@better-auth/sso 1.7.6 → 1.7.8

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { t as SSOPlugin } from "./index-sM6JWXeV.mjs";
+import { t as SSOPlugin } from "./index-CuvoOoW_.mjs";
 import { DBFieldAttribute } from "better-auth/db";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-yjzewvQF.mjs";
+import { t as PACKAGE_VERSION } from "./version-C76AN0VD.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-sM6JWXeV.d.mts → index-CuvoOoW_.d.mts}

@@ -149,6 +149,9 @@ interface SAMLConfig {
   /**
    * Provider-level post-auth redirect URL for IdP-initiated or fallback SAML
    * flows when no RelayState callback URL is available.
+   *
+   * Not the Assertion Consumer Service (ACS) URL. To accept responses
+   * addressed to another ACS URL, list it in `spMetadata.metadata`.
    */
   callbackUrl?: string | undefined;
   /**
@@ -988,9 +991,9 @@ declare const updateSSOProvider: (options: SSOOptions) => _$better_call0.StrictE
       pkce: z.ZodOptional<z.ZodOptional<z.ZodDefault<z.ZodBoolean>>>;
       overrideUserInfo: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
       mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
-        email: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
         emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
         image: z.ZodOptional<z.ZodString>;
         extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
       }, z.core.$strict>>>;
@@ -998,9 +1001,9 @@ declare const updateSSOProvider: (options: SSOOptions) => _$better_call0.StrictE
     samlConfig: z.ZodOptional<z.ZodObject<{
       audience: z.ZodOptional<z.ZodOptional<z.ZodString>>;
       mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
-        email: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
         emailVerified: z.ZodOptional<z.ZodString>;
-        name: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
         firstName: z.ZodOptional<z.ZodString>;
         lastName: z.ZodOptional<z.ZodString>;
         extraFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
@@ -1320,7 +1323,6 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => _$bette
                             description: string;
                           };
                         };
-                        required: string[];
                       };
                     };
                     required: string[];

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-sM6JWXeV.mjs";
+import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-CuvoOoW_.mjs";
 export { AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DeprecatedAlgorithmBehavior, DigestAlgorithm, DiscoverOIDCConfigParams, DiscoveryError, DiscoveryErrorCode, HydratedOIDCConfig, KeyEncryptionAlgorithm, OIDCConfig, OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, RequiredDiscoveryField, SAMLConditions, SAMLConfig, SAMLIdentityProviderMetadata, SAMLServiceProviderPolicy, SSOOIDCUserResolutionInput, SSOOptions, SSOPlugin, SSOProvider, SSOProviderMutationGuardContext, SSOProviderMutationGuardInput, SSOProviderReference, SSOProviderUserProfile, SSOSAMLUserResolutionInput, SSOUserResolution, SSOUserResolutionContext, SSOUserResolutionInput, SignatureAlgorithm, TimestampValidationOptions, computeDiscoveryUrl, deriveSAMLIdentityProviderEntityID, deriveSAMLServiceProviderPolicy, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-yjzewvQF.mjs";
+import { t as PACKAGE_VERSION } from "./version-C76AN0VD.mjs";
 import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
@@ -648,7 +648,7 @@ function validateDiscoveryDocument(doc, configuredIssuer) {
 	const missingFields = [];
 	for (const field of REQUIRED_DISCOVERY_FIELDS) if (!doc[field]) missingFields.push(field);
 	if (missingFields.length > 0) throw new DiscoveryError("discovery_incomplete", `Discovery document is missing required fields: ${missingFields.join(", ")}`, { missingFields });
-	if ((doc.issuer.endsWith("/") ? doc.issuer.slice(0, -1) : doc.issuer) !== (configuredIssuer.endsWith("/") ? configuredIssuer.slice(0, -1) : configuredIssuer)) throw new DiscoveryError("issuer_mismatch", `Discovered issuer "${doc.issuer}" does not match configured issuer "${configuredIssuer}"`, {
+	if (doc.issuer !== configuredIssuer) throw new DiscoveryError("issuer_mismatch", `Discovered issuer "${doc.issuer}" does not match configured issuer "${configuredIssuer}"`, {
 		discovered: doc.issuer,
 		configured: configuredIssuer
 	});
@@ -1851,16 +1851,16 @@ function parseSSOProviderAdditionalFields(options, data, action) {
 	});
 }
 const oidcMappingSchema = z.strictObject({
-	email: z.string().meta({ description: "Field mapping for email (defaults to 'email')" }),
+	email: z.string().meta({ description: "Field mapping for email (defaults to 'email')" }).optional(),
 	emailVerified: z.string().meta({ description: "Field mapping for email verification (defaults to 'email_verified')" }).optional(),
-	name: z.string().meta({ description: "Field mapping for name (defaults to 'name')" }),
+	name: z.string().meta({ description: "Field mapping for name (defaults to 'name')" }).optional(),
 	image: z.string().meta({ description: "Field mapping for image (defaults to 'picture')" }).optional(),
 	extraFields: z.record(z.string(), z.any()).optional()
 }).optional();
 const samlMappingSchema = z.strictObject({
-	email: z.string().meta({ description: "Field mapping for email (defaults to 'email')" }),
+	email: z.string().meta({ description: "Field mapping for email (defaults to 'email')" }).optional(),
 	emailVerified: z.string().meta({ description: "Field mapping for email verification" }).optional(),
-	name: z.string().meta({ description: "Field mapping for name (defaults to 'displayName')" }),
+	name: z.string().meta({ description: "Field mapping for name (defaults to 'displayName')" }).optional(),
 	firstName: z.string().meta({ description: "Field mapping for first name (defaults to 'givenName')" }).optional(),
 	lastName: z.string().meta({ description: "Field mapping for last name (defaults to 'surname')" }).optional(),
 	extraFields: z.record(z.string(), z.any()).optional()
@@ -1977,7 +1977,7 @@ const OIDC_IDENTITY_BOUNDARY_FIELDS = [
 	"tokenEndpoint",
 	"userInfoEndpoint"
 ];
-const SAML_IDENTITY_BOUNDARY_FIELDS = ["audience", "callbackUrl"];
+const SAML_IDENTITY_BOUNDARY_FIELDS = ["audience"];
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -1995,7 +1995,13 @@ function hasChangedField(current, updated, fields) {
 function oidcIdentityBoundaryChanged(current, updated) {
 	return hasChangedField(current, updated, OIDC_IDENTITY_BOUNDARY_FIELDS);
 }
-function samlIdentityBoundaryChanged(current, updated) {
+/**
+* Signing certificates are reported apart from the identity boundary: they
+* change who can sign assertions, so the mutation guard treats them as an
+* authentication-boundary change, but they do not change which IdP identities
+* linked accounts belong to.
+*/
+function samlBoundaryChanges(current, updated) {
 	const currentIdentityProvider = createIdP(current).entityMeta;
 	const updatedIdentityProvider = createIdP(updated).entityMeta;
 	let currentServiceProvider;
@@ -2004,7 +2010,10 @@ function samlIdentityBoundaryChanged(current, updated) {
 		currentServiceProvider = current.spMetadata?.metadata ? parseSAMLServiceProviderMetadata(current.spMetadata.metadata) : null;
 		updatedServiceProvider = updated.spMetadata?.metadata ? parseSAMLServiceProviderMetadata(updated.spMetadata.metadata) : null;
 	} catch {
-		return true;
+		return {
+			identity: true,
+			trustAnchors: true
+		};
 	}
 	const effectiveIdentityBoundary = (config) => {
 		const identityProvider = config === current ? currentIdentityProvider : updatedIdentityProvider;
@@ -2015,7 +2024,7 @@ function samlIdentityBoundaryChanged(current, updated) {
 			idpPostService: identityProvider.getSingleSignOnService("post"),
 			spEntityId: serviceProvider?.entityID ?? config.spMetadata?.entityID ?? config.issuer,
 			spNameIDFormat: serviceProvider?.nameIDFormats.at(0) ?? config.identifierFormat,
-			spPostServices: serviceProvider ? getSAMLPostAssertionConsumerServiceUrls(config.spMetadata?.metadata) : config.callbackUrl ? [config.callbackUrl] : [],
+			spPostServices: serviceProvider ? getSAMLPostAssertionConsumerServiceUrls(config.spMetadata?.metadata) : [],
 			wantAssertionsSigned: serviceProvider?.wantAssertionsSigned ?? config.wantAssertionsSigned === true
 		};
 	};
@@ -2023,18 +2032,27 @@ function samlIdentityBoundaryChanged(current, updated) {
 		const certificates = identityProvider.getX509Certificate("signing");
 		return (Array.isArray(certificates) ? certificates : certificates ? [certificates] : []).map((certificate) => normalizePem(certificate) ?? certificate).sort();
 	};
-	return hasChangedField(current, updated, SAML_IDENTITY_BOUNDARY_FIELDS) || identityValueChanged(trustAnchors(currentIdentityProvider), trustAnchors(updatedIdentityProvider)) || identityValueChanged(effectiveIdentityBoundary(current), effectiveIdentityBoundary(updated));
+	return {
+		identity: hasChangedField(current, updated, SAML_IDENTITY_BOUNDARY_FIELDS) || identityValueChanged(effectiveIdentityBoundary(current), effectiveIdentityBoundary(updated)),
+		trustAnchors: identityValueChanged(trustAnchors(currentIdentityProvider), trustAnchors(updatedIdentityProvider))
+	};
 }
 function parseConfigSnapshot(config, configType) {
 	if (!config) return;
 	if (typeof config === "string") return parseAndValidateConfig(config, configType);
 	return config;
 }
-function ssoProviderIdentityBoundaryChanged(current, updated) {
+function ssoProviderAuthBoundaryChanged(current, updated) {
 	if (identityValueChanged(current.issuer, updated.issuer)) return true;
 	const currentSamlConfig = parseConfigSnapshot(current.samlConfig, "SAML");
 	const updatedSamlConfig = parseConfigSnapshot(updated.samlConfig, "SAML");
-	if (currentSamlConfig && (!updatedSamlConfig || samlIdentityBoundaryChanged(currentSamlConfig, updatedSamlConfig))) return true;
+	if (currentSamlConfig) {
+		if (!updatedSamlConfig) return true;
+		if (identityValueChanged(currentSamlConfig, updatedSamlConfig)) {
+			const changes = samlBoundaryChanges(currentSamlConfig, updatedSamlConfig);
+			if (changes.identity || changes.trustAnchors) return true;
+		}
+	}
 	const currentOidcConfig = parseConfigSnapshot(current.oidcConfig, "OIDC");
 	const updatedOidcConfig = parseConfigSnapshot(updated.oidcConfig, "OIDC");
 	return Boolean(currentOidcConfig && (!updatedOidcConfig || oidcIdentityBoundaryChanged(currentOidcConfig, updatedOidcConfig)));
@@ -2104,7 +2122,7 @@ async function lockSSOProviderForAccountLink(ctx, provider) {
 		code: "SSO_PROVIDER_CHANGED",
 		message: "SSO provider changed while account linking was in progress"
 	});
-	if (ssoProviderIdentityBoundaryChanged(provider, lockedProvider)) throw new APIError("CONFLICT", {
+	if (ssoProviderAuthBoundaryChanged(provider, lockedProvider)) throw new APIError("CONFLICT", {
 		code: "SSO_PROVIDER_CHANGED",
 		message: "SSO provider changed while account linking was in progress"
 	});
@@ -2356,7 +2374,7 @@ const updateSSOProvider = (options) => {
 		metadata: { openapi: {
 			operationId: "updateSSOProvider",
 			summary: "Update SSO provider",
-			description: "Partially update an SSO provider. Only provided fields are updated. If domain changes, domainVerified is reset to false.",
+			description: "Partially update an SSO provider. A supplied OIDC or SAML mapping replaces the entire previous mapping. If the domain changes, domainVerified is reset to false.",
 			responses: {
 				"200": { description: "SSO provider updated successfully. The `certificate` field is an array of parsed certificates for SAML providers, or absent when certs live inside `idpMetadata.metadata`." },
 				"404": { description: "Provider not found" },
@@ -2379,6 +2397,7 @@ const updateSSOProvider = (options) => {
 			if (!existingProvider) throw new APIError("NOT_FOUND", { message: "Provider not found" });
 			const updateData = { ...additionalFields };
 			let providerIdentityBoundaryChanged = body.issuer !== void 0 && body.issuer !== existingProvider.issuer;
+			let trustAnchorsChanged = false;
 			if (body.issuer !== void 0) updateData.issuer = body.issuer;
 			if (body.domain !== void 0) {
 				updateData.domain = body.domain;
@@ -2397,7 +2416,9 @@ const updateSSOProvider = (options) => {
 				validateCertSources(updatedSamlConfig);
 				assertSAMLIdentityProviderAuthority(updatedSamlConfig);
 				assertSAMLServiceProviderMetadataPolicy(updatedSamlConfig);
-				if (samlIdentityBoundaryChanged(currentSamlConfig, updatedSamlConfig)) providerIdentityBoundaryChanged = true;
+				const changes = samlBoundaryChanges(currentSamlConfig, updatedSamlConfig);
+				if (changes.identity) providerIdentityBoundaryChanged = true;
+				trustAnchorsChanged = changes.trustAnchors;
 				updateData.samlConfig = JSON.stringify(updatedSamlConfig);
 			}
 			if (body.oidcConfig) {
@@ -2416,7 +2437,7 @@ const updateSSOProvider = (options) => {
 			}
 			await guardSSOProviderMutation(options, {
 				action: "update",
-				isAuthenticationBoundaryChange: providerIdentityBoundaryChanged
+				isAuthenticationBoundaryChange: providerIdentityBoundaryChanged || trustAnchorsChanged
 			}, existingProvider, trx, ctx.context.logger);
 			if (providerIdentityBoundaryChanged) {
 				if (await trx.findOne({
@@ -3291,8 +3312,7 @@ const registerSSOProvider = (options) => {
 												nullable: true,
 												description: "Additional field mappings"
 											}
-										},
-										required: ["email", "name"]
+										}
 									}
 								},
 								required: [
@@ -3888,6 +3908,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 		const value = claims[claim];
 		return typeof value === "string" && value.length > 0 ? value : void 0;
 	};
+	const readEmailClaim = (claims) => [claims[mapping.email || "email"]].flat().find((value) => typeof value === "string" && value.length > 0);
 	let rawProfile;
 	let verifiedIdToken = null;
 	if (tokenResponse.idToken) {
@@ -3918,7 +3939,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 		userInfo = {
 			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, rawUserInfo[value]])),
 			id: readStringClaim(rawUserInfo, "sub"),
-			email: readStringClaim(rawUserInfo, mapping.email || "email"),
+			email: readEmailClaim(rawUserInfo),
 			emailVerified: options?.trustEmailVerified ? parseProviderEmailVerified(rawUserInfo[mapping.emailVerified || "email_verified"]) : false,
 			name: readStringClaim(rawUserInfo, mapping.name || "name"),
 			image: readStringClaim(rawUserInfo, mapping.image || "picture")
@@ -3929,7 +3950,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 		userInfo = {
 			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, idToken[value]])),
 			id: idToken.sub,
-			email: readStringClaim(idToken, mapping.email || "email"),
+			email: readEmailClaim(idToken),
 			emailVerified: options?.trustEmailVerified ? parseProviderEmailVerified(idToken[mapping.emailVerified || "email_verified"]) : false,
 			name: readStringClaim(idToken, mapping.name || "name"),
 			image: readStringClaim(idToken, mapping.image || "picture")

package/dist/{version-yjzewvQF.mjs → version-C76AN0VD.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.6";
+const PACKAGE_VERSION = "1.7.8";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.7.6",
+  "version": "1.7.8",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -66,22 +66,22 @@
   "devDependencies": {
     "@types/body-parser": "^1.19.6",
     "@types/express": "^5.0.6",
-    "better-call": "1.4.0",
+    "better-call": "1.4.2",
     "body-parser": "^2.3.0",
     "express": "^5.2.1",
     "kysely": "^0.28.17 || ^0.29.0",
     "oauth2-mock-server": "^9.0.0",
     "tsdown": "0.21.10",
-    "@better-auth/core": "1.7.6",
-    "@better-auth/kysely-adapter": "1.7.6",
-    "better-auth": "1.7.6"
+    "@better-auth/core": "1.7.8",
+    "@better-auth/kysely-adapter": "1.7.8",
+    "better-auth": "1.7.8"
   },
   "peerDependencies": {
-    "@better-auth/utils": "0.4.2",
+    "@better-auth/utils": "^0.4.2 || ^0.5.0",
     "@better-fetch/fetch": "1.3.2",
-    "better-call": "1.4.0",
-    "better-auth": "^1.7.6",
-    "@better-auth/core": "^1.7.6"
+    "better-call": "1.4.2",
+    "@better-auth/core": "^1.7.8",
+    "better-auth": "^1.7.8"
   },
   "scripts": {
     "build": "tsdown",