@better-auth/sso 1.8.0-beta.1 → 1.8.0-beta.3

package/dist/client.d.mts

@@ -1,6 +1,5 @@
-import { t as SSOPlugin } from "./index-CuvoOoW_.mjs";
+import { t as SSOPlugin } from "./index-BvKzNnKP.mjs";
 import { DBFieldAttribute } from "better-auth/db";
-
 //#region src/client.d.ts
 interface SSOClientOptions {
   domainVerification?: {
@@ -14,7 +13,7 @@ interface SSOClientOptions {
     };
   } | undefined;
 }
-declare const ssoClient: <CO extends SSOClientOptions>(options?: CO | undefined) => {
+export declare const ssoClient: <CO extends SSOClientOptions>(options?: CO | undefined) => {
   id: "sso-client";
   version: string;
   $InferServerPlugin: SSOPlugin<{
@@ -31,4 +30,4 @@ declare const ssoClient: <CO extends SSOClientOptions>(options?: CO | undefined)
   };
 };
 //#endregion
-export { ssoClient };
+export {};

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-Bn0HtKjY.mjs";
+import { t as PACKAGE_VERSION } from "./version-HRaJjPrD.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-CuvoOoW_.d.mts → index-BvKzNnKP.d.mts}

@@ -1,9 +1,11 @@
 import { APIError } from "better-auth/api";
 import * as z from "zod";
+import "@better-fetch/fetch";
 import samlifyDefault from "samlify";
 import { DBFieldAttribute, FieldAttributeToObject, InferAdditionalFieldsFromPluginOptions, RemoveFieldsWithReturnedFalse } from "better-auth/db";
 import { Awaitable, DBTransactionAdapter, OAuth2Tokens, User } from "better-auth";
-import * as _$better_call0 from "better-call";
+import "@better-auth/core/db/adapter";
+import "@better-auth/core";
 //#region src/saml/algorithms.d.ts
 declare const SignatureAlgorithm: {
   readonly RSA_SHA1: "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
@@ -479,7 +481,7 @@ interface SSOOptions {
         domain?: string | undefined;
         domainVerified?: string | undefined;
       };
-      additionalFields?: { [key in string]: DBFieldAttribute };
+      additionalFields?: { [key in string]: DBFieldAttribute; };
     };
   } | undefined;
   /**
@@ -683,7 +685,7 @@ interface SSOOptions {
 }
 //#endregion
 //#region src/routes/domain-verification.d.ts
-declare const requestDomainVerification: (options: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/request-domain-verification", {
+declare const requestDomainVerification: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/request-domain-verification", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -705,7 +707,7 @@ declare const requestDomainVerification: (options: SSOOptions) => _$better_call0
       };
     };
   };
-  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -731,7 +733,7 @@ declare const requestDomainVerification: (options: SSOOptions) => _$better_call0
 }, {
   domainVerificationToken: string;
 }>;
-declare const verifyDomain: (options: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/verify-domain", {
+declare const verifyDomain: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/verify-domain", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -756,7 +758,7 @@ declare const verifyDomain: (options: SSOOptions) => _$better_call0.StrictEndpoi
       };
     };
   };
-  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -794,9 +796,9 @@ type ParsedCert = ReturnType<typeof parseCertificate>;
 type SanitizedCert = ParsedCert | {
   error: string;
 };
-declare const listSSOProviders: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/providers", {
+declare const listSSOProviders: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/providers", {
   method: "GET";
-  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -865,9 +867,9 @@ declare const listSSOProviders: (options?: SSOOptions) => _$better_call0.StrictE
     spMetadataUrl: string;
   }[];
 }>;
-declare const getSSOProvider: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/get-provider", {
+declare const getSSOProvider: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/get-provider", {
   method: "GET";
-  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -943,9 +945,9 @@ declare const getSSOProvider: (options?: SSOOptions) => _$better_call0.StrictEnd
   } | undefined;
   spMetadataUrl: string;
 }>;
-declare const updateSSOProvider: (options: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/update-provider", {
+declare const updateSSOProvider: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/update-provider", {
   method: "POST";
-  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -999,7 +1001,6 @@ declare const updateSSOProvider: (options: SSOOptions) => _$better_call0.StrictE
       }, z.core.$strict>>>;
     }, z.core.$strip>>;
     samlConfig: z.ZodOptional<z.ZodObject<{
-      audience: z.ZodOptional<z.ZodOptional<z.ZodString>>;
       mapping: z.ZodOptional<z.ZodOptional<z.ZodObject<{
         email: z.ZodOptional<z.ZodString>;
         emailVerified: z.ZodOptional<z.ZodString>;
@@ -1021,6 +1022,7 @@ declare const updateSSOProvider: (options: SSOOptions) => _$better_call0.StrictE
       }, z.core.$strip>>>;
       cert: z.ZodOptional<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
       entryPoint: z.ZodOptional<z.ZodString>;
+      audience: z.ZodOptional<z.ZodOptional<z.ZodString>>;
       callbackUrl: z.ZodOptional<z.ZodOptional<z.ZodString>>;
       wantAssertionsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
       authnRequestsSigned: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
@@ -1099,9 +1101,9 @@ declare const updateSSOProvider: (options: SSOOptions) => _$better_call0.StrictE
   } | undefined;
   spMetadataUrl: string;
 }>;
-declare const deleteSSOProvider: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/delete-provider", {
+declare const deleteSSOProvider: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/delete-provider", {
   method: "POST";
-  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1150,7 +1152,7 @@ declare const deleteSSOProvider: (options?: SSOOptions) => _$better_call0.Strict
 }>;
 //#endregion
 //#region src/routes/sso.d.ts
-declare const spMetadata: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/sp/metadata", {
+declare const spMetadata: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/metadata", {
   method: "GET";
   query: z.ZodObject<{
     providerId: z.ZodString;
@@ -1168,12 +1170,12 @@ declare const spMetadata: (options?: SSOOptions) => _$better_call0.StrictEndpoin
     };
   };
 }, Response>;
-declare const registerSSOProvider: <O extends SSOOptions>(options: O) => _$better_call0.StrictEndpoint<"/sso/register", {
+declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import("better-call").StrictEndpoint<"/sso/register", {
   method: "POST";
   body: z.ZodObject<{
     [x: string]: z.ZodOptional<z.ZodAny>;
   }, z.core.$strip>;
-  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1369,7 +1371,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => _$bette
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
 } & Omit<InferSSOProvider<O>, "samlConfig" | "oidcConfig">>;
-declare const signInSSO: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sign-in/sso", {
+declare const signInSSO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sign-in/sso", {
   method: "POST";
   body: z.ZodObject<{
     email: z.ZodOptional<z.ZodString>;
@@ -1491,7 +1493,7 @@ declare const signInSSO: (options?: SSOOptions) => _$better_call0.StrictEndpoint
   url: string;
   redirect: boolean;
 }>;
-declare const callbackSSO: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/callback/:providerId", {
+declare const callbackSSO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback/:providerId", {
   method: "GET";
   query: z.ZodObject<{
     code: z.ZodOptional<z.ZodString>;
@@ -1519,7 +1521,7 @@ declare const callbackSSO: (options?: SSOOptions) => _$better_call0.StrictEndpoi
  * Used when `options.redirectURI` is set — the `providerId` is read from
  * the OAuth state instead of the URL path.
  */
-declare const callbackSSOShared: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/callback", {
+declare const callbackSSOShared: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback", {
   metadata: {
     openapi: {
       operationId: string;
@@ -1542,7 +1544,7 @@ declare const callbackSSOShared: (options?: SSOOptions) => _$better_call0.Strict
   }, z.core.$strip>;
   allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
 }, never>;
-declare const acsEndpoint: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
+declare const acsEndpoint: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
   method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLResponse: z.ZodString;
@@ -1572,7 +1574,7 @@ declare const acsEndpoint: (options?: SSOOptions) => _$better_call0.StrictEndpoi
     scope: "server";
   };
 }, never>;
-declare const sloEndpoint: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
+declare const sloEndpoint: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
   method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLRequest: z.ZodOptional<z.ZodString>;
@@ -1593,12 +1595,12 @@ declare const sloEndpoint: (options?: SSOOptions) => _$better_call0.StrictEndpoi
     scope: "server";
   };
 }, void | Response>;
-declare const initiateSLO: (options?: SSOOptions) => _$better_call0.StrictEndpoint<"/sso/saml2/logout/:providerId", {
+declare const initiateSLO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/logout/:providerId", {
   method: "POST";
   body: z.ZodObject<{
     callbackURL: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
-  use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+  use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1762,7 +1764,29 @@ interface OIDCDiscoveryDocument {
 /**
  * Error codes for OIDC discovery operations.
  */
-type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */ | "discovery_invalid_url" /** OIDC endpoint URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */ | "discovery_private_host" /** Server-side OIDC endpoint fetch received an HTTP redirect response */ | "oidc_endpoint_redirect" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
+type DiscoveryErrorCode =
+/** Request to discovery endpoint timed out */
+"discovery_timeout" |
+/** Discovery endpoint returned 404 or similar */
+"discovery_not_found" |
+/** Discovery endpoint returned invalid JSON */
+"discovery_invalid_json" |
+/** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */
+"discovery_invalid_url" |
+/** OIDC endpoint URL is not trusted by the trusted origins configuration */
+"discovery_untrusted_origin" |
+/** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */
+"discovery_private_host" |
+/** Server-side OIDC endpoint fetch received an HTTP redirect response */
+"oidc_endpoint_redirect" |
+/** Discovery document issuer doesn't match configured issuer */
+"issuer_mismatch" |
+/** Discovery document is missing required fields */
+"discovery_incomplete" |
+/** IdP only advertises token auth methods that Better Auth doesn't currently support */
+"unsupported_token_auth_method" |
+/** Catch-all for unexpected errors */
+"discovery_unexpected_error";
 /**
  * Custom error class for OIDC discovery failures.
  * Can be caught and mapped to APIError at the edge.

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-CuvoOoW_.mjs";
-export { AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DeprecatedAlgorithmBehavior, DigestAlgorithm, DiscoverOIDCConfigParams, DiscoveryError, DiscoveryErrorCode, HydratedOIDCConfig, KeyEncryptionAlgorithm, OIDCConfig, OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, RequiredDiscoveryField, SAMLConditions, SAMLConfig, SAMLIdentityProviderMetadata, SAMLServiceProviderPolicy, SSOOIDCUserResolutionInput, SSOOptions, SSOPlugin, SSOProvider, SSOProviderMutationGuardContext, SSOProviderMutationGuardInput, SSOProviderReference, SSOProviderUserProfile, SSOSAMLUserResolutionInput, SSOUserResolution, SSOUserResolutionContext, SSOUserResolutionInput, SignatureAlgorithm, TimestampValidationOptions, computeDiscoveryUrl, deriveSAMLIdentityProviderEntityID, deriveSAMLServiceProviderPolicy, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };
+import { A as SAMLIdentityProviderMetadata, B as SSOUserResolutionContext, C as deriveSAMLIdentityProviderEntityID, D as DEFAULT_MAX_SAML_RESPONSE_SIZE, E as DEFAULT_MAX_SAML_METADATA_SIZE, F as SSOProviderMutationGuardInput, G as DigestAlgorithm, H as AlgorithmValidationOptions, I as SSOProviderReference, K as KeyEncryptionAlgorithm, L as SSOProviderUserProfile, M as SSOOptions, N as SSOProvider, O as OIDCConfig, P as SSOProviderMutationGuardContext, R as SSOSAMLUserResolutionInput, S as SAMLServiceProviderPolicy, T as DEFAULT_CLOCK_SKEW_MS, U as DataEncryptionAlgorithm, V as SSOUserResolutionInput, W as DeprecatedAlgorithmBehavior, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as TimestampValidationOptions, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as SSOOIDCUserResolutionInput, k as SAMLConfig, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, q as SignatureAlgorithm, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as deriveSAMLServiceProviderPolicy, x as validateSAMLTimestamp, y as SAMLConditions, z as SSOUserResolution } from "./index-BvKzNnKP.mjs";
+export { type AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, type DeprecatedAlgorithmBehavior, DigestAlgorithm, type DiscoverOIDCConfigParams, DiscoveryError, type DiscoveryErrorCode, type HydratedOIDCConfig, KeyEncryptionAlgorithm, type OIDCConfig, type OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, type RequiredDiscoveryField, type SAMLConditions, type SAMLConfig, type SAMLIdentityProviderMetadata, type SAMLServiceProviderPolicy, type SSOOIDCUserResolutionInput, type SSOOptions, SSOPlugin, type SSOProvider, type SSOProviderMutationGuardContext, type SSOProviderMutationGuardInput, type SSOProviderReference, type SSOProviderUserProfile, type SSOSAMLUserResolutionInput, type SSOUserResolution, type SSOUserResolutionContext, type SSOUserResolutionInput, SignatureAlgorithm, type TimestampValidationOptions, computeDiscoveryUrl, deriveSAMLIdentityProviderEntityID, deriveSAMLServiceProviderPolicy, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-Bn0HtKjY.mjs";
+import { t as PACKAGE_VERSION } from "./version-HRaJjPrD.mjs";
 import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
@@ -7,14 +7,14 @@ import { generateRandomString } from "better-auth/crypto";
 import * as z from "zod";
 import { getCurrentAdapter, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { filterOutputFields } from "@better-auth/core/utils/db";
+import { verifyIdToken } from "@better-auth/core/oauth2/internal";
 import { classifyHost, isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { betterFetch } from "@better-fetch/fetch";
-import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
+import { createRemoteJWKSet, customFetch } from "jose";
 import { base64, base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
 import { DOMParser } from "@xmldom/xmldom";
-import * as samlifyNamespace from "samlify";
-import samlifyDefault from "samlify";
+import samlifyDefault, * as samlifyNamespace from "samlify";
 import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
 import { parseInputData, toZodSchema } from "better-auth/db";
 import { isAPIError } from "@better-auth/core/utils/is-api-error";
@@ -40,7 +40,7 @@ const LOGOUT_REQUEST_KEY_PREFIX = "saml-logout-request:";
 * Default TTL for used assertion records (15 minutes).
 * This should match the maximum expected NotOnOrAfter window plus clock skew.
 */
-const DEFAULT_ASSERTION_TTL_MS = 900 * 1e3;
+const DEFAULT_ASSERTION_TTL_MS = 9e5;
 /**
 * Default clock skew tolerance (5 minutes).
 * Allows for minor time differences between IdP and SP servers.
@@ -50,17 +50,17 @@ const DEFAULT_ASSERTION_TTL_MS = 900 * 1e3;
 * - Clock synchronization differences (NTP drift)
 * - Distributed systems across timezones
 */
-const DEFAULT_CLOCK_SKEW_MS = 300 * 1e3;
+const DEFAULT_CLOCK_SKEW_MS = 3e5;
 /**
 * Default maximum size for SAML responses (256 KB).
 * Protects against memory exhaustion from oversized SAML payloads.
 */
-const DEFAULT_MAX_SAML_RESPONSE_SIZE = 256 * 1024;
+const DEFAULT_MAX_SAML_RESPONSE_SIZE = 262144;
 /**
 * Default maximum size for IdP metadata (100 KB).
 * Protects against oversized metadata documents.
 */
-const DEFAULT_MAX_SAML_METADATA_SIZE = 100 * 1024;
+const DEFAULT_MAX_SAML_METADATA_SIZE = 102400;
 //#endregion
 //#region src/utils.ts
 const unsafeSAMLRedirectPathPrefix = /^\/(?:\/|\\|%2f|%5c)/i;
@@ -113,7 +113,8 @@ const validateEmailDomain = (email, domain) => {
 	return domainMatches(emailDomain, domain);
 };
 function parseCertificate(certPem) {
-	const cert = new X509Certificate(certPem.includes("-----BEGIN") ? certPem : `-----BEGIN CERTIFICATE-----\n${certPem}\n-----END CERTIFICATE-----`);
+	const normalized = certPem.includes("-----BEGIN") ? certPem : `-----BEGIN CERTIFICATE-----\n${certPem}\n-----END CERTIFICATE-----`;
+	const cert = new X509Certificate(normalized);
 	return {
 		fingerprintSha256: cert.fingerprint256,
 		notBefore: cert.validFrom,
@@ -577,11 +578,13 @@ function assertOIDCAuthorizedParty(payload, clientId) {
 * the SSO OIDC flow.
 */
 async function validateOIDCIdToken(token, jwksEndpoint, options, isTrustedOrigin) {
-	const verified = await jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint), { [customFetch]: (url, init) => fetchOIDCEndpointResponse("jwksEndpoint", url, init, isTrustedOrigin) }), {
+	const jwks = createRemoteJWKSet(new URL(jwksEndpoint), { [customFetch]: (url, init) => fetchOIDCEndpointResponse("jwksEndpoint", url, init, isTrustedOrigin) });
+	const verified = await verifyIdToken(token, {
+		jwks,
 		audience: options.audience,
 		issuer: options.issuer
 	});
-	if (typeof options.audience === "string") assertOIDCAuthorizedParty(verified.payload, options.audience);
+	assertOIDCAuthorizedParty(verified.payload, options.audience);
 	return verified;
 }
 /**
@@ -1098,10 +1101,7 @@ function handleDeprecatedAlgorithm(message, behavior, errorCode) {
 			message,
 			code: errorCode
 		});
-		case "warn":
-			console.warn(`[SAML Security Warning] ${message}`);
-			break;
-		case "allow": break;
+		case "warn": console.warn(`[SAML Security Warning] ${message}`);
 	}
 }
 function validateSignatureAlgorithm(algorithm, options = {}) {
@@ -2276,9 +2276,10 @@ async function checkProviderAccess(ctx, providerId) {
 	});
 	if (!provider) throw new APIError("NOT_FOUND", { message: "Provider not found" });
 	let hasAccess = false;
-	if (provider.organizationId) if (ctx.context.hasPlugin("organization")) hasAccess = await isOrgAdmin(ctx, userId, provider.organizationId);
-	else hasAccess = provider.userId === userId;
-	else hasAccess = provider.userId === userId;
+	if (provider.organizationId) {
+		if (ctx.context.hasPlugin("organization")) hasAccess = await isOrgAdmin(ctx, userId, provider.organizationId);
+		else hasAccess = provider.userId === userId;
+	} else hasAccess = provider.userId === userId;
 	if (!hasAccess) throw new APIError("FORBIDDEN", { message: "You don't have access to this provider" });
 	return provider;
 }
@@ -2573,7 +2574,7 @@ const requestDomainVerification = (options) => {
 		await ctx.context.internalAdapter.createVerificationValue({
 			identifier,
 			value: domainVerificationToken,
-			expiresAt: new Date(Date.now() + 3600 * 24 * 7 * 1e3)
+			expiresAt: new Date(Date.now() + 6048e5)
 		});
 		ctx.setStatus(201);
 		return ctx.json({ domainVerificationToken });
@@ -2661,7 +2662,7 @@ async function generateRelayState(c, link, providerReference) {
 		/**
 		* This is the actual expiry time of the state
 		*/
-		expiresAt: Date.now() + 600 * 1e3,
+		expiresAt: Date.now() + 6e5,
 		requestSignUp: c.body.requestSignUp,
 		serverContext: providerReference ? { [SSO_PROVIDER_STATE_KEY]: providerReference } : void 0
 	};
@@ -3191,9 +3192,10 @@ const spMetadata = (options) => {
 	});
 };
 const registerSSOProvider = (options) => {
+	const registerBodySchema = getRegisterSSOProviderBodySchema(options);
 	return createAuthEndpoint("/sso/register", {
 		method: "POST",
-		body: getRegisterSSOProviderBodySchema(options),
+		body: registerBodySchema,
 		use: [sessionMiddleware],
 		metadata: {
 			$Infer: { body: {} },
@@ -3388,13 +3390,13 @@ const registerSSOProvider = (options) => {
 			if (!member) throw new APIError("BAD_REQUEST", { message: "You are not a member of the organization" });
 			if (ctx.context.hasPlugin("organization") && !hasOrgAdminRole(member)) throw new APIError("FORBIDDEN", { message: "You must be an organization owner or admin to register SSO providers" });
 		}
-		if (new Set([
+		if ((/* @__PURE__ */ new Set([
 			...BUILT_IN_ACCOUNT_PROVIDER_IDS,
 			...Object.keys(ctx.context.options.socialProviders ?? {}),
 			...ctx.context.socialProviders.map((p) => p.id),
 			...ctx.context.trustedProviders,
 			...options?.defaultSSO?.map((p) => p.providerId) ?? []
-		]).has(body.providerId)) {
+		])).has(body.providerId)) {
 			ctx.context.logger.warn(`SSO provider registration rejected for reserved providerId: ${body.providerId}`);
 			throw new APIError("UNPROCESSABLE_ENTITY", { message: "This providerId is reserved and cannot be used for an SSO provider" });
 		}
@@ -3536,7 +3538,7 @@ const registerSSOProvider = (options) => {
 			await ctx.context.internalAdapter.createVerificationValue({
 				identifier: getVerificationIdentifier(options, provider.providerId),
 				value: domainVerificationToken,
-				expiresAt: new Date(Date.now() + 3600 * 24 * 7 * 1e3)
+				expiresAt: new Date(Date.now() + 6048e5)
 			});
 		}
 		const result = {
@@ -3816,7 +3818,9 @@ async function handleOIDCCallback(ctx, options, providerId, stateData, parsedPro
 	const { code, error, error_description } = ctx.query;
 	if (!stateData) stateData = await parseState(ctx);
 	if (!stateData) {
-		const redirectURL = appendQueryParams(ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`, new URLSearchParams({ error: "invalid_state" }));
+		const errorURL = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
+		const params = new URLSearchParams({ error: "invalid_state" });
+		const redirectURL = appendQueryParams(errorURL, params);
 		throw ctx.redirect(redirectURL);
 	}
 	const providerReference = parsedProviderReference ?? parseSSOProviderReference(stateData.serverContext?.["ssoProviderReference"]);
@@ -4197,15 +4201,19 @@ const callbackSSOShared = (options) => {
 	}, async (ctx) => {
 		const stateData = await parseState(ctx);
 		if (!stateData) {
-			const redirectURL = appendQueryParams(ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`, new URLSearchParams({ error: "invalid_state" }));
+			const errorURL = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
+			const params = new URLSearchParams({ error: "invalid_state" });
+			const redirectURL = appendQueryParams(errorURL, params);
 			throw ctx.redirect(redirectURL);
 		}
 		const providerReference = parseSSOProviderReference(stateData.serverContext?.[SSO_PROVIDER_STATE_KEY]);
 		if (!providerReference) {
-			const redirectURL = appendQueryParams(stateData.errorURL || stateData.callbackURL, new URLSearchParams({
+			const errorURL = stateData.errorURL || stateData.callbackURL;
+			const params = new URLSearchParams({
 				error: "invalid_state",
 				error_description: "missing_sso_provider_reference"
-			}));
+			});
+			const redirectURL = appendQueryParams(errorURL, params);
 			throw ctx.redirect(redirectURL);
 		}
 		return handleOIDCCallback(ctx, options, providerReference.providerId, stateData, providerReference);
@@ -4241,7 +4249,9 @@ const acsEndpoint = (options) => {
 		let resolvedErrorRedirectUrl;
 		if (ctx.method === "GET" && !ctx.body?.SAMLResponse) {
 			if (!(await getSessionFromCtx(ctx))?.session) {
-				const redirectURL = appendQueryParams(ctx.context.options.onAPIError?.errorURL || `${appOrigin}/error`, new URLSearchParams({ error: "invalid_request" }));
+				const errorURL = ctx.context.options.onAPIError?.errorURL || `${appOrigin}/error`;
+				const params = new URLSearchParams({ error: "invalid_request" });
+				const redirectURL = appendQueryParams(errorURL, params);
 				throw ctx.redirect(redirectURL);
 			}
 			const relayState = ctx.query?.RelayState;
@@ -4310,10 +4320,11 @@ const sloEndpoint = (options) => {
 		const appOrigin = new URL(ctx.context.baseURL).origin;
 		const safeErrorURL = getSafeRedirectUrl([relayState], `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
 		if (!samlRequest && !samlResponse) {
-			const redirectURL = appendQueryParams(safeErrorURL, new URLSearchParams({
+			const params = new URLSearchParams({
 				error: "invalid_request",
 				error_description: "missing_logout_data"
-			}));
+			});
+			const redirectURL = appendQueryParams(safeErrorURL, params);
 			throw ctx.redirect(redirectURL);
 		}
 		const provider = await findSAMLProvider(providerId, options, ctx.context.adapter);
@@ -4376,14 +4387,16 @@ async function handleLogoutRequest(ctx, sp, idp, relayState, providerId) {
 	const stored = await ctx.context.internalAdapter.findVerificationValue(key);
 	if (stored) {
 		const data = safeJsonParse(stored.value);
-		if (data) if (!sessionIndex || !data.sessionIndex || sessionIndex === data.sessionIndex) {
-			await ctx.context.internalAdapter.deleteSession(data.sessionToken).catch((e) => ctx.context.logger.warn("Failed to delete session during SLO", { error: e }));
-			await ctx.context.internalAdapter.deleteVerificationByIdentifier(`${SAML_SESSION_BY_ID_PREFIX}${data.sessionId}`).catch((e) => ctx.context.logger.warn("Failed to delete SAML session lookup during SLO", e));
-		} else ctx.context.logger.warn("SessionIndex mismatch in LogoutRequest - skipping session deletion", {
-			providerId,
-			requestedSessionIndex: sessionIndex,
-			storedSessionIndex: data.sessionIndex
-		});
+		if (data) {
+			if (!sessionIndex || !data.sessionIndex || sessionIndex === data.sessionIndex) {
+				await ctx.context.internalAdapter.deleteSession(data.sessionToken).catch((e) => ctx.context.logger.warn("Failed to delete session during SLO", { error: e }));
+				await ctx.context.internalAdapter.deleteVerificationByIdentifier(`${SAML_SESSION_BY_ID_PREFIX}${data.sessionId}`).catch((e) => ctx.context.logger.warn("Failed to delete SAML session lookup during SLO", e));
+			} else ctx.context.logger.warn("SessionIndex mismatch in LogoutRequest - skipping session deletion", {
+				providerId,
+				requestedSessionIndex: sessionIndex,
+				storedSessionIndex: data.sessionIndex
+			});
+		}
 		await ctx.context.internalAdapter.deleteVerificationByIdentifier(key).catch((e) => ctx.context.logger.warn("Failed to delete SAML session key during SLO", e));
 	}
 	const currentSession = await getSessionFromCtx(ctx);

package/dist/{version-Bn0HtKjY.mjs → version-HRaJjPrD.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.8.0-beta.1";
+const PACKAGE_VERSION = "1.8.0-beta.3";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.8.0-beta.1",
+  "version": "1.8.0-beta.3",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -66,22 +66,22 @@
   "devDependencies": {
     "@types/body-parser": "^1.19.6",
     "@types/express": "^5.0.6",
-    "better-call": "1.4.2",
+    "better-call": "1.4.4",
     "body-parser": "^2.3.0",
     "express": "^5.2.1",
     "kysely": "^0.28.17 || ^0.29.0",
     "oauth2-mock-server": "^9.0.0",
-    "tsdown": "0.21.10",
-    "@better-auth/core": "1.8.0-beta.1",
-    "@better-auth/kysely-adapter": "1.8.0-beta.1",
-    "better-auth": "1.8.0-beta.1"
+    "tsdown": "0.23.1",
+    "@better-auth/core": "1.8.0-beta.3",
+    "@better-auth/kysely-adapter": "1.8.0-beta.3",
+    "better-auth": "1.8.0-beta.3"
   },
   "peerDependencies": {
     "@better-auth/utils": "^0.4.2 || ^0.5.0",
-    "@better-fetch/fetch": "1.3.2",
-    "better-call": "1.4.2",
-    "better-auth": "^1.8.0-beta.1",
-    "@better-auth/core": "^1.8.0-beta.1"
+    "@better-fetch/fetch": "1.3.3",
+    "better-call": "1.4.4",
+    "@better-auth/core": "^1.8.0-beta.3",
+    "better-auth": "^1.8.0-beta.3"
   },
   "scripts": {
     "build": "tsdown",