@better-auth/sso 1.7.0-rc.3 → 1.7.0-rc.5

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { t as SSOPlugin } from "./index-Sxfa9KQp.mjs";
+import { t as SSOPlugin } from "./index-SHmV18t8.mjs";
 import { DBFieldAttribute } from "better-auth/db";
 //#region src/client.d.ts
 interface SSOClientOptions {

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-xoFrTW0m.mjs";
+import { t as PACKAGE_VERSION } from "./version-CwxXc1Y6.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-Sxfa9KQp.d.mts → index-SHmV18t8.d.mts}

@@ -263,7 +263,7 @@ interface BaseSSOUserResolutionInput {
   providerId: string;
   accountKey: {
     issuer: string;
-    providerAccountId: string;
+    accountId: string;
   };
   providerUser: SSOProviderUserProfile;
   providerReference: SSOProviderReference;
@@ -704,7 +704,7 @@ declare const requestDomainVerification: (options: SSOOptions) => import("better
       };
     };
   };
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -726,7 +726,7 @@ declare const requestDomainVerification: (options: SSOOptions) => import("better
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
 }, {
   domainVerificationToken: string;
 }>;
@@ -755,7 +755,7 @@ declare const verifyDomain: (options: SSOOptions) => import("better-call").Stric
       };
     };
   };
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -777,7 +777,7 @@ declare const verifyDomain: (options: SSOOptions) => import("better-call").Stric
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
 }, void>;
 //#endregion
 //#region src/utils.d.ts
@@ -795,7 +795,7 @@ type SanitizedCert = ParsedCert | {
 };
 declare const listSSOProviders: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/providers", {
   method: "GET";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -817,7 +817,7 @@ declare const listSSOProviders: (options?: SSOOptions) => import("better-call").
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   metadata: {
     openapi: {
       operationId: string;
@@ -866,7 +866,7 @@ declare const listSSOProviders: (options?: SSOOptions) => import("better-call").
 }>;
 declare const getSSOProvider: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/get-provider", {
   method: "GET";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -888,7 +888,7 @@ declare const getSSOProvider: (options?: SSOOptions) => import("better-call").St
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   query: z.ZodObject<{
     providerId: z.ZodString;
   }, z.core.$strip>;
@@ -944,7 +944,7 @@ declare const getSSOProvider: (options?: SSOOptions) => import("better-call").St
 }>;
 declare const updateSSOProvider: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/update-provider", {
   method: "POST";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -966,7 +966,7 @@ declare const updateSSOProvider: (options: SSOOptions) => import("better-call").
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   body: z.ZodObject<{
     issuer: z.ZodOptional<z.ZodString>;
     domain: z.ZodOptional<z.ZodString>;
@@ -1100,7 +1100,7 @@ declare const updateSSOProvider: (options: SSOOptions) => import("better-call").
 }>;
 declare const deleteSSOProvider: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/delete-provider", {
   method: "POST";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1122,7 +1122,7 @@ declare const deleteSSOProvider: (options?: SSOOptions) => import("better-call")
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   body: z.ZodObject<{
     providerId: z.ZodString;
   }, z.core.$strip>;
@@ -1172,7 +1172,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import(
   body: z.ZodObject<{
     [x: string]: z.ZodOptional<z.ZodAny>;
   }, z.core.$strip>;
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1194,7 +1194,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import(
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   metadata: {
     $Infer: {
       body: Record<string, any> & SSOProviderAdditionalFieldsInput<O>;
@@ -1598,7 +1598,7 @@ declare const initiateSLO: (options?: SSOOptions) => import("better-call").Stric
   body: z.ZodObject<{
     callbackURL: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1620,7 +1620,7 @@ declare const initiateSLO: (options?: SSOOptions) => import("better-call").Stric
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   metadata: {
     readonly scope: "server";
   };

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-Sxfa9KQp.mjs";
+import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-SHmV18t8.mjs";
 export { type AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, type DeprecatedAlgorithmBehavior, DigestAlgorithm, type DiscoverOIDCConfigParams, DiscoveryError, type DiscoveryErrorCode, type HydratedOIDCConfig, KeyEncryptionAlgorithm, type OIDCConfig, type OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, type RequiredDiscoveryField, type SAMLConditions, type SAMLConfig, type SAMLIdentityProviderMetadata, type SAMLServiceProviderPolicy, type SSOOIDCUserResolutionInput, type SSOOptions, SSOPlugin, type SSOProvider, type SSOProviderMutationGuardContext, type SSOProviderMutationGuardInput, type SSOProviderReference, type SSOProviderUserProfile, type SSOSAMLUserResolutionInput, type SSOUserResolution, type SSOUserResolutionContext, type SSOUserResolutionInput, SignatureAlgorithm, type TimestampValidationOptions, computeDiscoveryUrl, deriveSAMLIdentityProviderEntityID, deriveSAMLServiceProviderPolicy, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-xoFrTW0m.mjs";
+import { t as PACKAGE_VERSION } from "./version-CwxXc1Y6.mjs";
 import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
@@ -151,98 +151,146 @@ function maskClientId(clientId) {
 }
 //#endregion
 //#region src/linking/org-assignment.ts
-/**
-* Assigns a user to an organization based on the SSO provider's organizationId.
-* Used in SSO flows (OIDC, SAML) where the provider is already linked to an org.
-*/
-async function assignOrganizationFromProvider(ctx, options) {
-	const { user, profile, provider, token, provisioningOptions } = options;
-	if (!provider.organizationId) return;
-	if (provisioningOptions?.disabled) return;
-	if (!ctx.context.hasPlugin("organization")) return;
+const VERIFIED_PROVIDER_PAGE_SIZE = 100;
+function getEmailDomain(email) {
+	const parts = email.trim().toLowerCase().split("@");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
+	const domain = parts[1];
+	if (domain.includes("/") || domain.includes("\\") || domain.includes(":")) return null;
+	const normalizedDomains = parseProviderDomains(domain);
+	if (!normalizedDomains || normalizedDomains.length !== 1) return null;
+	return normalizedDomains[0] ?? null;
+}
+async function findVerifiedDomainProviders(ctx, domain) {
+	const matchingProviders = [];
+	let offset = 0;
+	while (true) {
+		const page = await ctx.context.adapter.findMany({
+			model: "ssoProvider",
+			where: [{
+				field: "domainVerified",
+				value: true
+			}],
+			limit: VERIFIED_PROVIDER_PAGE_SIZE,
+			offset,
+			sortBy: {
+				field: "providerId",
+				direction: "asc"
+			}
+		});
+		matchingProviders.push(...page.filter((provider) => domainMatches(domain, provider.domain)));
+		if (page.length < VERIFIED_PROVIDER_PAGE_SIZE) return matchingProviders;
+		offset += page.length;
+	}
+}
+async function assignOrganization(ctx, options) {
+	if (options.provisioningOptions?.disabled) return "provisioning-disabled";
+	if (!ctx.context.hasPlugin("organization")) return "ineligible-source";
+	let user;
+	let provider;
+	let organizationId;
+	let userInfo;
+	let token;
+	if (options.reason === "provider-bound") {
+		if (!options.provider.organizationId) return "no-target";
+		user = options.user;
+		provider = options.provider;
+		organizationId = options.provider.organizationId;
+		userInfo = options.profile.rawAttributes || {};
+		token = options.token;
+	} else {
+		if (!options.domainVerification?.enabled) return "provisioning-disabled";
+		const canonicalUser = await ctx.context.internalAdapter.findUserById(options.user.id);
+		if (!canonicalUser) {
+			ctx.context.logger.error("Unable to assign SSO organization membership because the canonical user was not found", { userId: options.user.id });
+			return "ineligible-source";
+		}
+		if (!canonicalUser.emailVerified) return "unverified-identity";
+		const domain = getEmailDomain(canonicalUser.email);
+		if (!domain) return "unverified-identity";
+		const matchingProviders = (await findVerifiedDomainProviders(ctx, domain)).filter((matchingProvider) => Boolean(matchingProvider.organizationId));
+		if (new Set(matchingProviders.map((matchingProvider) => matchingProvider.organizationId)).size > 1) {
+			ctx.context.logger.warn("Skipped SSO organization provisioning because a verified domain maps to multiple organizations", {
+				domain,
+				userId: canonicalUser.id
+			});
+			return "ambiguous-target";
+		}
+		if (matchingProviders.length === 0) return "no-target";
+		matchingProviders.sort((left, right) => left.providerId.localeCompare(right.providerId));
+		const selectedProvider = matchingProviders[0];
+		if (!selectedProvider) return "no-target";
+		user = canonicalUser;
+		provider = selectedProvider;
+		organizationId = selectedProvider.organizationId;
+		userInfo = {};
+		token = void 0;
+	}
 	if (await ctx.context.adapter.findOne({
 		model: "member",
 		where: [{
 			field: "organizationId",
-			value: provider.organizationId
+			value: organizationId
 		}, {
 			field: "userId",
 			value: user.id
 		}]
-	})) return;
-	const role = provisioningOptions?.getRole ? await provisioningOptions.getRole({
+	})) return "already-member";
+	if (await ctx.context.adapter.findOne({
+		model: "invitation",
+		where: [
+			{
+				field: "organizationId",
+				value: organizationId
+			},
+			{
+				field: "email",
+				value: user.email.toLowerCase()
+			},
+			{
+				field: "status",
+				value: "pending"
+			},
+			{
+				field: "expiresAt",
+				value: /* @__PURE__ */ new Date(),
+				operator: "gt"
+			}
+		]
+	})) return "invitation-pending";
+	const role = options.provisioningOptions?.getRole ? await options.provisioningOptions.getRole({
 		user,
-		userInfo: profile.rawAttributes || {},
+		userInfo,
 		token,
 		provider
-	}) : provisioningOptions?.defaultRole || "member";
+	}) : options.provisioningOptions?.defaultRole || "member";
 	await ctx.context.adapter.create({
 		model: "member",
 		data: {
-			organizationId: provider.organizationId,
+			organizationId,
 			userId: user.id,
 			role,
 			createdAt: /* @__PURE__ */ new Date()
 		}
 	});
+	return "assigned";
 }
 /**
-* Assigns a user to an organization based on their email domain.
-* Looks up SSO providers that match the user's email domain and assigns
-* the user to the associated organization.
-*
-* This enables domain-based org assignment for non-SSO sign-in methods
-* (e.g., Google OAuth with @acme.com email gets added to Acme's org).
+* Assigns a user to the organization explicitly bound to an SSO provider.
 */
-async function assignOrganizationByDomain(ctx, options) {
-	const { user, provisioningOptions, domainVerification } = options;
-	if (provisioningOptions?.disabled) return;
-	if (!ctx.context.hasPlugin("organization")) return;
-	const domain = user.email.split("@")[1];
-	if (!domain) return;
-	const whereClause = [{
-		field: "domain",
-		value: domain
-	}];
-	if (domainVerification?.enabled) whereClause.push({
-		field: "domainVerified",
-		value: true
-	});
-	let ssoProvider = await ctx.context.adapter.findOne({
-		model: "ssoProvider",
-		where: whereClause
+async function assignOrganizationFromProvider(ctx, options) {
+	await assignOrganization(ctx, {
+		reason: "provider-bound",
+		...options
 	});
-	if (!ssoProvider) ssoProvider = (await ctx.context.adapter.findMany({
-		model: "ssoProvider",
-		where: domainVerification?.enabled ? [{
-			field: "domainVerified",
-			value: true
-		}] : []
-	})).find((p) => domainMatches(domain, p.domain)) ?? null;
-	if (!ssoProvider || !ssoProvider.organizationId) return;
-	if (await ctx.context.adapter.findOne({
-		model: "member",
-		where: [{
-			field: "organizationId",
-			value: ssoProvider.organizationId
-		}, {
-			field: "userId",
-			value: user.id
-		}]
-	})) return;
-	const role = provisioningOptions?.getRole ? await provisioningOptions.getRole({
-		user,
-		userInfo: {},
-		provider: ssoProvider
-	}) : provisioningOptions?.defaultRole || "member";
-	await ctx.context.adapter.create({
-		model: "member",
-		data: {
-			organizationId: ssoProvider.organizationId,
-			userId: user.id,
-			role,
-			createdAt: /* @__PURE__ */ new Date()
-		}
+}
+/**
+* Assigns a verified user to the organization for their verified email domain.
+*/
+async function assignOrganizationByDomain(ctx, options) {
+	await assignOrganization(ctx, {
+		reason: "verified-domain",
+		...options
 	});
 }
 //#endregion
@@ -2452,6 +2500,23 @@ const deleteSSOProvider = (options) => {
 const DNS_LABEL_MAX_LENGTH = 63;
 const DEFAULT_TOKEN_PREFIX = "better-auth-token";
 const domainVerificationBodySchema = z.object({ providerId: z.string() });
+async function completeDomainVerification(adapter, provider) {
+	if (!await adapter.incrementOne({
+		model: "ssoProvider",
+		where: [{
+			field: "id",
+			value: provider.id
+		}, {
+			field: "domain",
+			value: provider.domain
+		}],
+		increment: {},
+		set: { domainVerified: true }
+	})) throw new APIError("CONFLICT", {
+		code: "SSO_PROVIDER_CHANGED",
+		message: "SSO provider changed while domain verification was in progress. Reload the provider and try again"
+	});
+}
 function getVerificationIdentifier(options, providerId) {
 	return `_${options.domainVerification?.tokenPrefix || DEFAULT_TOKEN_PREFIX}-${providerId}`;
 }
@@ -2501,7 +2566,7 @@ const verifyDomain = (options) => {
 			description: "Verify the provider domain ownership via DNS records",
 			responses: {
 				"404": { description: "Provider not found" },
-				"409": { description: "Domain has already been verified or no pending verification exists" },
+				"409": { description: "Domain has already been verified, or the provider changed while verification was in progress" },
 				"502": { description: "Unable to verify domain ownership due to upstream validator error" },
 				"204": { description: "Domain ownership was verified" }
 			}
@@ -2556,14 +2621,7 @@ const verifyDomain = (options) => {
 				code: "DOMAIN_VERIFICATION_FAILED"
 			});
 		}
-		await ctx.context.adapter.update({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: provider.providerId
-			}],
-			update: { domainVerified: true }
-		});
+		await completeDomainVerification(ctx.context.adapter, provider);
 		ctx.setStatus(204);
 	});
 };
@@ -2944,7 +3002,7 @@ async function processSAMLResponse(ctx, params, options) {
 	};
 	const accountKey = {
 		issuer,
-		providerAccountId: userInfo.id
+		accountId: userInfo.id
 	};
 	const isTrustedProvider = "domainVerified" in provider && !!provider.domainVerified && validateEmailDomain(userInfo.email, provider.domain);
 	const callbackUrl = redirectCandidates.some(Boolean) ? samlRedirectUrl : ctx.context.baseURL;
@@ -2983,7 +3041,7 @@ async function processSAMLResponse(ctx, params, options) {
 				account: {
 					providerId,
 					issuer: accountKey.issuer,
-					providerAccountId: accountKey.providerAccountId,
+					accountId: accountKey.accountId,
 					accessToken: "",
 					refreshToken: ""
 				},
@@ -3030,7 +3088,7 @@ async function processSAMLResponse(ctx, params, options) {
 		profile: {
 			providerType: "saml",
 			providerId,
-			providerAccountId: userInfo.id,
+			accountId: userInfo.id,
 			email: userInfo.email,
 			emailVerified: userInfo.emailVerified,
 			rawAttributes: attributes
@@ -3891,7 +3949,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 	};
 	const accountKey = {
 		issuer: verifiedIdToken && readStringClaim(verifiedIdToken.payload, "iss") || provider.issuer,
-		providerAccountId: userInfoId
+		accountId: userInfoId
 	};
 	const isTrustedProvider = "domainVerified" in provider && provider.domainVerified === true && validateEmailDomain(userInfoEmail, provider.domain);
 	let linked;
@@ -3935,7 +3993,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 					accessToken: tokenResponse.accessToken,
 					refreshToken: tokenResponse.refreshToken,
 					issuer: accountKey.issuer,
-					providerAccountId: userInfoId,
+					accountId: userInfoId,
 					providerId: provider.providerId,
 					accessTokenExpiresAt: tokenResponse.accessTokenExpiresAt,
 					refreshTokenExpiresAt: tokenResponse.refreshTokenExpiresAt,
@@ -3993,7 +4051,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 		profile: {
 			providerType: "oidc",
 			providerId: provider.providerId,
-			providerAccountId: userInfoId,
+			accountId: userInfoId,
 			email: userInfoEmail,
 			emailVerified: Boolean(userInfo.emailVerified),
 			rawAttributes: userInfo

package/dist/{version-xoFrTW0m.mjs → version-CwxXc1Y6.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-rc.3";
+const PACKAGE_VERSION = "1.7.0-rc.5";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.7.0-rc.3",
+  "version": "1.7.0-rc.5",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -66,22 +66,22 @@
   "devDependencies": {
     "@types/body-parser": "^1.19.6",
     "@types/express": "^5.0.6",
-    "better-call": "1.3.7",
-    "body-parser": "^2.2.2",
+    "better-call": "1.4.0",
+    "body-parser": "^2.3.0",
     "express": "^5.2.1",
     "kysely": "^0.28.17 || ^0.29.0",
     "oauth2-mock-server": "^9.0.0",
     "tsdown": "0.22.7",
-    "@better-auth/core": "1.7.0-rc.3",
-    "better-auth": "1.7.0-rc.3",
-    "@better-auth/kysely-adapter": "1.7.0-rc.3"
+    "@better-auth/core": "1.7.0-rc.5",
+    "@better-auth/kysely-adapter": "1.7.0-rc.5",
+    "better-auth": "1.7.0-rc.5"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
-    "better-call": "1.3.7",
-    "@better-auth/core": "^1.7.0-rc.3",
-    "better-auth": "^1.7.0-rc.3"
+    "better-call": "1.4.0",
+    "@better-auth/core": "^1.7.0-rc.5",
+    "better-auth": "^1.7.0-rc.5"
   },
   "scripts": {
     "build": "tsdown",