@better-auth/sso 1.7.18 → 1.7.20

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BabgsTE7.mjs";
+import { t as PACKAGE_VERSION } from "./version-COmqWYke.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BabgsTE7.mjs";
+import { t as PACKAGE_VERSION } from "./version-COmqWYke.mjs";
 import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
@@ -1383,7 +1383,7 @@ function parseSAMLServiceProviderMetadata(metadata) {
 			if (value) nameIDFormats.push(value);
 		}
 		for (const service of directMetadataChildren(descriptor, "AssertionConsumerService")) {
-			if (service.getAttribute("Binding") !== "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST") continue;
+			if (service.getAttribute("Binding") !== SAML_HTTP_POST_BINDING) continue;
 			const location = service.getAttribute("Location")?.trim();
 			if (!location || !isAbsoluteHttpUrl(location)) throw new Error("Invalid SAML POST AssertionConsumerService");
 			postAssertionConsumerServiceUrls.push(location);
@@ -1693,6 +1693,7 @@ async function findSAMLProvider(providerId, options, adapter) {
 }
 function createSP(config, baseURL, providerId, opts) {
 	const spData = config.spMetadata;
+	const clockSkew = opts?.clockSkew ?? 3e5;
 	const sloLocation = `${baseURL}/sso/saml2/sp/slo/${providerId}`;
 	const acsUrl = `${baseURL}/sso/saml2/sp/acs/${providerId}`;
 	let metadata = spData?.metadata;
@@ -1725,7 +1726,7 @@ function createSP(config, baseURL, providerId, opts) {
 		encPrivateKey: normalizePem(spData?.encPrivateKey),
 		encPrivateKeyPass: spData?.encPrivateKeyPass,
 		relayState: opts?.relayState,
-		clockDrifts: opts?.clockSkew && opts?.clockSkew !== 0 ? [-opts.clockSkew, opts.clockSkew] : void 0
+		clockDrifts: [-clockSkew, clockSkew]
 	});
 }
 /**
@@ -2806,17 +2807,12 @@ function getSAMLRedirectCandidates(relayStateCallbackUrl, samlConfig, samlOption
 		samlConfig?.callbackUrl
 	];
 }
-function toArray(value) {
-	if (Array.isArray(value)) return value;
-	return value ? [value] : [];
-}
-function getExpectedSAMLRecipients(config, baseURL, providerId, currentCallbackPath, assertionConsumerServiceUrl) {
+function getExpectedSAMLRecipients(config, baseURL, providerId, currentCallbackPath) {
 	const configuredPostAssertionConsumerServiceUrls = getSAMLPostAssertionConsumerServiceUrls(config.spMetadata?.metadata);
 	return [
 		currentCallbackPath,
 		`${baseURL}/sso/saml2/sp/acs/${providerId}`,
-		...configuredPostAssertionConsumerServiceUrls,
-		...toArray(assertionConsumerServiceUrl)
+		...configuredPostAssertionConsumerServiceUrls
 	];
 }
 async function getSAMLResponseBindingContent(sp, samlContent) {
@@ -2899,8 +2895,7 @@ async function processSAMLResponse(ctx, params, options) {
 		logger: ctx.context.logger
 	});
 	const expectedAudiences = [sp.entityMeta.getEntityID(), parsedSamlConfig.audience];
-	const assertionConsumerServiceUrl = sp.entityMeta.getAssertionConsumerService(SAML_HTTP_POST_BINDING);
-	const expectedRecipients = getExpectedSAMLRecipients(parsedSamlConfig, ctx.context.baseURL, providerId, currentCallbackPath, assertionConsumerServiceUrl);
+	const expectedRecipients = getExpectedSAMLRecipients(parsedSamlConfig, ctx.context.baseURL, providerId, currentCallbackPath);
 	const serviceProviderPolicy = deriveSAMLServiceProviderPolicy(parsedSamlConfig);
 	let samlBindingContent;
 	try {

package/dist/{version-BabgsTE7.mjs → version-COmqWYke.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.18";
+const PACKAGE_VERSION = "1.7.20";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.7.18",
+  "version": "1.7.20",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -72,16 +72,16 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "oauth2-mock-server": "^9.0.0",
     "tsdown": "0.23.1",
-    "@better-auth/kysely-adapter": "1.7.18",
-    "better-auth": "1.7.18",
-    "@better-auth/core": "1.7.18"
+    "@better-auth/core": "1.7.20",
+    "@better-auth/kysely-adapter": "1.7.20",
+    "better-auth": "1.7.20"
   },
   "peerDependencies": {
     "@better-auth/utils": "^0.4.2 || ^0.5.0",
     "@better-fetch/fetch": "1.3.3",
     "better-call": "1.4.5",
-    "@better-auth/core": "^1.7.18",
-    "better-auth": "^1.7.18"
+    "@better-auth/core": "^1.7.20",
+    "better-auth": "^1.7.20"
   },
   "scripts": {
     "build": "tsdown",