@_mustachio/openauth 0.11.0 → 0.13.0

package/dist/esm/domain/scim/patch.js

@@ -0,0 +1,568 @@
+// src/domain/scim/patch.ts
+import { err, ok } from "../../types/result";
+import {
+  parseMembers,
+  SCIM_ENTERPRISE_SCHEMA,
+  SCIM_PATCH_SCHEMA
+} from "./resource";
+var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function coerceBoolean(v) {
+  if (typeof v === "boolean")
+    return v;
+  if (typeof v === "string") {
+    const lowered = v.toLowerCase();
+    if (lowered === "true")
+      return true;
+    if (lowered === "false")
+      return false;
+  }
+  return;
+}
+var asString = (v) => typeof v === "string" ? v : undefined;
+function stripEnterprisePrefix(path) {
+  if (path.toLowerCase() === SCIM_ENTERPRISE_SCHEMA.toLowerCase()) {
+    return { path: "", enterprise: true };
+  }
+  const prefix = `${SCIM_ENTERPRISE_SCHEMA}:`;
+  if (path.toLowerCase().startsWith(prefix.toLowerCase())) {
+    return { path: path.slice(prefix.length), enterprise: true };
+  }
+  const corePrefix = "urn:ietf:params:scim:schemas:core:2.0:user:";
+  if (path.toLowerCase().startsWith(corePrefix)) {
+    return { path: path.slice(corePrefix.length), enterprise: false };
+  }
+  return { path, enterprise: false };
+}
+function parseMultiValuedPath(path) {
+  const m = /^([A-Za-z]+)\[\s*type\s+eq\s+"([^"]+)"\s*\]\.([A-Za-z]+)$/i.exec(path.trim());
+  if (!m)
+    return null;
+  return {
+    attribute: m[1].toLowerCase(),
+    type: m[2],
+    sub: m[3].toLowerCase()
+  };
+}
+function upsertByType(current, type, value) {
+  const list = [...current ?? []];
+  const byType = list.findIndex((e) => (e.type ?? "").toLowerCase() === type.toLowerCase());
+  if (byType >= 0) {
+    list[byType] = { ...list[byType], value };
+    return list;
+  }
+  const untyped = list.filter((e) => e.type === undefined);
+  if (untyped.length === 1) {
+    const idx = list.indexOf(untyped[0]);
+    list[idx] = { ...list[idx], value, type };
+    return list;
+  }
+  list.push({ value, type });
+  return list;
+}
+var NAME_SUBS = new Set([
+  "formatted",
+  "familyname",
+  "givenname",
+  "middlename",
+  "honorificprefix",
+  "honorificsuffix"
+]);
+var NAME_CANONICAL = {
+  formatted: "formatted",
+  familyname: "familyName",
+  givenname: "givenName",
+  middlename: "middleName",
+  honorificprefix: "honorificPrefix",
+  honorificsuffix: "honorificSuffix"
+};
+var ENTERPRISE_SUBS = {
+  employeenumber: "employeeNumber",
+  costcenter: "costCenter",
+  organization: "organization",
+  division: "division",
+  department: "department"
+};
+function invalidPath(detail) {
+  return { status: 400, scimType: "invalidPath", detail };
+}
+var SKIP = null;
+function applyOperation(draft, op, rawPath, value) {
+  const operation = op.toLowerCase();
+  if (operation !== "add" && operation !== "replace" && operation !== "remove") {
+    return invalidPath(`unsupported PATCH op "${op}"`);
+  }
+  if (rawPath === undefined || rawPath.trim().length === 0) {
+    if (operation === "remove") {
+      return invalidPath('"remove" requires a path');
+    }
+    if (!isRecord(value)) {
+      return invalidPath("a PATCH operation without a path must carry an object value");
+    }
+    for (const [k, v] of Object.entries(value)) {
+      const nested = applyOperation(draft, operation, k, v);
+      if (nested)
+        return nested;
+    }
+    return null;
+  }
+  const { path: stripped, enterprise } = stripEnterprisePrefix(rawPath.trim());
+  const removing = operation === "remove";
+  const mv = parseMultiValuedPath(stripped);
+  if (mv) {
+    if (mv.attribute !== "emails" && mv.attribute !== "phonenumbers") {
+      return SKIP;
+    }
+    if (mv.sub !== "value") {
+      return invalidPath(`only the ".value" sub-attribute of a multi-valued path is ` + `supported, got ".${mv.sub}"`);
+    }
+    const key = mv.attribute === "emails" ? "emails" : "phoneNumbers";
+    const current = mv.attribute === "emails" ? draft.emails : draft.phoneNumbers;
+    if (removing) {
+      const filtered = (current ?? []).filter((e) => (e.type ?? "").toLowerCase() !== mv.type.toLowerCase());
+      if (key === "emails")
+        draft.emails = filtered;
+      else
+        draft.phoneNumbers = filtered;
+      draft.patch[key] = filtered.length > 0 ? filtered : null;
+      return null;
+    }
+    const v = asString(value);
+    if (v === undefined) {
+      return {
+        status: 400,
+        scimType: "invalidValue",
+        detail: `value for "${rawPath}" must be a string`
+      };
+    }
+    const next = upsertByType(current, mv.type, v);
+    if (key === "emails")
+      draft.emails = next;
+    else
+      draft.phoneNumbers = next;
+    draft.patch[key] = next;
+    return null;
+  }
+  if (stripped.includes("[")) {
+    return invalidPath(`unsupported multi-valued path "${rawPath}"; only ` + `<attr>[type eq "…"].value is supported`);
+  }
+  const segments = stripped.split(".");
+  const head = (segments[0] ?? "").toLowerCase();
+  const sub = segments[1]?.toLowerCase();
+  if (segments.length > 2) {
+    return invalidPath(`path "${rawPath}" is too deeply nested`);
+  }
+  if (enterprise) {
+    if (stripped === "") {
+      if (removing) {
+        draft.enterprise = undefined;
+        draft.patch.enterprise = null;
+        return null;
+      }
+      if (!isRecord(value)) {
+        return {
+          status: 400,
+          scimType: "invalidValue",
+          detail: "the enterprise extension requires an object value"
+        };
+      }
+      for (const [k, v] of Object.entries(value)) {
+        const nested = applyOperation(draft, operation, `${SCIM_ENTERPRISE_SCHEMA}:${k}`, v);
+        if (nested)
+          return nested;
+      }
+      return null;
+    }
+    const canonical = ENTERPRISE_SUBS[head];
+    if (head === "manager") {
+      const current = { ...draft.enterprise ?? {} };
+      if (removing)
+        delete current["manager"];
+      else {
+        const v = isRecord(value) ? {
+          value: asString(value["value"]),
+          displayName: asString(value["displayName"])
+        } : { value: asString(value) };
+        current["manager"] = v;
+      }
+      draft.enterprise = current;
+      draft.patch.enterprise = current;
+      return null;
+    }
+    if (!canonical) {
+      return SKIP;
+    }
+    const current = { ...draft.enterprise ?? {} };
+    if (removing)
+      delete current[canonical];
+    else {
+      const v = asString(value);
+      if (v === undefined) {
+        return {
+          status: 400,
+          scimType: "invalidValue",
+          detail: `value for "${rawPath}" must be a string`
+        };
+      }
+      current[canonical] = v;
+    }
+    draft.enterprise = current;
+    draft.patch.enterprise = current;
+    return null;
+  }
+  if (head === "name") {
+    if (sub === undefined) {
+      if (removing) {
+        draft.name = undefined;
+        draft.patch.name = null;
+        return null;
+      }
+      if (!isRecord(value)) {
+        return invalidPath('"name" requires an object value');
+      }
+      const merged = operation === "add" ? { ...draft.name ?? {} } : {};
+      for (const [k, v] of Object.entries(value)) {
+        const canonical = NAME_CANONICAL[k.toLowerCase()];
+        const s = asString(v);
+        if (canonical && s !== undefined)
+          merged[canonical] = s;
+      }
+      draft.name = merged;
+      draft.patch.name = Object.keys(merged).length > 0 ? merged : null;
+      return null;
+    }
+    if (!NAME_SUBS.has(sub)) {
+      return invalidPath(`name sub-attribute "${sub}" is not supported`);
+    }
+    const canonical = NAME_CANONICAL[sub];
+    const merged = { ...draft.name ?? {} };
+    if (removing)
+      delete merged[canonical];
+    else {
+      const s = asString(value);
+      if (s === undefined) {
+        return {
+          status: 400,
+          scimType: "invalidValue",
+          detail: `value for "${rawPath}" must be a string`
+        };
+      }
+      merged[canonical] = s;
+    }
+    draft.name = merged;
+    draft.patch.name = Object.keys(merged).length > 0 ? merged : null;
+    return null;
+  }
+  if (sub !== undefined) {
+    return SKIP;
+  }
+  switch (head) {
+    case "active": {
+      if (removing) {
+        return invalidPath('"active" cannot be removed; set it to false');
+      }
+      const b = coerceBoolean(value);
+      if (b === undefined) {
+        return {
+          status: 400,
+          scimType: "invalidValue",
+          detail: `"active" must be a boolean, got ${JSON.stringify(value)}`
+        };
+      }
+      draft.patch.active = b;
+      return null;
+    }
+    case "username": {
+      if (removing) {
+        return invalidPath('"userName" cannot be removed');
+      }
+      const s = asString(value);
+      if (s === undefined || s.length === 0) {
+        return {
+          status: 400,
+          scimType: "invalidValue",
+          detail: '"userName" must be a non-empty string'
+        };
+      }
+      draft.patch.userName = s;
+      return null;
+    }
+    case "externalid": {
+      draft.patch.externalId = removing ? null : asString(value) ?? null;
+      return null;
+    }
+    case "displayname": {
+      draft.patch.displayName = removing ? null : asString(value) ?? null;
+      return null;
+    }
+    case "emails":
+    case "phonenumbers": {
+      const key = head === "emails" ? "emails" : "phoneNumbers";
+      if (removing) {
+        if (key === "emails")
+          draft.emails = undefined;
+        else
+          draft.phoneNumbers = undefined;
+        draft.patch[key] = null;
+        return null;
+      }
+      if (!Array.isArray(value)) {
+        return {
+          status: 400,
+          scimType: "invalidValue",
+          detail: `"${head}" must be an array`
+        };
+      }
+      const list = [];
+      for (const entry of value) {
+        if (!isRecord(entry))
+          continue;
+        const v = asString(entry["value"]);
+        if (v === undefined)
+          continue;
+        const type = asString(entry["type"]);
+        const primary = entry["primary"];
+        list.push({
+          value: v,
+          ...type !== undefined ? { type } : {},
+          ...typeof primary === "boolean" ? { primary } : {}
+        });
+      }
+      if (key === "emails")
+        draft.emails = list;
+      else
+        draft.phoneNumbers = list;
+      draft.patch[key] = list.length > 0 ? list : null;
+      return null;
+    }
+    default:
+      return SKIP;
+  }
+}
+function normalizePatch(body, current) {
+  if (!isRecord(body)) {
+    return err({
+      status: 400,
+      scimType: "invalidSyntax",
+      detail: "request body must be a JSON object"
+    });
+  }
+  const schemas = body["schemas"];
+  if (Array.isArray(schemas) && !schemas.some((s) => typeof s === "string" && s.toLowerCase() === SCIM_PATCH_SCHEMA.toLowerCase())) {
+    return err({
+      status: 400,
+      scimType: "invalidSyntax",
+      detail: `PATCH body must declare the ${SCIM_PATCH_SCHEMA} schema`
+    });
+  }
+  const rawOps = body["Operations"] ?? body["operations"];
+  if (!Array.isArray(rawOps) || rawOps.length === 0) {
+    return err({
+      status: 400,
+      scimType: "invalidSyntax",
+      detail: "PATCH body must carry a non-empty Operations array"
+    });
+  }
+  const draft = {
+    patch: {},
+    emails: current.emails ? [...current.emails] : undefined,
+    phoneNumbers: current.phoneNumbers ? [...current.phoneNumbers] : undefined,
+    name: current.name ? { ...current.name } : undefined,
+    enterprise: current.enterprise ? { ...current.enterprise } : undefined
+  };
+  for (const raw of rawOps) {
+    if (!isRecord(raw)) {
+      return err({
+        status: 400,
+        scimType: "invalidSyntax",
+        detail: "each PATCH operation must be an object"
+      });
+    }
+    const op = asString(raw["op"]);
+    if (op === undefined) {
+      return err({
+        status: 400,
+        scimType: "invalidSyntax",
+        detail: "each PATCH operation must carry an op"
+      });
+    }
+    const failure = applyOperation(draft, op, asString(raw["path"]), raw["value"]);
+    if (failure)
+      return err(failure);
+  }
+  if (Object.keys(draft.patch).length === 0) {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail: "PATCH resolved to no changes"
+    });
+  }
+  return ok(draft.patch);
+}
+function parseMemberFilterPath(path) {
+  const m = /^members\[\s*value\s+eq\s+"([^"]+)"\s*\]$/i.exec(path.trim());
+  return m ? m[1] : null;
+}
+function normalizeGroupPatch(body) {
+  if (!isRecord(body)) {
+    return err({
+      status: 400,
+      scimType: "invalidSyntax",
+      detail: "request body must be a JSON object"
+    });
+  }
+  const schemas = body["schemas"];
+  if (Array.isArray(schemas) && !schemas.some((s) => typeof s === "string" && s.toLowerCase() === SCIM_PATCH_SCHEMA.toLowerCase())) {
+    return err({
+      status: 400,
+      scimType: "invalidSyntax",
+      detail: `PATCH body must declare the ${SCIM_PATCH_SCHEMA} schema`
+    });
+  }
+  const rawOps = body["Operations"] ?? body["operations"];
+  if (!Array.isArray(rawOps) || rawOps.length === 0) {
+    return err({
+      status: 400,
+      scimType: "invalidSyntax",
+      detail: "PATCH body must carry a non-empty Operations array"
+    });
+  }
+  const patch = {};
+  const added = [];
+  const removed = [];
+  let replacement = null;
+  const applyAdd = (members) => {
+    if (replacement !== null) {
+      for (const m of members) {
+        if (!replacement.some((e) => e.value === m.value))
+          replacement.push(m);
+      }
+      return;
+    }
+    for (const m of members) {
+      if (!added.some((e) => e.value === m.value))
+        added.push(m);
+    }
+  };
+  const applyRemove = (ids) => {
+    if (replacement !== null) {
+      replacement = replacement.filter((e) => !ids.includes(e.value));
+      return;
+    }
+    for (const id of ids)
+      if (!removed.includes(id))
+        removed.push(id);
+  };
+  const handle = (op, rawPath, value) => {
+    const operation = op.toLowerCase();
+    if (operation !== "add" && operation !== "replace" && operation !== "remove") {
+      return invalidPath(`unsupported PATCH op "${op}"`);
+    }
+    if (rawPath === undefined || rawPath.trim().length === 0) {
+      if (!isRecord(value)) {
+        return invalidPath("a PATCH operation without a path must carry an object value");
+      }
+      for (const [k, v] of Object.entries(value)) {
+        const nested = handle(operation, k, v);
+        if (nested)
+          return nested;
+      }
+      return null;
+    }
+    const path = rawPath.trim();
+    const targeted = parseMemberFilterPath(path);
+    if (targeted !== null) {
+      if (operation !== "remove") {
+        return invalidPath(`only "remove" is supported with a members[value eq …] path`);
+      }
+      applyRemove([targeted]);
+      return null;
+    }
+    if (path.toLowerCase() === "members") {
+      if (operation === "remove" && value === undefined) {
+        replacement = [];
+        return null;
+      }
+      const members = parseMembers(value);
+      if (members === undefined) {
+        return {
+          status: 400,
+          scimType: "invalidValue",
+          detail: '"members" must be an array of {value} entries'
+        };
+      }
+      if (operation === "add")
+        applyAdd(members);
+      else if (operation === "remove")
+        applyRemove(members.map((m) => m.value));
+      else
+        replacement = [...members];
+      return null;
+    }
+    if (path.includes("[")) {
+      return invalidPath(`unsupported path "${rawPath}"; only members[value eq "…"] is ` + `supported for targeted membership changes`);
+    }
+    switch (path.toLowerCase()) {
+      case "displayname": {
+        if (operation === "remove") {
+          return invalidPath('"displayName" cannot be removed');
+        }
+        const s = asString(value);
+        if (s === undefined || s.length === 0) {
+          return {
+            status: 400,
+            scimType: "invalidValue",
+            detail: '"displayName" must be a non-empty string'
+          };
+        }
+        patch.displayName = s;
+        return null;
+      }
+      case "externalid": {
+        patch.externalId = operation === "remove" ? null : asString(value) ?? null;
+        return null;
+      }
+      default:
+        return invalidPath(`attribute "${rawPath}" is not patchable on a Group`);
+    }
+  };
+  for (const raw of rawOps) {
+    if (!isRecord(raw)) {
+      return err({
+        status: 400,
+        scimType: "invalidSyntax",
+        detail: "each PATCH operation must be an object"
+      });
+    }
+    const op = asString(raw["op"]);
+    if (op === undefined) {
+      return err({
+        status: 400,
+        scimType: "invalidSyntax",
+        detail: "each PATCH operation must carry an op"
+      });
+    }
+    const failure = handle(op, asString(raw["path"]), raw["value"]);
+    if (failure)
+      return err(failure);
+  }
+  if (replacement !== null)
+    patch.members = replacement;
+  else {
+    if (added.length > 0)
+      patch.addMembers = added;
+    if (removed.length > 0)
+      patch.removeMembers = removed;
+  }
+  if (Object.keys(patch).length === 0) {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail: "PATCH resolved to no changes"
+    });
+  }
+  return ok(patch);
+}
+export {
+  normalizeGroupPatch,
+  normalizePatch
+};