@better-auth/sso 1.7.0-rc.2 → 1.7.0-rc.3

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { t as SSOPlugin } from "./index-D1yk91me.mjs";
+import { t as SSOPlugin } from "./index-Sxfa9KQp.mjs";
 import { DBFieldAttribute } from "better-auth/db";
 //#region src/client.d.ts
 interface SSOClientOptions {

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-m-Zfjx6T.mjs";
+import { t as PACKAGE_VERSION } from "./version-xoFrTW0m.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-D1yk91me.d.mts → index-Sxfa9KQp.d.mts}

@@ -1,8 +1,10 @@
 import { APIError } from "better-auth/api";
 import * as z from "zod";
 import "@better-fetch/fetch";
+import samlifyDefault from "samlify";
 import { DBFieldAttribute, FieldAttributeToObject, InferAdditionalFieldsFromPluginOptions, RemoveFieldsWithReturnedFalse } from "better-auth/db";
 import { Awaitable, DBTransactionAdapter, OAuth2Tokens, User } from "better-auth";
+import "@better-auth/core/db/adapter";
 import "@better-auth/core";
 //#region src/saml/algorithms.d.ts
 declare const SignatureAlgorithm: {
@@ -173,9 +175,10 @@ interface SAMLConfig {
     encPrivateKeyPass?: string | undefined;
   };
   /**
-   * Request signed assertions from the IdP. When true, the SP metadata
-   * advertises `WantAssertionsSigned="true"` and samlify will reject
-   * unsigned assertions.
+   * Request and require signed assertions from the IdP. When true, generated
+   * SP metadata advertises `WantAssertionsSigned="true"` and the ACS rejects
+   * unsigned assertions. Custom SP metadata supplies the effective policy and
+   * accepts the XML Schema boolean forms `true`, `false`, `1`, and `0`.
    */
   wantAssertionsSigned?: boolean | undefined;
   authnRequestsSigned?: boolean | undefined;
@@ -239,37 +242,106 @@ type SSOProviderUserProfile = {
   name: string;
   image?: string | null | undefined;
 } & Record<string, unknown>;
-/** OIDC identity and profile data available to an application's SSO resolver. */
-interface SSOUserResolutionInput {
-  protocol: "oidc";
+/**
+ * Opaque reference to the SSO provider configuration accepted for the current
+ * authentication flow.
+ *
+ * This reference is a transient authentication fence. Applications must not
+ * persist it as a tenant or user binding.
+ */
+interface SSOProviderReference {
+  providerId: string;
+  source: {
+    type: "configured";
+  } | {
+    type: "persisted";
+    recordId: string;
+  };
+  authenticationConfigurationFingerprint: string;
+}
+interface BaseSSOUserResolutionInput {
   providerId: string;
   accountKey: {
     issuer: string;
     providerAccountId: string;
   };
   providerUser: SSOProviderUserProfile;
+  providerReference: SSOProviderReference;
+}
+/** OIDC identity and profile data available to an application's SSO resolver. */
+interface SSOOIDCUserResolutionInput extends BaseSSOUserResolutionInput {
+  protocol: "oidc";
+  /** Raw claims from UserInfo, or the verified ID Token when UserInfo is absent. */
   providerClaims: Record<string, unknown>;
+  /** Claims from the cryptographically verified ID Token. */
+  verifiedIdTokenClaims: Record<string, unknown>;
+}
+/** SAML identity and assertion data available to an application's SSO resolver. */
+interface SSOSAMLUserResolutionInput extends BaseSSOUserResolutionInput {
+  protocol: "saml";
+  /**
+   * Attributes from the verified assertion. Multi-valued attributes remain
+   * arrays and all scalar values remain strings.
+   */
+  providerAttributes: Record<string, string | readonly string[]>;
 }
+/** Verified SSO identity and provider data available to an application resolver. */
+type SSOUserResolutionInput = SSOOIDCUserResolutionInput | SSOSAMLUserResolutionInput;
 /** Transaction-bound capabilities available while resolving an SSO user. */
 interface SSOUserResolutionContext {
   database: DBTransactionAdapter;
 }
+interface BaseSSOProviderMutationGuardInput {
+  provider: {
+    id: string;
+    providerId: string;
+    organizationId: string | null;
+  };
+  /**
+   * Opaque reference to the exact locked provider configuration.
+   *
+   * This value is transient and must not be persisted as a tenant binding.
+   */
+  providerReference: SSOProviderReference;
+}
+/** Mutation attempted against one exact persisted SSO provider row. */
+type SSOProviderMutationGuardInput = (BaseSSOProviderMutationGuardInput & {
+  action: "update";
+  /**
+   * True when the validated proposal changes provider identity,
+   * routing, or verification policy used to authenticate accounts.
+   */
+  isAuthenticationBoundaryChange: boolean;
+}) | (BaseSSOProviderMutationGuardInput & {
+  action: "delete";
+});
+/** Transaction-bound context for guarding a persisted provider mutation. */
+interface SSOProviderMutationGuardContext {
+  database: DBTransactionAdapter;
+}
 interface SSOOptions {
   /**
    * Resolve a verified provider identity to a Better Auth user.
    *
-   * Currently invoked for OIDC callbacks only.
+   * For OIDC, `accountKey` is derived from the validated ID Token. For SAML,
+   * it contains the verified IdP entity ID and signed NameID. Profile fields,
+   * raw OIDC claims, and SAML assertion attributes are protocol-accepted
+   * provider data and may require application-level validation.
    *
-   * TODO: Invoke this resolver for SAML callbacks after normalizing the verified
-   * IdP entity ID as `accountKey.issuer` and the signed NameID as
-   * `accountKey.providerAccountId`.
-   *
-   * `accountKey` is derived from the validated ID Token. Profile fields and raw
-   * claims are protocol-accepted provider data and may require application-level
-   * validation. The callback runs on every OIDC sign-in inside the same native
-   * database transaction as account finalization and session creation.
+   * The callback runs on every SSO sign-in inside the same native database
+   * transaction as account finalization and session creation.
    */
   resolveUser?: ((input: SSOUserResolutionInput, context: SSOUserResolutionContext) => Awaitable<SSOUserResolution>) | undefined;
+  /**
+   * Guards updates and deletion of an exact persisted SSO provider.
+   *
+   * The callback runs after the provider row is locked and before any provider
+   * or linked Account mutation. Update inputs disclose only whether the
+   * validated proposal changes the authentication boundary; proposed secrets
+   * and configuration values are never exposed. Throw to reject the mutation.
+   * Better Auth converts callback failures into a stable conflict response.
+   */
+  guardProviderMutation?: ((input: SSOProviderMutationGuardInput, context: SSOProviderMutationGuardContext) => Awaitable<void>) | undefined;
   /**
    * custom function to provision a user when they sign in with an SSO provider.
    */
@@ -576,7 +648,7 @@ interface SSOOptions {
      */
     maxResponseSize?: number;
     /**
-     * Maximum allowed size for IdP metadata XML in bytes.
+     * Maximum allowed size for IdP or SP metadata XML in bytes.
      *
      * @default 102400 (100KB)
      */
@@ -927,9 +999,15 @@ declare const updateSSOProvider: (options: SSOOptions) => import("better-call").
     }, z.core.$strip>>;
     samlConfig: z.ZodOptional<z.ZodObject<{
       audience: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-      cert: z.ZodOptional<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
-      entryPoint: z.ZodOptional<z.ZodString>;
-      callbackUrl: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+        email: z.ZodString;
+        emailVerified: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        firstName: z.ZodOptional<z.ZodString>;
+        lastName: z.ZodOptional<z.ZodString>;
+        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+      }, z.core.$strict>>>;
+      privateKey: z.ZodOptional<z.ZodOptional<z.ZodString>>;
       spMetadata: z.ZodOptional<z.ZodOptional<z.ZodObject<{
         metadata: z.ZodOptional<z.ZodString>;
         entityID: z.ZodOptional<z.ZodString>;
@@ -940,20 +1018,14 @@ declare const updateSSOProvider: (options: SSOOptions) => import("better-call").
         encPrivateKey: z.ZodOptional<z.ZodString>;
         encPrivateKeyPass: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>>>;
+      cert: z.ZodOptional<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+      entryPoint: z.ZodOptional<z.ZodString>;
+      callbackUrl: z.ZodOptional<z.ZodOptional<z.ZodString>>;
       wantAssertionsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
       authnRequestsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
       signatureAlgorithm: z.ZodOptional<z.ZodOptional<z.ZodString>>;
       digestAlgorithm: z.ZodOptional<z.ZodOptional<z.ZodString>>;
       identifierFormat: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-      privateKey: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-      mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
-        email: z.ZodString;
-        emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
-        firstName: z.ZodOptional<z.ZodString>;
-        lastName: z.ZodOptional<z.ZodString>;
-        extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-      }, z.core.$strict>>>;
       idpInitiatedCallbackUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
       idpMetadata: z.ZodOptional<z.ZodObject<{
         cert: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
@@ -1026,7 +1098,7 @@ declare const updateSSOProvider: (options: SSOOptions) => import("better-call").
   } | undefined;
   spMetadataUrl: string;
 }>;
-declare const deleteSSOProvider: () => import("better-call").StrictEndpoint<"/sso/delete-provider", {
+declare const deleteSSOProvider: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/delete-provider", {
   method: "POST";
   use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
@@ -1576,6 +1648,25 @@ declare const DEFAULT_MAX_SAML_RESPONSE_SIZE: number;
  */
 declare const DEFAULT_MAX_SAML_METADATA_SIZE: number;
 //#endregion
+//#region src/routes/helpers.d.ts
+interface SAMLServiceProviderPolicy {
+  /** Effective assertion-signing requirement advertised by SP metadata. */
+  wantAssertionsSigned: boolean;
+}
+/**
+ * Parses custom SP metadata and returns its effective verification policy.
+ *
+ * Configurations without custom metadata use the code-defined policy directly.
+ * Invalid or unusable custom metadata throws an API error with the
+ * `SAML_INVALID_SP_METADATA` code.
+ */
+declare function deriveSAMLServiceProviderPolicy(config: Pick<SAMLConfig, "spMetadata" | "wantAssertionsSigned">): SAMLServiceProviderPolicy;
+/**
+ * Derive the verified SAML identity-provider entity ID using the same metadata
+ * parsing and manual-configuration validation as SAML authentication.
+ */
+declare function deriveSAMLIdentityProviderEntityID(config: SAMLConfig): string;
+//#endregion
 //#region src/saml/timestamp.d.ts
 interface TimestampValidationOptions {
   clockSkew?: number;
@@ -1930,4 +2021,4 @@ declare function sso<O extends SSOOptions>(options?: O | undefined): {
   options: NoInfer<O>;
 };
 //#endregion
-export { SSOProviderUserProfile as A, DEFAULT_MAX_SAML_METADATA_SIZE as C, SAMLIdentityProviderMetadata as D, SAMLConfig as E, DataEncryptionAlgorithm as F, DeprecatedAlgorithmBehavior as I, DigestAlgorithm as L, SSOUserResolutionContext as M, SSOUserResolutionInput as N, SSOOptions as O, AlgorithmValidationOptions as P, KeyEncryptionAlgorithm as R, DEFAULT_CLOCK_SKEW_MS as S, OIDCConfig as T, REQUIRED_DISCOVERY_FIELDS as _, fetchDiscoveryDocument as a, TimestampValidationOptions as b, normalizeUrl as c, validateDiscoveryUrl as d, DiscoverOIDCConfigParams as f, OIDCDiscoveryDocument as g, HydratedOIDCConfig as h, discoverOIDCConfig as i, SSOUserResolution as j, SSOProvider as k, selectTokenEndpointAuthMethod as l, DiscoveryErrorCode as m, sso as n, needsRuntimeDiscovery as o, DiscoveryError as p, computeDiscoveryUrl as r, normalizeDiscoveryUrls as s, SSOPlugin as t, validateDiscoveryDocument as u, RequiredDiscoveryField as v, DEFAULT_MAX_SAML_RESPONSE_SIZE as w, validateSAMLTimestamp as x, SAMLConditions as y, SignatureAlgorithm as z };
+export { SAMLIdentityProviderMetadata as A, SSOUserResolutionContext as B, deriveSAMLIdentityProviderEntityID as C, DEFAULT_MAX_SAML_RESPONSE_SIZE as D, DEFAULT_MAX_SAML_METADATA_SIZE as E, SSOProviderMutationGuardInput as F, DigestAlgorithm as G, AlgorithmValidationOptions as H, SSOProviderReference as I, KeyEncryptionAlgorithm as K, SSOProviderUserProfile as L, SSOOptions as M, SSOProvider as N, OIDCConfig as O, SSOProviderMutationGuardContext as P, SSOSAMLUserResolutionInput as R, SAMLServiceProviderPolicy as S, DEFAULT_CLOCK_SKEW_MS as T, DataEncryptionAlgorithm as U, SSOUserResolutionInput as V, DeprecatedAlgorithmBehavior as W, REQUIRED_DISCOVERY_FIELDS as _, fetchDiscoveryDocument as a, TimestampValidationOptions as b, normalizeUrl as c, validateDiscoveryUrl as d, DiscoverOIDCConfigParams as f, OIDCDiscoveryDocument as g, HydratedOIDCConfig as h, discoverOIDCConfig as i, SSOOIDCUserResolutionInput as j, SAMLConfig as k, selectTokenEndpointAuthMethod as l, DiscoveryErrorCode as m, sso as n, needsRuntimeDiscovery as o, DiscoveryError as p, SignatureAlgorithm as q, computeDiscoveryUrl as r, normalizeDiscoveryUrls as s, SSOPlugin as t, validateDiscoveryDocument as u, RequiredDiscoveryField as v, deriveSAMLServiceProviderPolicy as w, validateSAMLTimestamp as x, SAMLConditions as y, SSOUserResolution as z };

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as SSOProviderUserProfile, C as DEFAULT_MAX_SAML_METADATA_SIZE, D as SAMLIdentityProviderMetadata, E as SAMLConfig, F as DataEncryptionAlgorithm, I as DeprecatedAlgorithmBehavior, L as DigestAlgorithm, M as SSOUserResolutionContext, N as SSOUserResolutionInput, O as SSOOptions, P as AlgorithmValidationOptions, R as KeyEncryptionAlgorithm, S as DEFAULT_CLOCK_SKEW_MS, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOUserResolution, k as SSOProvider, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as DEFAULT_MAX_SAML_RESPONSE_SIZE, x as validateSAMLTimestamp, y as SAMLConditions, z as SignatureAlgorithm } from "./index-D1yk91me.mjs";
-export { type AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, type DeprecatedAlgorithmBehavior, DigestAlgorithm, type DiscoverOIDCConfigParams, DiscoveryError, type DiscoveryErrorCode, type HydratedOIDCConfig, KeyEncryptionAlgorithm, type OIDCConfig, type OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, type RequiredDiscoveryField, type SAMLConditions, type SAMLConfig, type SAMLIdentityProviderMetadata, type SSOOptions, SSOPlugin, type SSOProvider, type SSOProviderUserProfile, type SSOUserResolution, type SSOUserResolutionContext, type SSOUserResolutionInput, SignatureAlgorithm, type TimestampValidationOptions, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };
+import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-Sxfa9KQp.mjs";
+export { type AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, type DeprecatedAlgorithmBehavior, DigestAlgorithm, type DiscoverOIDCConfigParams, DiscoveryError, type DiscoveryErrorCode, type HydratedOIDCConfig, KeyEncryptionAlgorithm, type OIDCConfig, type OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, type RequiredDiscoveryField, type SAMLConditions, type SAMLConfig, type SAMLIdentityProviderMetadata, type SAMLServiceProviderPolicy, type SSOOIDCUserResolutionInput, type SSOOptions, SSOPlugin, type SSOProvider, type SSOProviderMutationGuardContext, type SSOProviderMutationGuardInput, type SSOProviderReference, type SSOProviderUserProfile, type SSOSAMLUserResolutionInput, type SSOUserResolution, type SSOUserResolutionContext, type SSOUserResolutionInput, SignatureAlgorithm, type TimestampValidationOptions, computeDiscoveryUrl, deriveSAMLIdentityProviderEntityID, deriveSAMLServiceProviderPolicy, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };