@better-auth/sso 1.8.0-beta.7 → 1.8.0-beta.8

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-B5en_Bdq.mjs";
+import { t as PACKAGE_VERSION } from "./version-WwwFpRb_.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { t as PACKAGE_VERSION } from "./version-B5en_Bdq.mjs";
-import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
+import { t as PACKAGE_VERSION } from "./version-WwwFpRb_.mjs";
+import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, generateGenericState, getSessionFromCtx, parseGenericState, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
 import { getHostname } from "tldts";
@@ -17,11 +17,12 @@ import { DOMParser } from "@xmldom/xmldom";
 import samlifyDefault, * as samlifyNamespace from "samlify";
 import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
 import { parseInputData, toZodSchema } from "better-auth/db";
+import { HIDE_METADATA } from "@better-auth/core/api";
+import { PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, authorizationCodeRequest, createAuthorizationURL, createPrivateKeyJwtClientAssertionGetter, getOAuth2Tokens } from "@better-auth/core/oauth2";
 import { isAPIError } from "@better-auth/core/utils/is-api-error";
 import { appendQueryParams } from "@better-auth/core/utils/url";
-import { HIDE_METADATA, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, authorizationCodeRequest, createAuthorizationURL, createPrivateKeyJwtClientAssertionGetter, generateGenericState, generateState, getOAuth2Tokens, parseGenericState, parseState } from "better-auth";
 import { deleteSessionCookie, setAccountCookie, setSessionCookie } from "better-auth/cookies";
-import { additionalAuthorizationParamsSchema, handleOAuthUserInfo } from "better-auth/oauth2";
+import { additionalAuthorizationParamsSchema, generateState, handleOAuthUserInfo, parseState } from "better-auth/oauth2";
 //#region src/constants.ts
 /**
 * SAML Constants
@@ -1383,7 +1384,7 @@ function parseSAMLServiceProviderMetadata(metadata) {
 			if (value) nameIDFormats.push(value);
 		}
 		for (const service of directMetadataChildren(descriptor, "AssertionConsumerService")) {
-			if (service.getAttribute("Binding") !== "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST") continue;
+			if (service.getAttribute("Binding") !== SAML_HTTP_POST_BINDING) continue;
 			const location = service.getAttribute("Location")?.trim();
 			if (!location || !isAbsoluteHttpUrl(location)) throw new Error("Invalid SAML POST AssertionConsumerService");
 			postAssertionConsumerServiceUrls.push(location);
@@ -1693,6 +1694,7 @@ async function findSAMLProvider(providerId, options, adapter) {
 }
 function createSP(config, baseURL, providerId, opts) {
 	const spData = config.spMetadata;
+	const clockSkew = opts?.clockSkew ?? 3e5;
 	const sloLocation = `${baseURL}/sso/saml2/sp/slo/${providerId}`;
 	const acsUrl = `${baseURL}/sso/saml2/sp/acs/${providerId}`;
 	let metadata = spData?.metadata;
@@ -1725,7 +1727,7 @@ function createSP(config, baseURL, providerId, opts) {
 		encPrivateKey: normalizePem(spData?.encPrivateKey),
 		encPrivateKeyPass: spData?.encPrivateKeyPass,
 		relayState: opts?.relayState,
-		clockDrifts: opts?.clockSkew && opts?.clockSkew !== 0 ? [-opts.clockSkew, opts.clockSkew] : void 0
+		clockDrifts: [-clockSkew, clockSkew]
 	});
 }
 /**
@@ -2806,17 +2808,12 @@ function getSAMLRedirectCandidates(relayStateCallbackUrl, samlConfig, samlOption
 		samlConfig?.callbackUrl
 	];
 }
-function toArray(value) {
-	if (Array.isArray(value)) return value;
-	return value ? [value] : [];
-}
-function getExpectedSAMLRecipients(config, baseURL, providerId, currentCallbackPath, assertionConsumerServiceUrl) {
+function getExpectedSAMLRecipients(config, baseURL, providerId, currentCallbackPath) {
 	const configuredPostAssertionConsumerServiceUrls = getSAMLPostAssertionConsumerServiceUrls(config.spMetadata?.metadata);
 	return [
 		currentCallbackPath,
 		`${baseURL}/sso/saml2/sp/acs/${providerId}`,
-		...configuredPostAssertionConsumerServiceUrls,
-		...toArray(assertionConsumerServiceUrl)
+		...configuredPostAssertionConsumerServiceUrls
 	];
 }
 async function getSAMLResponseBindingContent(sp, samlContent) {
@@ -2827,20 +2824,16 @@ async function getSAMLResponseBindingContent(sp, samlContent) {
 /**
 * Extracts the Assertion ID from a SAML response XML.
 * Used for replay protection per SAML 2.0 Core section 2.3.3.
+*
+* Reads the ID through the DOM so character references are decoded the same
+* way the signature check decodes them: re-spelling the ID keeps the
+* signature valid, so it must not change the replay key.
 */
 function extractAssertionId(samlContent) {
 	try {
-		const parsed = new XMLParser({
-			ignoreAttributes: false,
-			attributeNamePrefix: "@_",
-			removeNSPrefix: true
-		}).parse(samlContent);
-		const response = parsed.Response || parsed["samlp:Response"];
-		if (!response) return null;
-		const rawAssertion = response.Assertion || response["saml:Assertion"];
-		const assertion = Array.isArray(rawAssertion) ? rawAssertion[0] : rawAssertion;
-		if (!assertion) return null;
-		return assertion["@_ID"] || null;
+		const response = new DOMParser().parseFromString(samlContent, "text/xml").documentElement;
+		if (response?.localName !== "Response") return null;
+		return Array.from(response.childNodes).find((node) => node.nodeType === 1 && node.localName === "Assertion")?.getAttribute("ID") || null;
 	} catch {
 		return null;
 	}
@@ -2899,8 +2892,7 @@ async function processSAMLResponse(ctx, params, options) {
 		logger: ctx.context.logger
 	});
 	const expectedAudiences = [sp.entityMeta.getEntityID(), parsedSamlConfig.audience];
-	const assertionConsumerServiceUrl = sp.entityMeta.getAssertionConsumerService(SAML_HTTP_POST_BINDING);
-	const expectedRecipients = getExpectedSAMLRecipients(parsedSamlConfig, ctx.context.baseURL, providerId, currentCallbackPath, assertionConsumerServiceUrl);
+	const expectedRecipients = getExpectedSAMLRecipients(parsedSamlConfig, ctx.context.baseURL, providerId, currentCallbackPath);
 	const serviceProviderPolicy = deriveSAMLServiceProviderPolicy(parsedSamlConfig);
 	let samlBindingContent;
 	try {
@@ -4428,7 +4420,7 @@ const initiateSLO = (options) => {
 		const session = ctx.context.session;
 		const sessionLookupKey = `${SAML_SESSION_BY_ID_PREFIX}${session.session.id}`;
 		const sessionLookup = await ctx.context.internalAdapter.findVerificationValue(sessionLookupKey);
-		let nameID = session.user.email;
+		let nameID;
 		let sessionIndex;
 		let samlSessionKey;
 		if (sessionLookup) {
@@ -4437,11 +4429,15 @@ const initiateSLO = (options) => {
 			if (stored) {
 				const data = safeJsonParse(stored.value);
 				if (data) {
-					nameID = data.nameID || nameID;
+					nameID = data.nameID;
 					sessionIndex = data.sessionIndex;
 				}
 			}
 		}
+		if (!nameID) {
+			const [account] = (await ctx.context.internalAdapter.findAccounts(session.user.id)).filter((account) => account.providerId === providerId).sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
+			nameID = account?.accountId ?? session.user.email;
+		}
 		const logoutRequest = sp.createLogoutRequest(idp, "redirect", {
 			logoutNameID: nameID,
 			sessionIndex,
@@ -4506,6 +4502,53 @@ function assertNoAdditionalFieldCollisions(options) {
 		if (builtInFieldNames.has(fieldName)) throw new Error(`ssoProvider additional field "${key}" maps to built-in field "${fieldName}"`);
 	}
 }
+const SAML_SESSION_RECORD_PAGE_SIZE = 100;
+async function findSAMLSessionRecord(ctx, identifier, isOwnRecord) {
+	for (let offset = 0;; offset += SAML_SESSION_RECORD_PAGE_SIZE) {
+		const page = await ctx.adapter.findMany({
+			model: "verification",
+			where: [{
+				field: "identifier",
+				value: identifier
+			}],
+			sortBy: {
+				field: "createdAt",
+				direction: "desc"
+			},
+			limit: SAML_SESSION_RECORD_PAGE_SIZE,
+			offset
+		});
+		const record = page.find(isOwnRecord);
+		if (record || page.length < SAML_SESSION_RECORD_PAGE_SIZE) return record;
+	}
+}
+/**
+* SLO records are written with the session's expiry at sign-in. Move it when a
+* refresh extends the session, so expired-row cleanup doesn't drop them early.
+*/
+async function extendSAMLSessionRecords(ctx, session) {
+	const lookupKey = `${SAML_SESSION_BY_ID_PREFIX}${session.id}`;
+	const lookup = await ctx.internalAdapter.findVerificationValue(lookupKey);
+	const expiresAt = new Date(session.expiresAt);
+	if (!lookup || new Date(lookup.expiresAt) >= expiresAt) return;
+	const isOwnRecord = (record) => safeJsonParse(record.value)?.sessionId === session.id;
+	const latest = await ctx.internalAdapter.findVerificationValue(lookup.value);
+	const secondaryStorageOnly = ctx.options.secondaryStorage && !ctx.options.verification?.storeInDatabase;
+	if (latest && secondaryStorageOnly) {
+		if (isOwnRecord(latest)) await ctx.internalAdapter.updateVerificationByIdentifier(lookup.value, { expiresAt });
+	} else if (latest) {
+		const record = await findSAMLSessionRecord(ctx, latest.identifier, isOwnRecord);
+		if (record) await ctx.adapter.update({
+			model: "verification",
+			where: [{
+				field: "id",
+				value: record.id
+			}],
+			update: { expiresAt }
+		});
+	}
+	await ctx.internalAdapter.updateVerificationByIdentifier(lookupKey, { expiresAt });
+}
 function sso(options) {
 	assertNoAdditionalFieldCollisions(options);
 	const optionsWithStore = options;
@@ -4538,8 +4581,13 @@ function sso(options) {
 		version: PACKAGE_VERSION,
 		init(ctx) {
 			const existing = ctx.skipOriginCheck;
-			if (existing === true) return {};
-			return { context: { skipOriginCheck: [...Array.isArray(existing) ? existing : [], ...SAML_SKIP_ORIGIN_CHECK_PATHS] } };
+			return {
+				...existing !== true && { context: { skipOriginCheck: [...Array.isArray(existing) ? existing : [], ...SAML_SKIP_ORIGIN_CHECK_PATHS] } },
+				options: { databaseHooks: { session: { update: { async after(session) {
+					if (!options?.saml?.enableSingleLogout) return;
+					await extendSAMLSessionRecords(ctx, session).catch((error) => ctx.logger.warn("Failed to extend SAML session records", { error }));
+				} } } } }
+			};
 		},
 		endpoints,
 		hooks: {

package/dist/{version-B5en_Bdq.mjs → version-WwwFpRb_.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.8.0-beta.7";
+const PACKAGE_VERSION = "1.8.0-beta.8";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.8.0-beta.7",
+  "version": "1.8.0-beta.8",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -72,16 +72,16 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "oauth2-mock-server": "^9.0.0",
     "tsdown": "0.23.1",
-    "@better-auth/kysely-adapter": "1.8.0-beta.7",
-    "better-auth": "1.8.0-beta.7",
-    "@better-auth/core": "1.8.0-beta.7"
+    "@better-auth/core": "1.8.0-beta.8",
+    "@better-auth/kysely-adapter": "1.8.0-beta.8",
+    "better-auth": "1.8.0-beta.8"
   },
   "peerDependencies": {
     "@better-auth/utils": "^0.4.2 || ^0.5.0",
     "@better-fetch/fetch": "1.3.3",
     "better-call": "1.4.5",
-    "@better-auth/core": "^1.8.0-beta.7",
-    "better-auth": "^1.8.0-beta.7"
+    "@better-auth/core": "^1.8.0-beta.8",
+    "better-auth": "^1.8.0-beta.8"
   },
   "scripts": {
     "build": "tsdown",