@_mustachio/openauth 0.11.0 → 0.13.0

package/src/domain/scim/resource.ts

@@ -0,0 +1,358 @@
+/**
+ * SCIM resource shapes — validation in, serialization out, and the
+ * error envelope.
+ *
+ * RFC 7643 defines the User schema; RFC 7644 defines the message
+ * envelopes. Both are picky in ways that are easy to get subtly wrong
+ * and that Okta's validator checks, so the details here are asserted in
+ * tests rather than assumed:
+ *
+ *   - `status` in an Error is a **string**, not a number.
+ *   - `ListResponse` uses `Resources` with a capital R.
+ *   - `startIndex` is **1-based**.
+ *   - `meta.location` must be an absolute URL; Okta reads it.
+ *
+ * Pure: no I/O, no port access.
+ */
+import type {
+  ScimEnterpriseUser,
+  ScimGroupMember,
+  ScimGroupRecord,
+  ScimGroupWrite,
+  ScimMultiValue,
+  ScimName,
+  ScimUserRecord,
+  ScimUserWrite,
+} from "../../types/scim"
+import { err, ok, type Result } from "../../types/result"
+
+export const SCIM_USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User"
+export const SCIM_GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group"
+export const SCIM_ENTERPRISE_SCHEMA =
+  "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
+export const SCIM_LIST_SCHEMA =
+  "urn:ietf:params:scim:api:messages:2.0:ListResponse"
+export const SCIM_ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error"
+export const SCIM_PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp"
+
+/** RFC 7644 §3.12 `scimType` values we emit. */
+export type ScimErrorType =
+  | "invalidFilter"
+  | "invalidPath"
+  | "invalidSyntax"
+  | "invalidValue"
+  | "mutability"
+  | "noTarget"
+  | "uniqueness"
+  | "tooMany"
+
+export type ScimValidationError = {
+  status: number
+  detail: string
+  scimType?: ScimErrorType
+}
+
+/** RFC 7644 §3.12 error envelope. */
+export function scimErrorBody(
+  status: number,
+  detail: string,
+  scimType?: ScimErrorType,
+): Record<string, unknown> {
+  return {
+    schemas: [SCIM_ERROR_SCHEMA],
+    // A string, per the RFC's own examples — a number here is a common
+    // implementation bug and Okta's validator notices.
+    status: String(status),
+    ...(scimType !== undefined ? { scimType } : {}),
+    detail,
+  }
+}
+
+const isRecord = (v: unknown): v is Record<string, unknown> =>
+  typeof v === "object" && v !== null && !Array.isArray(v)
+
+const asString = (v: unknown): string | undefined =>
+  typeof v === "string" && v.length > 0 ? v : undefined
+
+function parseName(v: unknown): ScimName | undefined {
+  if (!isRecord(v)) return undefined
+  const out: ScimName = {}
+  for (const k of [
+    "formatted",
+    "familyName",
+    "givenName",
+    "middleName",
+    "honorificPrefix",
+    "honorificSuffix",
+  ] as const) {
+    const s = asString(v[k])
+    if (s !== undefined) out[k] = s
+  }
+  return Object.keys(out).length > 0 ? out : undefined
+}
+
+function parseMultiValues(v: unknown): ScimMultiValue[] | undefined {
+  if (!Array.isArray(v)) return undefined
+  const out: ScimMultiValue[] = []
+  for (const entry of v) {
+    if (!isRecord(entry)) continue
+    const value = asString(entry["value"])
+    if (value === undefined) continue
+    const type = asString(entry["type"])
+    const primary = entry["primary"]
+    out.push({
+      value,
+      ...(type !== undefined ? { type } : {}),
+      ...(typeof primary === "boolean" ? { primary } : {}),
+    })
+  }
+  return out.length > 0 ? out : undefined
+}
+
+function parseEnterprise(v: unknown): ScimEnterpriseUser | undefined {
+  if (!isRecord(v)) return undefined
+  const out: ScimEnterpriseUser = {}
+  for (const k of [
+    "employeeNumber",
+    "costCenter",
+    "organization",
+    "division",
+    "department",
+  ] as const) {
+    const s = asString(v[k])
+    if (s !== undefined) out[k] = s
+  }
+  const mgr = v["manager"]
+  if (isRecord(mgr)) {
+    const value = asString(mgr["value"])
+    const displayName = asString(mgr["displayName"])
+    if (value !== undefined || displayName !== undefined) {
+      out.manager = {
+        ...(value !== undefined ? { value } : {}),
+        ...(displayName !== undefined ? { displayName } : {}),
+      }
+    }
+  }
+  return Object.keys(out).length > 0 ? out : undefined
+}
+
+/**
+ * Validate a `POST` / `PUT` user payload into a `ScimUserWrite`.
+ *
+ * Unknown attributes are ignored rather than rejected: SCIM clients send
+ * plenty the spec allows and we do not model, and failing the whole
+ * provisioning run over an extra field would be hostile. The two
+ * exceptions are hard errors — a missing `userName`, which leaves the
+ * record unidentifiable, and `password`, which we refuse to handle at
+ * all rather than accept and drop.
+ */
+export function parseUserWrite(
+  body: unknown,
+): Result<ScimUserWrite, ScimValidationError> {
+  if (!isRecord(body)) {
+    return err({
+      status: 400,
+      scimType: "invalidSyntax",
+      detail: "request body must be a JSON object",
+    })
+  }
+
+  if (body["password"] !== undefined) {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail:
+        "this Service Provider does not accept 'password' over SCIM; " +
+        "credentials are managed by the authentication methods, not the " +
+        "directory feed",
+    })
+  }
+
+  const userName = asString(body["userName"])
+  if (userName === undefined) {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail: "userName is required and must be a non-empty string",
+    })
+  }
+
+  const activeRaw = body["active"]
+  if (activeRaw !== undefined && typeof activeRaw !== "boolean") {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail: "active must be a boolean",
+    })
+  }
+
+  const externalId = asString(body["externalId"])
+  const displayName = asString(body["displayName"])
+  const name = parseName(body["name"])
+  const emails = parseMultiValues(body["emails"])
+  const phoneNumbers = parseMultiValues(body["phoneNumbers"])
+  const enterprise = parseEnterprise(body[SCIM_ENTERPRISE_SCHEMA])
+
+  return ok({
+    userName,
+    // SCIM defaults `active` to true on create. Resolving the default
+    // here keeps the semantics in one place instead of in every host.
+    active: activeRaw === undefined ? true : activeRaw,
+    ...(externalId !== undefined ? { externalId } : {}),
+    ...(displayName !== undefined ? { displayName } : {}),
+    ...(name !== undefined ? { name } : {}),
+    ...(emails !== undefined ? { emails } : {}),
+    ...(phoneNumbers !== undefined ? { phoneNumbers } : {}),
+    ...(enterprise !== undefined ? { enterprise } : {}),
+  })
+}
+
+const iso = (ms: number | undefined): string | undefined =>
+  ms === undefined ? undefined : new Date(ms).toISOString()
+
+/** Serialize a host record into a SCIM User resource. */
+export function serializeUser(
+  user: ScimUserRecord,
+  baseUrl: string,
+): Record<string, unknown> {
+  const schemas = [SCIM_USER_SCHEMA]
+  if (user.enterprise !== undefined) schemas.push(SCIM_ENTERPRISE_SCHEMA)
+
+  const created = iso(user.createdAt)
+  const lastModified = iso(user.updatedAt)
+
+  return {
+    schemas,
+    id: user.id,
+    ...(user.externalId !== undefined ? { externalId: user.externalId } : {}),
+    userName: user.userName,
+    ...(user.name !== undefined ? { name: user.name } : {}),
+    ...(user.displayName !== undefined
+      ? { displayName: user.displayName }
+      : {}),
+    ...(user.emails !== undefined ? { emails: user.emails } : {}),
+    ...(user.phoneNumbers !== undefined
+      ? { phoneNumbers: user.phoneNumbers }
+      : {}),
+    active: user.active,
+    ...(user.enterprise !== undefined
+      ? { [SCIM_ENTERPRISE_SCHEMA]: user.enterprise }
+      : {}),
+    meta: {
+      resourceType: "User",
+      ...(created !== undefined ? { created } : {}),
+      ...(lastModified !== undefined ? { lastModified } : {}),
+      location: `${baseUrl}/Users/${encodeURIComponent(user.id)}`,
+    },
+  }
+}
+
+/** RFC 7644 §3.4.2 ListResponse. */
+export function serializeList(
+  users: ScimUserRecord[],
+  totalResults: number,
+  startIndex: number,
+  baseUrl: string,
+): Record<string, unknown> {
+  return {
+    schemas: [SCIM_LIST_SCHEMA],
+    totalResults,
+    startIndex,
+    itemsPerPage: users.length,
+    // Capital R — the spec's own casing, and a frequent interop bug.
+    Resources: users.map((u) => serializeUser(u, baseUrl)),
+  }
+}
+
+function parseMembers(v: unknown): ScimGroupMember[] | undefined {
+  // Some IdPs send a bare object where the spec wants an array.
+  const list = Array.isArray(v) ? v : isRecord(v) ? [v] : undefined
+  if (list === undefined) return undefined
+  const out: ScimGroupMember[] = []
+  for (const entry of list) {
+    if (!isRecord(entry)) continue
+    const value = asString(entry["value"])
+    if (value === undefined) continue
+    const display = asString(entry["display"])
+    out.push({ value, ...(display !== undefined ? { display } : {}) })
+  }
+  return out
+}
+
+export { parseMembers }
+
+/** Validate a `POST` / `PUT` group payload. */
+export function parseGroupWrite(
+  body: unknown,
+): Result<ScimGroupWrite, ScimValidationError> {
+  if (!isRecord(body)) {
+    return err({
+      status: 400,
+      scimType: "invalidSyntax",
+      detail: "request body must be a JSON object",
+    })
+  }
+  const displayName = asString(body["displayName"])
+  if (displayName === undefined) {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail: "displayName is required and must be a non-empty string",
+    })
+  }
+  const externalId = asString(body["externalId"])
+  const members = parseMembers(body["members"])
+  return ok({
+    displayName,
+    ...(externalId !== undefined ? { externalId } : {}),
+    ...(members !== undefined ? { members } : {}),
+  })
+}
+
+/** Serialize a host group record into a SCIM Group resource. */
+export function serializeGroup(
+  group: ScimGroupRecord,
+  baseUrl: string,
+): Record<string, unknown> {
+  const created = iso(group.createdAt)
+  const lastModified = iso(group.updatedAt)
+  return {
+    schemas: [SCIM_GROUP_SCHEMA],
+    id: group.id,
+    ...(group.externalId !== undefined ? { externalId: group.externalId } : {}),
+    displayName: group.displayName,
+    // Omitted entirely when the host did not load membership — `[]`
+    // would tell the client the group has been emptied.
+    ...(group.members !== undefined
+      ? {
+          members: group.members.map((m) => ({
+            value: m.value,
+            ...(m.display !== undefined ? { display: m.display } : {}),
+            $ref: `${baseUrl}/Users/${encodeURIComponent(m.value)}`,
+            type: "User",
+          })),
+        }
+      : {}),
+    meta: {
+      resourceType: "Group",
+      ...(created !== undefined ? { created } : {}),
+      ...(lastModified !== undefined ? { lastModified } : {}),
+      location: `${baseUrl}/Groups/${encodeURIComponent(group.id)}`,
+    },
+  }
+}
+
+export function serializeGroupList(
+  groups: ScimGroupRecord[],
+  totalResults: number,
+  startIndex: number,
+  baseUrl: string,
+): Record<string, unknown> {
+  return {
+    schemas: [SCIM_LIST_SCHEMA],
+    totalResults,
+    startIndex,
+    itemsPerPage: groups.length,
+    Resources: groups.map((g) => serializeGroup(g, baseUrl)),
+  }
+}

package/src/http/context.ts

@@ -11,12 +11,15 @@ import type { AuditLog } from "../ports/audit-log"
 import type { ConfigStore } from "../ports/config-store"
 import type { KeyStore } from "../ports/key-store"
 import type { MethodStore } from "../ports/method-store"
+import type { ScimDirectory } from "../ports/scim-directory"
 import type { SessionStore } from "../ports/session-store"
 import type { TokenStore } from "../ports/token-store"
 import type { MethodCache } from "../domain/method-cache"
 import type { AuthError } from "../types/error"
 import type {
   ExchangeAudience,
+  LogoutEventInput,
+  LogoutHookResult,
   PersistUpstreamTokens,
   RegisterClient,
   RenderPicker,
@@ -41,6 +44,8 @@ export type HttpDeps = {
   keyStore: KeyStore
   methodStore?: MethodStore
   auditLog?: AuditLog
+  /** See `IdPOptions.scimDirectory`. Absent ⇒ `/scim/v2/*` answers 501. */
+  scimDirectory?: ScimDirectory
   methodCache: MethodCache
   stateKeys: StateKeyRing
   /** Resolves the issuer URL — string or per-request function. */
@@ -49,6 +54,10 @@ export type HttpDeps = {
   callbackHostFor?: (tenantId: TenantId) => string
   resolveTenant: (req: Request) => Promise<Result<TenantId, AuthError>>
   success: (input: SuccessMapInput) => Promise<SubjectClaim>
+  /** See `IdPOptions.onLogout` — upstream Single Logout host hook. */
+  onLogout?: (
+    input: LogoutEventInput,
+  ) => Promise<LogoutHookResult> | LogoutHookResult
   persistUpstreamTokens?: PersistUpstreamTokens
   exchangeAudience?: ExchangeAudience
   renderPicker?: RenderPicker

package/src/http/cookies.ts

@@ -7,7 +7,7 @@
  * strip method-returned `Set-Cookie` / security / `Cache-Control` headers so
  * methods cannot bypass policy.
  */
-import type { SetCookie } from "../types/method"
+import type { CachePolicy, SetCookie } from "../types/method"
 
 /** Parse an incoming `Cookie:` header into a read-only map. */
 export function parseCookieHeader(header: string | null): Map<string, string> {
@@ -117,6 +117,24 @@ const STRIPPED_HEADERS = [
   "cache-control",
 ] as const
 
+/**
+ * Serialize a `MethodResult.challenge`'s `CachePolicy` into a
+ * `Cache-Control` header value. The framework owns this header (methods
+ * cannot set it directly — see `STRIPPED_HEADERS`); a method opts into
+ * caching via the typed `cache` field and this renders it. Absent /
+ * `maxAge: 0` ⇒ `no-store` (the safe default for auth UI).
+ */
+export function cacheControlHeader(cache: CachePolicy | undefined): string {
+  if (!cache) return "no-store"
+  if ((cache.maxAge ?? -1) === 0) return "no-store"
+  const parts: string[] = []
+  if (cache.isPrivate) parts.push("private")
+  if (cache.maxAge !== undefined) parts.push(`max-age=${cache.maxAge}`)
+  if (cache.sMaxAge !== undefined) parts.push(`s-maxage=${cache.sMaxAge}`)
+  if (cache.immutable) parts.push("immutable")
+  return parts.length ? parts.join(", ") : "no-store"
+}
+
 export type ApplyOptions = {
   setCookies?: SetCookie[]
   cookieDefaults?: CookieDefaults

package/src/http/handlers/authorize.ts

@@ -24,7 +24,7 @@ import type {
 import type { PickerContext, PickerMethod } from "../../types/picker"
 import { renderPicker as renderDefaultPicker } from "../../ui/picker"
 
-import { applyResponsePolicy } from "../cookies"
+import { applyResponsePolicy, cacheControlHeader } from "../cookies"
 import type { HttpContext, HttpDeps } from "../context"
 import {
   authorizeDirectErrorResponse,
@@ -209,7 +209,7 @@ export function makeAuthorizeHandler(deps: HttpDeps) {
         return applyResponsePolicy(out.response, {
           setCookies: [flowCookie, ...out.setCookies],
           cookieDefaults: deps.cookieDefaults,
-          cacheControl: cacheControlFor(out.cache),
+          cacheControl: cacheControlHeader(out.cache),
         })
       }
       case "issue-code": {
@@ -340,23 +340,3 @@ function clearFlowCookie() {
     maxAge: 0,
   }
 }
-
-function cacheControlFor(
-  cache:
-    | {
-        maxAge?: number
-        sMaxAge?: number
-        isPrivate?: boolean
-        immutable?: boolean
-      }
-    | undefined,
-): string {
-  if (!cache) return "no-store"
-  if ((cache.maxAge ?? -1) === 0) return "no-store"
-  const parts: string[] = []
-  if (cache.isPrivate) parts.push("private")
-  if (cache.maxAge !== undefined) parts.push(`max-age=${cache.maxAge}`)
-  if (cache.sMaxAge !== undefined) parts.push(`s-maxage=${cache.sMaxAge}`)
-  if (cache.immutable) parts.push("immutable")
-  return parts.length ? parts.join(", ") : "no-store"
-}

package/src/http/handlers/callback.ts

@@ -16,8 +16,16 @@ import { authorizeDirectErrorResponse } from "../errors"
 
 export function makeCallbackHandler(deps: HttpDeps) {
   return async (c: HttpContext): Promise<Response> => {
+    const tenant = c.get("tenant")
     const result = await handleCallback(
-      { rawRequest: c.req.raw, cookies: c.get("cookies") },
+      {
+        rawRequest: c.req.raw,
+        cookies: c.get("cookies"),
+        // Only the IdP-initiated (no-state) path reads these; the
+        // SP-initiated path derives tenant from the consumed flow.
+        ...(tenant ? { tenant } : {}),
+        issuerUrl: c.get("issuerUrl"),
+      },
       {
         configStore: deps.configStore,
         sessionStore: deps.sessionStore,

package/src/http/handlers/method-route.ts

@@ -7,11 +7,15 @@
  * `domain/method-route.handleMethodRoute` orchestrator handles flow lookup
  * + dispatch + result translation.
  */
-import { handleMethodRoute } from "../../domain/method-route"
+import {
+  handleMethodRoute,
+  handlePublicMethodRoute,
+} from "../../domain/method-route"
+import type { RouteKey } from "../../domain/method-dispatch"
 import { authError } from "../../types/error"
 import { isErr } from "../../types/result"
 
-import { applyResponsePolicy } from "../cookies"
+import { applyResponsePolicy, cacheControlHeader } from "../cookies"
 import type { HttpContext, HttpDeps } from "../context"
 import { authorizeDirectErrorResponse } from "../errors"
 
@@ -23,6 +27,72 @@ export function makeMethodRouteHandler(deps: HttpDeps) {
         authError.invalidRequest("tenant unresolved"),
       )
     }
+
+    // Public fast-path (additive — leaves the cookie-gated path below
+    // byte-identical for every non-public request). Only a clean hit —
+    // well-formed `/m/<id>/<sub>`, method resolves, and the resolved
+    // method explicitly lists this route key in `publicRoutes` — is
+    // diverted here, cookie-free. Anything else falls through to the
+    // original flow-cookie-gated logic with its original error
+    // ordering. `methodCache.resolve` is a cache lookup; the duplicate
+    // resolve on the gated path is a cache hit.
+    {
+      const u = new URL(c.req.url)
+      const segs = u.pathname.split("/").filter(Boolean)
+      if (segs.length >= 3 && segs[0] === "m") {
+        const methodId = segs[1]!
+        const subPath = "/" + segs.slice(2).join("/")
+        const httpMethod =
+          c.req.method.toUpperCase() === "POST" ? "POST" : "GET"
+        const routeKey = `${httpMethod} ${subPath}` as RouteKey
+        const resolved = await deps.methodCache.resolve(tenant.config, methodId)
+        if (
+          !isErr(resolved) &&
+          resolved.value.publicRoutes?.includes(routeKey)
+        ) {
+          const issuerUrl = c.get("issuerUrl")
+          const callbackHost =
+            deps.callbackHostFor?.(tenant.id) ?? new URL(issuerUrl).host
+          // Mirrors the ACS URL derivation in domain/authorize.ts
+          // (callbackHost/path/url). Source of truth is there; the
+          // metadata.test.ts anti-drift test asserts the emitted
+          // entityID/ACS equal what buildAuthnRequestRedirect derives.
+          const callbackUrl = `${new URL(issuerUrl).protocol}//${callbackHost}/cb/${methodId}`
+          const pub = await handlePublicMethodRoute(
+            {
+              rawRequest: c.req.raw,
+              tenant,
+              method: resolved.value,
+              route: routeKey,
+              subPath,
+              dispatch: { state: "", callbackUrl, issuerUrl },
+            },
+            {
+              sessionStore: deps.sessionStore,
+              tokenStore: deps.tokenStore,
+              clock: deps.clock,
+              ...(deps.auditLog ? { auditLog: deps.auditLog } : {}),
+              ...(deps.onLogout ? { onLogout: deps.onLogout } : {}),
+            },
+          )
+          if (isErr(pub)) return authorizeDirectErrorResponse(pub.error)
+          if (pub.value.kind === "denied") {
+            return applyResponsePolicy(
+              new Response(`access_denied: ${pub.value.reason}`, {
+                status: 403,
+                headers: { "content-type": "text/plain" },
+              }),
+              { cookieDefaults: deps.cookieDefaults },
+            )
+          }
+          return applyResponsePolicy(pub.value.response, {
+            cacheControl: cacheControlHeader(pub.value.cache),
+            cookieDefaults: deps.cookieDefaults,
+          })
+        }
+      }
+    }
+
     const cookies = c.get("cookies")
     const flowId = cookies.get("idp.flow")
     if (!flowId) {

package/src/http/handlers/scim.ts

@@ -0,0 +1,107 @@
+/**
+ * `/scim/v2/*` — SCIM 2.0 provisioning.
+ *
+ * Thin by design: parse the request into plain data, hand it to
+ * `handleScimRequest`, serialize the result. Every decision — auth,
+ * routing, validation, status codes — lives in the domain, so the whole
+ * SCIM surface is testable without Hono.
+ *
+ * Responses carry `application/scim+json` per RFC 7644 §3.1.
+ */
+import { handleScimRequest } from "../../domain/scim/handle"
+import { scimErrorBody } from "../../domain/scim/resource"
+
+import type { HttpContext, HttpDeps } from "../context"
+
+const SCIM_CONTENT_TYPE = "application/scim+json;charset=utf-8"
+const MOUNT = "/scim/v2"
+
+function scimResponse(
+  status: number,
+  body: Record<string, unknown> | null,
+  extra: Record<string, string> = {},
+): Response {
+  if (body === null || status === 204) {
+    return new Response(null, { status, headers: extra })
+  }
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": SCIM_CONTENT_TYPE,
+      // Provisioning responses are per-tenant and mutable; never cached.
+      "cache-control": "no-store",
+      ...extra,
+    },
+  })
+}
+
+export function makeScimHandler(deps: HttpDeps) {
+  return async (c: HttpContext): Promise<Response> => {
+    if (!deps.scimDirectory) {
+      return scimResponse(
+        501,
+        scimErrorBody(
+          501,
+          "SCIM is not configured on this deployment (no scimDirectory " +
+            "was supplied to createIdP)",
+        ),
+      )
+    }
+
+    const tenant = c.get("tenant")
+    if (!tenant) {
+      // The tenant middleware could not resolve a partition. Answer the
+      // same way an unknown token does, so this endpoint never reveals
+      // which tenants exist.
+      return scimResponse(
+        403,
+        scimErrorBody(403, "SCIM provisioning is not enabled for this tenant"),
+      )
+    }
+
+    const url = new URL(c.req.url)
+    const path = url.pathname.startsWith(MOUNT)
+      ? url.pathname.slice(MOUNT.length)
+      : url.pathname
+
+    const method = c.req.method.toUpperCase()
+
+    // Only read a body for methods that carry one. An unparseable body
+    // becomes `null` and the domain reports it as invalid syntax with
+    // the right SCIM envelope, rather than throwing here.
+    let body: unknown = null
+    if (method === "POST" || method === "PUT" || method === "PATCH") {
+      const raw = await c.req.raw.text()
+      if (raw.length > 0) {
+        try {
+          body = JSON.parse(raw)
+        } catch {
+          return scimResponse(
+            400,
+            scimErrorBody(
+              400,
+              "request body is not valid JSON",
+              "invalidSyntax",
+            ),
+          )
+        }
+      }
+    }
+
+    const issuer = c.get("issuerUrl")
+    const base = issuer.endsWith("/") ? issuer.slice(0, -1) : issuer
+
+    const result = await handleScimRequest({
+      tenant,
+      method,
+      path,
+      query: url.searchParams,
+      body,
+      authorization: c.req.header("authorization") ?? null,
+      baseUrl: `${base}${MOUNT}`,
+      directory: deps.scimDirectory,
+    })
+
+    return scimResponse(result.status, result.body, result.headers ?? {})
+  }
+}