@better-auth/sso 1.7.0-rc.4 → 1.7.0-rc.6

package/dist/client.d.mts

@@ -1,5 +1,6 @@
-import { t as SSOPlugin } from "./index-nfENSAuB.mjs";
+import { t as SSOPlugin } from "./index-CZytzKv6.mjs";
 import { DBFieldAttribute } from "better-auth/db";
+
 //#region src/client.d.ts
 interface SSOClientOptions {
   domainVerification?: {

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-Do0kTnv7.mjs";
+import { t as PACKAGE_VERSION } from "./version-CceXYJfW.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-nfENSAuB.d.mts → index-CZytzKv6.d.mts}

@@ -1,11 +1,9 @@
 import { APIError } from "better-auth/api";
 import * as z from "zod";
-import "@better-fetch/fetch";
 import samlifyDefault from "samlify";
 import { DBFieldAttribute, FieldAttributeToObject, InferAdditionalFieldsFromPluginOptions, RemoveFieldsWithReturnedFalse } from "better-auth/db";
 import { Awaitable, DBTransactionAdapter, OAuth2Tokens, User } from "better-auth";
-import "@better-auth/core/db/adapter";
-import "@better-auth/core";
+import * as _$better_call0 from "better-call";
 //#region src/saml/algorithms.d.ts
 declare const SignatureAlgorithm: {
   readonly RSA_SHA1: "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
@@ -478,7 +476,7 @@ interface SSOOptions {
         domain?: string | undefined;
         domainVerified?: string | undefined;
       };
-      additionalFields?: { [key in string]: DBFieldAttribute; };
+      additionalFields?: { [key in string]: DBFieldAttribute };
     };
   } | undefined;
   /**
@@ -682,7 +680,7 @@ interface SSOOptions {
 }
 //#endregion
 //#region src/routes/domain-verification.d.ts
-declare const requestDomainVerification: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/request-domain-verification", {
+declare const requestDomainVerification: (options: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/request-domain-verification", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -704,7 +702,7 @@ declare const requestDomainVerification: (options: SSOOptions) => import("better
       };
     };
   };
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -726,11 +724,11 @@ declare const requestDomainVerification: (options: SSOOptions) => import("better
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
 }, {
   domainVerificationToken: string;
 }>;
-declare const verifyDomain: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/verify-domain", {
+declare const verifyDomain: (options: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/verify-domain", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -755,7 +753,7 @@ declare const verifyDomain: (options: SSOOptions) => import("better-call").Stric
       };
     };
   };
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -777,7 +775,7 @@ declare const verifyDomain: (options: SSOOptions) => import("better-call").Stric
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
 }, void>;
 //#endregion
 //#region src/utils.d.ts
@@ -793,9 +791,9 @@ type ParsedCert = ReturnType<typeof parseCertificate>;
 type SanitizedCert = ParsedCert | {
   error: string;
 };
-declare const listSSOProviders: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/providers", {
+declare const listSSOProviders: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/providers", {
   method: "GET";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -817,7 +815,7 @@ declare const listSSOProviders: (options?: SSOOptions) => import("better-call").
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   metadata: {
     openapi: {
       operationId: string;
@@ -864,9 +862,9 @@ declare const listSSOProviders: (options?: SSOOptions) => import("better-call").
     spMetadataUrl: string;
   }[];
 }>;
-declare const getSSOProvider: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/get-provider", {
+declare const getSSOProvider: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/get-provider", {
   method: "GET";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -888,7 +886,7 @@ declare const getSSOProvider: (options?: SSOOptions) => import("better-call").St
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   query: z.ZodObject<{
     providerId: z.ZodString;
   }, z.core.$strip>;
@@ -942,9 +940,9 @@ declare const getSSOProvider: (options?: SSOOptions) => import("better-call").St
   } | undefined;
   spMetadataUrl: string;
 }>;
-declare const updateSSOProvider: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/update-provider", {
+declare const updateSSOProvider: (options: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/update-provider", {
   method: "POST";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -966,7 +964,7 @@ declare const updateSSOProvider: (options: SSOOptions) => import("better-call").
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   body: z.ZodObject<{
     issuer: z.ZodOptional<z.ZodString>;
     domain: z.ZodOptional<z.ZodString>;
@@ -1098,9 +1096,9 @@ declare const updateSSOProvider: (options: SSOOptions) => import("better-call").
   } | undefined;
   spMetadataUrl: string;
 }>;
-declare const deleteSSOProvider: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/delete-provider", {
+declare const deleteSSOProvider: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/delete-provider", {
   method: "POST";
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1122,7 +1120,7 @@ declare const deleteSSOProvider: (options?: SSOOptions) => import("better-call")
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   body: z.ZodObject<{
     providerId: z.ZodString;
   }, z.core.$strip>;
@@ -1149,7 +1147,7 @@ declare const deleteSSOProvider: (options?: SSOOptions) => import("better-call")
 }>;
 //#endregion
 //#region src/routes/sso.d.ts
-declare const spMetadata: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/metadata", {
+declare const spMetadata: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/sp/metadata", {
   method: "GET";
   query: z.ZodObject<{
     providerId: z.ZodString;
@@ -1167,12 +1165,12 @@ declare const spMetadata: (options?: SSOOptions) => import("better-call").Strict
     };
   };
 }, Response>;
-declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import("better-call").StrictEndpoint<"/sso/register", {
+declare const registerSSOProvider: <O extends SSOOptions>(options: O) => _$better_call0.StrictEndpoint<"/sso/register", {
   method: "POST";
   body: z.ZodObject<{
     [x: string]: z.ZodOptional<z.ZodAny>;
   }, z.core.$strip>;
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1194,7 +1192,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import(
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   metadata: {
     $Infer: {
       body: Record<string, any> & SSOProviderAdditionalFieldsInput<O>;
@@ -1369,7 +1367,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import(
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
 } & Omit<InferSSOProvider<O>, "samlConfig" | "oidcConfig">>;
-declare const signInSSO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sign-in/sso", {
+declare const signInSSO: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sign-in/sso", {
   method: "POST";
   body: z.ZodObject<{
     email: z.ZodOptional<z.ZodString>;
@@ -1491,7 +1489,7 @@ declare const signInSSO: (options?: SSOOptions) => import("better-call").StrictE
   url: string;
   redirect: boolean;
 }>;
-declare const callbackSSO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback/:providerId", {
+declare const callbackSSO: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/callback/:providerId", {
   method: "GET";
   query: z.ZodObject<{
     code: z.ZodOptional<z.ZodString>;
@@ -1519,7 +1517,7 @@ declare const callbackSSO: (options?: SSOOptions) => import("better-call").Stric
  * Used when `options.redirectURI` is set — the `providerId` is read from
  * the OAuth state instead of the URL path.
  */
-declare const callbackSSOShared: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback", {
+declare const callbackSSOShared: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/callback", {
   metadata: {
     openapi: {
       operationId: string;
@@ -1542,7 +1540,7 @@ declare const callbackSSOShared: (options?: SSOOptions) => import("better-call")
   }, z.core.$strip>;
   allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
 }, void>;
-declare const acsEndpoint: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
+declare const acsEndpoint: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
   method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLResponse: z.ZodString;
@@ -1572,7 +1570,7 @@ declare const acsEndpoint: (options?: SSOOptions) => import("better-call").Stric
     scope: "server";
   };
 }, never>;
-declare const sloEndpoint: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
+declare const sloEndpoint: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
   method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLRequest: z.ZodOptional<z.ZodString>;
@@ -1593,12 +1591,12 @@ declare const sloEndpoint: (options?: SSOOptions) => import("better-call").Stric
     scope: "server";
   };
 }, void | Response>;
-declare const initiateSLO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/logout/:providerId", {
+declare const initiateSLO: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/logout/:providerId", {
   method: "POST";
   body: z.ZodObject<{
     callbackURL: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
-  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1620,7 +1618,7 @@ declare const initiateSLO: (options?: SSOOptions) => import("better-call").Stric
         image?: string | null | undefined;
       };
     };
-  }>)[];
+  }>>[];
   metadata: {
     readonly scope: "server";
   };
@@ -1762,29 +1760,7 @@ interface OIDCDiscoveryDocument {
 /**
  * Error codes for OIDC discovery operations.
  */
-type DiscoveryErrorCode =
-/** Request to discovery endpoint timed out */
-"discovery_timeout" |
-/** Discovery endpoint returned 404 or similar */
-"discovery_not_found" |
-/** Discovery endpoint returned invalid JSON */
-"discovery_invalid_json" |
-/** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */
-"discovery_invalid_url" |
-/** OIDC endpoint URL is not trusted by the trusted origins configuration */
-"discovery_untrusted_origin" |
-/** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */
-"discovery_private_host" |
-/** Server-side OIDC endpoint fetch received an HTTP redirect response */
-"oidc_endpoint_redirect" |
-/** Discovery document issuer doesn't match configured issuer */
-"issuer_mismatch" |
-/** Discovery document is missing required fields */
-"discovery_incomplete" |
-/** IdP only advertises token auth methods that Better Auth doesn't currently support */
-"unsupported_token_auth_method" |
-/** Catch-all for unexpected errors */
-"discovery_unexpected_error";
+type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */ | "discovery_invalid_url" /** OIDC endpoint URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */ | "discovery_private_host" /** Server-side OIDC endpoint fetch received an HTTP redirect response */ | "oidc_endpoint_redirect" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
 /**
  * Custom error class for OIDC discovery failures.
  * Can be caught and mapped to APIError at the edge.

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-nfENSAuB.mjs";
-export { type AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, type DeprecatedAlgorithmBehavior, DigestAlgorithm, type DiscoverOIDCConfigParams, DiscoveryError, type DiscoveryErrorCode, type HydratedOIDCConfig, KeyEncryptionAlgorithm, type OIDCConfig, type OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, type RequiredDiscoveryField, type SAMLConditions, type SAMLConfig, type SAMLIdentityProviderMetadata, type SAMLServiceProviderPolicy, type SSOOIDCUserResolutionInput, type SSOOptions, SSOPlugin, type SSOProvider, type SSOProviderMutationGuardContext, type SSOProviderMutationGuardInput, type SSOProviderReference, type SSOProviderUserProfile, type SSOSAMLUserResolutionInput, type SSOUserResolution, type SSOUserResolutionContext, type SSOUserResolutionInput, SignatureAlgorithm, type TimestampValidationOptions, computeDiscoveryUrl, deriveSAMLIdentityProviderEntityID, deriveSAMLServiceProviderPolicy, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };
+import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-CZytzKv6.mjs";
+export { AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DeprecatedAlgorithmBehavior, DigestAlgorithm, DiscoverOIDCConfigParams, DiscoveryError, DiscoveryErrorCode, HydratedOIDCConfig, KeyEncryptionAlgorithm, OIDCConfig, OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, RequiredDiscoveryField, SAMLConditions, SAMLConfig, SAMLIdentityProviderMetadata, SAMLServiceProviderPolicy, SSOOIDCUserResolutionInput, SSOOptions, SSOPlugin, SSOProvider, SSOProviderMutationGuardContext, SSOProviderMutationGuardInput, SSOProviderReference, SSOProviderUserProfile, SSOSAMLUserResolutionInput, SSOUserResolution, SSOUserResolutionContext, SSOUserResolutionInput, SignatureAlgorithm, TimestampValidationOptions, computeDiscoveryUrl, deriveSAMLIdentityProviderEntityID, deriveSAMLServiceProviderPolicy, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-Do0kTnv7.mjs";
+import { t as PACKAGE_VERSION } from "./version-CceXYJfW.mjs";
 import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
@@ -151,98 +151,146 @@ function maskClientId(clientId) {
 }
 //#endregion
 //#region src/linking/org-assignment.ts
-/**
-* Assigns a user to an organization based on the SSO provider's organizationId.
-* Used in SSO flows (OIDC, SAML) where the provider is already linked to an org.
-*/
-async function assignOrganizationFromProvider(ctx, options) {
-	const { user, profile, provider, token, provisioningOptions } = options;
-	if (!provider.organizationId) return;
-	if (provisioningOptions?.disabled) return;
-	if (!ctx.context.hasPlugin("organization")) return;
+const VERIFIED_PROVIDER_PAGE_SIZE = 100;
+function getEmailDomain(email) {
+	const parts = email.trim().toLowerCase().split("@");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
+	const domain = parts[1];
+	if (domain.includes("/") || domain.includes("\\") || domain.includes(":")) return null;
+	const normalizedDomains = parseProviderDomains(domain);
+	if (!normalizedDomains || normalizedDomains.length !== 1) return null;
+	return normalizedDomains[0] ?? null;
+}
+async function findVerifiedDomainProviders(ctx, domain) {
+	const matchingProviders = [];
+	let offset = 0;
+	while (true) {
+		const page = await ctx.context.adapter.findMany({
+			model: "ssoProvider",
+			where: [{
+				field: "domainVerified",
+				value: true
+			}],
+			limit: VERIFIED_PROVIDER_PAGE_SIZE,
+			offset,
+			sortBy: {
+				field: "providerId",
+				direction: "asc"
+			}
+		});
+		matchingProviders.push(...page.filter((provider) => domainMatches(domain, provider.domain)));
+		if (page.length < VERIFIED_PROVIDER_PAGE_SIZE) return matchingProviders;
+		offset += page.length;
+	}
+}
+async function assignOrganization(ctx, options) {
+	if (options.provisioningOptions?.disabled) return "provisioning-disabled";
+	if (!ctx.context.hasPlugin("organization")) return "ineligible-source";
+	let user;
+	let provider;
+	let organizationId;
+	let userInfo;
+	let token;
+	if (options.reason === "provider-bound") {
+		if (!options.provider.organizationId) return "no-target";
+		user = options.user;
+		provider = options.provider;
+		organizationId = options.provider.organizationId;
+		userInfo = options.profile.rawAttributes || {};
+		token = options.token;
+	} else {
+		if (!options.domainVerification?.enabled) return "provisioning-disabled";
+		const canonicalUser = await ctx.context.internalAdapter.findUserById(options.user.id);
+		if (!canonicalUser) {
+			ctx.context.logger.error("Unable to assign SSO organization membership because the canonical user was not found", { userId: options.user.id });
+			return "ineligible-source";
+		}
+		if (!canonicalUser.emailVerified) return "unverified-identity";
+		const domain = getEmailDomain(canonicalUser.email);
+		if (!domain) return "unverified-identity";
+		const matchingProviders = (await findVerifiedDomainProviders(ctx, domain)).filter((matchingProvider) => Boolean(matchingProvider.organizationId));
+		if (new Set(matchingProviders.map((matchingProvider) => matchingProvider.organizationId)).size > 1) {
+			ctx.context.logger.warn("Skipped SSO organization provisioning because a verified domain maps to multiple organizations", {
+				domain,
+				userId: canonicalUser.id
+			});
+			return "ambiguous-target";
+		}
+		if (matchingProviders.length === 0) return "no-target";
+		matchingProviders.sort((left, right) => left.providerId.localeCompare(right.providerId));
+		const selectedProvider = matchingProviders[0];
+		if (!selectedProvider) return "no-target";
+		user = canonicalUser;
+		provider = selectedProvider;
+		organizationId = selectedProvider.organizationId;
+		userInfo = {};
+		token = void 0;
+	}
 	if (await ctx.context.adapter.findOne({
 		model: "member",
 		where: [{
 			field: "organizationId",
-			value: provider.organizationId
+			value: organizationId
 		}, {
 			field: "userId",
 			value: user.id
 		}]
-	})) return;
-	const role = provisioningOptions?.getRole ? await provisioningOptions.getRole({
+	})) return "already-member";
+	if (await ctx.context.adapter.findOne({
+		model: "invitation",
+		where: [
+			{
+				field: "organizationId",
+				value: organizationId
+			},
+			{
+				field: "email",
+				value: user.email.toLowerCase()
+			},
+			{
+				field: "status",
+				value: "pending"
+			},
+			{
+				field: "expiresAt",
+				value: /* @__PURE__ */ new Date(),
+				operator: "gt"
+			}
+		]
+	})) return "invitation-pending";
+	const role = options.provisioningOptions?.getRole ? await options.provisioningOptions.getRole({
 		user,
-		userInfo: profile.rawAttributes || {},
+		userInfo,
 		token,
 		provider
-	}) : provisioningOptions?.defaultRole || "member";
+	}) : options.provisioningOptions?.defaultRole || "member";
 	await ctx.context.adapter.create({
 		model: "member",
 		data: {
-			organizationId: provider.organizationId,
+			organizationId,
 			userId: user.id,
 			role,
 			createdAt: /* @__PURE__ */ new Date()
 		}
 	});
+	return "assigned";
 }
 /**
-* Assigns a user to an organization based on their email domain.
-* Looks up SSO providers that match the user's email domain and assigns
-* the user to the associated organization.
-*
-* This enables domain-based org assignment for non-SSO sign-in methods
-* (e.g., Google OAuth with @acme.com email gets added to Acme's org).
+* Assigns a user to the organization explicitly bound to an SSO provider.
 */
-async function assignOrganizationByDomain(ctx, options) {
-	const { user, provisioningOptions, domainVerification } = options;
-	if (provisioningOptions?.disabled) return;
-	if (!ctx.context.hasPlugin("organization")) return;
-	const domain = user.email.split("@")[1];
-	if (!domain) return;
-	const whereClause = [{
-		field: "domain",
-		value: domain
-	}];
-	if (domainVerification?.enabled) whereClause.push({
-		field: "domainVerified",
-		value: true
-	});
-	let ssoProvider = await ctx.context.adapter.findOne({
-		model: "ssoProvider",
-		where: whereClause
+async function assignOrganizationFromProvider(ctx, options) {
+	await assignOrganization(ctx, {
+		reason: "provider-bound",
+		...options
 	});
-	if (!ssoProvider) ssoProvider = (await ctx.context.adapter.findMany({
-		model: "ssoProvider",
-		where: domainVerification?.enabled ? [{
-			field: "domainVerified",
-			value: true
-		}] : []
-	})).find((p) => domainMatches(domain, p.domain)) ?? null;
-	if (!ssoProvider || !ssoProvider.organizationId) return;
-	if (await ctx.context.adapter.findOne({
-		model: "member",
-		where: [{
-			field: "organizationId",
-			value: ssoProvider.organizationId
-		}, {
-			field: "userId",
-			value: user.id
-		}]
-	})) return;
-	const role = provisioningOptions?.getRole ? await provisioningOptions.getRole({
-		user,
-		userInfo: {},
-		provider: ssoProvider
-	}) : provisioningOptions?.defaultRole || "member";
-	await ctx.context.adapter.create({
-		model: "member",
-		data: {
-			organizationId: ssoProvider.organizationId,
-			userId: user.id,
-			role,
-			createdAt: /* @__PURE__ */ new Date()
-		}
+}
+/**
+* Assigns a verified user to the organization for their verified email domain.
+*/
+async function assignOrganizationByDomain(ctx, options) {
+	await assignOrganization(ctx, {
+		reason: "verified-domain",
+		...options
 	});
 }
 //#endregion
@@ -2452,6 +2500,23 @@ const deleteSSOProvider = (options) => {
 const DNS_LABEL_MAX_LENGTH = 63;
 const DEFAULT_TOKEN_PREFIX = "better-auth-token";
 const domainVerificationBodySchema = z.object({ providerId: z.string() });
+async function completeDomainVerification(adapter, provider) {
+	if (!await adapter.incrementOne({
+		model: "ssoProvider",
+		where: [{
+			field: "id",
+			value: provider.id
+		}, {
+			field: "domain",
+			value: provider.domain
+		}],
+		increment: {},
+		set: { domainVerified: true }
+	})) throw new APIError("CONFLICT", {
+		code: "SSO_PROVIDER_CHANGED",
+		message: "SSO provider changed while domain verification was in progress. Reload the provider and try again"
+	});
+}
 function getVerificationIdentifier(options, providerId) {
 	return `_${options.domainVerification?.tokenPrefix || DEFAULT_TOKEN_PREFIX}-${providerId}`;
 }
@@ -2501,7 +2566,7 @@ const verifyDomain = (options) => {
 			description: "Verify the provider domain ownership via DNS records",
 			responses: {
 				"404": { description: "Provider not found" },
-				"409": { description: "Domain has already been verified or no pending verification exists" },
+				"409": { description: "Domain has already been verified, or the provider changed while verification was in progress" },
 				"502": { description: "Unable to verify domain ownership due to upstream validator error" },
 				"204": { description: "Domain ownership was verified" }
 			}
@@ -2556,14 +2621,7 @@ const verifyDomain = (options) => {
 				code: "DOMAIN_VERIFICATION_FAILED"
 			});
 		}
-		await ctx.context.adapter.update({
-			model: "ssoProvider",
-			where: [{
-				field: "providerId",
-				value: provider.providerId
-			}],
-			update: { domainVerified: true }
-		});
+		await completeDomainVerification(ctx.context.adapter, provider);
 		ctx.setStatus(204);
 	});
 };
@@ -3310,13 +3368,13 @@ const registerSSOProvider = (options) => {
 			if (!member) throw new APIError("BAD_REQUEST", { message: "You are not a member of the organization" });
 			if (ctx.context.hasPlugin("organization") && !hasOrgAdminRole(member)) throw new APIError("FORBIDDEN", { message: "You must be an organization owner or admin to register SSO providers" });
 		}
-		if ((/* @__PURE__ */ new Set([
+		if (new Set([
 			...BUILT_IN_ACCOUNT_PROVIDER_IDS,
 			...Object.keys(ctx.context.options.socialProviders ?? {}),
 			...ctx.context.socialProviders.map((p) => p.id),
 			...ctx.context.trustedProviders,
 			...options?.defaultSSO?.map((p) => p.providerId) ?? []
-		])).has(body.providerId)) {
+		]).has(body.providerId)) {
 			ctx.context.logger.warn(`SSO provider registration rejected for reserved providerId: ${body.providerId}`);
 			throw new APIError("UNPROCESSABLE_ENTITY", { message: "This providerId is reserved and cannot be used for an SSO provider" });
 		}

package/dist/{version-Do0kTnv7.mjs → version-CceXYJfW.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-rc.4";
+const PACKAGE_VERSION = "1.7.0-rc.6";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.7.0-rc.4",
+  "version": "1.7.0-rc.6",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -66,22 +66,22 @@
   "devDependencies": {
     "@types/body-parser": "^1.19.6",
     "@types/express": "^5.0.6",
-    "better-call": "1.3.7",
+    "better-call": "1.4.0",
     "body-parser": "^2.3.0",
     "express": "^5.2.1",
     "kysely": "^0.28.17 || ^0.29.0",
     "oauth2-mock-server": "^9.0.0",
-    "tsdown": "0.22.7",
-    "better-auth": "1.7.0-rc.4",
-    "@better-auth/core": "1.7.0-rc.4",
-    "@better-auth/kysely-adapter": "1.7.0-rc.4"
+    "tsdown": "0.21.10",
+    "@better-auth/core": "1.7.0-rc.6",
+    "@better-auth/kysely-adapter": "1.7.0-rc.6",
+    "better-auth": "1.7.0-rc.6"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
-    "better-call": "1.3.7",
-    "@better-auth/core": "^1.7.0-rc.4",
-    "better-auth": "^1.7.0-rc.4"
+    "better-call": "1.4.0",
+    "@better-auth/core": "^1.7.0-rc.6",
+    "better-auth": "^1.7.0-rc.6"
   },
   "scripts": {
     "build": "tsdown",