@_mustachio/openauth 0.11.0 → 0.13.0

package/dist/esm/domain/scim/resource.js

@@ -0,0 +1,256 @@
+// src/domain/scim/resource.ts
+import { err, ok } from "../../types/result";
+var SCIM_USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
+var SCIM_GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
+var SCIM_ENTERPRISE_SCHEMA = "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";
+var SCIM_LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
+var SCIM_ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
+var SCIM_PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
+function scimErrorBody(status, detail, scimType) {
+  return {
+    schemas: [SCIM_ERROR_SCHEMA],
+    status: String(status),
+    ...scimType !== undefined ? { scimType } : {},
+    detail
+  };
+}
+var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var asString = (v) => typeof v === "string" && v.length > 0 ? v : undefined;
+function parseName(v) {
+  if (!isRecord(v))
+    return;
+  const out = {};
+  for (const k of [
+    "formatted",
+    "familyName",
+    "givenName",
+    "middleName",
+    "honorificPrefix",
+    "honorificSuffix"
+  ]) {
+    const s = asString(v[k]);
+    if (s !== undefined)
+      out[k] = s;
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}
+function parseMultiValues(v) {
+  if (!Array.isArray(v))
+    return;
+  const out = [];
+  for (const entry of v) {
+    if (!isRecord(entry))
+      continue;
+    const value = asString(entry["value"]);
+    if (value === undefined)
+      continue;
+    const type = asString(entry["type"]);
+    const primary = entry["primary"];
+    out.push({
+      value,
+      ...type !== undefined ? { type } : {},
+      ...typeof primary === "boolean" ? { primary } : {}
+    });
+  }
+  return out.length > 0 ? out : undefined;
+}
+function parseEnterprise(v) {
+  if (!isRecord(v))
+    return;
+  const out = {};
+  for (const k of [
+    "employeeNumber",
+    "costCenter",
+    "organization",
+    "division",
+    "department"
+  ]) {
+    const s = asString(v[k]);
+    if (s !== undefined)
+      out[k] = s;
+  }
+  const mgr = v["manager"];
+  if (isRecord(mgr)) {
+    const value = asString(mgr["value"]);
+    const displayName = asString(mgr["displayName"]);
+    if (value !== undefined || displayName !== undefined) {
+      out.manager = {
+        ...value !== undefined ? { value } : {},
+        ...displayName !== undefined ? { displayName } : {}
+      };
+    }
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}
+function parseUserWrite(body) {
+  if (!isRecord(body)) {
+    return err({
+      status: 400,
+      scimType: "invalidSyntax",
+      detail: "request body must be a JSON object"
+    });
+  }
+  if (body["password"] !== undefined) {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail: "this Service Provider does not accept 'password' over SCIM; " + "credentials are managed by the authentication methods, not the " + "directory feed"
+    });
+  }
+  const userName = asString(body["userName"]);
+  if (userName === undefined) {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail: "userName is required and must be a non-empty string"
+    });
+  }
+  const activeRaw = body["active"];
+  if (activeRaw !== undefined && typeof activeRaw !== "boolean") {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail: "active must be a boolean"
+    });
+  }
+  const externalId = asString(body["externalId"]);
+  const displayName = asString(body["displayName"]);
+  const name = parseName(body["name"]);
+  const emails = parseMultiValues(body["emails"]);
+  const phoneNumbers = parseMultiValues(body["phoneNumbers"]);
+  const enterprise = parseEnterprise(body[SCIM_ENTERPRISE_SCHEMA]);
+  return ok({
+    userName,
+    active: activeRaw === undefined ? true : activeRaw,
+    ...externalId !== undefined ? { externalId } : {},
+    ...displayName !== undefined ? { displayName } : {},
+    ...name !== undefined ? { name } : {},
+    ...emails !== undefined ? { emails } : {},
+    ...phoneNumbers !== undefined ? { phoneNumbers } : {},
+    ...enterprise !== undefined ? { enterprise } : {}
+  });
+}
+var iso = (ms) => ms === undefined ? undefined : new Date(ms).toISOString();
+function serializeUser(user, baseUrl) {
+  const schemas = [SCIM_USER_SCHEMA];
+  if (user.enterprise !== undefined)
+    schemas.push(SCIM_ENTERPRISE_SCHEMA);
+  const created = iso(user.createdAt);
+  const lastModified = iso(user.updatedAt);
+  return {
+    schemas,
+    id: user.id,
+    ...user.externalId !== undefined ? { externalId: user.externalId } : {},
+    userName: user.userName,
+    ...user.name !== undefined ? { name: user.name } : {},
+    ...user.displayName !== undefined ? { displayName: user.displayName } : {},
+    ...user.emails !== undefined ? { emails: user.emails } : {},
+    ...user.phoneNumbers !== undefined ? { phoneNumbers: user.phoneNumbers } : {},
+    active: user.active,
+    ...user.enterprise !== undefined ? { [SCIM_ENTERPRISE_SCHEMA]: user.enterprise } : {},
+    meta: {
+      resourceType: "User",
+      ...created !== undefined ? { created } : {},
+      ...lastModified !== undefined ? { lastModified } : {},
+      location: `${baseUrl}/Users/${encodeURIComponent(user.id)}`
+    }
+  };
+}
+function serializeList(users, totalResults, startIndex, baseUrl) {
+  return {
+    schemas: [SCIM_LIST_SCHEMA],
+    totalResults,
+    startIndex,
+    itemsPerPage: users.length,
+    Resources: users.map((u) => serializeUser(u, baseUrl))
+  };
+}
+function parseMembers(v) {
+  const list = Array.isArray(v) ? v : isRecord(v) ? [v] : undefined;
+  if (list === undefined)
+    return;
+  const out = [];
+  for (const entry of list) {
+    if (!isRecord(entry))
+      continue;
+    const value = asString(entry["value"]);
+    if (value === undefined)
+      continue;
+    const display = asString(entry["display"]);
+    out.push({ value, ...display !== undefined ? { display } : {} });
+  }
+  return out;
+}
+function parseGroupWrite(body) {
+  if (!isRecord(body)) {
+    return err({
+      status: 400,
+      scimType: "invalidSyntax",
+      detail: "request body must be a JSON object"
+    });
+  }
+  const displayName = asString(body["displayName"]);
+  if (displayName === undefined) {
+    return err({
+      status: 400,
+      scimType: "invalidValue",
+      detail: "displayName is required and must be a non-empty string"
+    });
+  }
+  const externalId = asString(body["externalId"]);
+  const members = parseMembers(body["members"]);
+  return ok({
+    displayName,
+    ...externalId !== undefined ? { externalId } : {},
+    ...members !== undefined ? { members } : {}
+  });
+}
+function serializeGroup(group, baseUrl) {
+  const created = iso(group.createdAt);
+  const lastModified = iso(group.updatedAt);
+  return {
+    schemas: [SCIM_GROUP_SCHEMA],
+    id: group.id,
+    ...group.externalId !== undefined ? { externalId: group.externalId } : {},
+    displayName: group.displayName,
+    ...group.members !== undefined ? {
+      members: group.members.map((m) => ({
+        value: m.value,
+        ...m.display !== undefined ? { display: m.display } : {},
+        $ref: `${baseUrl}/Users/${encodeURIComponent(m.value)}`,
+        type: "User"
+      }))
+    } : {},
+    meta: {
+      resourceType: "Group",
+      ...created !== undefined ? { created } : {},
+      ...lastModified !== undefined ? { lastModified } : {},
+      location: `${baseUrl}/Groups/${encodeURIComponent(group.id)}`
+    }
+  };
+}
+function serializeGroupList(groups, totalResults, startIndex, baseUrl) {
+  return {
+    schemas: [SCIM_LIST_SCHEMA],
+    totalResults,
+    startIndex,
+    itemsPerPage: groups.length,
+    Resources: groups.map((g) => serializeGroup(g, baseUrl))
+  };
+}
+export {
+  SCIM_ENTERPRISE_SCHEMA,
+  SCIM_ERROR_SCHEMA,
+  SCIM_GROUP_SCHEMA,
+  SCIM_LIST_SCHEMA,
+  SCIM_PATCH_SCHEMA,
+  SCIM_USER_SCHEMA,
+  parseGroupWrite,
+  parseMembers,
+  parseUserWrite,
+  scimErrorBody,
+  serializeGroup,
+  serializeGroupList,
+  serializeList,
+  serializeUser
+};

package/dist/esm/domain/state-envelope.js

@@ -75,6 +75,6 @@ function isEnvelopeShape(value) {
   return typeof v.tenantId === "string" && typeof v.flowId === "string" && typeof v.nonce === "string" && typeof v.kid === "string";
 }
 export {
-  verifyStateEnvelope,
-  mintStateEnvelope
+  mintStateEnvelope,
+  verifyStateEnvelope
 };

package/dist/esm/domain/token.js

@@ -237,10 +237,10 @@ async function hashTokenForAudit(token) {
   return base64url.encode(await sha256(utf8.encode(token))).slice(0, 16);
 }
 export {
-  saveEncryptedCode,
-  mintTokens,
-  hashClientSecret,
-  exchangeCode,
+  DEFAULT_ACCESS_TTL_MS,
   DEFAULT_REFRESH_TTL_MS,
-  DEFAULT_ACCESS_TTL_MS
+  exchangeCode,
+  hashClientSecret,
+  mintTokens,
+  saveEncryptedCode
 };

package/dist/esm/error.js

@@ -61,13 +61,13 @@ class InvalidAuthorizationCodeError extends Error {
   }
 }
 export {
-  UnknownStateError,
-  UnauthorizedClientError,
-  OauthError,
-  MissingProviderError,
-  MissingParameterError,
-  InvalidSubjectError,
-  InvalidRefreshTokenError,
+  InvalidAccessTokenError,
   InvalidAuthorizationCodeError,
-  InvalidAccessTokenError
+  InvalidRefreshTokenError,
+  InvalidSubjectError,
+  MissingParameterError,
+  MissingProviderError,
+  OauthError,
+  UnauthorizedClientError,
+  UnknownStateError
 };

package/dist/esm/http/cookies.js

@@ -67,6 +67,22 @@ var STRIPPED_HEADERS = [
   "permissions-policy",
   "cache-control"
 ];
+function cacheControlHeader(cache) {
+  if (!cache)
+    return "no-store";
+  if ((cache.maxAge ?? -1) === 0)
+    return "no-store";
+  const parts = [];
+  if (cache.isPrivate)
+    parts.push("private");
+  if (cache.maxAge !== undefined)
+    parts.push(`max-age=${cache.maxAge}`);
+  if (cache.sMaxAge !== undefined)
+    parts.push(`s-maxage=${cache.sMaxAge}`);
+  if (cache.immutable)
+    parts.push("immutable");
+  return parts.length ? parts.join(", ") : "no-store";
+}
 function applyResponsePolicy(response, opts = {}) {
   const headers = new Headers(response.headers);
   const stripped = [];
@@ -92,7 +108,8 @@ function applyResponsePolicy(response, opts = {}) {
   });
 }
 export {
-  serializeSetCookie,
+  applyResponsePolicy,
+  cacheControlHeader,
   parseCookieHeader,
-  applyResponsePolicy
+  serializeSetCookie
 };

package/dist/esm/http/errors.js

@@ -63,9 +63,9 @@ function isNonRecoverable(error) {
   return false;
 }
 export {
-  tokenEndpointErrorResponse,
-  publicErrorCode,
-  isNonRecoverable,
+  authorizeDirectErrorResponse,
   authorizeRedirectErrorResponse,
-  authorizeDirectErrorResponse
+  isNonRecoverable,
+  publicErrorCode,
+  tokenEndpointErrorResponse
 };

package/dist/esm/http/handlers/authorize.js

@@ -4,7 +4,7 @@ import { startAuthorize } from "../../domain/authorize";
 import { asTenantId } from "../../types/tenant";
 import { authError } from "../../types/error";
 import { renderPicker as renderDefaultPicker } from "../../ui/picker";
-import { applyResponsePolicy } from "../cookies";
+import { applyResponsePolicy, cacheControlHeader } from "../cookies";
 import {
   authorizeDirectErrorResponse,
   authorizeRedirectErrorResponse,
@@ -48,7 +48,7 @@ function makeAuthorizeHandler(deps) {
     }
     const q = parsed.data;
     if (raw.request_uri === undefined) {
-      const client = tenant.config.clients.find((c2) => c2.id === q.client_id);
+      const client = tenant.config.clients.find((c) => c.id === q.client_id);
       if (client?.requirePushedAuthorizationRequests) {
         return authorizeDirectErrorResponse(authError.invalidRequest("this client requires Pushed Authorization Requests (RFC 9126)", "request_uri"));
       }
@@ -123,7 +123,7 @@ function makeAuthorizeHandler(deps) {
         return applyResponsePolicy(out.response, {
           setCookies: [flowCookie, ...out.setCookies],
           cookieDefaults: deps.cookieDefaults,
-          cacheControl: cacheControlFor(out.cache)
+          cacheControl: cacheControlHeader(out.cache)
         });
       }
       case "issue-code": {
@@ -229,22 +229,6 @@ function clearFlowCookie() {
     maxAge: 0
   };
 }
-function cacheControlFor(cache) {
-  if (!cache)
-    return "no-store";
-  if ((cache.maxAge ?? -1) === 0)
-    return "no-store";
-  const parts = [];
-  if (cache.isPrivate)
-    parts.push("private");
-  if (cache.maxAge !== undefined)
-    parts.push(`max-age=${cache.maxAge}`);
-  if (cache.sMaxAge !== undefined)
-    parts.push(`s-maxage=${cache.sMaxAge}`);
-  if (cache.immutable)
-    parts.push("immutable");
-  return parts.length ? parts.join(", ") : "no-store";
-}
 export {
   makeAuthorizeHandler
 };

package/dist/esm/http/handlers/callback.js

@@ -5,7 +5,13 @@ import { applyResponsePolicy } from "../cookies";
 import { authorizeDirectErrorResponse } from "../errors";
 function makeCallbackHandler(deps) {
   return async (c) => {
-    const result = await handleCallback({ rawRequest: c.req.raw, cookies: c.get("cookies") }, {
+    const tenant = c.get("tenant");
+    const result = await handleCallback({
+      rawRequest: c.req.raw,
+      cookies: c.get("cookies"),
+      ...tenant ? { tenant } : {},
+      issuerUrl: c.get("issuerUrl")
+    }, {
       configStore: deps.configStore,
       sessionStore: deps.sessionStore,
       tokenStore: deps.tokenStore,

package/dist/esm/http/handlers/metadata.js

@@ -32,6 +32,6 @@ function makeJwksHandler(deps) {
   };
 }
 export {
-  makeJwksHandler,
-  makeDiscoveryHandler
+  makeDiscoveryHandler,
+  makeJwksHandler
 };

package/dist/esm/http/handlers/method-route.js

@@ -1,8 +1,11 @@
 // src/http/handlers/method-route.ts
-import { handleMethodRoute } from "../../domain/method-route";
+import {
+  handleMethodRoute,
+  handlePublicMethodRoute
+} from "../../domain/method-route";
 import { authError } from "../../types/error";
 import { isErr } from "../../types/result";
-import { applyResponsePolicy } from "../cookies";
+import { applyResponsePolicy, cacheControlHeader } from "../cookies";
 import { authorizeDirectErrorResponse } from "../errors";
 function makeMethodRouteHandler(deps) {
   return async (c) => {
@@ -10,6 +13,48 @@ function makeMethodRouteHandler(deps) {
     if (!tenant) {
       return authorizeDirectErrorResponse(authError.invalidRequest("tenant unresolved"));
     }
+    {
+      const u = new URL(c.req.url);
+      const segs = u.pathname.split("/").filter(Boolean);
+      if (segs.length >= 3 && segs[0] === "m") {
+        const methodId = segs[1];
+        const subPath = "/" + segs.slice(2).join("/");
+        const httpMethod = c.req.method.toUpperCase() === "POST" ? "POST" : "GET";
+        const routeKey = `${httpMethod} ${subPath}`;
+        const resolved = await deps.methodCache.resolve(tenant.config, methodId);
+        if (!isErr(resolved) && resolved.value.publicRoutes?.includes(routeKey)) {
+          const issuerUrl = c.get("issuerUrl");
+          const callbackHost = deps.callbackHostFor?.(tenant.id) ?? new URL(issuerUrl).host;
+          const callbackUrl = `${new URL(issuerUrl).protocol}//${callbackHost}/cb/${methodId}`;
+          const pub = await handlePublicMethodRoute({
+            rawRequest: c.req.raw,
+            tenant,
+            method: resolved.value,
+            route: routeKey,
+            subPath,
+            dispatch: { state: "", callbackUrl, issuerUrl }
+          }, {
+            sessionStore: deps.sessionStore,
+            tokenStore: deps.tokenStore,
+            clock: deps.clock,
+            ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+            ...deps.onLogout ? { onLogout: deps.onLogout } : {}
+          });
+          if (isErr(pub))
+            return authorizeDirectErrorResponse(pub.error);
+          if (pub.value.kind === "denied") {
+            return applyResponsePolicy(new Response(`access_denied: ${pub.value.reason}`, {
+              status: 403,
+              headers: { "content-type": "text/plain" }
+            }), { cookieDefaults: deps.cookieDefaults });
+          }
+          return applyResponsePolicy(pub.value.response, {
+            cacheControl: cacheControlHeader(pub.value.cache),
+            cookieDefaults: deps.cookieDefaults
+          });
+        }
+      }
+    }
     const cookies = c.get("cookies");
     const flowId = cookies.get("idp.flow");
     if (!flowId) {

package/dist/esm/http/handlers/revocation.js

@@ -93,6 +93,6 @@ async function readForm(req) {
   return new URLSearchParams(await req.text());
 }
 export {
-  makeRevokeHandler,
-  makeIntrospectHandler
+  makeIntrospectHandler,
+  makeRevokeHandler
 };

package/dist/esm/http/handlers/scim.js

@@ -0,0 +1,59 @@
+// src/http/handlers/scim.ts
+import { handleScimRequest } from "../../domain/scim/handle";
+import { scimErrorBody } from "../../domain/scim/resource";
+var SCIM_CONTENT_TYPE = "application/scim+json;charset=utf-8";
+var MOUNT = "/scim/v2";
+function scimResponse(status, body, extra = {}) {
+  if (body === null || status === 204) {
+    return new Response(null, { status, headers: extra });
+  }
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": SCIM_CONTENT_TYPE,
+      "cache-control": "no-store",
+      ...extra
+    }
+  });
+}
+function makeScimHandler(deps) {
+  return async (c) => {
+    if (!deps.scimDirectory) {
+      return scimResponse(501, scimErrorBody(501, "SCIM is not configured on this deployment (no scimDirectory " + "was supplied to createIdP)"));
+    }
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return scimResponse(403, scimErrorBody(403, "SCIM provisioning is not enabled for this tenant"));
+    }
+    const url = new URL(c.req.url);
+    const path = url.pathname.startsWith(MOUNT) ? url.pathname.slice(MOUNT.length) : url.pathname;
+    const method = c.req.method.toUpperCase();
+    let body = null;
+    if (method === "POST" || method === "PUT" || method === "PATCH") {
+      const raw = await c.req.raw.text();
+      if (raw.length > 0) {
+        try {
+          body = JSON.parse(raw);
+        } catch {
+          return scimResponse(400, scimErrorBody(400, "request body is not valid JSON", "invalidSyntax"));
+        }
+      }
+    }
+    const issuer = c.get("issuerUrl");
+    const base = issuer.endsWith("/") ? issuer.slice(0, -1) : issuer;
+    const result = await handleScimRequest({
+      tenant,
+      method,
+      path,
+      query: url.searchParams,
+      body,
+      authorization: c.req.header("authorization") ?? null,
+      baseUrl: `${base}${MOUNT}`,
+      directory: deps.scimDirectory
+    });
+    return scimResponse(result.status, result.body, result.headers ?? {});
+  };
+}
+export {
+  makeScimHandler
+};

package/dist/esm/http/middleware/tenant.js

@@ -7,6 +7,25 @@ import {
   tokenEndpointErrorResponse
 } from "../errors";
 import { authError } from "../../types/error";
+function isScimPath(pathname) {
+  return pathname === "/scim/v2" || pathname.startsWith("/scim/v2/");
+}
+function scimTenantErrorResponse(error) {
+  const operational = error.code === "server_error" || error.code === "internal_error";
+  const status = operational ? 500 : 403;
+  const detail = operational ? "the configuration store backing this endpoint failed the request" : "SCIM provisioning is not enabled for this tenant";
+  return new Response(JSON.stringify({
+    schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
+    status: String(status),
+    detail
+  }), {
+    status,
+    headers: {
+      "content-type": "application/scim+json;charset=utf-8",
+      "cache-control": "no-store"
+    }
+  });
+}
 function isCallbackPath(pathname) {
   return pathname.startsWith("/cb/");
 }
@@ -27,12 +46,12 @@ function tenantMiddleware(deps) {
       const recovery = await runCallbackRecovery(c.req.raw, deps);
       c.set("recovery", recovery);
       if (recovery.kind !== "fresh-request") {
-        const cfg2 = await deps.configStore.getTenantConfig(recovery.tenantId);
-        if (isErr(cfg2)) {
-          return tokenEndpointErrorResponse(cfg2.error);
+        const cfg = await deps.configStore.getTenantConfig(recovery.tenantId);
+        if (isErr(cfg)) {
+          return tokenEndpointErrorResponse(cfg.error);
         }
         const customCb = deps.buildCustomContext ? await deps.buildCustomContext(c.req.raw) : {};
-        c.set("tenant", buildTenantContext(c.req.raw, recovery.tenantId, cfg2.value, customCb));
+        c.set("tenant", buildTenantContext(c.req.raw, recovery.tenantId, cfg.value, customCb));
         return next();
       }
     }
@@ -41,6 +60,9 @@ function tenantMiddleware(deps) {
       if (url.pathname === "/authorize") {
         return authorizeDirectErrorResponse(resolved.error);
       }
+      if (isScimPath(url.pathname)) {
+        return scimTenantErrorResponse(resolved.error);
+      }
       return tokenEndpointErrorResponse(resolved.error);
     }
     const tenantId = resolved.value;
@@ -50,6 +72,9 @@ function tenantMiddleware(deps) {
       if (url.pathname === "/authorize") {
         return authorizeDirectErrorResponse(err);
       }
+      if (isScimPath(url.pathname)) {
+        return scimTenantErrorResponse(cfg.error);
+      }
       return tokenEndpointErrorResponse(err);
     }
     const custom = deps.buildCustomContext ? await deps.buildCustomContext(c.req.raw) : {};
@@ -97,6 +122,6 @@ async function extractStateParam(req) {
   }
 }
 export {
-  tenantMiddleware,
-  bootstrapMiddleware
+  bootstrapMiddleware,
+  tenantMiddleware
 };

package/dist/esm/http/router.js

@@ -7,6 +7,7 @@ import { makeDiscoveryHandler, makeJwksHandler } from "./handlers/metadata";
 import { makeMethodRouteHandler } from "./handlers/method-route";
 import { makeParHandler } from "./handlers/par";
 import { makeRegisterHandler } from "./handlers/register";
+import { makeScimHandler } from "./handlers/scim";
 import { makeIntrospectHandler, makeRevokeHandler } from "./handlers/revocation";
 import { makeTokenHandler } from "./handlers/token";
 import { makeUserinfoHandler } from "./handlers/userinfo";
@@ -34,6 +35,8 @@ function buildRouter(deps) {
   app.use("/end_session", tenantMiddleware(deps));
   app.get("/end_session", makeEndSessionHandler(deps));
   app.post("/end_session", makeEndSessionHandler(deps));
+  app.use("/scim/v2/*", tenantMiddleware(deps));
+  app.all("/scim/v2/*", makeScimHandler(deps));
   app.use("/par", tenantMiddleware(deps));
   app.post("/par", makeParHandler(deps));
   app.use("/register", tenantMiddleware(deps));

package/dist/esm/http/schemas/authorize.js

@@ -25,6 +25,6 @@ var authorizeRequestUriQuerySchema = z.object({
   request_uri: z.string({ required_error: "missing request_uri" }).min(1)
 }).passthrough();
 export {
-  authorizeRequestUriQuerySchema,
-  authorizeQuerySchema
+  authorizeQuerySchema,
+  authorizeRequestUriQuerySchema
 };

package/dist/esm/http/schemas/revocation.js

@@ -13,6 +13,6 @@ var introspectBodySchema = z.object({
   client_secret: z.string().optional()
 });
 export {
-  revokeBodySchema,
-  introspectBodySchema
+  introspectBodySchema,
+  revokeBodySchema
 };