@better-auth/sso 1.7.20 → 1.7.21

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-COmqWYke.mjs";
+import { t as PACKAGE_VERSION } from "./version-BjN4UKdQ.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { t as PACKAGE_VERSION } from "./version-COmqWYke.mjs";
-import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
+import { t as PACKAGE_VERSION } from "./version-BjN4UKdQ.mjs";
+import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, generateGenericState, getSessionFromCtx, parseGenericState, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
 import { getHostname } from "tldts";
@@ -17,11 +17,12 @@ import { DOMParser } from "@xmldom/xmldom";
 import samlifyDefault, * as samlifyNamespace from "samlify";
 import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
 import { parseInputData, toZodSchema } from "better-auth/db";
+import { HIDE_METADATA } from "@better-auth/core/api";
+import { PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, authorizationCodeRequest, createAuthorizationURL, createPrivateKeyJwtClientAssertionGetter, getOAuth2Tokens } from "@better-auth/core/oauth2";
 import { isAPIError } from "@better-auth/core/utils/is-api-error";
 import { appendQueryParams } from "@better-auth/core/utils/url";
-import { HIDE_METADATA, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, authorizationCodeRequest, createAuthorizationURL, createPrivateKeyJwtClientAssertionGetter, generateGenericState, generateState, getOAuth2Tokens, parseGenericState, parseState } from "better-auth";
 import { deleteSessionCookie, setAccountCookie, setSessionCookie } from "better-auth/cookies";
-import { additionalAuthorizationParamsSchema, handleOAuthUserInfo } from "better-auth/oauth2";
+import { additionalAuthorizationParamsSchema, generateState, handleOAuthUserInfo, parseState } from "better-auth/oauth2";
 //#region src/constants.ts
 /**
 * SAML Constants
@@ -2823,20 +2824,16 @@ async function getSAMLResponseBindingContent(sp, samlContent) {
 /**
 * Extracts the Assertion ID from a SAML response XML.
 * Used for replay protection per SAML 2.0 Core section 2.3.3.
+*
+* Reads the ID through the DOM so character references are decoded the same
+* way the signature check decodes them: re-spelling the ID keeps the
+* signature valid, so it must not change the replay key.
 */
 function extractAssertionId(samlContent) {
 	try {
-		const parsed = new XMLParser({
-			ignoreAttributes: false,
-			attributeNamePrefix: "@_",
-			removeNSPrefix: true
-		}).parse(samlContent);
-		const response = parsed.Response || parsed["samlp:Response"];
-		if (!response) return null;
-		const rawAssertion = response.Assertion || response["saml:Assertion"];
-		const assertion = Array.isArray(rawAssertion) ? rawAssertion[0] : rawAssertion;
-		if (!assertion) return null;
-		return assertion["@_ID"] || null;
+		const response = new DOMParser().parseFromString(samlContent, "text/xml").documentElement;
+		if (response?.localName !== "Response") return null;
+		return Array.from(response.childNodes).find((node) => node.nodeType === 1 && node.localName === "Assertion")?.getAttribute("ID") || null;
 	} catch {
 		return null;
 	}
@@ -4423,7 +4420,7 @@ const initiateSLO = (options) => {
 		const session = ctx.context.session;
 		const sessionLookupKey = `${SAML_SESSION_BY_ID_PREFIX}${session.session.id}`;
 		const sessionLookup = await ctx.context.internalAdapter.findVerificationValue(sessionLookupKey);
-		let nameID = session.user.email;
+		let nameID;
 		let sessionIndex;
 		let samlSessionKey;
 		if (sessionLookup) {
@@ -4432,11 +4429,15 @@ const initiateSLO = (options) => {
 			if (stored) {
 				const data = safeJsonParse(stored.value);
 				if (data) {
-					nameID = data.nameID || nameID;
+					nameID = data.nameID;
 					sessionIndex = data.sessionIndex;
 				}
 			}
 		}
+		if (!nameID) {
+			const [account] = (await ctx.context.internalAdapter.findAccounts(session.user.id)).filter((account) => account.providerId === providerId).sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
+			nameID = account?.accountId ?? session.user.email;
+		}
 		const logoutRequest = sp.createLogoutRequest(idp, "redirect", {
 			logoutNameID: nameID,
 			sessionIndex,
@@ -4501,6 +4502,53 @@ function assertNoAdditionalFieldCollisions(options) {
 		if (builtInFieldNames.has(fieldName)) throw new Error(`ssoProvider additional field "${key}" maps to built-in field "${fieldName}"`);
 	}
 }
+const SAML_SESSION_RECORD_PAGE_SIZE = 100;
+async function findSAMLSessionRecord(ctx, identifier, isOwnRecord) {
+	for (let offset = 0;; offset += SAML_SESSION_RECORD_PAGE_SIZE) {
+		const page = await ctx.adapter.findMany({
+			model: "verification",
+			where: [{
+				field: "identifier",
+				value: identifier
+			}],
+			sortBy: {
+				field: "createdAt",
+				direction: "desc"
+			},
+			limit: SAML_SESSION_RECORD_PAGE_SIZE,
+			offset
+		});
+		const record = page.find(isOwnRecord);
+		if (record || page.length < SAML_SESSION_RECORD_PAGE_SIZE) return record;
+	}
+}
+/**
+* SLO records are written with the session's expiry at sign-in. Move it when a
+* refresh extends the session, so expired-row cleanup doesn't drop them early.
+*/
+async function extendSAMLSessionRecords(ctx, session) {
+	const lookupKey = `${SAML_SESSION_BY_ID_PREFIX}${session.id}`;
+	const lookup = await ctx.internalAdapter.findVerificationValue(lookupKey);
+	const expiresAt = new Date(session.expiresAt);
+	if (!lookup || new Date(lookup.expiresAt) >= expiresAt) return;
+	const isOwnRecord = (record) => safeJsonParse(record.value)?.sessionId === session.id;
+	const latest = await ctx.internalAdapter.findVerificationValue(lookup.value);
+	const secondaryStorageOnly = ctx.options.secondaryStorage && !ctx.options.verification?.storeInDatabase;
+	if (latest && secondaryStorageOnly) {
+		if (isOwnRecord(latest)) await ctx.internalAdapter.updateVerificationByIdentifier(lookup.value, { expiresAt });
+	} else if (latest) {
+		const record = await findSAMLSessionRecord(ctx, latest.identifier, isOwnRecord);
+		if (record) await ctx.adapter.update({
+			model: "verification",
+			where: [{
+				field: "id",
+				value: record.id
+			}],
+			update: { expiresAt }
+		});
+	}
+	await ctx.internalAdapter.updateVerificationByIdentifier(lookupKey, { expiresAt });
+}
 function sso(options) {
 	assertNoAdditionalFieldCollisions(options);
 	const optionsWithStore = options;
@@ -4533,8 +4581,13 @@ function sso(options) {
 		version: PACKAGE_VERSION,
 		init(ctx) {
 			const existing = ctx.skipOriginCheck;
-			if (existing === true) return {};
-			return { context: { skipOriginCheck: [...Array.isArray(existing) ? existing : [], ...SAML_SKIP_ORIGIN_CHECK_PATHS] } };
+			return {
+				...existing !== true && { context: { skipOriginCheck: [...Array.isArray(existing) ? existing : [], ...SAML_SKIP_ORIGIN_CHECK_PATHS] } },
+				options: { databaseHooks: { session: { update: { async after(session) {
+					if (!options?.saml?.enableSingleLogout) return;
+					await extendSAMLSessionRecords(ctx, session).catch((error) => ctx.logger.warn("Failed to extend SAML session records", { error }));
+				} } } } }
+			};
 		},
 		endpoints,
 		hooks: {

package/dist/{version-COmqWYke.mjs → version-BjN4UKdQ.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.20";
+const PACKAGE_VERSION = "1.7.21";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.7.20",
+  "version": "1.7.21",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -72,16 +72,16 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "oauth2-mock-server": "^9.0.0",
     "tsdown": "0.23.1",
-    "@better-auth/core": "1.7.20",
-    "@better-auth/kysely-adapter": "1.7.20",
-    "better-auth": "1.7.20"
+    "@better-auth/core": "1.7.21",
+    "@better-auth/kysely-adapter": "1.7.21",
+    "better-auth": "1.7.21"
   },
   "peerDependencies": {
     "@better-auth/utils": "^0.4.2 || ^0.5.0",
     "@better-fetch/fetch": "1.3.3",
     "better-call": "1.4.5",
-    "@better-auth/core": "^1.7.20",
-    "better-auth": "^1.7.20"
+    "@better-auth/core": "^1.7.21",
+    "better-auth": "^1.7.21"
   },
   "scripts": {
     "build": "tsdown",