github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-01 10:50:40 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity
Files
auth@1.7.0-beta.5
better-auth/packages/scim/CHANGELOG.md
T

22 KiB
Raw Permalink Blame History

@better-auth/scim

1.7.0-beta.5

Patch Changes

  • #9864 41cca60 Thanks @GautamBytes! - Add a user.validateUserInfo provisioning gate that lets applications reject an identity before a user is created or a new account is linked. It runs once at the creation step for every method that provisions a user (OAuth, SSO/SAML, email/password, magic link, email OTP, anonymous, SIWE, phone number, admin-created users, and SCIM), including stateless setups with no persistent database.

    It also re-runs when an existing OAuth or SSO user signs in again (source.action is "sign-in"), where it receives the fresh provider email and profile so a domain or org policy can reject a user whose provider identity moved out of bounds. Non-provider returning sign-ins are not re-validated.

    The callback receives the mapped user plus a source describing the action (create-user, link-account, or sign-in), the method, and provider metadata: source.oauth for OAuth providers and source.sso for OIDC/SAML SSO providers. Return { error, errorDescription } to reject: browser flows redirect to the error URL and programmatic flows return a 403.

  • Updated dependencies [0cbaf81, e014029, ec8a38c, 7fe0e2b, 4f53b61, e0d2b9e, 91f235f, 76a3342, 41cca60]:

    • better-auth@1.7.0-beta.5
    • @better-auth/core@1.7.0-beta.5

1.7.0-beta.4

Minor Changes

  • #9840 a8ea86e Thanks @gustavovalverde! - Personal (non-organization) SCIM connections now always belong to the user who created them. Owner binding used to be opt-in through the providerOwnership option, which defaulted to off. With it off, a personal connection was stored without an owner, and the management endpoints denied access only when a stored owner differed from the caller. An unowned connection passed that check for any signed-in user, who could read it, list it, regenerate its token, or delete it. Regenerating the token rotated the secret and invalidated the original.

    generateSCIMToken now records the creator's userId on every personal connection. The generate-token, list-provider-connections, get-provider-connection, and delete-provider-connection endpoints grant access only to that owner. Organization-scoped connections keep their existing behavior and continue to use organization membership and the configured requiredRole checks.

    This release is breaking. It removes the providerOwnership option, and owner binding can no longer be disabled. The scimProvider.userId column is now a permanent part of the schema, so run a migration after upgrading with npx auth migrate or npx auth generate.

    Connections created before this release carry no owner. Access now fails closed, so those connections are no longer reachable through the management endpoints, including token regeneration. Reclaim them at the database level: delete scimProvider rows that have neither organizationId nor userId, or set userId to the intended owner, then regenerate tokens as needed. Organization-scoped connections are not affected.

1.6.16

Patch Changes

  • #9974 cb1cbfa Thanks @Bekacru! - SCIM user provisioning no longer links to a pre-existing user by matching email alone. When a user with the same email already exists, createSCIMUser now returns 409 (uniqueness) unless the new linkExistingUsers option explicitly opts in (via true, trustedDomains, requireExistingOrgMembership, or a shouldLinkUser callback). Additionally, an organization-scoped SCIM DELETE now deprovisions the user — removing their organization membership and the SCIM account link — instead of deleting the global Better Auth user. A new canGenerateToken option lets applications authorize SCIM token creation, including restricting personal (non-org) tokens.

  • Updated dependencies [cb1cbfa, cb1cbfa, cb1cbfa, cb1cbfa, cb1cbfa, cb1cbfa, 87e7aa5, cb1cbfa, cb1cbfa, cb1cbfa, 893cf6c, cb1cbfa, cb1cbfa, 5e49c56, cb1cbfa]:

    • better-auth@1.6.16
    • @better-auth/core@1.6.16

1.6.15

Patch Changes

1.6.14

Patch Changes

1.6.13

Patch Changes

1.7.0-beta.3

Patch Changes

  • Updated dependencies [4e8e4c7, 523f95c, 729c00d]:
    • better-auth@1.7.0-beta.3
    • @better-auth/core@1.7.0-beta.3

1.7.0-beta.2

Patch Changes

1.7.0-beta.1

Patch Changes

1.7.0-beta.0

Patch Changes

1.6.10

Patch Changes

1.6.9

Patch Changes

  • Updated dependencies [815ecf6]:
    • @better-auth/core@1.6.9
    • better-auth@1.6.9

1.6.8

Patch Changes

  • Updated dependencies [856ab24, 9aa8e63]:
    • better-auth@1.6.8
    • @better-auth/core@1.6.8

1.6.7

Patch Changes

1.6.6

Patch Changes

1.6.5

Patch Changes

  • Updated dependencies [938dd80, 0538627]:
    • better-auth@1.6.5
    • @better-auth/core@1.6.5

1.6.4

Patch Changes

1.6.3

Patch Changes

1.6.2

Patch Changes

1.6.1

Patch Changes

1.6.0

Minor Changes

Patch Changes

1.6.0-beta.0

Minor Changes

  • 28b1291 Thanks @gustavovalverde! - Add optional version field to the plugin interface and expose version from all built-in plugins

Patch Changes

Reference in New Issue View Git Blame Copy Permalink