@_mustachio/openauth 0.12.0 → 0.13.0

package/dist/esm/domain/scim/handle.js

@@ -0,0 +1,338 @@
+// src/domain/scim/handle.ts
+import { timingSafeEqualStr } from "../crypto";
+import { hashClientSecret } from "../token";
+import { resourceTypes, schemas, serviceProviderConfig } from "./discovery";
+import {
+  GROUP_FILTER_ATTRIBUTES,
+  parseScimFilter,
+  SUPPORTED_FILTER_HELP,
+  USER_FILTER_ATTRIBUTES
+} from "./filter";
+import { normalizeGroupPatch, normalizePatch } from "./patch";
+import {
+  parseGroupWrite,
+  parseUserWrite,
+  scimErrorBody,
+  serializeGroup,
+  serializeGroupList,
+  serializeList,
+  serializeUser
+} from "./resource";
+var DEFAULT_PAGE_SIZE = 100;
+var PAGE_SIZE_CEILING = 500;
+function created(body) {
+  const location = body["meta"]?.["location"];
+  return {
+    status: 201,
+    body,
+    ...typeof location === "string" ? { headers: { location } } : {}
+  };
+}
+var fail = (status, detail, scimType) => ({
+  status,
+  body: scimErrorBody(status, detail, scimType)
+});
+function fromPortError(error) {
+  if (error.code === "conflict") {
+    return fail(409, error.description, "uniqueness");
+  }
+  if (error.code === "invalid_request") {
+    return fail(400, error.description, "invalidValue");
+  }
+  return fail(500, "the directory backing this endpoint failed the request");
+}
+function unwrap(r) {
+  if (r.ok)
+    return { value: r.value };
+  return { response: fromPortError(r.error) };
+}
+async function authenticate(scim, authorization) {
+  if (!scim || scim.enabled !== true) {
+    return fail(403, "SCIM provisioning is not enabled for this tenant");
+  }
+  const prefix = "bearer ";
+  if (authorization === null || !authorization.toLowerCase().startsWith(prefix)) {
+    return fail(401, "a Bearer token is required");
+  }
+  const presented = authorization.slice(prefix.length).trim();
+  if (presented.length === 0)
+    return fail(401, "a Bearer token is required");
+  const hashed = await hashClientSecret(presented);
+  if (!timingSafeEqualStr(hashed, scim.tokenHash)) {
+    return fail(401, "invalid Bearer token");
+  }
+  return null;
+}
+function userIdFrom(path) {
+  const m = /^\/Users\/(.+)$/.exec(path);
+  if (!m)
+    return null;
+  try {
+    return decodeURIComponent(m[1]);
+  } catch {
+    return m[1];
+  }
+}
+function clampPaging(query, maxPageSize) {
+  const rawStart = Number(query.get("startIndex") ?? "1");
+  const startIndex = Number.isFinite(rawStart) && rawStart >= 1 ? Math.floor(rawStart) : 1;
+  const rawCount = query.get("count");
+  if (rawCount === null)
+    return { startIndex, count: maxPageSize };
+  const parsed = Number(rawCount);
+  if (!Number.isFinite(parsed))
+    return { startIndex, count: maxPageSize };
+  if (parsed < 0)
+    return { startIndex, count: 0 };
+  return { startIndex, count: Math.min(Math.floor(parsed), maxPageSize) };
+}
+async function listUsers(input, maxPageSize) {
+  const filter = parseScimFilter(input.query.get("filter"), USER_FILTER_ATTRIBUTES);
+  if (!filter.ok) {
+    return fail(400, filter.error.detail, "invalidFilter");
+  }
+  const { startIndex, count } = clampPaging(input.query, maxPageSize);
+  const page = await input.directory.findUsers(input.tenant.id, {
+    ...filter.value !== undefined ? { filter: filter.value } : {},
+    startIndex,
+    count
+  });
+  const r = unwrap(page);
+  if ("response" in r)
+    return r.response;
+  return {
+    status: 200,
+    body: serializeList(r.value.resources, r.value.totalResults, startIndex, input.baseUrl)
+  };
+}
+async function createUser(input) {
+  const parsed = parseUserWrite(input.body);
+  if (!parsed.ok) {
+    return fail(parsed.error.status, parsed.error.detail, parsed.error.scimType);
+  }
+  const created_ = await input.directory.createUser(input.tenant.id, parsed.value);
+  const r = unwrap(created_);
+  if ("response" in r)
+    return r.response;
+  return created(serializeUser(r.value, input.baseUrl));
+}
+async function loadUser(input, id) {
+  const found = await input.directory.getUser(input.tenant.id, id);
+  const r = unwrap(found);
+  if ("response" in r)
+    return r;
+  if (r.value === null) {
+    return { response: fail(404, `no User with id "${id}"`) };
+  }
+  return { user: r.value };
+}
+async function replaceUser(input, id) {
+  const existing = await loadUser(input, id);
+  if ("response" in existing)
+    return existing.response;
+  const parsed = parseUserWrite(input.body);
+  if (!parsed.ok) {
+    return fail(parsed.error.status, parsed.error.detail, parsed.error.scimType);
+  }
+  const write = parsed.value;
+  const replaced = await input.directory.replaceUser(input.tenant.id, id, write);
+  const r = unwrap(replaced);
+  if ("response" in r)
+    return r.response;
+  return { status: 200, body: serializeUser(r.value, input.baseUrl) };
+}
+async function patchUser(input, id) {
+  const existing = await loadUser(input, id);
+  if ("response" in existing)
+    return existing.response;
+  const normalized = normalizePatch(input.body, existing.user);
+  if (!normalized.ok) {
+    return fail(normalized.error.status, normalized.error.detail, normalized.error.scimType);
+  }
+  const patched = await input.directory.patchUser(input.tenant.id, id, normalized.value);
+  const r = unwrap(patched);
+  if ("response" in r)
+    return r.response;
+  return { status: 200, body: serializeUser(r.value, input.baseUrl) };
+}
+async function deleteUser(input, id) {
+  const existing = await loadUser(input, id);
+  if ("response" in existing)
+    return existing.response;
+  const deleted = await input.directory.deleteUser(input.tenant.id, id);
+  const r = unwrap(deleted);
+  if ("response" in r)
+    return r.response;
+  return { status: 204, body: null };
+}
+function groupsSupported(d) {
+  return typeof d.getGroup === "function" && typeof d.findGroups === "function" && typeof d.createGroup === "function" && typeof d.replaceGroup === "function" && typeof d.patchGroup === "function" && typeof d.deleteGroup === "function";
+}
+function excludesMembers(query) {
+  const raw = query.get("excludedAttributes");
+  if (raw === null)
+    return false;
+  return raw.split(",").map((s) => s.trim().toLowerCase()).includes("members");
+}
+async function loadGroup(input, groups, id) {
+  const found = await groups.getGroup(input.tenant.id, id);
+  const r = unwrap(found);
+  if ("response" in r)
+    return r;
+  if (r.value === null) {
+    return { response: fail(404, `no Group with id "${id}"`) };
+  }
+  return { group: r.value };
+}
+async function handleGroups(input, groups, path, method, maxPageSize) {
+  if (path === "/Groups" || path === "/Groups/") {
+    if (method === "GET") {
+      const filter = parseScimFilter(input.query.get("filter"), GROUP_FILTER_ATTRIBUTES);
+      if (!filter.ok)
+        return fail(400, filter.error.detail, "invalidFilter");
+      const { startIndex, count } = clampPaging(input.query, maxPageSize);
+      const page = await groups.findGroups(input.tenant.id, {
+        ...filter.value !== undefined ? { filter: filter.value } : {},
+        startIndex,
+        count,
+        excludeMembers: excludesMembers(input.query)
+      });
+      const r = unwrap(page);
+      if ("response" in r)
+        return r.response;
+      return {
+        status: 200,
+        body: serializeGroupList(r.value.resources, r.value.totalResults, startIndex, input.baseUrl)
+      };
+    }
+    if (method === "POST") {
+      const parsed = parseGroupWrite(input.body);
+      if (!parsed.ok) {
+        return fail(parsed.error.status, parsed.error.detail, parsed.error.scimType);
+      }
+      const createdGroup = await groups.createGroup(input.tenant.id, parsed.value);
+      const r = unwrap(createdGroup);
+      if ("response" in r)
+        return r.response;
+      return created(serializeGroup(r.value, input.baseUrl));
+    }
+    return fail(405, `${method} is not allowed on /Groups`);
+  }
+  const m = /^\/Groups\/(.+)$/.exec(path);
+  if (!m)
+    return fail(404, `unknown SCIM endpoint "${path}"`);
+  let id;
+  try {
+    id = decodeURIComponent(m[1]);
+  } catch {
+    id = m[1];
+  }
+  switch (method) {
+    case "GET": {
+      const existing = await loadGroup(input, groups, id);
+      if ("response" in existing)
+        return existing.response;
+      return {
+        status: 200,
+        body: serializeGroup(existing.group, input.baseUrl)
+      };
+    }
+    case "PUT": {
+      const existing = await loadGroup(input, groups, id);
+      if ("response" in existing)
+        return existing.response;
+      const parsed = parseGroupWrite(input.body);
+      if (!parsed.ok) {
+        return fail(parsed.error.status, parsed.error.detail, parsed.error.scimType);
+      }
+      const replaced = await groups.replaceGroup(input.tenant.id, id, parsed.value);
+      const r = unwrap(replaced);
+      if ("response" in r)
+        return r.response;
+      return { status: 200, body: serializeGroup(r.value, input.baseUrl) };
+    }
+    case "PATCH": {
+      const existing = await loadGroup(input, groups, id);
+      if ("response" in existing)
+        return existing.response;
+      const normalized = normalizeGroupPatch(input.body);
+      if (!normalized.ok) {
+        return fail(normalized.error.status, normalized.error.detail, normalized.error.scimType);
+      }
+      const patched = await groups.patchGroup(input.tenant.id, id, normalized.value);
+      const r = unwrap(patched);
+      if ("response" in r)
+        return r.response;
+      return { status: 200, body: serializeGroup(r.value, input.baseUrl) };
+    }
+    case "DELETE": {
+      const existing = await loadGroup(input, groups, id);
+      if ("response" in existing)
+        return existing.response;
+      const deleted = await groups.deleteGroup(input.tenant.id, id);
+      const r = unwrap(deleted);
+      if ("response" in r)
+        return r.response;
+      return { status: 204, body: null };
+    }
+    default:
+      return fail(405, `${method} is not allowed on /Groups/{id}`);
+  }
+}
+async function handleScimRequest(input) {
+  const scim = input.tenant.config.scim;
+  const authFailure = await authenticate(scim, input.authorization);
+  if (authFailure)
+    return authFailure;
+  const maxPageSize = Math.min(scim?.maxPageSize ?? DEFAULT_PAGE_SIZE, PAGE_SIZE_CEILING);
+  const path = input.path === "" ? "/" : input.path;
+  const method = input.method.toUpperCase();
+  if (path === "/ServiceProviderConfig" || path === "/ResourceTypes" || path === "/Schemas") {
+    if (method !== "GET") {
+      return fail(405, `${method} is not allowed on ${path}`);
+    }
+    const groups = groupsSupported(input.directory);
+    const body = path === "/ServiceProviderConfig" ? serviceProviderConfig(input.baseUrl, maxPageSize) : path === "/ResourceTypes" ? resourceTypes(input.baseUrl, groups) : schemas(input.baseUrl, groups);
+    return { status: 200, body };
+  }
+  if (path === "/Users" || path === "/Users/") {
+    if (method === "GET")
+      return listUsers(input, maxPageSize);
+    if (method === "POST")
+      return createUser(input);
+    return fail(405, `${method} is not allowed on /Users`);
+  }
+  const id = userIdFrom(path);
+  if (id !== null) {
+    switch (method) {
+      case "GET": {
+        const existing = await loadUser(input, id);
+        if ("response" in existing)
+          return existing.response;
+        return {
+          status: 200,
+          body: serializeUser(existing.user, input.baseUrl)
+        };
+      }
+      case "PUT":
+        return replaceUser(input, id);
+      case "PATCH":
+        return patchUser(input, id);
+      case "DELETE":
+        return deleteUser(input, id);
+      default:
+        return fail(405, `${method} is not allowed on /Users/{id}`);
+    }
+  }
+  if (path.startsWith("/Groups")) {
+    if (!groupsSupported(input.directory)) {
+      return fail(501, "Group provisioning is not implemented by this Service Provider");
+    }
+    return handleGroups(input, input.directory, path, method, maxPageSize);
+  }
+  return fail(404, `unknown SCIM endpoint "${path}"`);
+}
+export {
+  SUPPORTED_FILTER_HELP,
+  handleScimRequest
+};