@hammadj/better-auth-sso 1.5.0-beta.9

package/package.json

@@ -0,0 +1,87 @@
+{
+  "name": "@hammadj/better-auth-sso",
+  "author": "Bereket Engida",
+  "version": "1.5.0-beta.9",
+  "type": "module",
+  "main": "dist/index.mjs",
+  "types": "dist/index.d.mts",
+  "homepage": "https://www.better-auth.com/docs/plugins/sso",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/META-DREAMER/better-auth.git",
+    "directory": "packages/sso"
+  },
+  "license": "MIT",
+  "keywords": [
+    "sso",
+    "auth",
+    "sso",
+    "saml",
+    "oauth",
+    "oidc",
+    "openid",
+    "openid connect",
+    "openid connect",
+    "single sign on"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "module": "dist/index.mjs",
+  "description": "SSO plugin for Better Auth",
+  "exports": {
+    ".": {
+      "dev-source": "./src/index.ts",
+      "types": "./dist/index.d.mts",
+      "default": "./dist/index.mjs"
+    },
+    "./client": {
+      "dev-source": "./src/client.ts",
+      "types": "./dist/client.d.mts",
+      "default": "./dist/client.mjs"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "*": [
+        "./dist/index.d.mts"
+      ],
+      "client": [
+        "./dist/client.d.mts"
+      ]
+    }
+  },
+  "dependencies": {
+    "@better-auth/utils": "0.3.1",
+    "@better-fetch/fetch": "1.1.21",
+    "fast-xml-parser": "^5.3.3",
+    "jose": "^6.1.0",
+    "samlify": "^2.10.2",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/body-parser": "^1.19.6",
+    "@types/express": "^5.0.6",
+    "better-call": "1.2.0",
+    "body-parser": "^2.2.2",
+    "express": "^5.2.1",
+    "oauth2-mock-server": "^8.2.1",
+    "tsdown": "^0.20.1",
+    "@hammadj/better-auth-core": "1.5.0-beta.9",
+    "@hammadj/better-auth": "1.5.0-beta.9"
+  },
+  "peerDependencies": {
+    "@better-auth/utils": "0.3.1",
+    "@hammadj/better-auth-core": "1.5.0-beta.9",
+    "@hammadj/better-auth": "1.5.0-beta.9"
+  },
+  "scripts": {
+    "test": "vitest",
+    "coverage": "vitest run --coverage --coverage.provider=istanbul",
+    "lint:package": "publint run --strict",
+    "lint:types": "attw --profile esm-only --pack .",
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "typecheck": "tsc --project tsconfig.json"
+  }
+}

package/src/client.ts

@@ -0,0 +1,29 @@
+import type { BetterAuthClientPlugin } from "better-auth/client";
+import type { SSOPlugin } from "./index";
+
+interface SSOClientOptions {
+	domainVerification?:
+		| {
+				enabled: boolean;
+		  }
+		| undefined;
+}
+
+export const ssoClient = <CO extends SSOClientOptions>(
+	options?: CO | undefined,
+) => {
+	return {
+		id: "sso-client",
+		$InferServerPlugin: {} as SSOPlugin<{
+			domainVerification: {
+				enabled: CO["domainVerification"] extends { enabled: true }
+					? true
+					: false;
+			};
+		}>,
+		pathMethods: {
+			"/sso/providers": "GET",
+			"/sso/providers/:providerId": "GET",
+		},
+	} satisfies BetterAuthClientPlugin;
+};

package/src/constants.ts

@@ -0,0 +1,58 @@
+/**
+ * SAML Constants
+ *
+ * Centralized constants for SAML SSO functionality.
+ */
+
+// ============================================================================
+// Key Prefixes (for verification table storage)
+// ============================================================================
+
+/** Prefix for AuthnRequest IDs used in InResponseTo validation */
+export const AUTHN_REQUEST_KEY_PREFIX = "saml-authn-request:";
+
+/** Prefix for used Assertion IDs used in replay protection */
+export const USED_ASSERTION_KEY_PREFIX = "saml-used-assertion:";
+
+// ============================================================================
+// Time-To-Live (TTL) Defaults
+// ============================================================================
+
+/**
+ * Default TTL for AuthnRequest records (5 minutes).
+ * This should be sufficient for most IdPs while protecting against stale requests.
+ */
+export const DEFAULT_AUTHN_REQUEST_TTL_MS = 5 * 60 * 1000;
+
+/**
+ * Default TTL for used assertion records (15 minutes).
+ * This should match the maximum expected NotOnOrAfter window plus clock skew.
+ */
+export const DEFAULT_ASSERTION_TTL_MS = 15 * 60 * 1000;
+
+/**
+ * Default clock skew tolerance (5 minutes).
+ * Allows for minor time differences between IdP and SP servers.
+ *
+ * Accommodates:
+ * - Network latency and processing time
+ * - Clock synchronization differences (NTP drift)
+ * - Distributed systems across timezones
+ */
+export const DEFAULT_CLOCK_SKEW_MS = 5 * 60 * 1000;
+
+// ============================================================================
+// Size Limits (DoS Protection)
+// ============================================================================
+
+/**
+ * Default maximum size for SAML responses (256 KB).
+ * Protects against memory exhaustion from oversized SAML payloads.
+ */
+export const DEFAULT_MAX_SAML_RESPONSE_SIZE = 256 * 1024;
+
+/**
+ * Default maximum size for IdP metadata (100 KB).
+ * Protects against oversized metadata documents.
+ */
+export const DEFAULT_MAX_SAML_METADATA_SIZE = 100 * 1024;