@_mustachio/openauth 0.11.0 → 0.13.0

package/dist/esm/domain/scim/filter.js

@@ -0,0 +1,177 @@
+// src/domain/scim/filter.ts
+import { err, ok } from "../../types/result";
+var SUPPORTED_FILTER_HELP = 'supported filters are: userName eq "…", externalId eq "…", id eq "…", ' + 'active eq true|false, emails[type eq "…"].value eq "…", and two of ' + 'those joined by "and"';
+var ATTRIBUTES = {
+  id: "id",
+  username: "userName",
+  externalid: "externalId",
+  active: "active",
+  "emails.value": "emails.value",
+  displayname: "displayName"
+};
+var USER_FILTER_ATTRIBUTES = new Set(["id", "userName", "externalId", "active", "emails.value"]);
+var GROUP_FILTER_ATTRIBUTES = new Set(["id", "displayName", "externalId"]);
+function normalizeComplexPath(raw) {
+  const m = /^([A-Za-z]+)\[[^\]]*\]\.([A-Za-z]+)$/.exec(raw.trim());
+  if (!m)
+    return raw.trim();
+  return `${m[1]}.${m[2]}`;
+}
+function findOperator(term) {
+  let depth = 0;
+  let inQuotes = false;
+  for (let i = 0;i < term.length; i++) {
+    const ch = term[i];
+    if (ch === '"' && term[i - 1] !== "\\") {
+      inQuotes = !inQuotes;
+      continue;
+    }
+    if (inQuotes)
+      continue;
+    if (ch === "[")
+      depth++;
+    else if (ch === "]")
+      depth--;
+    else if (depth === 0 && ch === " ") {
+      const m = /^\s+([A-Za-z]{2,3})(?:\s+|$)/.exec(term.slice(i));
+      if (m) {
+        return {
+          attr: term.slice(0, i),
+          op: m[1],
+          value: term.slice(i + m[0].length)
+        };
+      }
+    }
+  }
+  return null;
+}
+function parseTerm(raw, allowed) {
+  const term = raw.trim();
+  const found = findOperator(term);
+  if (!found) {
+    return err({
+      detail: `could not parse filter term "${term}". ${SUPPORTED_FILTER_HELP}`
+    });
+  }
+  const { attr: rawAttr, op: rawOp, value: rawValue } = found;
+  if (rawOp.toLowerCase() !== "eq") {
+    return err({
+      detail: `operator "${rawOp}" is not supported; only "eq" is. ` + SUPPORTED_FILTER_HELP
+    });
+  }
+  const attrKey = normalizeComplexPath(rawAttr).toLowerCase();
+  const attribute = ATTRIBUTES[attrKey];
+  if (!attribute || !allowed.has(attribute)) {
+    return err({
+      detail: `attribute "${rawAttr.trim()}" is not filterable. ` + SUPPORTED_FILTER_HELP
+    });
+  }
+  const value = rawValue.trim();
+  if (attribute === "active") {
+    const lowered = value.toLowerCase();
+    if (lowered !== "true" && lowered !== "false") {
+      return err({
+        detail: `"active" must be compared to true or false, got ${value}`
+      });
+    }
+    return ok({ op: "eq", attribute, value: lowered === "true" });
+  }
+  if (value.length < 2 || !value.startsWith('"') || !value.endsWith('"')) {
+    return err({
+      detail: `value for "${attribute}" must be a quoted string, got ${value}`
+    });
+  }
+  const unquoted = value.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+  if (unquoted.length === 0) {
+    return err({ detail: `value for "${attribute}" must not be empty` });
+  }
+  return ok({ op: "eq", attribute, value: unquoted });
+}
+function parseScimFilter(raw, allowed = USER_FILTER_ATTRIBUTES) {
+  if (raw === null || raw === undefined || raw.trim().length === 0) {
+    return ok(undefined);
+  }
+  const input = raw.trim();
+  const masked = maskQuoted(input);
+  if (masked.includes("(") || masked.includes(")")) {
+    return err({
+      detail: `grouped expressions are not supported. ${SUPPORTED_FILTER_HELP}`
+    });
+  }
+  const parts = splitTopLevelAnd(input);
+  if (parts.length > 2) {
+    return err({
+      detail: `at most two terms joined by "and" are supported. ` + SUPPORTED_FILTER_HELP
+    });
+  }
+  if (/\sor\s/i.test(masked)) {
+    return err({
+      detail: `"or" is not supported. ${SUPPORTED_FILTER_HELP}`
+    });
+  }
+  if (/(^|\s)not\s/i.test(masked)) {
+    return err({
+      detail: `"not" is not supported. ${SUPPORTED_FILTER_HELP}`
+    });
+  }
+  const first = parseTerm(parts[0], allowed);
+  if (!first.ok)
+    return first;
+  if (parts.length === 1)
+    return ok(first.value);
+  const second = parseTerm(parts[1], allowed);
+  if (!second.ok)
+    return second;
+  return ok({ op: "and", left: first.value, right: second.value });
+}
+function maskQuoted(input) {
+  let out = "";
+  let inQuotes = false;
+  for (let i = 0;i < input.length; i++) {
+    const ch = input[i];
+    if (ch === '"' && input[i - 1] !== "\\") {
+      inQuotes = !inQuotes;
+      out += ch;
+      continue;
+    }
+    out += inQuotes ? " " : ch;
+  }
+  return out;
+}
+function splitTopLevelAnd(input) {
+  const parts = [];
+  let depth = 0;
+  let inQuotes = false;
+  let start = 0;
+  for (let i = 0;i < input.length; i++) {
+    const ch = input[i];
+    if (ch === '"' && input[i - 1] !== "\\") {
+      inQuotes = !inQuotes;
+      continue;
+    }
+    if (inQuotes)
+      continue;
+    if (ch === "[")
+      depth++;
+    else if (ch === "]")
+      depth--;
+    else if (depth === 0 && (ch === "a" || ch === "A")) {
+      const window = input.slice(i, i + 3);
+      const before = input[i - 1];
+      const after = input[i + 3];
+      if (window.toLowerCase() === "and" && (before === " " || before === undefined) && (after === " " || after === undefined)) {
+        parts.push(input.slice(start, i));
+        start = i + 3;
+        i += 2;
+      }
+    }
+  }
+  parts.push(input.slice(start));
+  return parts.map((p) => p.trim()).filter((p) => p.length > 0);
+}
+export {
+  GROUP_FILTER_ATTRIBUTES,
+  SUPPORTED_FILTER_HELP,
+  USER_FILTER_ATTRIBUTES,
+  parseScimFilter
+};

package/dist/esm/domain/scim/handle.js

@@ -0,0 +1,338 @@
+// src/domain/scim/handle.ts
+import { timingSafeEqualStr } from "../crypto";
+import { hashClientSecret } from "../token";
+import { resourceTypes, schemas, serviceProviderConfig } from "./discovery";
+import {
+  GROUP_FILTER_ATTRIBUTES,
+  parseScimFilter,
+  SUPPORTED_FILTER_HELP,
+  USER_FILTER_ATTRIBUTES
+} from "./filter";
+import { normalizeGroupPatch, normalizePatch } from "./patch";
+import {
+  parseGroupWrite,
+  parseUserWrite,
+  scimErrorBody,
+  serializeGroup,
+  serializeGroupList,
+  serializeList,
+  serializeUser
+} from "./resource";
+var DEFAULT_PAGE_SIZE = 100;
+var PAGE_SIZE_CEILING = 500;
+function created(body) {
+  const location = body["meta"]?.["location"];
+  return {
+    status: 201,
+    body,
+    ...typeof location === "string" ? { headers: { location } } : {}
+  };
+}
+var fail = (status, detail, scimType) => ({
+  status,
+  body: scimErrorBody(status, detail, scimType)
+});
+function fromPortError(error) {
+  if (error.code === "conflict") {
+    return fail(409, error.description, "uniqueness");
+  }
+  if (error.code === "invalid_request") {
+    return fail(400, error.description, "invalidValue");
+  }
+  return fail(500, "the directory backing this endpoint failed the request");
+}
+function unwrap(r) {
+  if (r.ok)
+    return { value: r.value };
+  return { response: fromPortError(r.error) };
+}
+async function authenticate(scim, authorization) {
+  if (!scim || scim.enabled !== true) {
+    return fail(403, "SCIM provisioning is not enabled for this tenant");
+  }
+  const prefix = "bearer ";
+  if (authorization === null || !authorization.toLowerCase().startsWith(prefix)) {
+    return fail(401, "a Bearer token is required");
+  }
+  const presented = authorization.slice(prefix.length).trim();
+  if (presented.length === 0)
+    return fail(401, "a Bearer token is required");
+  const hashed = await hashClientSecret(presented);
+  if (!timingSafeEqualStr(hashed, scim.tokenHash)) {
+    return fail(401, "invalid Bearer token");
+  }
+  return null;
+}
+function userIdFrom(path) {
+  const m = /^\/Users\/(.+)$/.exec(path);
+  if (!m)
+    return null;
+  try {
+    return decodeURIComponent(m[1]);
+  } catch {
+    return m[1];
+  }
+}
+function clampPaging(query, maxPageSize) {
+  const rawStart = Number(query.get("startIndex") ?? "1");
+  const startIndex = Number.isFinite(rawStart) && rawStart >= 1 ? Math.floor(rawStart) : 1;
+  const rawCount = query.get("count");
+  if (rawCount === null)
+    return { startIndex, count: maxPageSize };
+  const parsed = Number(rawCount);
+  if (!Number.isFinite(parsed))
+    return { startIndex, count: maxPageSize };
+  if (parsed < 0)
+    return { startIndex, count: 0 };
+  return { startIndex, count: Math.min(Math.floor(parsed), maxPageSize) };
+}
+async function listUsers(input, maxPageSize) {
+  const filter = parseScimFilter(input.query.get("filter"), USER_FILTER_ATTRIBUTES);
+  if (!filter.ok) {
+    return fail(400, filter.error.detail, "invalidFilter");
+  }
+  const { startIndex, count } = clampPaging(input.query, maxPageSize);
+  const page = await input.directory.findUsers(input.tenant.id, {
+    ...filter.value !== undefined ? { filter: filter.value } : {},
+    startIndex,
+    count
+  });
+  const r = unwrap(page);
+  if ("response" in r)
+    return r.response;
+  return {
+    status: 200,
+    body: serializeList(r.value.resources, r.value.totalResults, startIndex, input.baseUrl)
+  };
+}
+async function createUser(input) {
+  const parsed = parseUserWrite(input.body);
+  if (!parsed.ok) {
+    return fail(parsed.error.status, parsed.error.detail, parsed.error.scimType);
+  }
+  const created_ = await input.directory.createUser(input.tenant.id, parsed.value);
+  const r = unwrap(created_);
+  if ("response" in r)
+    return r.response;
+  return created(serializeUser(r.value, input.baseUrl));
+}
+async function loadUser(input, id) {
+  const found = await input.directory.getUser(input.tenant.id, id);
+  const r = unwrap(found);
+  if ("response" in r)
+    return r;
+  if (r.value === null) {
+    return { response: fail(404, `no User with id "${id}"`) };
+  }
+  return { user: r.value };
+}
+async function replaceUser(input, id) {
+  const existing = await loadUser(input, id);
+  if ("response" in existing)
+    return existing.response;
+  const parsed = parseUserWrite(input.body);
+  if (!parsed.ok) {
+    return fail(parsed.error.status, parsed.error.detail, parsed.error.scimType);
+  }
+  const write = parsed.value;
+  const replaced = await input.directory.replaceUser(input.tenant.id, id, write);
+  const r = unwrap(replaced);
+  if ("response" in r)
+    return r.response;
+  return { status: 200, body: serializeUser(r.value, input.baseUrl) };
+}
+async function patchUser(input, id) {
+  const existing = await loadUser(input, id);
+  if ("response" in existing)
+    return existing.response;
+  const normalized = normalizePatch(input.body, existing.user);
+  if (!normalized.ok) {
+    return fail(normalized.error.status, normalized.error.detail, normalized.error.scimType);
+  }
+  const patched = await input.directory.patchUser(input.tenant.id, id, normalized.value);
+  const r = unwrap(patched);
+  if ("response" in r)
+    return r.response;
+  return { status: 200, body: serializeUser(r.value, input.baseUrl) };
+}
+async function deleteUser(input, id) {
+  const existing = await loadUser(input, id);
+  if ("response" in existing)
+    return existing.response;
+  const deleted = await input.directory.deleteUser(input.tenant.id, id);
+  const r = unwrap(deleted);
+  if ("response" in r)
+    return r.response;
+  return { status: 204, body: null };
+}
+function groupsSupported(d) {
+  return typeof d.getGroup === "function" && typeof d.findGroups === "function" && typeof d.createGroup === "function" && typeof d.replaceGroup === "function" && typeof d.patchGroup === "function" && typeof d.deleteGroup === "function";
+}
+function excludesMembers(query) {
+  const raw = query.get("excludedAttributes");
+  if (raw === null)
+    return false;
+  return raw.split(",").map((s) => s.trim().toLowerCase()).includes("members");
+}
+async function loadGroup(input, groups, id) {
+  const found = await groups.getGroup(input.tenant.id, id);
+  const r = unwrap(found);
+  if ("response" in r)
+    return r;
+  if (r.value === null) {
+    return { response: fail(404, `no Group with id "${id}"`) };
+  }
+  return { group: r.value };
+}
+async function handleGroups(input, groups, path, method, maxPageSize) {
+  if (path === "/Groups" || path === "/Groups/") {
+    if (method === "GET") {
+      const filter = parseScimFilter(input.query.get("filter"), GROUP_FILTER_ATTRIBUTES);
+      if (!filter.ok)
+        return fail(400, filter.error.detail, "invalidFilter");
+      const { startIndex, count } = clampPaging(input.query, maxPageSize);
+      const page = await groups.findGroups(input.tenant.id, {
+        ...filter.value !== undefined ? { filter: filter.value } : {},
+        startIndex,
+        count,
+        excludeMembers: excludesMembers(input.query)
+      });
+      const r = unwrap(page);
+      if ("response" in r)
+        return r.response;
+      return {
+        status: 200,
+        body: serializeGroupList(r.value.resources, r.value.totalResults, startIndex, input.baseUrl)
+      };
+    }
+    if (method === "POST") {
+      const parsed = parseGroupWrite(input.body);
+      if (!parsed.ok) {
+        return fail(parsed.error.status, parsed.error.detail, parsed.error.scimType);
+      }
+      const createdGroup = await groups.createGroup(input.tenant.id, parsed.value);
+      const r = unwrap(createdGroup);
+      if ("response" in r)
+        return r.response;
+      return created(serializeGroup(r.value, input.baseUrl));
+    }
+    return fail(405, `${method} is not allowed on /Groups`);
+  }
+  const m = /^\/Groups\/(.+)$/.exec(path);
+  if (!m)
+    return fail(404, `unknown SCIM endpoint "${path}"`);
+  let id;
+  try {
+    id = decodeURIComponent(m[1]);
+  } catch {
+    id = m[1];
+  }
+  switch (method) {
+    case "GET": {
+      const existing = await loadGroup(input, groups, id);
+      if ("response" in existing)
+        return existing.response;
+      return {
+        status: 200,
+        body: serializeGroup(existing.group, input.baseUrl)
+      };
+    }
+    case "PUT": {
+      const existing = await loadGroup(input, groups, id);
+      if ("response" in existing)
+        return existing.response;
+      const parsed = parseGroupWrite(input.body);
+      if (!parsed.ok) {
+        return fail(parsed.error.status, parsed.error.detail, parsed.error.scimType);
+      }
+      const replaced = await groups.replaceGroup(input.tenant.id, id, parsed.value);
+      const r = unwrap(replaced);
+      if ("response" in r)
+        return r.response;
+      return { status: 200, body: serializeGroup(r.value, input.baseUrl) };
+    }
+    case "PATCH": {
+      const existing = await loadGroup(input, groups, id);
+      if ("response" in existing)
+        return existing.response;
+      const normalized = normalizeGroupPatch(input.body);
+      if (!normalized.ok) {
+        return fail(normalized.error.status, normalized.error.detail, normalized.error.scimType);
+      }
+      const patched = await groups.patchGroup(input.tenant.id, id, normalized.value);
+      const r = unwrap(patched);
+      if ("response" in r)
+        return r.response;
+      return { status: 200, body: serializeGroup(r.value, input.baseUrl) };
+    }
+    case "DELETE": {
+      const existing = await loadGroup(input, groups, id);
+      if ("response" in existing)
+        return existing.response;
+      const deleted = await groups.deleteGroup(input.tenant.id, id);
+      const r = unwrap(deleted);
+      if ("response" in r)
+        return r.response;
+      return { status: 204, body: null };
+    }
+    default:
+      return fail(405, `${method} is not allowed on /Groups/{id}`);
+  }
+}
+async function handleScimRequest(input) {
+  const scim = input.tenant.config.scim;
+  const authFailure = await authenticate(scim, input.authorization);
+  if (authFailure)
+    return authFailure;
+  const maxPageSize = Math.min(scim?.maxPageSize ?? DEFAULT_PAGE_SIZE, PAGE_SIZE_CEILING);
+  const path = input.path === "" ? "/" : input.path;
+  const method = input.method.toUpperCase();
+  if (path === "/ServiceProviderConfig" || path === "/ResourceTypes" || path === "/Schemas") {
+    if (method !== "GET") {
+      return fail(405, `${method} is not allowed on ${path}`);
+    }
+    const groups = groupsSupported(input.directory);
+    const body = path === "/ServiceProviderConfig" ? serviceProviderConfig(input.baseUrl, maxPageSize) : path === "/ResourceTypes" ? resourceTypes(input.baseUrl, groups) : schemas(input.baseUrl, groups);
+    return { status: 200, body };
+  }
+  if (path === "/Users" || path === "/Users/") {
+    if (method === "GET")
+      return listUsers(input, maxPageSize);
+    if (method === "POST")
+      return createUser(input);
+    return fail(405, `${method} is not allowed on /Users`);
+  }
+  const id = userIdFrom(path);
+  if (id !== null) {
+    switch (method) {
+      case "GET": {
+        const existing = await loadUser(input, id);
+        if ("response" in existing)
+          return existing.response;
+        return {
+          status: 200,
+          body: serializeUser(existing.user, input.baseUrl)
+        };
+      }
+      case "PUT":
+        return replaceUser(input, id);
+      case "PATCH":
+        return patchUser(input, id);
+      case "DELETE":
+        return deleteUser(input, id);
+      default:
+        return fail(405, `${method} is not allowed on /Users/{id}`);
+    }
+  }
+  if (path.startsWith("/Groups")) {
+    if (!groupsSupported(input.directory)) {
+      return fail(501, "Group provisioning is not implemented by this Service Provider");
+    }
+    return handleGroups(input, input.directory, path, method, maxPageSize);
+  }
+  return fail(404, `unknown SCIM endpoint "${path}"`);
+}
+export {
+  SUPPORTED_FILTER_HELP,
+  handleScimRequest
+};