@_mustachio/openauth 0.12.0 → 0.13.0

package/dist/esm/domain/scim/discovery.js

@@ -0,0 +1,206 @@
+// src/domain/scim/discovery.ts
+import {
+  SCIM_ENTERPRISE_SCHEMA,
+  SCIM_GROUP_SCHEMA,
+  SCIM_LIST_SCHEMA,
+  SCIM_USER_SCHEMA
+} from "./resource";
+function serviceProviderConfig(baseUrl, maxResults) {
+  return {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],
+    documentationUri: "https://datatracker.ietf.org/doc/html/rfc7644",
+    patch: { supported: true },
+    bulk: { supported: false, maxOperations: 0, maxPayloadSize: 0 },
+    filter: { supported: true, maxResults },
+    changePassword: { supported: false },
+    sort: { supported: false },
+    etag: { supported: false },
+    authenticationSchemes: [
+      {
+        type: "oauthbearertoken",
+        name: "OAuth Bearer Token",
+        description: "Authentication via the bearer token issued for this SCIM connection",
+        specUri: "https://datatracker.ietf.org/doc/html/rfc6750",
+        primary: true
+      }
+    ],
+    meta: {
+      resourceType: "ServiceProviderConfig",
+      location: `${baseUrl}/ServiceProviderConfig`
+    }
+  };
+}
+function resourceTypes(baseUrl, groups) {
+  const user = {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
+    id: "User",
+    name: "User",
+    endpoint: "/Users",
+    description: "User Account",
+    schema: SCIM_USER_SCHEMA,
+    schemaExtensions: [{ schema: SCIM_ENTERPRISE_SCHEMA, required: false }],
+    meta: {
+      resourceType: "ResourceType",
+      location: `${baseUrl}/ResourceTypes/User`
+    }
+  };
+  const group = {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
+    id: "Group",
+    name: "Group",
+    endpoint: "/Groups",
+    description: "Group",
+    schema: SCIM_GROUP_SCHEMA,
+    meta: {
+      resourceType: "ResourceType",
+      location: `${baseUrl}/ResourceTypes/Group`
+    }
+  };
+  const resources = groups ? [user, group] : [user];
+  return {
+    schemas: [SCIM_LIST_SCHEMA],
+    totalResults: resources.length,
+    startIndex: 1,
+    itemsPerPage: resources.length,
+    Resources: resources
+  };
+}
+var str = (name, extra = {}) => ({
+  name,
+  type: "string",
+  multiValued: false,
+  required: false,
+  caseExact: false,
+  mutability: "readWrite",
+  returned: "default",
+  uniqueness: "none",
+  ...extra
+});
+var multiValueSub = [
+  str("value"),
+  str("type"),
+  {
+    name: "primary",
+    type: "boolean",
+    multiValued: false,
+    required: false,
+    mutability: "readWrite",
+    returned: "default"
+  }
+];
+function schemas(baseUrl, groups) {
+  const userSchema = {
+    id: SCIM_USER_SCHEMA,
+    name: "User",
+    description: "User Account",
+    attributes: [
+      str("userName", { required: true, uniqueness: "server" }),
+      {
+        name: "name",
+        type: "complex",
+        multiValued: false,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: [
+          str("formatted"),
+          str("familyName"),
+          str("givenName"),
+          str("middleName"),
+          str("honorificPrefix"),
+          str("honorificSuffix")
+        ]
+      },
+      str("displayName"),
+      {
+        name: "active",
+        type: "boolean",
+        multiValued: false,
+        required: false,
+        mutability: "readWrite",
+        returned: "default"
+      },
+      {
+        name: "emails",
+        type: "complex",
+        multiValued: true,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: multiValueSub
+      },
+      {
+        name: "phoneNumbers",
+        type: "complex",
+        multiValued: true,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: multiValueSub
+      }
+    ],
+    meta: {
+      resourceType: "Schema",
+      location: `${baseUrl}/Schemas/${SCIM_USER_SCHEMA}`
+    }
+  };
+  const enterpriseSchema = {
+    id: SCIM_ENTERPRISE_SCHEMA,
+    name: "EnterpriseUser",
+    description: "Enterprise User Extension",
+    attributes: [
+      str("employeeNumber"),
+      str("costCenter"),
+      str("organization"),
+      str("division"),
+      str("department"),
+      {
+        name: "manager",
+        type: "complex",
+        multiValued: false,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: [str("value"), str("displayName")]
+      }
+    ],
+    meta: {
+      resourceType: "Schema",
+      location: `${baseUrl}/Schemas/${SCIM_ENTERPRISE_SCHEMA}`
+    }
+  };
+  const groupSchema = {
+    id: SCIM_GROUP_SCHEMA,
+    name: "Group",
+    description: "Group",
+    attributes: [
+      str("displayName", { required: true }),
+      {
+        name: "members",
+        type: "complex",
+        multiValued: true,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: [str("value"), str("display"), str("type")]
+      }
+    ],
+    meta: {
+      resourceType: "Schema",
+      location: `${baseUrl}/Schemas/${SCIM_GROUP_SCHEMA}`
+    }
+  };
+  const resources = groups ? [userSchema, enterpriseSchema, groupSchema] : [userSchema, enterpriseSchema];
+  return {
+    schemas: [SCIM_LIST_SCHEMA],
+    totalResults: resources.length,
+    startIndex: 1,
+    itemsPerPage: resources.length,
+    Resources: resources
+  };
+}
+export {
+  resourceTypes,
+  schemas,
+  serviceProviderConfig
+};

package/dist/esm/domain/scim/filter.js

@@ -0,0 +1,177 @@
+// src/domain/scim/filter.ts
+import { err, ok } from "../../types/result";
+var SUPPORTED_FILTER_HELP = 'supported filters are: userName eq "…", externalId eq "…", id eq "…", ' + 'active eq true|false, emails[type eq "…"].value eq "…", and two of ' + 'those joined by "and"';
+var ATTRIBUTES = {
+  id: "id",
+  username: "userName",
+  externalid: "externalId",
+  active: "active",
+  "emails.value": "emails.value",
+  displayname: "displayName"
+};
+var USER_FILTER_ATTRIBUTES = new Set(["id", "userName", "externalId", "active", "emails.value"]);
+var GROUP_FILTER_ATTRIBUTES = new Set(["id", "displayName", "externalId"]);
+function normalizeComplexPath(raw) {
+  const m = /^([A-Za-z]+)\[[^\]]*\]\.([A-Za-z]+)$/.exec(raw.trim());
+  if (!m)
+    return raw.trim();
+  return `${m[1]}.${m[2]}`;
+}
+function findOperator(term) {
+  let depth = 0;
+  let inQuotes = false;
+  for (let i = 0;i < term.length; i++) {
+    const ch = term[i];
+    if (ch === '"' && term[i - 1] !== "\\") {
+      inQuotes = !inQuotes;
+      continue;
+    }
+    if (inQuotes)
+      continue;
+    if (ch === "[")
+      depth++;
+    else if (ch === "]")
+      depth--;
+    else if (depth === 0 && ch === " ") {
+      const m = /^\s+([A-Za-z]{2,3})(?:\s+|$)/.exec(term.slice(i));
+      if (m) {
+        return {
+          attr: term.slice(0, i),
+          op: m[1],
+          value: term.slice(i + m[0].length)
+        };
+      }
+    }
+  }
+  return null;
+}
+function parseTerm(raw, allowed) {
+  const term = raw.trim();
+  const found = findOperator(term);
+  if (!found) {
+    return err({
+      detail: `could not parse filter term "${term}". ${SUPPORTED_FILTER_HELP}`
+    });
+  }
+  const { attr: rawAttr, op: rawOp, value: rawValue } = found;
+  if (rawOp.toLowerCase() !== "eq") {
+    return err({
+      detail: `operator "${rawOp}" is not supported; only "eq" is. ` + SUPPORTED_FILTER_HELP
+    });
+  }
+  const attrKey = normalizeComplexPath(rawAttr).toLowerCase();
+  const attribute = ATTRIBUTES[attrKey];
+  if (!attribute || !allowed.has(attribute)) {
+    return err({
+      detail: `attribute "${rawAttr.trim()}" is not filterable. ` + SUPPORTED_FILTER_HELP
+    });
+  }
+  const value = rawValue.trim();
+  if (attribute === "active") {
+    const lowered = value.toLowerCase();
+    if (lowered !== "true" && lowered !== "false") {
+      return err({
+        detail: `"active" must be compared to true or false, got ${value}`
+      });
+    }
+    return ok({ op: "eq", attribute, value: lowered === "true" });
+  }
+  if (value.length < 2 || !value.startsWith('"') || !value.endsWith('"')) {
+    return err({
+      detail: `value for "${attribute}" must be a quoted string, got ${value}`
+    });
+  }
+  const unquoted = value.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+  if (unquoted.length === 0) {
+    return err({ detail: `value for "${attribute}" must not be empty` });
+  }
+  return ok({ op: "eq", attribute, value: unquoted });
+}
+function parseScimFilter(raw, allowed = USER_FILTER_ATTRIBUTES) {
+  if (raw === null || raw === undefined || raw.trim().length === 0) {
+    return ok(undefined);
+  }
+  const input = raw.trim();
+  const masked = maskQuoted(input);
+  if (masked.includes("(") || masked.includes(")")) {
+    return err({
+      detail: `grouped expressions are not supported. ${SUPPORTED_FILTER_HELP}`
+    });
+  }
+  const parts = splitTopLevelAnd(input);
+  if (parts.length > 2) {
+    return err({
+      detail: `at most two terms joined by "and" are supported. ` + SUPPORTED_FILTER_HELP
+    });
+  }
+  if (/\sor\s/i.test(masked)) {
+    return err({
+      detail: `"or" is not supported. ${SUPPORTED_FILTER_HELP}`
+    });
+  }
+  if (/(^|\s)not\s/i.test(masked)) {
+    return err({
+      detail: `"not" is not supported. ${SUPPORTED_FILTER_HELP}`
+    });
+  }
+  const first = parseTerm(parts[0], allowed);
+  if (!first.ok)
+    return first;
+  if (parts.length === 1)
+    return ok(first.value);
+  const second = parseTerm(parts[1], allowed);
+  if (!second.ok)
+    return second;
+  return ok({ op: "and", left: first.value, right: second.value });
+}
+function maskQuoted(input) {
+  let out = "";
+  let inQuotes = false;
+  for (let i = 0;i < input.length; i++) {
+    const ch = input[i];
+    if (ch === '"' && input[i - 1] !== "\\") {
+      inQuotes = !inQuotes;
+      out += ch;
+      continue;
+    }
+    out += inQuotes ? " " : ch;
+  }
+  return out;
+}
+function splitTopLevelAnd(input) {
+  const parts = [];
+  let depth = 0;
+  let inQuotes = false;
+  let start = 0;
+  for (let i = 0;i < input.length; i++) {
+    const ch = input[i];
+    if (ch === '"' && input[i - 1] !== "\\") {
+      inQuotes = !inQuotes;
+      continue;
+    }
+    if (inQuotes)
+      continue;
+    if (ch === "[")
+      depth++;
+    else if (ch === "]")
+      depth--;
+    else if (depth === 0 && (ch === "a" || ch === "A")) {
+      const window = input.slice(i, i + 3);
+      const before = input[i - 1];
+      const after = input[i + 3];
+      if (window.toLowerCase() === "and" && (before === " " || before === undefined) && (after === " " || after === undefined)) {
+        parts.push(input.slice(start, i));
+        start = i + 3;
+        i += 2;
+      }
+    }
+  }
+  parts.push(input.slice(start));
+  return parts.map((p) => p.trim()).filter((p) => p.length > 0);
+}
+export {
+  GROUP_FILTER_ATTRIBUTES,
+  SUPPORTED_FILTER_HELP,
+  USER_FILTER_ATTRIBUTES,
+  parseScimFilter
+};