.adapter);
+			const existingProvider = await lockSSOProviderRow(ctx.context.adapter, providerId);
+			if (!existingProvider) throw new APIError("NOT_FOUND", { message: "Provider not found" });
+			const updateData = { ...additionalFields };
+			let providerIdentityBoundaryChanged = body.issuer !== void 0 && body.issuer !== existingProvider.issuer;
+			if (body.issuer !== void 0) updateData.issuer = body.issuer;
+			if (body.domain !== void 0) {
+				updateData.domain = body.domain;
+				if (body.domain !== existingProvider.domain) updateData.domainVerified = false;
 			}
-			if (body.samlConfig.signatureAlgorithm !== void 0 || body.samlConfig.digestAlgorithm !== void 0) validateConfigAlgorithms({
-				signatureAlgorithm: body.samlConfig.signatureAlgorithm,
-				digestAlgorithm: body.samlConfig.digestAlgorithm
-			}, options?.saml?.algorithms);
-			const currentSamlConfig = parseAndValidateConfig(existingProvider.samlConfig, "SAML");
-			const updatedSamlConfig = mergeSAMLConfig(currentSamlConfig, body.samlConfig, updateData.issuer || currentSamlConfig.issuer || existingProvider.issuer);
-			validateCertSources(updatedSamlConfig);
-			updateData.samlConfig = JSON.stringify(updatedSamlConfig);
-		}
-		if (body.oidcConfig) {
-			try {
-				validateOIDCEndpointUrls(body.oidcConfig, (url) => ctx.context.isTrustedOrigin(url));
-			} catch (error) {
-				if (error instanceof DiscoveryError) throw mapDiscoveryErrorToAPIError(error);
-				throw error;
+			if (body.samlConfig) {
+				if (body.samlConfig.idpMetadata?.metadata) {
+					const maxMetadataSize = options?.saml?.maxMetadataSize ?? 102400;
+					if (new TextEncoder().encode(body.samlConfig.idpMetadata.metadata).length > maxMetadataSize) throw new APIError("BAD_REQUEST", { message: `IdP metadata exceeds maximum allowed size (${maxMetadataSize} bytes)` });
+				}
+				if (body.samlConfig.signatureAlgorithm !== void 0 || body.samlConfig.digestAlgorithm !== void 0) validateConfigAlgorithms({
+					signatureAlgorithm: body.samlConfig.signatureAlgorithm,
+					digestAlgorithm: body.samlConfig.digestAlgorithm
+				}, options?.saml?.algorithms);
+				const currentSamlConfig = parseAndValidateConfig(existingProvider.samlConfig, "SAML");
+				const updatedSamlConfig = mergeSAMLConfig(currentSamlConfig, body.samlConfig, updateData.issuer || currentSamlConfig.issuer || existingProvider.issuer);
+				validateCertSources(updatedSamlConfig);
+				if (samlIdentityBoundaryChanged(currentSamlConfig, updatedSamlConfig)) providerIdentityBoundaryChanged = true;
+				updateData.samlConfig = JSON.stringify(updatedSamlConfig);
 			}
-			const currentOidcConfig = parseAndValidateConfig(existingProvider.oidcConfig, "OIDC");
-			const updatedOidcConfig = mergeOIDCConfig(currentOidcConfig, body.oidcConfig, updateData.issuer || currentOidcConfig.issuer || existingProvider.issuer);
-			if (updatedOidcConfig.tokenEndpointAuthentication !== "private_key_jwt" && !updatedOidcConfig.clientSecret) throw new APIError("BAD_REQUEST", { message: "clientSecret is required when using client_secret_basic or client_secret_post authentication" });
-			if (updatedOidcConfig.tokenEndpointAuthentication === "private_key_jwt" && !options?.resolvePrivateKey && !options?.defaultSSO?.some((p) => p.providerId === providerId && "privateKey" in p && p.privateKey)) throw new APIError("BAD_REQUEST", { message: "private_key_jwt authentication requires either a resolvePrivateKey callback or a privateKey in defaultSSO" });
-			updateData.oidcConfig = JSON.stringify(updatedOidcConfig);
-		}
-		await ctx.context.adapter.update({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: providerId
-			}],
-			update: updateData
-		});
-		const fullProvider = await ctx.context.adapter.findOne({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: providerId
-			}]
+			if (body.oidcConfig) {
+				try {
+					validateOIDCEndpointUrls(body.oidcConfig, (url) => ctx.context.isTrustedOrigin(url));
+				} catch (error) {
+					if (error instanceof DiscoveryError) throw mapDiscoveryErrorToAPIError(error);
+					throw error;
+				}
+				const currentOidcConfig = parseAndValidateConfig(existingProvider.oidcConfig, "OIDC");
+				const updatedOidcConfig = mergeOIDCConfig(currentOidcConfig, body.oidcConfig, updateData.issuer || currentOidcConfig.issuer || existingProvider.issuer);
+				if (updatedOidcConfig.tokenEndpointAuthentication !== "private_key_jwt" && !updatedOidcConfig.clientSecret) throw new APIError("BAD_REQUEST", { message: "clientSecret is required when using client_secret_basic or client_secret_post authentication" });
+				if (updatedOidcConfig.tokenEndpointAuthentication === "private_key_jwt" && !options?.resolvePrivateKey && !options?.defaultSSO?.some((p) => p.providerId === providerId && "privateKey" in p && p.privateKey)) throw new APIError("BAD_REQUEST", { message: "private_key_jwt authentication requires either a resolvePrivateKey callback or a privateKey in defaultSSO" });
+				if (oidcIdentityBoundaryChanged(currentOidcConfig, updatedOidcConfig)) providerIdentityBoundaryChanged = true;
+				updateData.oidcConfig = JSON.stringify(updatedOidcConfig);
+			}
+			if (providerIdentityBoundaryChanged) {
+				if (await trx.findOne({
+					model: "account",
+					where: [{
+						field: "providerId",
+						value: providerId
+					}]
+				})) throw new APIError("CONFLICT", { message: "Cannot change SSO provider identity fields while linked accounts exist" });
+			}
+			await trx.update({
+				model: "ssoProvider",
+				where: [{
+					field: "providerId",
+					value: providerId
+				}],
+				update: updateData
+			});
+			const updatedProvider = await trx.findOne({
+				model: "ssoProvider",
+				where: [{
+					field: "providerId",
+					value: providerId
+				}]
+			});
+			if (!updatedProvider) throw new APIError("NOT_FOUND", { message: "Provider not found after update" });
+			return updatedProvider;
 		});
-		if (!fullProvider) throw new APIError("NOT_FOUND", { message: "Provider not found after update" });
 		return ctx.json(sanitizeProvider(fullProvider, ctx.context.baseURL, options));
 	});
 };
@@ -1613,12 +1845,22 @@ const deleteSSOProvider = () => {
 	}, async (ctx) => {
 		const { providerId } = ctx.body;
 		await checkProviderAccess(ctx, providerId);
-		await ctx.context.adapter.delete({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: providerId
-			}]
+		await runWithTransaction(ctx.context.adapter, async () => {
+			const trx = await getCurrentAdapter(ctx.context.adapter);
+			await trx.deleteMany({
+				model: "account",
+				where: [{
+					field: "providerId",
+					value: providerId
+				}]
+			});
+			await trx.delete({
+				model: "ssoProvider",
+				where: [{
+					field: "providerId",
+					value: providerId
+				}]
+			});
 		});
 		return ctx.json({ success: true });
 	});
@@ -1700,7 +1942,6 @@ const verifyDomain = (options) => {
 			message: "No pending domain verification exists",
 			code: "NO_PENDING_VERIFICATION"
 		});
-		let records = [];
 		let dns;
 		try {
 			dns = await import("node:dns/promises");
@@ -1711,20 +1952,28 @@ const verifyDomain = (options) => {
 				code: "DOMAIN_VERIFICATION_FAILED"
 			});
 		}
-		const hostname = getHostnameFromDomain(provider.domain);
-		if (!hostname) throw new APIError("BAD_REQUEST", {
+		const domains = parseProviderDomains(provider.domain);
+		if (!domains) throw new APIError("BAD_REQUEST", {
 			message: "Invalid domain",
 			code: "INVALID_DOMAIN"
 		});
-		try {
-			records = (await dns.resolveTxt(`${identifier}.${hostname}`)).flat();
-		} catch (error) {
-			ctx.context.logger.warn("DNS resolution failure while validating domain ownership", error);
+		for (const domain of domains) {
+			let records = [];
+			try {
+				records = (await dns.resolveTxt(`${identifier}.${domain}`)).map((record) => record.join(""));
+			} catch (error) {
+				ctx.context.logger.warn(`DNS resolution failure while validating domain ownership for ${domain}`, error);
+			}
+			const verificationValue = activeVerification.value;
+			const verificationRecord = `${activeVerification.identifier}=${verificationValue}`;
+			if (!records.find((record) => {
+				const normalizedRecord = record.trim();
+				return normalizedRecord === verificationRecord || normalizedRecord === verificationValue;
+			})) throw new APIError("BAD_GATEWAY", {
+				message: `Unable to verify domain ownership for ${domain}. Try again later`,
+				code: "DOMAIN_VERIFICATION_FAILED"
+			});
 		}
-		if (!records.find((record) => record.includes(`${activeVerification.identifier}=${activeVerification.value}`))) throw new APIError("BAD_GATEWAY", {
-			message: "Unable to verify domain ownership. Try again later",
-			code: "DOMAIN_VERIFICATION_FAILED"
-		});
 		await ctx.context.adapter.update({
 			model: "ssoProvider",
 			where: [{
@@ -1877,7 +2126,17 @@ function escapeHtml(str) {
 	if (!str) return "";
 	return String(str).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+function isSAMLPostBindingLocation(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return false;
+	}
+	return url.protocol === "http:" || url.protocol === "https:";
+}
 function createSAMLPostForm(action, samlParam, samlValue, relayState) {
+	if (!isSAMLPostBindingLocation(action)) throw new APIError("BAD_REQUEST", { message: "SAML POST binding location must be an absolute http or https URL" });
 	const safeAction = escapeHtml(action);
 	const safeSamlParam = escapeHtml(samlParam);
 	const safeSamlValue = escapeHtml(samlValue);
@@ -1947,6 +2206,14 @@ function getSafeRedirectUrl(url, callbackPath, appOrigin, isTrustedOrigin) {
 		}
 		return url;
 	}
+	try {
+		const absoluteUrl = new URL(url);
+		if (absoluteUrl.origin === appOrigin) {
+			const callbackPathname = new URL(callbackPath).pathname;
+			if (absoluteUrl.pathname === callbackPathname) return appOrigin;
+			return url;
+		}
+	} catch {}
 	if (!isTrustedOrigin(url, { allowRelativePaths: false })) return appOrigin;
 	try {
 		const callbackPathname = new URL(callbackPath).pathname;
@@ -1956,6 +2223,39 @@ function getSafeRedirectUrl(url, callbackPath, appOrigin, isTrustedOrigin) {
 	}
 	return url;
 }
+function buildSAMLRedirectUrl(url, params) {
+	const searchParams = new URLSearchParams(params);
+	try {
+		const isRelativePath = url.startsWith("/") && !url.startsWith("//");
+		const parsedUrl = new URL(url, "http://better-auth.local");
+		for (const [key, value] of searchParams) parsedUrl.searchParams.set(key, value);
+		if (isRelativePath) return `${parsedUrl.pathname}${parsedUrl.search}${parsedUrl.hash}`;
+		return parsedUrl.toString();
+	} catch {
+		const hashIndex = url.indexOf("#");
+		const urlWithoutFragment = hashIndex === -1 ? url : url.slice(0, hashIndex);
+		const fragment = hashIndex === -1 ? "" : url.slice(hashIndex);
+		return `${urlWithoutFragment}${urlWithoutFragment.includes("?") ? "&" : "?"}${searchParams.toString()}${fragment}`;
+	}
+}
+function toArray(value) {
+	if (Array.isArray(value)) return value;
+	return value ? [value] : [];
+}
+function getExpectedSAMLRecipients(config, baseURL, providerId, currentCallbackPath, assertionConsumerServiceUrl) {
+	const configuredPostAssertionConsumerServiceUrls = getSAMLPostAssertionConsumerServiceUrls(config.spMetadata?.metadata);
+	return [
+		currentCallbackPath,
+		`${baseURL}/sso/saml2/sp/acs/${providerId}`,
+		...configuredPostAssertionConsumerServiceUrls,
+		...toArray(assertionConsumerServiceUrl)
+	];
+}
+async function getSAMLResponseBindingContent(sp, samlContent) {
+	if (!hasSAMLEncryptedAssertion(samlContent)) return samlContent;
+	const [decryptedContent] = await saml.SamlLib.decryptAssertion(sp, samlContent);
+	return decryptedContent;
+}
 /**
 * Extracts the Assertion ID from a SAML response XML.
 * Used for replay protection per SAML 2.0 Core section 2.3.3.
@@ -2004,7 +2304,7 @@ async function processSAMLResponse(ctx, params, options) {
 	if (!parsedSamlConfig) throw new APIError("BAD_REQUEST", { message: "Invalid SAML configuration" });
 	const sp = createSP(parsedSamlConfig, ctx.context.baseURL, providerId, { clockSkew: options?.saml?.clockSkew });
 	const idp = createIdP(parsedSamlConfig);
-	const samlRedirectUrl = getSafeRedirectUrl(relayState?.callbackURL, params.currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	const samlRedirectUrl = getSafeRedirectUrl(relayState?.callbackURL || parsedSamlConfig.callbackUrl, params.currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
 	validateSingleAssertion(SAMLResponse);
 	let parsedResponse;
 	try {
@@ -2024,12 +2324,47 @@ async function processSAMLResponse(ctx, params, options) {
 		});
 	}
 	const { extract } = parsedResponse;
+	const samlContent = parsedResponse.samlContent;
 	validateSAMLAlgorithms(parsedResponse, options?.saml?.algorithms);
 	validateSAMLTimestamp(extract.conditions, {
 		clockSkew: options?.saml?.clockSkew,
 		requireTimestamps: options?.saml?.requireTimestamps,
 		logger: ctx.context.logger
 	});
+	const expectedAudiences = [sp.entityMeta.getEntityID(), parsedSamlConfig.audience];
+	const assertionConsumerServiceUrl = sp.entityMeta.getAssertionConsumerService(SAML_HTTP_POST_BINDING);
+	const expectedRecipients = getExpectedSAMLRecipients(parsedSamlConfig, ctx.context.baseURL, providerId, currentCallbackPath, assertionConsumerServiceUrl);
+	let samlBindingContent;
+	try {
+		samlBindingContent = await getSAMLResponseBindingContent(sp, samlContent);
+		validateSAMLResponseBinding(samlBindingContent, {
+			expectedAudiences,
+			expectedRecipients
+		});
+	} catch (error) {
+		if (isAPIError(error)) {
+			ctx.context.logger.error("SAML response binding validation failed", {
+				providerId,
+				code: error.body?.code,
+				expectedAudiences: expectedAudiences.filter(Boolean),
+				expectedRecipients: expectedRecipients.filter(Boolean)
+			});
+			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+				error: "invalid_saml_response",
+				error_description: error.body?.message || error.message || "Invalid SAML response"
+			}));
+		}
+		ctx.context.logger.error("SAML response binding validation failed", {
+			providerId,
+			error,
+			expectedAudiences: expectedAudiences.filter(Boolean),
+			expectedRecipients: expectedRecipients.filter(Boolean)
+		});
+		throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+			error: "invalid_saml_response",
+			error_description: "SAML response binding could not be validated"
+		}));
+	}
 	await validateInResponseTo(ctx, {
 		extract,
 		providerId,
@@ -2045,8 +2380,7 @@ async function processSAMLResponse(ctx, params, options) {
 		providerId,
 		redirectUrl: samlRedirectUrl
 	});
-	const samlContent = parsedResponse.samlContent;
-	const assertionId = samlContent ? extractAssertionId(samlContent) : null;
+	const assertionId = extractAssertionId(samlBindingContent);
 	if (assertionId) {
 		const issuer = idp.entityMeta.getEntityID();
 		const conditions = extract.conditions;
@@ -2068,7 +2402,10 @@ async function processSAMLResponse(ctx, params, options) {
 				issuer,
 				providerId
 			});
-			throw ctx.redirect(`${samlRedirectUrl}?error=replay_detected&error_description=SAML+assertion+has+already+been+used`);
+			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+				error: "replay_detected",
+				error_description: "SAML assertion has already been used"
+			}));
 		}
 	} else ctx.context.logger.warn("Could not extract assertion ID for replay protection", { providerId });
 	const attributes = extract.attributes || {};
@@ -2094,45 +2431,46 @@ async function processSAMLResponse(ctx, params, options) {
 		throw new APIError("BAD_REQUEST", { message: "Unable to extract user ID or email from SAML response" });
 	}
 	const isTrustedProvider = "domainVerified" in provider && !!provider.domainVerified && validateEmailDomain(userInfo.email, provider.domain);
-	const postAuthRedirect = relayState?.callbackURL || ctx.context.baseURL;
+	const callbackUrl = relayState?.callbackURL || parsedSamlConfig.callbackUrl || ctx.context.baseURL;
 	const errorUrl = relayState?.errorURL || samlRedirectUrl;
 	let result;
 	try {
-		result = await handleOAuthUserInfo(ctx, {
-			userInfo: {
-				email: userInfo.email,
-				name: userInfo.name || userInfo.email,
-				id: userInfo.id,
-				emailVerified: userInfo.emailVerified
-			},
-			account: {
-				providerId,
-				accountId: userInfo.id,
-				accessToken: "",
-				refreshToken: ""
-			},
-			callbackURL: postAuthRedirect,
-			disableSignUp: options?.disableImplicitSignUp,
-			source: {
-				method: "sso-saml",
-				sso: {
+		result = await runWithTransaction(ctx.context.adapter, async () => {
+			await lockSSOProviderForAccountLink(ctx, provider);
+			return handleOAuthUserInfo(ctx, {
+				userInfo: {
+					email: userInfo.email,
+					name: userInfo.name || userInfo.email,
+					id: userInfo.id,
+					emailVerified: userInfo.emailVerified
+				},
+				account: {
 					providerId,
-					profile: attributes
-				}
-			},
-			isTrustedProvider,
-			trustProviderByName: false
+					accountId: userInfo.id,
+					accessToken: "",
+					refreshToken: ""
+				},
+				callbackURL: callbackUrl,
+				disableSignUp: options?.disableImplicitSignUp,
+				source: {
+					method: "sso-saml",
+					sso: {
+						providerId,
+						profile: attributes
+					}
+				},
+				isTrustedProvider,
+				trustProviderByName: false
+			});
 		});
 	} catch (e) {
-		if (isAPIError(e) && e.body?.code) {
-			const params = new URLSearchParams({ error: e.body.code });
-			if (e.body.message) params.set("error_description", e.body.message);
-			const sep = errorUrl.includes("?") ? "&" : "?";
-			throw ctx.redirect(`${errorUrl}${sep}${params.toString()}`);
-		}
+		if (isAPIError(e) && e.body?.code) throw ctx.redirect(buildSAMLRedirectUrl(errorUrl, {
+			error: e.body.code,
+			...e.body.message ? { error_description: e.body.message } : {}
+		}));
 		throw e;
 	}
-	if (result.error) throw ctx.redirect(`${samlRedirectUrl}?error=${result.error.split(" ").join("_")}`);
+	if (result.error) throw ctx.redirect(buildSAMLRedirectUrl(callbackUrl, { error: result.error.split(" ").join("_") }));
 	const { session, user } = result.data;
 	if (options?.provisionUser && (result.isRegister || options.provisionUserOnEveryLogin)) await options.provisionUser({
 		user,
@@ -2176,10 +2514,18 @@ async function processSAMLResponse(ctx, params, options) {
 			expiresAt: session.expiresAt
 		}).catch((e) => ctx.context.logger.warn("Failed to create SAML session lookup record", e));
 	}
-	return getSafeRedirectUrl(relayState?.callbackURL, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	return getSafeRedirectUrl(relayState?.callbackURL || parsedSamlConfig.callbackUrl, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
 }
 //#endregion
 //#region src/routes/sso.ts
+const BUILT_IN_ACCOUNT_PROVIDER_IDS = [
+	"credential",
+	"email-otp",
+	"magic-link",
+	"phone-number",
+	"anonymous",
+	"siwe"
+];
 /**
 * Builds the OIDC redirect URI. Uses the shared `redirectURI` option
 * when set, otherwise falls back to `/sso/callback/:providerId`.
@@ -2423,13 +2769,27 @@ const registerSSOProvider = (options) => {
 			if (ctx.context.hasPlugin("organization") && !hasOrgAdminRole(member)) throw new APIError("FORBIDDEN", { message: "You must be an organization owner or admin to register SSO providers" });
 		}
 		if (new Set([
-			"credential",
+			...BUILT_IN_ACCOUNT_PROVIDER_IDS,
+			...Object.keys(ctx.context.options.socialProviders ?? {}),
 			...ctx.context.socialProviders.map((p) => p.id),
-			...ctx.context.trustedProviders
+			...ctx.context.trustedProviders,
+			...options?.defaultSSO?.map((p) => p.providerId) ?? []
 		]).has(body.providerId)) {
 			ctx.context.logger.warn(`SSO provider registration rejected for reserved providerId: ${body.providerId}`);
 			throw new APIError("UNPROCESSABLE_ENTITY", { message: "This providerId is reserved and cannot be used for an SSO provider" });
 		}
+		if (ctx.context.hasPlugin("scim")) {
+			if (await ctx.context.adapter.findOne({
+				model: "scimProvider",
+				where: [{
+					field: "providerId",
+					value: body.providerId
+				}]
+			})) {
+				ctx.context.logger.warn(`SSO provider registration rejected for SCIM providerId: ${body.providerId}`);
+				throw new APIError("UNPROCESSABLE_ENTITY", { message: "This providerId is already used by a SCIM provider and cannot be used for an SSO provider" });
+			}
+		}
 		if (await ctx.context.adapter.findOne({
 			model: "ssoProvider",
 			where: [{
@@ -2538,6 +2898,7 @@ const registerSSOProvider = (options) => {
 					entryPoint: body.samlConfig.entryPoint,
 					cert: body.samlConfig.cert,
 					audience: body.samlConfig.audience,
+					callbackUrl: body.samlConfig.callbackUrl,
 					idpMetadata: body.samlConfig.idpMetadata,
 					spMetadata: body.samlConfig.spMetadata,
 					wantAssertionsSigned: body.samlConfig.wantAssertionsSigned,
@@ -2692,7 +3053,7 @@ const signInSSO = (options) => {
 		});
 		let provider = null;
 		if (options?.defaultSSO?.length) {
-			const matchingDefault = providerId ? options.defaultSSO.find((defaultProvider) => defaultProvider.providerId === providerId) : options.defaultSSO.find((defaultProvider) => defaultProvider.domain === domain);
+			const matchingDefault = providerId ? options.defaultSSO.find((defaultProvider) => defaultProvider.providerId === providerId) : options.defaultSSO.find((defaultProvider) => domain && domainMatches(domain, defaultProvider.domain));
 			if (matchingDefault) provider = {
 				issuer: matchingDefault.samlConfig?.issuer || matchingDefault.oidcConfig?.issuer || "",
 				providerId: matchingDefault.providerId,
@@ -2966,39 +3327,44 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 		};
 	} else throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=user_info_endpoint_not_found`);
 	if (!userInfo.email || !userInfo.id) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=missing_user_info`);
-	const isTrustedProvider = "domainVerified" in provider && provider.domainVerified === true && validateEmailDomain(userInfo.email, provider.domain);
+	const userInfoEmail = userInfo.email;
+	const userInfoId = userInfo.id;
+	const isTrustedProvider = "domainVerified" in provider && provider.domainVerified === true && validateEmailDomain(userInfoEmail, provider.domain);
 	let linked;
 	try {
-		linked = await handleOAuthUserInfo(ctx, {
-			userInfo: {
-				email: userInfo.email,
-				name: userInfo.name || "",
-				id: userInfo.id,
-				image: userInfo.image,
-				emailVerified: options?.trustEmailVerified ? userInfo.emailVerified || false : false
-			},
-			account: {
-				idToken: tokenResponse.idToken,
-				accessToken: tokenResponse.accessToken,
-				refreshToken: tokenResponse.refreshToken,
-				accountId: userInfo.id,
-				providerId: provider.providerId,
-				accessTokenExpiresAt: tokenResponse.accessTokenExpiresAt,
-				refreshTokenExpiresAt: tokenResponse.refreshTokenExpiresAt,
-				scope: tokenResponse.scopes?.join(",")
-			},
-			callbackURL,
-			disableSignUp: options?.disableImplicitSignUp && !requestSignUp,
-			overrideUserInfo: config.overrideUserInfo,
-			source: {
-				method: "sso-oidc",
-				sso: {
+		linked = await runWithTransaction(ctx.context.adapter, async () => {
+			await lockSSOProviderForAccountLink(ctx, provider);
+			return handleOAuthUserInfo(ctx, {
+				userInfo: {
+					email: userInfoEmail,
+					name: userInfo.name || "",
+					id: userInfoId,
+					image: userInfo.image,
+					emailVerified: options?.trustEmailVerified ? userInfo.emailVerified || false : false
+				},
+				account: {
+					idToken: tokenResponse.idToken,
+					accessToken: tokenResponse.accessToken,
+					refreshToken: tokenResponse.refreshToken,
+					accountId: userInfoId,
 					providerId: provider.providerId,
-					profile: rawProfile
-				}
-			},
-			isTrustedProvider,
-			trustProviderByName: false
+					accessTokenExpiresAt: tokenResponse.accessTokenExpiresAt,
+					refreshTokenExpiresAt: tokenResponse.refreshTokenExpiresAt,
+					scope: tokenResponse.scopes?.join(",")
+				},
+				callbackURL,
+				disableSignUp: options?.disableImplicitSignUp && !requestSignUp,
+				overrideUserInfo: config.overrideUserInfo,
+				source: {
+					method: "sso-oidc",
+					sso: {
+						providerId: provider.providerId,
+						profile: rawProfile
+					}
+				},
+				isTrustedProvider,
+				trustProviderByName: false
+			});
 		});
 	} catch (e) {
 		if (isAPIError(e) && e.body?.code) {
@@ -3028,8 +3394,8 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 		profile: {
 			providerType: "oidc",
 			providerId: provider.providerId,
-			accountId: userInfo.id,
-			email: userInfo.email,
+			accountId: userInfoId,
+			email: userInfoEmail,
 			emailVerified: Boolean(userInfo.emailVerified),
 			rawAttributes: userInfo
 		},

package/dist/{version-DPq9tYZW.mjs → version-BDD29zmX.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-beta.8";
+const PACKAGE_VERSION = "1.7.0-rc.0";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.7.0-beta.8",
+  "version": "1.7.0-rc.0",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -57,28 +57,28 @@
   },
   "dependencies": {
     "fast-xml-parser": "^5.8.0",
-    "jose": "^6.1.3",
+    "jose": "^6.2.3",
     "samlify": "^2.13.1",
-    "tldts": "^6.1.0",
+    "tldts": "^7.4.3",
     "zod": "^4.3.6"
   },
   "devDependencies": {
     "@types/body-parser": "^1.19.6",
     "@types/express": "^5.0.6",
-    "better-call": "1.3.6",
+    "better-call": "1.3.7",
     "body-parser": "^2.2.2",
     "express": "^5.2.1",
-    "oauth2-mock-server": "^8.2.2",
+    "oauth2-mock-server": "^9.0.0",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-beta.8",
-    "better-auth": "1.7.0-beta.8"
+    "@better-auth/core": "1.7.0-rc.0",
+    "better-auth": "1.7.0-rc.0"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
-    "better-call": "1.3.6",
-    "@better-auth/core": "^1.7.0-beta.8",
-    "better-auth": "^1.7.0-beta.8"
+    "better-call": "1.3.7",
+    "@better-auth/core": "^1.7.0-rc.0",
+    "better-auth": "^1.7.0-rc.0"
   },
   "scripts": {
     "build": "tsdown",