ecoportal-scim 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: a7ad495de878dc33d4bc202d34b37b8409a42acf1ab47777864e325cdfebcb29
+  data.tar.gz: 25369ed1936d1e264cd8cf2098fd706f576980fad5b4ca8ebfa92b9184459042
+SHA512:
+  metadata.gz: 057dc11619874eb6c4b8e625095e5997a5f6c620f7faa1a8409a9c45c2690299ea734d60357ca305a056c1c4f11e7582db9455beb06adf9b67cf80e409edf46a
+  data.tar.gz: 668f1f294873a9307b61de0ee7bcaf4d4badd44dda945813c108283ed8bdded477e322781b8996749cbf078f8f4222db7b9d98f41ea562e071eb3d86d37a3ef3

data/CHANGELOG.md

@@ -0,0 +1,46 @@
+# Change Log
+
+All notable changes to this project will be documented in this file.
+
+## [Unreleased]
+
+## [0.1.0] - 2026-11-01
+
+### Added
+
+- First commit.
+- `Groups` endpoint (list, get, patch), mirroring the `Users` endpoint architecture.
+  Supports the SCIM `PatchOp` membership flip (`add_members`/`remove_members`) needed
+  by the permission-verification test suite.
+- `Users` endpoint (list, get) -- read-only for now. `#each` enumerates the SCIM
+  `ListResponse` `Resources` the same way as `Groups`. `User` resource stays a Hash-shape
+  placeholder (see `Groups::Group`) pending the attribute model needed for the
+  APIv0-People adapter.
+- `Users::User` attribute readers (`id`, `user_name`, `name`/`given_name`/`family_name`,
+  `active?`, `external_id`, `emails`, `phone_numbers`), as an optional read-only wrapper
+  over a SCIM `User` Hash (`Users::User.new(scim.users.get(id))`). `Users#list`/`#get`
+  keep returning plain Hashes -- no change to the endpoint's public interface.
+- `Users::User#manager`/`#manager_id`/`#enterprise_extension` readers for the SCIM
+  enterprise-user extension's `manager` attribute, verified against the ecoPortal backend
+  (internal code spec `scim-users`): namespaced under
+  `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User`, shape narrowed to `{value}`
+  only (no `$ref`/`displayName`), `value` is the supervisor's ecoPortal-internal id.
+- README: documented the Users resource semantics (`active` is the enabled account, not the
+  archived flag; 500-per-page cap and paging; rate-limit guidance; no Bulk support) and how to
+  read the ecoPortal `requiredfields`/`schemafields` extension attributes from a `Users#list`
+  response.
+
+### Changed
+
+### Fixed
+
+- `Ecoportal::API::Scim#initialize` passed `scim_key:` to `Common::Scim::Client`, whose
+  keyword is `api_key:` -- the top-level entry point raised `ArgumentError` for every
+  endpoint (`users`/`groups`/`schemas`).
+
+- **Packaging allowlist hardened from root directory to full path.** `spec.files` allowlisted
+  `lib/` and `exe/` by directory, which says nothing about what a file under those roots IS --
+  only `.rb` now ships out of `lib/`. Preemptive: this gem has not leaked anything (confirmed
+  no non-`.rb` file is tracked under `lib/`), but the same directory-keyed allowlist shape had
+  already caused a near-miss in this gem before its first release, and a real incident in
+  ecoportal-api-graphql (2.2.0 shipped five `CLAUDE.md` files that lived under its `lib/`).

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 ecoPortal
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,107 @@
+# Ecoportal::API::Scim
+
+This is a basic collection of helpers that can be used to interact with the
+[ecoPortal](https://www.ecoportal.com) SCIM integration.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'ecoportal-scim', require: %w[ecoportal/scim]
+```
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install ecoportal-scim
+
+## Endpoints
+
+`Ecoportal::API::Scim` exposes four SCIM resources, each reachable from the top-level client:
+
+- `Groups` -- list, get and patch SCIM groups, including member add/remove.
+- `Users` -- list and get SCIM users (read-only).
+- `Schemas` -- list the SCIM schemas the api advertises.
+- `ServiceProviderConfig` -- fetch the api's SCIM service provider configuration.
+
+```ruby
+scim = Ecoportal::API::Scim.new(scim_id, scim_key)
+
+scim.users.get(user_id)       # => Hash, the SCIM User resource
+scim.groups.list              # => Hash, a SCIM ListResponse
+scim.schemas.list
+scim.service_provider_config.get
+```
+
+### Groups
+
+`Groups#add_members`/`#remove_members` send a SCIM `PatchOp` `add`/`remove` operation against
+the group's `members` path (RFC 7644 section 3.5.2).
+
+**Hazard -- `remove_members(id, [])` or `remove_members(id, nil)`:** both send
+`{"op"=>"remove", "path"=>"members", "value"=>[]}` -- a `remove` with a `path` and an empty
+`value` array, not an absent `value`. Per RFC 7644 section 3.5.2.2, a `remove` with a `path`
+and **no** `value` means "remove everything at that path"; whether the ecoPortal SCIM server
+treats "empty `value` array" the same way as "no `value`" is **unverified**. If it does,
+passing an empty or nil list -- an easy thing to do by accident, e.g. forwarding an empty
+filter result straight into `remove_members` -- could empty the entire group instead of being
+a no-op. **Guard the empty/nil case yourself** (skip the call, or assert non-empty) until this
+is confirmed against the api.
+
+### Users
+
+`Users#list` and `Users#get` return the api's plain parsed Hash bodies -- that return contract
+is unchanged and does not require anything below.
+
+`Users::User` is an optional, read-only wrapper for when you want typed accessors instead of
+raw Hash keys:
+
+```ruby
+user = Ecoportal::API::Scim::Users::User.new(scim.users.get(user_id))
+
+user.id              # => the SCIM `id`
+user.user_name       # => the SCIM `userName`
+user.name            # => { 'givenName' => ..., 'familyName' => ... }
+user.given_name
+user.family_name
+user.active?         # => true only when the api reports `active: true`
+user.external_id
+user.emails          # => the `emails` multi-valued attribute, [] if absent
+user.phone_numbers   # => the `phoneNumbers` multi-valued attribute, [] if absent
+user.doc             # => the raw Hash it wraps
+user['userName']     # => raw Hash access, for attributes without a reader
+```
+
+#### `manager` / supervisor
+
+The supervisor relationship is exposed under the SCIM enterprise-user extension, not the core
+`User` schema:
+
+```ruby
+user.enterprise_extension  # => the Hash keyed by the enterprise extension URI, {} if absent
+user.manager                # => the raw `manager` complex attribute, {} if absent
+user.manager_id              # => manager['value'], nil if absent
+```
+
+A few things worth knowing before relying on this:
+
+- **Narrower than stock SCIM.** ecoPortal's `manager` only ever carries `value` -- there is no
+  `$ref` and no `displayName`, unlike the generic SCIM enterprise-user schema (RFC 7643 4.3).
+  Code written against the RFC shape will look for fields that never arrive.
+- **Read/write asymmetry.** On read, `manager_id` is always the supervisor's ecoPortal-internal
+  id, never their `externalId`. On write (directly against the api, not yet exposed by this
+  gem), ecoPortal accepts either the internal id or the `externalId` and resolves it server-side.
+- **Absent means omitted, not null.** When a user has no supervisor, ecoPortal leaves `manager`
+  out of the enterprise extension entirely -- it is never emitted as `null` or an empty object.
+  This gem's `#manager` reader normalizes that absence to `{}` (and `#manager_id` to `nil`);
+  `#enterprise_extension` itself returns `{}` only if the api omitted the extension namespace.
+
+The behaviour described above is what the `Users::User` readers are written against. If ecoPortal changes it, those readers need to change with it.
+
+## Changelog
+
+See {file:CHANGELOG.md} for a list of changes.

data/lib/ecoportal/api/common/concerns/end_point.rb

@@ -0,0 +1,28 @@
+module Ecoportal
+  module API
+    module Common
+      module Concerns
+        module EndPoint
+          class << self
+            private
+
+            def included(base)
+              super
+
+              base.extend Ecoportal::API::Common::BaseClass
+              base.send :include, Ecoportal::API::Common::Logging
+            end
+          end
+
+          attr_reader :client
+
+          # @param client [Common::Client] a `Common::Client` object that holds the configuration of the api connection.
+          # @return [Users] an instance object ready to make user Scim interactions.
+          def initialize(client)
+            @client = client
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ecoportal/api/common/concerns.rb

@@ -0,0 +1,10 @@
+module Ecoportal
+  module API
+    module Common
+      module Concerns
+      end
+    end
+  end
+end
+
+require_relative 'concerns/end_point'

data/lib/ecoportal/api/common/scim/client.rb

@@ -0,0 +1,58 @@
+module Ecoportal
+  module API
+    module Common
+      module Scim
+        # @see Ecoportal::API::Common::Client
+        class Client < Ecoportal::API::Common::Client
+          MAIN_END_POINT = 'scim'.freeze
+
+          attr_accessor :logger
+
+          # @note the `scim_key` will be automatically added as parameter
+          #   `Authentication: Bearer` in the header of the http requests.
+          def initialize(
+            api_key:,
+            scim_id:,
+            version: 'v2',
+            host:    'live.ecoportal.com',
+            logger:  nil
+          )
+            @scim_id = scim_id
+
+            super(api_key: api_key, version: version, host: host, logger: logger)
+
+            if host.match(/^localhost|^127\.0\.0\.1/)
+              @base_uri = "http://#{host}/scim/"
+            else
+              @base_uri = "https://#{host}/scim/"
+            end
+          end
+
+          def delete(_path)
+            raise "DELETE operation does not have integration for api #{@version}"
+          end
+
+          # Full URl builder of the request
+          # @param path [String] the tail that completes the url of the request.
+          # @return [String] the final url.
+          def url_for(path)
+            "#{super('')}/#{scim_id}#{path}"
+          end
+
+          # Creates a HTTP object adding the `Authorization: Bearer KEY` param to the header.
+          # @note It configures HTTP so it only allows body data in json+scim format.
+          # @return [HTTP] HTTP object.
+          def base_request
+            @base_request ||= HTTP.headers(
+              'Authorization' => "Bearer #{api_key}"
+            ).accept(:'json+scim')
+          end
+
+          private
+
+          attr_reader :scim_id
+        end
+      end
+    end
+  end
+end

data/lib/ecoportal/api/common/scim/includer.rb

@@ -0,0 +1,16 @@
+module Ecoportal
+  module API
+    module Common
+      module Scim
+        module Includer
+          def include_missing(base, target)
+            return base if base <= target
+
+            base.send(:include, target)
+            base
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ecoportal/api/common/scim.rb

@@ -0,0 +1,11 @@
+module Ecoportal
+  module API
+    module Common
+      module Scim
+      end
+    end
+  end
+end
+
+require_relative 'scim/includer'
+require_relative 'scim/client'

data/lib/ecoportal/api/common.scim.rb

@@ -0,0 +1,13 @@
+module Ecoportal
+  module API
+    module Common
+      unless Ecoportal::API.const_defined?(:SCIM_VERSION)
+        msg = "Correct way to require this gem is `require 'ecoportal/scim`"
+        raise LoadError, msg
+      end
+    end
+  end
+end
+
+require_relative 'common/concerns'
+require_relative 'common/scim'

data/lib/ecoportal/api/scim/groups/group.rb

@@ -0,0 +1,17 @@
+module Ecoportal
+  module API
+    class Scim
+      class Groups
+        # SCIM Group resource, per RFC 7643 section 4.2.
+        # @note kept as a placeholder: `Groups` works against the plain parsed Hash
+        #   bodies returned by the api (`id`, `displayName`, `members` -- an array
+        #   of `{value, display}`). When it gains attribute readers, mirror the
+        #   Hash-wrapper shape of `Users::User`.
+        class Group
+          # SCIM core schema URI for `Group`, per RFC 7643 section 4.2.
+          SCHEMA = 'urn:ietf:params:scim:schemas:core:2.0:Group'.freeze
+        end
+      end
+    end
+  end
+end

data/lib/ecoportal/api/scim/groups.rb

@@ -0,0 +1,107 @@
+module Ecoportal
+  module API
+    class Scim
+      # @attr_reader client [Common::Client] a `Common::Client` object that
+      #   holds the configuration of the api connection.
+      class Groups
+        include Ecoportal::API::Common::Concerns::EndPoint
+        include Enumerable
+
+        class_resolver :group_class, 'Ecoportal::API::Scim::Groups::Group'
+
+        END_POINT    = '/Groups'.freeze
+        PATCH_SCHEMA = 'urn:ietf:params:scim:api:messages:2.0:PatchOp'.freeze
+
+        # Lists the groups of the organization.
+        # @note per RFC 7644 section 3.4.2, the response is a SCIM `ListResponse`
+        #   (`totalResults`, `startIndex`, `itemsPerPage`, `Resources`).
+        # @param filter [String] a SCIM filter expression.
+        # @param start_index [Integer] the 1-based index of the first result (SCIM `startIndex`).
+        # @param count [Integer] the maximum number of results (SCIM `count`).
+        # @return [Hash] the SCIM `ListResponse`.
+        def list(filter: nil, start_index: nil, count: nil)
+          params = {}
+          params[:filter]     = filter      if filter
+          params[:startIndex] = start_index if start_index
+          params[:count]      = count       if count
+
+          response = client.get(END_POINT, params: params)
+          body     = response.body
+          return body if response.success?
+
+          raise "Could not list groups - Error #{response.status}: #{body}"
+        end
+
+        # Iterates all the groups returned by `list`.
+        # @param filter [String] a SCIM filter expression.
+        # @yield [group] does something with the group resource.
+        # @yieldparam group [Hash]
+        def each(filter: nil, &block)
+          return to_enum(:each, filter: filter) unless block_given?
+
+          list(filter: filter).fetch('Resources', []).each(&block)
+        end
+
+        # Gets a group via api.
+        # @param id [String] the `id` of the target group.
+        # @return [Hash] the group resource.
+        def get(id)
+          response = client.get("#{END_POINT}/#{CGI.escape(id)}")
+          body     = response.body
+          return body if response.success?
+
+          raise "Could not get group #{id} - Error #{response.status}: #{body}"
+        end
+
+        # Sends a raw SCIM `PatchOp` request against a group.
+        # @note per RFC 7644 section 3.5.2.
+        # @param id [String] the `id` of the target group.
+        # @param operations [Array<Hash>] the SCIM `PatchOp` `Operations`.
+        # @return [Hash] the updated group resource.
+        def patch(id, operations:)
+          data = {
+            schemas:    [PATCH_SCHEMA],
+            Operations: operations
+          }
+
+          response = client.patch("#{END_POINT}/#{CGI.escape(id)}", data: data)
+          body     = response.body
+          return body if response.success?
+
+          raise "Could not patch group #{id} - Error #{response.status}: #{body}"
+        end
+
+        # Adds members to a group.
+        # @param id [String] the `id` of the target group.
+        # @param user_ids [Array<String>, String] the `id`s of the users to add.
+        # @return [Hash] the updated group resource.
+        def add_members(id, user_ids)
+          patch(id, operations: [member_operation('add', user_ids)])
+        end
+
+        # Removes members from a group.
+        # @param id [String] the `id` of the target group.
+        # @param user_ids [Array<String>, String] the `id`s of the users to remove.
+        # @return [Hash] the updated group resource.
+        def remove_members(id, user_ids)
+          patch(id, operations: [member_operation('remove', user_ids)])
+        end
+
+        private
+
+        # @param op_name [String] `add` or `remove`.
+        # @param user_ids [Array<String>, String] the `id`s of the target users.
+        # @return [Hash] a single SCIM `PatchOp` operation targeting `members`.
+        def member_operation(op_name, user_ids)
+          {
+            'op'    => op_name,
+            'path'  => 'members',
+            'value' => Array(user_ids).map { |user_id| { 'value' => user_id } }
+          }
+        end
+      end
+    end
+  end
+end
+
+require_relative 'groups/group'

data/lib/ecoportal/api/scim/schemas/schema.rb

@@ -0,0 +1,11 @@
+module Ecoportal
+  module API
+    class Scim
+      class Schemas
+        class Schema
+          # Pending: model over the /Schemas resource (scaffold stub).
+        end
+      end
+    end
+  end
+end

data/lib/ecoportal/api/scim/schemas.rb

@@ -0,0 +1,14 @@
+module Ecoportal
+  module API
+    class Scim
+      class Schemas
+        include Ecoportal::API::Common::Concerns::EndPoint
+        include Enumerable
+
+        class_resolver :user_class, 'Ecoportal::API::Scim::Schemas::Schema'
+      end
+    end
+  end
+end
+
+require_relative 'schemas/schema'

data/lib/ecoportal/api/scim/service_provider_config.rb

@@ -0,0 +1,9 @@
+module Ecoportal
+  module API
+    class Scim
+      class ServiceProviderConfig
+        include Ecoportal::API::Common::Concerns::EndPoint
+      end
+    end
+  end
+end

data/lib/ecoportal/api/scim/users/user.rb

@@ -0,0 +1,119 @@
+module Ecoportal
+  module API
+    class Scim
+      class Users
+        # SCIM User resource, per RFC 7643 section 4.1.
+        # @note the `Users` endpoint keeps returning the plain parsed Hash bodies of
+        #   the api (its public interface is unchanged): this class is an optional,
+        #   read-only wrapper over one of those Hashes, offering snake_case readers
+        #   for the attributes this api actually returns.
+        # @example
+        #   user = Ecoportal::API::Scim::Users::User.new(scim.users.get(id))
+        #   user.user_name # => 'alice.example@example.com'
+        class User
+          # SCIM core schema URI for `User`, per RFC 7643 section 4.1.
+          SCHEMA = 'urn:ietf:params:scim:schemas:core:2.0:User'.freeze
+
+          # @return [Hash] the raw SCIM resource Hash this object wraps.
+          attr_reader :doc
+
+          # @param doc [Hash] a SCIM `User` resource, as returned by `Users#get`
+          #   or by one entry of `Users#list`'s `Resources`.
+          def initialize(doc = {})
+            @doc = doc || {}
+          end
+
+          # @return [String, nil] the SCIM `id` (the api-side identifier).
+          def id
+            doc['id']
+          end
+
+          # @return [String, nil] the SCIM `userName`.
+          def user_name
+            doc['userName']
+          end
+
+          # @return [Hash] the SCIM `name` complex attribute (`givenName`, `familyName`).
+          def name
+            doc['name'] || {}
+          end
+
+          # @return [String, nil] the SCIM `name.givenName`.
+          def given_name
+            name['givenName']
+          end
+
+          # @return [String, nil] the SCIM `name.familyName`.
+          def family_name
+            name['familyName']
+          end
+
+          # @note only `true` when the api reports the boolean `true`: a missing
+          #   `active` attribute is **not** treated as active.
+          # @return [Boolean] the SCIM `active` flag.
+          def active?
+            doc['active'] == true
+          end
+
+          # @return [String, nil] the SCIM `externalId`.
+          def external_id
+            doc['externalId']
+          end
+
+          # @return [Array<Hash>] the SCIM `emails` multi-valued attribute
+          #   (each entry a `{value, primary, ...}` Hash). Empty when absent.
+          def emails
+            doc['emails'] || []
+          end
+
+          # @return [Array<Hash>] the SCIM `phoneNumbers` multi-valued attribute
+          #   (each entry a `{value, primary, ...}` Hash). Empty when absent.
+          def phone_numbers
+            doc['phoneNumbers'] || []
+          end
+
+          # SCIM enterprise-user extension schema URI, per RFC 7643 section 4.3.
+          # ecoPortal namespaces `manager` under this URI (see `#manager`).
+          ENTERPRISE_SCHEMA = 'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User'.freeze
+
+          # @return [Hash] the SCIM enterprise-user extension namespace Hash,
+          #   keyed by `ENTERPRISE_SCHEMA` at the top level of the resource.
+          #   Empty when the api did not include the extension.
+          def enterprise_extension
+            doc[ENTERPRISE_SCHEMA] || {}
+          end
+
+          # @note ecoPortal's `manager` complex type carries only `value` -- no
+          #   `$ref` or `displayName` (unlike the generic SCIM enterprise-user
+          #   schema).
+          # @return [Hash] the SCIM `manager` complex attribute, namespaced
+          #   under `ENTERPRISE_SCHEMA`. Empty when the api did not include a
+          #   supervisor (ecoPortal omits the attribute entirely rather than
+          #   emitting a null/empty one).
+          def manager
+            enterprise_extension['manager'] || {}
+          end
+
+          # @note this is the supervisor's ecoPortal-internal id, not their
+          #   `externalId` -- the two are accepted interchangeably on writes
+          #   but only the internal id is ever returned on reads.
+          # @return [String, nil] the SCIM `manager.value`.
+          def manager_id
+            manager['value']
+          end
+
+          # @param key [String] a raw SCIM attribute name (i.e. `'userName'`).
+          # @return [Object, nil] the raw value, for attributes without a reader.
+          def [](key)
+            doc[key]
+          end
+
+          # @return [Hash] the raw SCIM resource Hash.
+          def to_h
+            doc
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ecoportal/api/scim/users.rb

@@ -0,0 +1,59 @@
+module Ecoportal
+  module API
+    class Scim
+      # @attr_reader client [Common::Client] a `Common::Client` object that
+      #   holds the configuration of the api connection.
+      class Users
+        include Ecoportal::API::Common::Concerns::EndPoint
+        include Enumerable
+
+        class_resolver :user_class, 'Ecoportal::API::Scim::Users::User'
+
+        END_POINT = '/Users'.freeze
+
+        # Lists the users of the organization.
+        # @note per RFC 7644 section 3.4.2, the response is a SCIM `ListResponse`
+        #   (`totalResults`, `startIndex`, `itemsPerPage`, `Resources`).
+        # @param filter [String] a SCIM filter expression.
+        # @param start_index [Integer] the 1-based index of the first result (SCIM `startIndex`).
+        # @param count [Integer] the maximum number of results (SCIM `count`).
+        # @return [Hash] the SCIM `ListResponse`.
+        def list(filter: nil, start_index: nil, count: nil)
+          params = {}
+          params[:filter]     = filter      if filter
+          params[:startIndex] = start_index if start_index
+          params[:count]      = count       if count
+
+          response = client.get(END_POINT, params: params)
+          body     = response.body
+          return body if response.success?
+
+          raise "Could not list users - Error #{response.status}: #{body}"
+        end
+
+        # Iterates all the users returned by `list`.
+        # @param filter [String] a SCIM filter expression.
+        # @yield [user] does something with the user resource.
+        # @yieldparam user [Hash]
+        def each(filter: nil, &block)
+          return to_enum(:each, filter: filter) unless block_given?
+
+          list(filter: filter).fetch('Resources', []).each(&block)
+        end
+
+        # Gets a user via api.
+        # @param id [String] the `id` of the target user.
+        # @return [Hash] the user resource.
+        def get(id)
+          response = client.get("#{END_POINT}/#{CGI.escape(id)}")
+          body     = response.body
+          return body if response.success?
+
+          raise "Could not get user #{id} - Error #{response.status}: #{body}"
+        end
+      end
+    end
+  end
+end
+
+require_relative 'users/user'

data/lib/ecoportal/api/scim.rb

@@ -0,0 +1,80 @@
+module Ecoportal
+  module API
+    # @attr_reader client [Common::Client] a `Common::Client` object that holds the configuration of the api connection.
+    # @attr_reader logger [Logger] the logger.
+    class Scim
+      unless Ecoportal::API.const_defined?(:SCIM_VERSION)
+        msg = "Correct way to require this gem is `require 'ecoportal/scim`"
+        raise LoadError, msg
+      end
+
+      extend Ecoportal::API::Common::BaseClass
+      include Ecoportal::API::Common::Logging
+
+      VERSION = 'v2'.freeze
+
+      class_resolver :users_class, 'Ecoportal::API::Scim::Users'
+      class_resolver :groups_class, 'Ecoportal::API::Scim::Groups'
+      class_resolver :schemas_class, 'Ecoportal::API::Scim::Schemas'
+      class_resolver :service_provider_config_class, 'Ecoportal::API::Scim::ServiceProviderConfig'
+
+      # Creates an `V2` object to scope version specific api requests.
+      # @note
+      #   - You should use either `api_key` or `user_key` and `org_key`
+      #   - The const `VERSION` determineds the api version that client will query against.
+      #   - This means that each subclass of `V2` should define their own `VERSION` constant.
+      # @param api_key [String] the key version to stablish the api connection.
+      # @param user_key [String] the user key used for the api connection (requires `org_key`).
+      # @param org_key [String] the org key used for the api connection (requires `user_key`).
+      # @param host [String] api server domain.
+      # @param logger [Logger] an object with `Logger` interface to generate logs.
+      def initialize(
+        scim_id,
+        scim_key,
+        host:     'live.ecoportal.com',
+        logger:   default_logger
+      )
+        @logger = logger
+        @client = Common::Scim::Client.new(
+          api_key: scim_key,
+          scim_id: scim_id,
+          host:    host,
+          version: self.class::VERSION,
+          logger:  @logger
+        )
+      end
+
+      # @return [Common::Scim::Client] the low-level SCIM http client.
+      attr_reader :client
+
+      # Obtain specific object for User resource.
+      # @return [User] an instance object ready to make User Scim interactions.
+      def users
+        users_class.new(client)
+      end
+
+      # Obtain specific object for Group resource.
+      # @return [Groups] an instance object ready to make Group Scim interactions.
+      def groups
+        groups_class.new(client)
+      end
+
+      # Obtain specific object for Schemas resource.
+      # @return [Schemas] an instance object ready to make Schemas Scim interactions.
+      def schemas
+        schemas_class.new(client)
+      end
+
+      # Obtain specific object for Schemas resource.
+      # @return [ServiceProviderConfig] an instance object ready to make
+      #   ServiceProviderConfig Scim interactions.
+      def service_provider_config
+        service_provider_config_class.new(client)
+      end
+    end
+  end
+end
+
+require_relative 'scim/schemas'
+require_relative 'scim/users'
+require_relative 'scim/groups'

data/lib/ecoportal/api/scim_version.rb

@@ -0,0 +1,5 @@
+module Ecoportal
+  module API
+    SCIM_VERSION = '0.1.0'.freeze
+  end
+end

data/lib/ecoportal/scim.rb

@@ -0,0 +1,10 @@
+require 'ecoportal/api'
+require_relative 'api/scim_version'
+
+module Ecoportal
+  module API
+  end
+end
+
+require_relative 'api/common.scim'
+require_relative 'api/scim'

metadata

@@ -0,0 +1,195 @@
+--- !ruby/object:Gem::Specification
+name: ecoportal-scim
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Oscar Segura
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 13.0.3
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '14'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 13.0.3
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '14'
+- !ruby/object:Gem::Dependency
+  name: redcarpet
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.6.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.6.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.12.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.12.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
+- !ruby/object:Gem::Dependency
+  name: rubocop-rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3'
+- !ruby/object:Gem::Dependency
+  name: yard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+- !ruby/object:Gem::Dependency
+  name: ecoportal-api
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.10'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.10.12
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.10'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.10.12
+email:
+- oscar@ecoportal.co.nz
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- lib/ecoportal/api/common.scim.rb
+- lib/ecoportal/api/common/concerns.rb
+- lib/ecoportal/api/common/concerns/end_point.rb
+- lib/ecoportal/api/common/scim.rb
+- lib/ecoportal/api/common/scim/client.rb
+- lib/ecoportal/api/common/scim/includer.rb
+- lib/ecoportal/api/scim.rb
+- lib/ecoportal/api/scim/groups.rb
+- lib/ecoportal/api/scim/groups/group.rb
+- lib/ecoportal/api/scim/schemas.rb
+- lib/ecoportal/api/scim/schemas/schema.rb
+- lib/ecoportal/api/scim/service_provider_config.rb
+- lib/ecoportal/api/scim/users.rb
+- lib/ecoportal/api/scim/users/user.rb
+- lib/ecoportal/api/scim_version.rb
+- lib/ecoportal/scim.rb
+homepage: https://www.ecoportal.com
+licenses:
+- MIT
+metadata:
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.2.2
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.8
+specification_version: 4
+summary: Ruby client implementation for ecoPortal SCIM
+test_files: []