@better-auth/sso 1.7.20 → 1.7.22

package/dist/client.d.mts

@@ -1,6 +1,5 @@
-import { t as SSOPlugin } from "./index-BvKzNnKP.mjs";
+import { t as SSOPlugin } from "./index-CndkJEsk.mjs";
 import { DBFieldAttribute } from "better-auth/db";
-//#region src/client.d.ts
 interface SSOClientOptions {
   domainVerification?: {
     enabled: boolean;
@@ -29,5 +28,4 @@ export declare const ssoClient: <CO extends SSOClientOptions>(options?: CO | und
     "/sso/get-provider": "GET";
   };
 };
-//#endregion
 export {};

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { t as PACKAGE_VERSION } from "./version-COmqWYke.mjs";
-//#region src/client.ts
+import { t as PACKAGE_VERSION } from "./version-DnGxDgB4.mjs";
+// src/client.ts
 const ssoClient = (options) => {
 	return {
 		id: "sso-client",
@@ -11,5 +11,4 @@ const ssoClient = (options) => {
 		}
 	};
 };
-//#endregion
 export { ssoClient };

package/dist/{index-BvKzNnKP.d.mts → index-CndkJEsk.d.mts}

@@ -6,7 +6,6 @@ import { DBFieldAttribute, FieldAttributeToObject, InferAdditionalFieldsFromPlug
 import { Awaitable, DBTransactionAdapter, OAuth2Tokens, User } from "better-auth";
 import "@better-auth/core/db/adapter";
 import "@better-auth/core";
-//#region src/saml/algorithms.d.ts
 declare const SignatureAlgorithm: {
   readonly RSA_SHA1: "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
   readonly RSA_SHA256: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";
@@ -44,8 +43,6 @@ interface AlgorithmValidationOptions {
   allowedKeyEncryptionAlgorithms?: string[];
   allowedDataEncryptionAlgorithms?: string[];
 }
-//#endregion
-//#region src/types.d.ts
 interface OIDCMapping {
   email?: string | undefined;
   emailVerified?: string | undefined;
@@ -683,8 +680,6 @@ interface SSOOptions {
     idpInitiatedCallbackUrl?: string | undefined;
   };
 }
-//#endregion
-//#region src/routes/domain-verification.d.ts
 declare const requestDomainVerification: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/request-domain-verification", {
   method: "POST";
   body: z.ZodObject<{
@@ -782,16 +777,12 @@ declare const verifyDomain: (options: SSOOptions) => import("better-call").Stric
     };
   }>>[];
 }, void>;
-//#endregion
-//#region src/utils.d.ts
 declare function parseCertificate(certPem: string): {
   fingerprintSha256: string;
   notBefore: string;
   notAfter: string;
   publicKeyAlgorithm: string;
 };
-//#endregion
-//#region src/routes/providers.d.ts
 type ParsedCert = ReturnType<typeof parseCertificate>;
 type SanitizedCert = ParsedCert | {
   error: string;
@@ -1150,8 +1141,6 @@ declare const deleteSSOProvider: (options?: SSOOptions) => import("better-call")
 }, {
   success: boolean;
 }>;
-//#endregion
-//#region src/routes/sso.d.ts
 declare const spMetadata: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/metadata", {
   method: "GET";
   query: z.ZodObject<{
@@ -1200,7 +1189,9 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import(
   }>>[];
   metadata: {
     $Infer: {
-      body: Record<string, any> & SSOProviderAdditionalFieldsInput<O>;
+      body: {
+        [x: string]: any;
+      } & SSOProviderAdditionalFieldsInput<O>;
     };
     openapi: {
       operationId: string;
@@ -1627,8 +1618,6 @@ declare const initiateSLO: (options?: SSOOptions) => import("better-call").Stric
     readonly scope: "server";
   };
 }, never>;
-//#endregion
-//#region src/constants.d.ts
 /**
  * Default clock skew tolerance (5 minutes).
  * Allows for minor time differences between IdP and SP servers.
@@ -1649,8 +1638,6 @@ declare const DEFAULT_MAX_SAML_RESPONSE_SIZE: number;
  * Protects against oversized metadata documents.
  */
 declare const DEFAULT_MAX_SAML_METADATA_SIZE: number;
-//#endregion
-//#region src/routes/helpers.d.ts
 interface SAMLServiceProviderPolicy {
   /** Effective assertion-signing requirement advertised by SP metadata. */
   wantAssertionsSigned: boolean;
@@ -1668,8 +1655,6 @@ declare function deriveSAMLServiceProviderPolicy(config: Pick<SAMLConfig, "spMet
  * parsing and manual-configuration validation as SAML authentication.
  */
 declare function deriveSAMLIdentityProviderEntityID(config: SAMLConfig): string;
-//#endregion
-//#region src/saml/timestamp.d.ts
 interface TimestampValidationOptions {
   clockSkew?: number;
   requireTimestamps?: boolean;
@@ -1688,8 +1673,6 @@ interface SAMLConditions {
  * @throws {APIError} If timestamps are invalid, expired, or not yet valid
  */
 declare function validateSAMLTimestamp(conditions: SAMLConditions | undefined, options?: TimestampValidationOptions): void;
-//#endregion
-//#region src/oidc/types.d.ts
 /**
  * OIDC Discovery Types
  *
@@ -1856,8 +1839,6 @@ interface DiscoverOIDCConfigParams {
  */
 declare const REQUIRED_DISCOVERY_FIELDS: readonly ["issuer", "authorization_endpoint", "token_endpoint", "jwks_uri"];
 type RequiredDiscoveryField = (typeof REQUIRED_DISCOVERY_FIELDS)[number];
-//#endregion
-//#region src/oidc/discovery.d.ts
 /**
  * Main entry point: Discover and hydrate OIDC configuration from an issuer.
  *
@@ -1957,8 +1938,6 @@ declare function selectTokenEndpointAuthMethod(doc: OIDCDiscoveryDocument, exist
  * @returns true if runtime discovery should be performed
  */
 declare function needsRuntimeDiscovery(config: Partial<HydratedOIDCConfig> | undefined): boolean;
-//#endregion
-//#region src/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
     sso: {
@@ -2022,5 +2001,4 @@ declare function sso<O extends SSOOptions>(options?: O | undefined): {
   };
   options: NoInfer<O>;
 };
-//#endregion
 export { SAMLIdentityProviderMetadata as A, SSOUserResolutionContext as B, deriveSAMLIdentityProviderEntityID as C, DEFAULT_MAX_SAML_RESPONSE_SIZE as D, DEFAULT_MAX_SAML_METADATA_SIZE as E, SSOProviderMutationGuardInput as F, DigestAlgorithm as G, AlgorithmValidationOptions as H, SSOProviderReference as I, KeyEncryptionAlgorithm as K, SSOProviderUserProfile as L, SSOOptions as M, SSOProvider as N, OIDCConfig as O, SSOProviderMutationGuardContext as P, SSOSAMLUserResolutionInput as R, SAMLServiceProviderPolicy as S, DEFAULT_CLOCK_SKEW_MS as T, DataEncryptionAlgorithm as U, SSOUserResolutionInput as V, DeprecatedAlgorithmBehavior as W, REQUIRED_DISCOVERY_FIELDS as _, fetchDiscoveryDocument as a, TimestampValidationOptions as b, normalizeUrl as c, validateDiscoveryUrl as d, DiscoverOIDCConfigParams as f, OIDCDiscoveryDocument as g, HydratedOIDCConfig as h, discoverOIDCConfig as i, SSOOIDCUserResolutionInput as j, SAMLConfig as k, selectTokenEndpointAuthMethod as l, DiscoveryErrorCode as m, sso as n, needsRuntimeDiscovery as o, DiscoveryError as p, SignatureAlgorithm as q, computeDiscoveryUrl as r, normalizeDiscoveryUrls as s, SSOPlugin as t, validateDiscoveryDocument as u, RequiredDiscoveryField as v, deriveSAMLServiceProviderPolicy as w, validateSAMLTimestamp as x, SAMLConditions as y, SSOUserResolution as z };

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-BvKzNnKP.mjs";
+import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-CndkJEsk.mjs";
 export { type AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, type DeprecatedAlgorithmBehavior, DigestAlgorithm, type DiscoverOIDCConfigParams, DiscoveryError, type DiscoveryErrorCode, type HydratedOIDCConfig, KeyEncryptionAlgorithm, type OIDCConfig, type OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, type RequiredDiscoveryField, type SAMLConditions, type SAMLConfig, type SAMLIdentityProviderMetadata, type SAMLServiceProviderPolicy, type SSOOIDCUserResolutionInput, type SSOOptions, SSOPlugin, type SSOProvider, type SSOProviderMutationGuardContext, type SSOProviderMutationGuardInput, type SSOProviderReference, type SSOProviderUserProfile, type SSOSAMLUserResolutionInput, type SSOUserResolution, type SSOUserResolutionContext, type SSOUserResolutionInput, SignatureAlgorithm, type TimestampValidationOptions, computeDiscoveryUrl, deriveSAMLIdentityProviderEntityID, deriveSAMLServiceProviderPolicy, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { t as PACKAGE_VERSION } from "./version-COmqWYke.mjs";
-import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
+import { t as PACKAGE_VERSION } from "./version-DnGxDgB4.mjs";
+import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, generateGenericState, getSessionFromCtx, parseGenericState, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
 import { getHostname } from "tldts";
@@ -17,12 +17,13 @@ import { DOMParser } from "@xmldom/xmldom";
 import samlifyDefault, * as samlifyNamespace from "samlify";
 import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
 import { parseInputData, toZodSchema } from "better-auth/db";
+import { HIDE_METADATA } from "@better-auth/core/api";
+import { PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, authorizationCodeRequest, createAuthorizationURL, createPrivateKeyJwtClientAssertionGetter, getOAuth2Tokens, parseStringBoolean } from "@better-auth/core/oauth2";
 import { isAPIError } from "@better-auth/core/utils/is-api-error";
 import { appendQueryParams } from "@better-auth/core/utils/url";
-import { HIDE_METADATA, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, authorizationCodeRequest, createAuthorizationURL, createPrivateKeyJwtClientAssertionGetter, generateGenericState, generateState, getOAuth2Tokens, parseGenericState, parseState } from "better-auth";
 import { deleteSessionCookie, setAccountCookie, setSessionCookie } from "better-auth/cookies";
-import { additionalAuthorizationParamsSchema, handleOAuthUserInfo } from "better-auth/oauth2";
-//#region src/constants.ts
+import { additionalAuthorizationParamsSchema, generateState, handleOAuthUserInfo, parseState } from "better-auth/oauth2";
+// src/constants.ts
 /**
 * SAML Constants
 *
@@ -61,8 +62,7 @@ const DEFAULT_MAX_SAML_RESPONSE_SIZE = 262144;
 * Protects against oversized metadata documents.
 */
 const DEFAULT_MAX_SAML_METADATA_SIZE = 102400;
-//#endregion
-//#region src/utils.ts
+// src/utils.ts
 const unsafeSAMLRedirectPathPrefix = /^\/(?:\/|\\|%2f|%5c)/i;
 const isSafeSAMLRedirectPath = (url) => url.startsWith("/") && !unsafeSAMLRedirectPathPrefix.test(url);
 /**
@@ -94,16 +94,6 @@ const domainMatches = (searchDomain, domainList) => {
 	return domains.some((domain) => search === domain || search.endsWith(`.${domain}`));
 };
 /**
-* Strictly parse a provider-supplied email-verification claim.
-*
-* OIDC userInfo, OIDC id-token, and SAML attribute values are frequently
-* strings, so a loose `Boolean(value)` or truthy fallback treats the string
-* `"false"` as verified. Only a boolean `true` or the exact string `"true"`
-* count as verified; every other value, including `"false"`, `"0"`, `""`,
-* numbers, arrays, and objects, is unverified.
-*/
-const parseProviderEmailVerified = (value) => value === true || value === "true";
-/**
 * Validates email domain against allowed domain(s).
 * Supports comma-separated domains for multi-domain SSO.
 */
@@ -151,8 +141,7 @@ function maskClientId(clientId) {
 	if (clientId.length <= 4) return "****";
 	return `****${clientId.slice(-4)}`;
 }
-//#endregion
-//#region src/linking/org-assignment.ts
+// src/linking/org-assignment.ts
 const VERIFIED_PROVIDER_PAGE_SIZE = 100;
 function getEmailDomain(email) {
 	const parts = email.trim().toLowerCase().split("@");
@@ -295,8 +284,7 @@ async function assignOrganizationByDomain(ctx, options) {
 		...options
 	});
 }
-//#endregion
-//#region src/oidc/types.ts
+// src/oidc/types.ts
 /**
 * Custom error class for OIDC discovery failures.
 * Can be caught and mapped to APIError at the edge.
@@ -321,8 +309,7 @@ const REQUIRED_DISCOVERY_FIELDS = [
 	"token_endpoint",
 	"jwks_uri"
 ];
-//#endregion
-//#region src/oidc/discovery.ts
+// src/oidc/discovery.ts
 /**
 * OIDC Discovery Pipeline
 *
@@ -788,8 +775,7 @@ async function ensureRuntimeDiscovery(config, issuer, isTrustedOrigin) {
 	await assertServerFetchedOIDCEndpointsAllowed(resolved, isTrustedOrigin);
 	return resolved;
 }
-//#endregion
-//#region src/oidc/errors.ts
+// src/oidc/errors.ts
 /**
 * OIDC Discovery Error Mapping
 *
@@ -869,8 +855,7 @@ function mapDiscoveryErrorToAPIError(error) {
 			});
 	}
 }
-//#endregion
-//#region src/provider-reference.ts
+// src/provider-reference.ts
 const SSO_PROVIDER_STATE_KEY = "ssoProviderReference";
 function serializeCanonical(value) {
 	if (value === null) return "null";
@@ -965,8 +950,7 @@ async function isCurrentSSOProviderReference(provider, reference) {
 	if (source.type === "persisted" && (reference.source.type !== "persisted" || source.recordId !== reference.source.recordId)) return false;
 	return reference.authenticationConfigurationFingerprint === await computeProviderAuthenticationFingerprint(provider);
 }
-//#endregion
-//#region src/saml/parser.ts
+// src/saml/parser.ts
 const xmlParser = new XMLParser({
 	ignoreAttributes: false,
 	attributeNamePrefix: "@_",
@@ -999,8 +983,7 @@ function countAllNodes(obj, nodeName) {
 	else if (typeof value === "object" && value !== null) count += countAllNodes(value, nodeName);
 	return count;
 }
-//#endregion
-//#region src/saml/algorithms.ts
+// src/saml/algorithms.ts
 const SignatureAlgorithm = {
 	RSA_SHA1: "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
 	RSA_SHA256: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
@@ -1177,8 +1160,7 @@ function validateConfigAlgorithms(config, options = {}) {
 	}
 }
 const saml = typeof samlifyNamespace.SPMetadata === "function" && typeof samlifyNamespace.setSchemaValidator === "function" ? samlifyNamespace : samlifyDefault ?? samlifyNamespace;
-//#endregion
-//#region src/saml/assertions.ts
+// src/saml/assertions.ts
 const SAML_ASSERTION_NAMESPACE = "urn:oasis:names:tc:SAML:2.0:assertion";
 const SAML_PROTOCOL_NAMESPACE = "urn:oasis:names:tc:SAML:2.0:protocol";
 const XML_SIGNATURE_NAMESPACE = "http://www.w3.org/2000/09/xmldsig#";
@@ -1254,8 +1236,7 @@ function verifySAMLAssertionSignature(samlContent, verificationOptions) {
 		throw assertionSignatureFailure();
 	}
 }
-//#endregion
-//#region src/saml/error-codes.ts
+// src/saml/error-codes.ts
 const SAML_ERROR_CODES = defineErrorCodes({
 	SINGLE_LOGOUT_NOT_ENABLED: "Single Logout is not enabled",
 	INVALID_LOGOUT_RESPONSE: "Invalid LogoutResponse",
@@ -1265,8 +1246,7 @@ const SAML_ERROR_CODES = defineErrorCodes({
 	SAML_PROVIDER_NOT_FOUND: "SAML provider not found",
 	CERT_SOURCE_MISSING: "samlConfig requires either a signing certificate (cert or idpMetadata.cert) or an idpMetadata.metadata XML document."
 });
-//#endregion
-//#region src/saml/cert.ts
+// src/saml/cert.ts
 /**
 * IdP signing-certificate rules for SAML configs. Centralized so the runtime
 * verification path (`createIdP`), the sanitizer (`getSSOProvider` and
@@ -1295,8 +1275,7 @@ function validateCertSources(config) {
 	const hasExplicitCert = config.idpMetadata?.cert !== void 0 || config.cert !== void 0;
 	if (!hasMetadataXml && !hasExplicitCert) throw APIError.from("BAD_REQUEST", SAML_ERROR_CODES.CERT_SOURCE_MISSING);
 }
-//#endregion
-//#region src/saml/response-binding.ts
+// src/saml/response-binding.ts
 const SAML_HTTP_POST_BINDING = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
 const SAML_BEARER_CONFIRMATION_METHOD = "urn:oasis:names:tc:SAML:2.0:cm:bearer";
 const SAML_METADATA_NAMESPACE = "urn:oasis:names:tc:SAML:2.0:metadata";
@@ -1473,8 +1452,7 @@ function validateSAMLResponseBinding(samlContent, options) {
 	validateBearerRecipient(assertion, expectedRecipients);
 	validateResponseDestination(response, expectedRecipients);
 }
-//#endregion
-//#region src/saml/response-validation.ts
+// src/saml/response-validation.ts
 function errorRedirectUrl(base, error, description) {
 	try {
 		const url = new URL(base);
@@ -1571,8 +1549,7 @@ function validateAudience(c, ctx) {
 		throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "invalid_saml_response", "Audience mismatch"));
 	}
 }
-//#endregion
-//#region src/user-resolution.ts
+// src/user-resolution.ts
 const SSO_AUTHENTICATION_FAILURE = Symbol("SSO_AUTHENTICATION_FAILURE");
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -1658,8 +1635,7 @@ function getFailedSSOAuthenticationResult(error) {
 	if (!(error instanceof Error) || !(SSO_AUTHENTICATION_FAILURE in error) || error[SSO_AUTHENTICATION_FAILURE] !== true || !("result" in error)) return;
 	return error.result;
 }
-//#endregion
-//#region src/routes/helpers.ts
+// src/routes/helpers.ts
 /**
 * Same as `normalizePem`, but applied across the resolved list of IdP signing
 * certificates so multi-cert rotation configs survive the line-trim step.
@@ -1823,8 +1799,7 @@ function createSAMLPostForm(action, samlParam, samlValue, relayState) {
 	const html = `<!DOCTYPE html><html><body onload="document.forms[0].submit();"><form method="POST" action="${safeAction}"><input type="hidden" name="${safeSamlParam}" value="${safeSamlValue}" />${safeRelayState ? `<input type="hidden" name="RelayState" value="${safeRelayState}" />` : ""}<noscript><input type="submit" value="Continue" /></noscript></form></body></html>`;
 	return new Response(html, { headers: { "Content-Type": "text/html" } });
 }
-//#endregion
-//#region src/routes/schemas.ts
+// src/routes/schemas.ts
 const absoluteUrlSchema = z.url();
 const samlRedirectUrlSchema = z.string().refine((url) => isSafeSAMLRedirectPath(url) || absoluteUrlSchema.safeParse(url).success, { message: "Expected an absolute URL or a relative path starting with /" });
 function getSSOProviderAdditionalFields$1(options) {
@@ -1967,8 +1942,7 @@ function getUpdateSSOProviderBodySchema(options) {
 		...getSSOProviderAdditionalFieldsSchema(options).partial().shape
 	});
 }
-//#endregion
-//#region src/routes/providers.ts
+// src/routes/providers.ts
 const ADMIN_ROLES = ["owner", "admin"];
 const OIDC_IDENTITY_BOUNDARY_FIELDS = [
 	"authorizationEndpoint",
@@ -2519,8 +2493,7 @@ const deleteSSOProvider = (options) => {
 		return ctx.json({ success: true });
 	});
 };
-//#endregion
-//#region src/routes/domain-verification.ts
+// src/routes/domain-verification.ts
 const DNS_LABEL_MAX_LENGTH = 63;
 const DEFAULT_TOKEN_PREFIX = "better-auth-token";
 const domainVerificationBodySchema = z.object({ providerId: z.string() });
@@ -2649,8 +2622,7 @@ const verifyDomain = (options) => {
 		ctx.setStatus(204);
 	});
 };
-//#endregion
-//#region src/saml-state.ts
+// src/saml-state.ts
 async function generateRelayState(c, link, providerReference) {
 	const callbackURL = c.body.callbackURL;
 	if (!callbackURL) throw new APIError("BAD_REQUEST", { message: "callbackURL is required" });
@@ -2700,8 +2672,7 @@ async function parseRelayState(c) {
 	if (!parsedData.errorURL) parsedData.errorURL = errorURL;
 	return parsedData;
 }
-//#endregion
-//#region src/saml/timestamp.ts
+// src/saml/timestamp.ts
 /**
 * Validates SAML assertion timestamp conditions (NotBefore/NotOnOrAfter).
 * Prevents acceptance of expired or future-dated assertions.
@@ -2741,8 +2712,7 @@ function validateSAMLTimestamp(conditions, options = {}) {
 		});
 	}
 }
-//#endregion
-//#region src/routes/saml-pipeline.ts
+// src/routes/saml-pipeline.ts
 function isSameSSOProviderReference(left, right) {
 	if (left.providerId !== right.providerId || left.authenticationConfigurationFingerprint !== right.authenticationConfigurationFingerprint || left.source.type !== right.source.type) return false;
 	return left.source.type === "configured" ? true : right.source.type === "persisted" && left.source.recordId === right.source.recordId;
@@ -2823,20 +2793,16 @@ async function getSAMLResponseBindingContent(sp, samlContent) {
 /**
 * Extracts the Assertion ID from a SAML response XML.
 * Used for replay protection per SAML 2.0 Core section 2.3.3.
+*
+* Reads the ID through the DOM so character references are decoded the same
+* way the signature check decodes them: re-spelling the ID keeps the
+* signature valid, so it must not change the replay key.
 */
 function extractAssertionId(samlContent) {
 	try {
-		const parsed = new XMLParser({
-			ignoreAttributes: false,
-			attributeNamePrefix: "@_",
-			removeNSPrefix: true
-		}).parse(samlContent);
-		const response = parsed.Response || parsed["samlp:Response"];
-		if (!response) return null;
-		const rawAssertion = response.Assertion || response["saml:Assertion"];
-		const assertion = Array.isArray(rawAssertion) ? rawAssertion[0] : rawAssertion;
-		if (!assertion) return null;
-		return assertion["@_ID"] || null;
+		const response = new DOMParser().parseFromString(samlContent, "text/xml").documentElement;
+		if (response?.localName !== "Response") return null;
+		return Array.from(response.childNodes).find((node) => node.nodeType === 1 && node.localName === "Assertion")?.getAttribute("ID") || null;
 	} catch {
 		return null;
 	}
@@ -2999,7 +2965,7 @@ async function processSAMLResponse(ctx, params, options) {
 		id: extract.nameID,
 		email: (attr(mapping.email || "email") || extract.nameID || "").toLowerCase(),
 		name: [attr(mapping.firstName || "givenName"), attr(mapping.lastName || "surname")].filter(Boolean).join(" ") || attr(mapping.name || "displayName") || extract.nameID,
-		emailVerified: options?.trustEmailVerified && mapping.emailVerified ? parseProviderEmailVerified(attr(mapping.emailVerified)) : false
+		emailVerified: options?.trustEmailVerified && mapping.emailVerified ? parseStringBoolean(attr(mapping.emailVerified)) ?? false : false
 	};
 	if (!userInfo.id || !userInfo.email) {
 		ctx.context.logger.error("Missing essential user info from SAML response", {
@@ -3140,8 +3106,7 @@ async function processSAMLResponse(ctx, params, options) {
 	}
 	return samlRedirectUrl;
 }
-//#endregion
-//#region src/routes/sso.ts
+// src/routes/sso.ts
 const BUILT_IN_ACCOUNT_PROVIDER_IDS = [
 	"credential",
 	"email-otp",
@@ -3939,7 +3904,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, rawUserInfo[value]])),
 			id: readStringClaim(rawUserInfo, "sub"),
 			email: readEmailClaim(rawUserInfo),
-			emailVerified: options?.trustEmailVerified ? parseProviderEmailVerified(rawUserInfo[mapping.emailVerified || "email_verified"]) : false,
+			emailVerified: options?.trustEmailVerified ? parseStringBoolean(rawUserInfo[mapping.emailVerified || "email_verified"]) ?? false : false,
 			name: readStringClaim(rawUserInfo, mapping.name || "name"),
 			image: readStringClaim(rawUserInfo, mapping.image || "picture")
 		};
@@ -3950,7 +3915,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, idToken[value]])),
 			id: idToken.sub,
 			email: readEmailClaim(idToken),
-			emailVerified: options?.trustEmailVerified ? parseProviderEmailVerified(idToken[mapping.emailVerified || "email_verified"]) : false,
+			emailVerified: options?.trustEmailVerified ? parseStringBoolean(idToken[mapping.emailVerified || "email_verified"]) ?? false : false,
 			name: readStringClaim(idToken, mapping.name || "name"),
 			image: readStringClaim(idToken, mapping.image || "picture")
 		};
@@ -4423,7 +4388,7 @@ const initiateSLO = (options) => {
 		const session = ctx.context.session;
 		const sessionLookupKey = `${SAML_SESSION_BY_ID_PREFIX}${session.session.id}`;
 		const sessionLookup = await ctx.context.internalAdapter.findVerificationValue(sessionLookupKey);
-		let nameID = session.user.email;
+		let nameID;
 		let sessionIndex;
 		let samlSessionKey;
 		if (sessionLookup) {
@@ -4432,11 +4397,15 @@ const initiateSLO = (options) => {
 			if (stored) {
 				const data = safeJsonParse(stored.value);
 				if (data) {
-					nameID = data.nameID || nameID;
+					nameID = data.nameID;
 					sessionIndex = data.sessionIndex;
 				}
 			}
 		}
+		if (!nameID) {
+			const [account] = (await ctx.context.internalAdapter.findAccounts(session.user.id)).filter((account) => account.providerId === providerId).sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
+			nameID = account?.accountId ?? session.user.email;
+		}
 		const logoutRequest = sp.createLogoutRequest(idp, "redirect", {
 			logoutNameID: nameID,
 			sessionIndex,
@@ -4455,8 +4424,7 @@ const initiateSLO = (options) => {
 		throw ctx.redirect(logoutRequest.context);
 	});
 };
-//#endregion
-//#region src/index.ts
+// src/index.ts
 saml.setSchemaValidator({ async validate(xml) {
 	if (XMLValidator.validate(xml, { allowBooleanAttributes: true }) === true) return "SUCCESS_VALIDATE_XML";
 	throw "ERR_INVALID_XML";
@@ -4501,6 +4469,53 @@ function assertNoAdditionalFieldCollisions(options) {
 		if (builtInFieldNames.has(fieldName)) throw new Error(`ssoProvider additional field "${key}" maps to built-in field "${fieldName}"`);
 	}
 }
+const SAML_SESSION_RECORD_PAGE_SIZE = 100;
+async function findSAMLSessionRecord(ctx, identifier, isOwnRecord) {
+	for (let offset = 0;; offset += SAML_SESSION_RECORD_PAGE_SIZE) {
+		const page = await ctx.adapter.findMany({
+			model: "verification",
+			where: [{
+				field: "identifier",
+				value: identifier
+			}],
+			sortBy: {
+				field: "createdAt",
+				direction: "desc"
+			},
+			limit: SAML_SESSION_RECORD_PAGE_SIZE,
+			offset
+		});
+		const record = page.find(isOwnRecord);
+		if (record || page.length < SAML_SESSION_RECORD_PAGE_SIZE) return record;
+	}
+}
+/**
+* SLO records are written with the session's expiry at sign-in. Move it when a
+* refresh extends the session, so expired-row cleanup doesn't drop them early.
+*/
+async function extendSAMLSessionRecords(ctx, session) {
+	const lookupKey = `${SAML_SESSION_BY_ID_PREFIX}${session.id}`;
+	const lookup = await ctx.internalAdapter.findVerificationValue(lookupKey);
+	const expiresAt = new Date(session.expiresAt);
+	if (!lookup || new Date(lookup.expiresAt) >= expiresAt) return;
+	const isOwnRecord = (record) => safeJsonParse(record.value)?.sessionId === session.id;
+	const latest = await ctx.internalAdapter.findVerificationValue(lookup.value);
+	const secondaryStorageOnly = ctx.options.secondaryStorage && !ctx.options.verification?.storeInDatabase;
+	if (latest && secondaryStorageOnly) {
+		if (isOwnRecord(latest)) await ctx.internalAdapter.updateVerificationByIdentifier(lookup.value, { expiresAt });
+	} else if (latest) {
+		const record = await findSAMLSessionRecord(ctx, latest.identifier, isOwnRecord);
+		if (record) await ctx.adapter.update({
+			model: "verification",
+			where: [{
+				field: "id",
+				value: record.id
+			}],
+			update: { expiresAt }
+		});
+	}
+	await ctx.internalAdapter.updateVerificationByIdentifier(lookupKey, { expiresAt });
+}
 function sso(options) {
 	assertNoAdditionalFieldCollisions(options);
 	const optionsWithStore = options;
@@ -4533,8 +4548,13 @@ function sso(options) {
 		version: PACKAGE_VERSION,
 		init(ctx) {
 			const existing = ctx.skipOriginCheck;
-			if (existing === true) return {};
-			return { context: { skipOriginCheck: [...Array.isArray(existing) ? existing : [], ...SAML_SKIP_ORIGIN_CHECK_PATHS] } };
+			return {
+				...existing !== true && { context: { skipOriginCheck: [...Array.isArray(existing) ? existing : [], ...SAML_SKIP_ORIGIN_CHECK_PATHS] } },
+				options: { databaseHooks: { session: { update: { async after(session) {
+					if (!options?.saml?.enableSingleLogout) return;
+					await extendSAMLSessionRecords(ctx, session).catch((error) => ctx.logger.warn("Failed to extend SAML session records", { error }));
+				} } } } }
+			};
 		},
 		endpoints,
 		hooks: {
@@ -4624,5 +4644,4 @@ function sso(options) {
 		options
 	};
 }
-//#endregion
 export { DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DigestAlgorithm, DiscoveryError, KeyEncryptionAlgorithm, REQUIRED_DISCOVERY_FIELDS, SignatureAlgorithm, computeDiscoveryUrl, deriveSAMLIdentityProviderEntityID, deriveSAMLServiceProviderPolicy, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };

package/dist/version-DnGxDgB4.mjs

@@ -0,0 +1,3 @@
+// src/version.ts
+const PACKAGE_VERSION = "1.7.22";
+export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.7.20",
+  "version": "1.7.22",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -64,24 +64,24 @@
     "zod": "^4.5.4"
   },
   "devDependencies": {
+    "@better-auth/core": "1.7.22",
+    "@better-auth/kysely-adapter": "1.7.22",
     "@types/body-parser": "^1.19.6",
     "@types/express": "^5.0.6",
+    "better-auth": "1.7.22",
     "better-call": "1.4.5",
     "body-parser": "^2.3.0",
     "express": "^5.2.1",
     "kysely": "^0.28.17 || ^0.29.0",
     "oauth2-mock-server": "^9.0.0",
-    "tsdown": "0.23.1",
-    "@better-auth/core": "1.7.20",
-    "@better-auth/kysely-adapter": "1.7.20",
-    "better-auth": "1.7.20"
+    "tsdown": "0.23.1"
   },
   "peerDependencies": {
+    "@better-auth/core": "^1.7.22",
     "@better-auth/utils": "^0.4.2 || ^0.5.0",
     "@better-fetch/fetch": "1.3.3",
-    "better-call": "1.4.5",
-    "@better-auth/core": "^1.7.20",
-    "better-auth": "^1.7.20"
+    "better-auth": "^1.7.22",
+    "better-call": "1.4.5"
   },
   "scripts": {
     "build": "tsdown",

package/dist/version-COmqWYke.mjs

@@ -1,5 +0,0 @@
-//#endregion
-//#region src/version.ts
-const PACKAGE_VERSION = "1.7.20";
-//#endregion
-export { PACKAGE_VERSION as t };