mirror of
https://github.com/better-auth/better-auth.git
synced 2026-08-16 19:03:16 -05:00
999acbd41d
* fix(sso): bind domain verification to provider state Complete domain verification with an atomic guarded transition keyed by the provider row, exact domain snapshot, and unverified state. Concurrent provider mutations now return a retryable conflict instead of applying stale DNS proof. Document the conflict behavior and cover provider mutation, replacement, deletion, simultaneous verification, memory-adapter, and downstream trust cases. * fix(sso): allow domain verification when the stored bit is null * test(sso): assert the resolved DNS hostname outside the mock callback * fix(sso): require verified domains for organization assignment Use verified persisted provider domains and canonical verified user emails for domain-derived routing and organization membership. Keep explicit organization-bound SSO provisioning separate from domain trust. * fix(sso): scope domain verification to organization assignment * fix(sso): keep verified provider lookup internal --------- Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>