@better-auth/sso 1.8.0-beta.0 → 1.8.0-beta.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/client.d.mts +1 -1
  2. package/dist/client.mjs +1 -1
  3. package/dist/{index-CuvoOoW_.d.mts → index-qb-OvHIE.d.mts} +1 -1
  4. package/dist/index.d.mts +1 -1
  5. package/dist/index.mjs +6 -4
  6. package/dist/{version-B3TRcA4n.mjs → version-Dv2lqEg3.mjs} +1 -1
  7. package/package.json +8 -8
package/dist/client.d.mts CHANGED
@@ -1,4 +1,4 @@
1
- import { t as SSOPlugin } from "./index-CuvoOoW_.mjs";
1
+ import { t as SSOPlugin } from "./index-qb-OvHIE.mjs";
2
2
  import { DBFieldAttribute } from "better-auth/db";
3
3
 
4
4
  //#region src/client.d.ts
package/dist/client.mjs CHANGED
@@ -1,4 +1,4 @@
1
- import { t as PACKAGE_VERSION } from "./version-B3TRcA4n.mjs";
1
+ import { t as PACKAGE_VERSION } from "./version-Dv2lqEg3.mjs";
2
2
  //#region src/client.ts
3
3
  const ssoClient = (options) => {
4
4
  return {
package/dist/{index-CuvoOoW_.d.mts → index-qb-OvHIE.d.mts} RENAMED
@@ -999,7 +999,6 @@ declare const updateSSOProvider: (options: SSOOptions) => _$better_call0.StrictE
999
999
  }, z.core.$strict>>>;
1000
1000
  }, z.core.$strip>>;
1001
1001
  samlConfig: z.ZodOptional<z.ZodObject<{
1002
- audience: z.ZodOptional<z.ZodOptional<z.ZodString>>;
1003
1002
  mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
1004
1003
  email: z.ZodOptional<z.ZodString>;
1005
1004
  emailVerified: z.ZodOptional<z.ZodString>;
@@ -1021,6 +1020,7 @@ declare const updateSSOProvider: (options: SSOOptions) => _$better_call0.StrictE
1021
1020
  }, z.core.$strip>>>;
1022
1021
  cert: z.ZodOptional<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
1023
1022
  entryPoint: z.ZodOptional<z.ZodString>;
1023
+ audience: z.ZodOptional<z.ZodOptional<z.ZodString>>;
1024
1024
  callbackUrl: z.ZodOptional<z.ZodOptional<z.ZodString>>;
1025
1025
  wantAssertionsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
1026
1026
  authnRequestsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
package/dist/index.d.mts CHANGED
@@ -1,2 +1,2 @@
1
- import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-CuvoOoW_.mjs";
1
+ import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-qb-OvHIE.mjs";
2
2
  export { AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DeprecatedAlgorithmBehavior, DigestAlgorithm, DiscoverOIDCConfigParams, DiscoveryError, DiscoveryErrorCode, HydratedOIDCConfig, KeyEncryptionAlgorithm, OIDCConfig, OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, RequiredDiscoveryField, SAMLConditions, SAMLConfig, SAMLIdentityProviderMetadata, SAMLServiceProviderPolicy, SSOOIDCUserResolutionInput, SSOOptions, SSOPlugin, SSOProvider, SSOProviderMutationGuardContext, SSOProviderMutationGuardInput, SSOProviderReference, SSOProviderUserProfile, SSOSAMLUserResolutionInput, SSOUserResolution, SSOUserResolutionContext, SSOUserResolutionInput, SignatureAlgorithm, TimestampValidationOptions, computeDiscoveryUrl, deriveSAMLIdentityProviderEntityID, deriveSAMLServiceProviderPolicy, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };
package/dist/index.mjs CHANGED
@@ -1,4 +1,4 @@
1
- import { t as PACKAGE_VERSION } from "./version-B3TRcA4n.mjs";
1
+ import { t as PACKAGE_VERSION } from "./version-Dv2lqEg3.mjs";
2
2
  import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
3
3
  import { XMLParser, XMLValidator } from "fast-xml-parser";
4
4
  import { X509Certificate } from "node:crypto";
@@ -7,9 +7,10 @@ import { generateRandomString } from "better-auth/crypto";
7
7
  import * as z from "zod";
8
8
  import { getCurrentAdapter, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
9
9
  import { filterOutputFields } from "@better-auth/core/utils/db";
10
+ import { verifyIdToken } from "@better-auth/core/oauth2/internal";
10
11
  import { classifyHost, isPublicRoutableHost } from "@better-auth/core/utils/host";
11
12
  import { betterFetch } from "@better-fetch/fetch";
12
- import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
13
+ import { createRemoteJWKSet, customFetch } from "jose";
13
14
  import { base64, base64Url } from "@better-auth/utils/base64";
14
15
  import { createHash } from "@better-auth/utils/hash";
15
16
  import { DOMParser } from "@xmldom/xmldom";
@@ -577,11 +578,12 @@ function assertOIDCAuthorizedParty(payload, clientId) {
577
578
  * the SSO OIDC flow.
578
579
  */
579
580
  async function validateOIDCIdToken(token, jwksEndpoint, options, isTrustedOrigin) {
580
- const verified = await jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint), { [customFetch]: (url, init) => fetchOIDCEndpointResponse("jwksEndpoint", url, init, isTrustedOrigin) }), {
581
+ const verified = await verifyIdToken(token, {
582
+ jwks: createRemoteJWKSet(new URL(jwksEndpoint), { [customFetch]: (url, init) => fetchOIDCEndpointResponse("jwksEndpoint", url, init, isTrustedOrigin) }),
581
583
  audience: options.audience,
582
584
  issuer: options.issuer
583
585
  });
584
- if (typeof options.audience === "string") assertOIDCAuthorizedParty(verified.payload, options.audience);
586
+ assertOIDCAuthorizedParty(verified.payload, options.audience);
585
587
  return verified;
586
588
  }
587
589
  /**
package/dist/{version-B3TRcA4n.mjs → version-Dv2lqEg3.mjs} RENAMED
@@ -1,5 +1,5 @@
1
1
  //#endregion
2
2
  //#region src/version.ts
3
- const PACKAGE_VERSION = "1.8.0-beta.0";
3
+ const PACKAGE_VERSION = "1.8.0-beta.2";
4
4
  //#endregion
5
5
  export { PACKAGE_VERSION as t };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@better-auth/sso",
3
- "version": "1.8.0-beta.0",
3
+ "version": "1.8.0-beta.2",
4
4
  "description": "SSO plugin for Better Auth",
5
5
  "type": "module",
6
6
  "license": "MIT",
@@ -66,22 +66,22 @@
66
66
  "devDependencies": {
67
67
  "@types/body-parser": "^1.19.6",
68
68
  "@types/express": "^5.0.6",
69
- "better-call": "1.4.2",
69
+ "better-call": "1.4.4",
70
70
  "body-parser": "^2.3.0",
71
71
  "express": "^5.2.1",
72
72
  "kysely": "^0.28.17 || ^0.29.0",
73
73
  "oauth2-mock-server": "^9.0.0",
74
74
  "tsdown": "0.21.10",
75
- "@better-auth/core": "1.8.0-beta.0",
76
- "better-auth": "1.8.0-beta.0",
77
- "@better-auth/kysely-adapter": "1.8.0-beta.0"
75
+ "@better-auth/core": "1.8.0-beta.2",
76
+ "@better-auth/kysely-adapter": "1.8.0-beta.2",
77
+ "better-auth": "1.8.0-beta.2"
78
78
  },
79
79
  "peerDependencies": {
80
80
  "@better-auth/utils": "^0.4.2 || ^0.5.0",
81
81
  "@better-fetch/fetch": "1.3.2",
82
- "better-call": "1.4.2",
83
- "@better-auth/core": "^1.8.0-beta.0",
84
- "better-auth": "^1.8.0-beta.0"
82
+ "better-call": "1.4.4",
83
+ "@better-auth/core": "^1.8.0-beta.2",
84
+ "better-auth": "^1.8.0-beta.2"
85
85
  },
86
86
  "scripts": {
87
87
  "build": "tsdown",