Taesu and GitHub
c03ced528a
chore: bump @biomejs/biome ( #11760 )
2026-10-14 21:01:10 +00:00
Gustavo Valverde and GitHub
adbdc06e33
fix(sso): stop treating the SAML post-login redirect as an identity field ( #11743 )
2026-10-14 09:33:05 +00:00
c3f11cc1a1
docs(sso): clarify SAML callbackUrl vs ACS endpoint in 1.7 ( #11703 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 10:18:24 +01:00
182e92bd8a
fix(sso): allow rotating SAML IdP signing certificate with linked accounts ( #11687 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 10:16:38 +01:00
a878f9ab47
fix(sso): support array of emails in OIDC claim resolution ( #11640 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-14 10:16:10 +01:00
6c89bb18f1
fix(sso): accept partial mappings when updating a provider ( #11378 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-10-12 13:36:49 +00:00
61f64f46ad
fix(sso): reject mismatched OIDC issuers ( #11438 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-10-08 16:25:31 +00:00
Gustavo Valverde and GitHub
ac54bfd678
fix(auth): isolate verification records and encryption purposes ( #11494 )
2026-09-30 20:56:11 +00:00
Taesu and GitHub
2220ee7269
revert: drop the issuer column and resolve accounts by provider id ( #11153 )
2026-09-05 23:03:14 +00:00
Taesu and GitHub
e2fb86b27e
test(sso): align mock IdP with SAML redirect binding ( #11058 )
2026-08-29 20:11:38 +00:00
Gustavo Valverde and GitHub
6a0a7cbcb1
fix(auth): preserve provider-scoped account identity ( #10969 )
2026-08-28 22:34:54 +00:00
Taesu and GitHub
79904f0be8
fix(origin-check): support fragments in relative redirect URLs ( #10983 )
2026-08-25 10:12:21 +00:00
Gustavo Valverde
1fa55595e8
test(sso): exercise provider pagination boundary
2026-08-11 15:11:30 -04:00
Gustavo Valverde
5071415398
fix(sso): harden domain organization assignment
2026-08-11 14:53:03 -04:00
Gustavo Valverde
970fd0cc9f
test(sso): align legacy provider fixture
2026-08-11 14:15:27 -04:00
Gustavo Valverde
73d6f80e5b
chore(sync): merge main into next
2026-08-11 14:14:49 -04:00
999acbd41d
Merge commit from fork
...
* fix(sso): bind domain verification to provider state
Complete domain verification with an atomic guarded transition keyed by the provider row, exact domain snapshot, and unverified state. Concurrent provider mutations now return a retryable conflict instead of applying stale DNS proof.
Document the conflict behavior and cover provider mutation, replacement, deletion, simultaneous verification, memory-adapter, and downstream trust cases.
* fix(sso): allow domain verification when the stored bit is null
* test(sso): assert the resolved DNS hostname outside the mock callback
* fix(sso): require verified domains for organization assignment
Use verified persisted provider domains and canonical verified user emails for domain-derived routing and organization membership. Keep explicit organization-bound SSO provisioning separate from domain trust.
* fix(sso): scope domain verification to organization assignment
* fix(sso): keep verified provider lookup internal
---------
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-08-11 13:50:45 -04:00
Gustavo Valverde and GitHub
8bc28daf42
fix(core): preserve issuer-scoped account identities ( #10668 )
2026-08-04 13:47:09 -04:00
Gustavo Valverde and GitHub
26b194960f
feat(scim): add managed connection catalog and runtime connection resolution ( #10592 )
2026-08-03 13:15:13 -04:00
Gustavo Valverde and GitHub
59c4c832fc
feat(sso): extend resolveUser to SAML and harden provider lifecycle ( #10621 )
2026-08-03 12:51:21 -04:00
Gustavo Valverde
cd4eb5627f
fix(sync): address behavioral review findings
2026-07-22 14:22:40 -04:00
Gustavo Valverde
47012469e8
test(sso): validate redirects through provider schema
2026-07-22 10:49:00 -04:00
Gustavo Valverde
73e2d2dd62
fix(sync): align tests with next contracts
2026-07-22 10:40:52 -04:00
Gustavo Valverde
558d2de0a7
chore(sync): merge main into next
2026-07-22 10:39:55 -04:00
Gustavo Valverde and GitHub
ed61b4798e
feat(sso): add transactional OIDC user resolution ( #10473 )
2026-07-22 06:53:55 -04:00
c020a9d6a2
fix(sso): redirect idp initiated saml flows in split origin deployments ( #10388 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-22 06:14:46 -04:00
Gustavo Valverde and GitHub
dbd302e422
feat(auth)!: scope accounts by issuer ( #10403 )
2026-07-16 17:24:34 +01:00
Gustavo Valverde
f291e5ba74
fix: address sync review fallout
2026-06-26 08:09:34 +01:00
Gustavo Valverde
cc1aed88d3
fix: address sync review feedback
2026-06-26 07:42:55 +01:00
Gustavo Valverde
4bcda56649
chore: resolve 10178 main-to-next sync conflicts
...
Merges origin/main into origin/next for the replacement sync PR and records the hand-resolved package metadata, changelog, OAuth/social provider, admin, SIWE, SCIM, SSO, username, rate-limiter, and next-owned MCP/OIDC provider conflicts.
2026-06-26 06:33:24 +01:00
fa1e036ae7
fix(sso): validate SAML response binding against the Service Provider ( #10226 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 03:07:43 +00:00
7a7a7b311a
fix(sso): delete linked account rows when an SSO provider is deleted ( #10224 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 03:07:21 +00:00
fcabaaffcb
fix(sso): require DNS proof for every domain listed on a provider ( #10227 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 02:49:15 +00:00
1a8b7ccc83
fix(sso): restrict SAML SLO POST form action to http(s) schemes ( #10225 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 02:27:12 +00:00
Gustavo Valverde and GitHub
6ddb5554c0
chore(deps)!: upgrade dependencies to latest ( #10170 )
2026-06-20 10:15:37 -07:00
Gustavo Valverde and GitHub
27f06181c7
revert(oauth): remove granted scopes architecture ( #10123 )
2026-06-17 22:27:20 -07:00
Gustavo Valverde and GitHub
4475f4a39b
fix(sso): reject OIDC endpoint redirects portably ( #10072 )
2026-06-15 06:56:55 +00:00
48070ada8b
feat(sso): support additionalFields on ssoProvider ( #9445 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-12 10:00:55 -07:00
Gustavo Valverde
7a55ae4f52
Merge remote-tracking branch 'origin/next' into chore/sync-main-to-next-20260611
...
# Conflicts:
# .changeset/accept-invitation-team-capacity.md
# .changeset/adapters-native-increment-one.md
# .changeset/api-key-atomic-quota.md
# .changeset/delete-account-token-single-use.md
# .changeset/device-code-single-use.md
# .changeset/electron-code-single-use.md
# .changeset/email-otp-attempts-atomic.md
# .changeset/increment-one-primitive.md
# .changeset/memory-adapter-transaction-isolation.md
# .changeset/one-time-token-single-use.md
# .changeset/passkey-ceremony-binding.md
# .changeset/password-reset-token-single-use.md
# .changeset/phone-otp-attempts-atomic.md
# .changeset/rate-limit-atomic-consume.md
# .changeset/redis-increment.md
# .changeset/reserve-verification-value.md
# .changeset/saml-replay-reserve.md
# .changeset/siwe-nonce-single-use.md
# .changeset/two-factor-challenge-single-use.md
# .changeset/twofactor-otp-attempts-atomic.md
# packages/api-key/src/adapter.ts
# packages/api-key/src/api-key.test.ts
# packages/better-auth/src/api/rate-limiter/index.ts
# packages/better-auth/src/api/rate-limiter/rate-limiter.test.ts
# packages/better-auth/src/db/internal-adapter.ts
# packages/better-auth/src/plugins/device-authorization/routes.ts
# packages/better-auth/src/plugins/organization/adapter.ts
# packages/better-auth/src/plugins/organization/routes/crud-invites.ts
# packages/better-auth/src/plugins/organization/routes/crud-members.ts
# packages/better-auth/src/plugins/organization/routes/crud-team.ts
# packages/better-auth/src/plugins/organization/team.test.ts
# packages/better-auth/src/plugins/phone-number/routes.ts
# packages/better-auth/src/plugins/two-factor/two-factor.security.test.ts
# packages/core/src/db/adapter/factory.ts
# packages/core/src/db/adapter/index.ts
# packages/core/src/db/type.ts
# packages/core/src/types/context.ts
# packages/core/src/types/init-options.ts
# packages/drizzle-adapter/src/drizzle-adapter.test.ts
# packages/drizzle-adapter/src/drizzle-adapter.ts
# packages/electron/test/electron.test.ts
# packages/kysely-adapter/src/kysely-adapter.ts
# packages/memory-adapter/src/memory-adapter.ts
# packages/mongo-adapter/src/mongodb-adapter.test.ts
# packages/mongo-adapter/src/mongodb-adapter.ts
# packages/passkey/src/routes.ts
# packages/prisma-adapter/src/prisma-adapter.ts
# packages/redis-storage/src/redis-storage.ts
# packages/redis-storage/test/redis-storage.test.ts
# packages/sso/src/saml.test.ts
2026-06-11 18:45:17 -07:00
Gustavo Valverde
381fc6cfaf
chore: sync main to next
2026-06-11 18:18:13 -07:00
Gustavo Valverde and GitHub
86ccb5de91
feat(auth)!: harden atomic state transitions ( #10000 )
2026-06-12 00:46:44 +00:00
Gustavo Valverde and GitHub
ed7b6c9ac0
fix: enforce team capacity, constant-time SCIM tokens, and org-admin SSO domain verification ( #10002 )
2026-06-11 19:21:34 +00:00
Gustavo Valverde and GitHub
fdef997eb9
fix: harden provider identity validation (One Tap, Microsoft, SSO, WeChat, Reddit) ( #10003 )
2026-06-11 19:10:55 +00:00
Gustavo Valverde and GitHub
baeaa00bc2
fix: make single-use credentials, counters, and replay markers atomic ( #9993 )
2026-06-11 05:11:26 +00:00
Gustavo Valverde
bf7f2c5b4e
chore: sync main to next
2026-06-10 11:30:38 -07:00
Bereket Engida and GitHub
cb1cbfa4cc
fix: address bug findings across packages ( #9974 )
2026-06-09 19:46:12 -07:00
Gustavo Valverde and GitHub
a6b0295df3
fix(sso): consume SAML AuthnRequest atomically ( #9972 )
2026-06-10 01:58:45 +00:00
Gustavo Valverde and GitHub
af572166a2
fix(auth)!: harden validateUserInfo source contract ( #9940 )
2026-06-07 22:52:59 -07:00
0cbaf81bed
feat(oauth): server-trusted state channel; fix anonymous cookieless linking ( #9930 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-08 01:00:05 +00:00
41cca606d1
feat(auth): add user.validateUserInfo provisioning gate ( #9864 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 14:34:48 -07:00
TaesuandGitHub
Gustavo ValverdeandGitHub
