@absolutejs/auth 0.37.0 → 0.38.0

package/dist/index.d.ts

@@ -13418,6 +13418,76 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
             };
         };
     };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
 }))) & ({} | {
     [x: string]: {
         post: {
@@ -15137,6 +15207,7 @@ export * from './sso/types';
 export * from './sso/config';
 export * from './scim/types';
 export * from './scim/config';
+export * from './scim/extensions';
 export { scimRoutes } from './scim/routes';
 export { createInMemoryScimTokenStore } from './scim/inMemoryScimTokenStore';
 export { createNeonScimTokenStore, createPostgresScimTokenStore, scimTokensTable } from './scim/postgresScimTokenStore';

package/dist/index.js

@@ -8315,10 +8315,26 @@ var GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
 var LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
 var ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
 var SPC_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig";
+var RESOURCE_TYPE_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:ResourceType";
 var SCIM_CONTENT_TYPE = "application/scim+json";
 var FILTER_MAX_RESULTS = 200;
 var FILTER_PATTERN = /^\s*(\w[\w.]*)\s+eq\s+"([^"]*)"\s*$/u;
-var toUserResource = (user, location) => {
+var mergeCustomSchemas = (resource, custom, map) => {
+  if (custom === undefined || map === undefined)
+    return;
+  const extra = map.toScim(custom);
+  for (const [key, value] of Object.entries(extra)) {
+    resource[key] = value;
+  }
+  const extraSchemas = (map.schemas ?? []).map((schema) => schema.id);
+  if (extraSchemas.length === 0)
+    return;
+  const { schemas } = resource;
+  if (Array.isArray(schemas)) {
+    resource.schemas = [...schemas, ...extraSchemas];
+  }
+};
+var toUserResource = (user, location, map) => {
   const resource = {
     active: user.active,
     id: user.id,
@@ -8339,6 +8355,7 @@ var toUserResource = (user, location) => {
   if (user.email !== undefined) {
     resource.emails = [{ primary: true, value: user.email }];
   }
+  mergeCustomSchemas(resource, user.custom, map);
   return resource;
 };
 var stringField = (source, field) => {
@@ -8353,7 +8370,7 @@ var primaryEmail = (emails) => {
   const flagged = emails.find((entry) => typeof entry === "object" && entry !== null && Reflect.get(entry, "primary") === true);
   return stringField(flagged ?? emails[0], "value");
 };
-var parseUserInput = (body) => {
+var parseUserInput = (body, map) => {
   if (typeof body !== "object" || body === null)
     return;
   const userName = stringField(body, "userName");
@@ -8361,8 +8378,14 @@ var parseUserInput = (body) => {
     return;
   const active = Reflect.get(body, "active");
   const name = Reflect.get(body, "name");
+  const bodyRecord = {};
+  for (const key of Object.keys(body)) {
+    bodyRecord[key] = Reflect.get(body, key);
+  }
+  const custom = map === undefined ? undefined : map.fromScim(bodyRecord);
   return {
     active: typeof active === "boolean" ? active : true,
+    custom,
     displayName: stringField(body, "displayName"),
     email: primaryEmail(Reflect.get(body, "emails")),
     externalId: stringField(body, "externalId"),
@@ -8423,6 +8446,7 @@ var applyOperation = (target, operation) => {
 var applyPatch = (user, body) => {
   const next = {
     active: user.active,
+    custom: user.custom,
     displayName: user.displayName,
     email: user.email,
     externalId: user.externalId,
@@ -8468,6 +8492,15 @@ var scimJson = (resource, httpStatus) => new Response(JSON.stringify(resource),
   status: httpStatus
 });
 var serviceProviderConfig = (location) => ({
+  authenticationSchemes: [
+    {
+      description: "Authentication scheme using the OAuth Bearer Token Standard",
+      name: "OAuth Bearer Token",
+      primary: true,
+      specUri: "https://www.rfc-editor.org/info/rfc6750",
+      type: "oauthbearertoken"
+    }
+  ],
   bulk: { maxOperations: 0, maxPayloadSize: 0, supported: false },
   changePassword: { supported: false },
   etag: { supported: false },
@@ -8477,6 +8510,111 @@ var serviceProviderConfig = (location) => ({
   schemas: [SPC_SCHEMA],
   sort: { supported: false }
 });
+var CORE_USER_ATTRIBUTES = [
+  { multiValued: false, name: "userName", required: true, type: "string" },
+  { multiValued: false, name: "active", required: false, type: "boolean" },
+  { multiValued: false, name: "displayName", required: false, type: "string" },
+  { multiValued: false, name: "externalId", required: false, type: "string" },
+  {
+    multiValued: false,
+    name: "name",
+    required: false,
+    subAttributes: [
+      { multiValued: false, name: "givenName", required: false, type: "string" },
+      { multiValued: false, name: "familyName", required: false, type: "string" }
+    ],
+    type: "complex"
+  },
+  {
+    multiValued: true,
+    name: "emails",
+    required: false,
+    subAttributes: [
+      { multiValued: false, name: "value", required: false, type: "string" },
+      { multiValued: false, name: "primary", required: false, type: "boolean" }
+    ],
+    type: "complex"
+  }
+];
+var CORE_GROUP_ATTRIBUTES = [
+  { multiValued: false, name: "displayName", required: true, type: "string" },
+  { multiValued: false, name: "externalId", required: false, type: "string" },
+  {
+    multiValued: true,
+    name: "members",
+    required: false,
+    subAttributes: [
+      { multiValued: false, name: "value", required: false, type: "string" },
+      { multiValued: false, name: "display", required: false, type: "string" }
+    ],
+    type: "complex"
+  }
+];
+var CORE_USER_SCHEMA = {
+  attributes: CORE_USER_ATTRIBUTES,
+  description: "User Account",
+  id: USER_SCHEMA,
+  name: "User"
+};
+var CORE_GROUP_SCHEMA = {
+  attributes: CORE_GROUP_ATTRIBUTES,
+  description: "Group",
+  id: GROUP_SCHEMA,
+  name: "Group"
+};
+var schemaResource = (schema, location) => ({
+  attributes: schema.attributes,
+  description: schema.description ?? schema.name,
+  id: schema.id,
+  meta: { location, resourceType: "Schema" },
+  name: schema.name
+});
+var schemaList = (location, extras = []) => {
+  const all = [CORE_USER_SCHEMA, CORE_GROUP_SCHEMA, ...extras];
+  const resources = all.map((schema) => schemaResource(schema, `${location}/${schema.id}`));
+  return listResponse(resources);
+};
+var schemaOne = (location, id, extras = []) => {
+  const all = [CORE_USER_SCHEMA, CORE_GROUP_SCHEMA, ...extras];
+  const found = all.find((schema) => schema.id === id);
+  if (found === undefined)
+    return;
+  return schemaResource(found, location);
+};
+var resourceTypeUser = (location, usersEndpoint, extensionSchemaIds) => ({
+  description: "User Account",
+  endpoint: usersEndpoint,
+  id: "User",
+  meta: { location, resourceType: "ResourceType" },
+  name: "User",
+  schema: USER_SCHEMA,
+  schemaExtensions: extensionSchemaIds.map((schema) => ({
+    required: false,
+    schema
+  })),
+  schemas: [RESOURCE_TYPE_SCHEMA]
+});
+var resourceTypeGroup = (location, groupsEndpoint) => ({
+  description: "Group",
+  endpoint: groupsEndpoint,
+  id: "Group",
+  meta: { location, resourceType: "ResourceType" },
+  name: "Group",
+  schema: GROUP_SCHEMA,
+  schemas: [RESOURCE_TYPE_SCHEMA]
+});
+var resourceTypeList = (location, usersEndpoint, groupsEndpoint, extras = []) => listResponse([
+  resourceTypeUser(`${location}/User`, usersEndpoint, extras.map((schema) => schema.id)),
+  resourceTypeGroup(`${location}/Group`, groupsEndpoint)
+]);
+var resourceTypeOne = (location, id, usersEndpoint, groupsEndpoint, extras = []) => {
+  if (id === "User") {
+    return resourceTypeUser(location, usersEndpoint, extras.map((schema) => schema.id));
+  }
+  if (id === "Group")
+    return resourceTypeGroup(location, groupsEndpoint);
+  return;
+};
 var REMOVE_MEMBER_PATTERN = /^members\[\s*value\s+eq\s+"([^"]*)"\s*\]$/iu;
 var parseMembers = (value) => {
   if (!Array.isArray(value))
@@ -8577,6 +8715,7 @@ var SCIM_CONTENT_TYPE2 = "application/scim+json";
 var unauthorized = () => scimError(SCIM_UNAUTHORIZED, "Invalid or missing SCIM bearer token");
 var notImplemented = () => scimError(SCIM_NOT_IMPLEMENTED, "Group provisioning is not configured");
 var scimRoutes = ({
+  customAttributes,
   getScimGroup,
   getScimUser,
   listScimGroups,
@@ -8595,8 +8734,17 @@ var scimRoutes = ({
   const groupsRoute = `${scimRoute}/Groups`;
   const groupRoute = `${scimRoute}/Groups/:id`;
   const spcRoute = `${scimRoute}/ServiceProviderConfig`;
+  const schemasRoute = `${scimRoute}/Schemas`;
+  const schemaRoute = `${scimRoute}/Schemas/:id`;
+  const resourceTypesRoute = `${scimRoute}/ResourceTypes`;
+  const resourceTypeRoute = `${scimRoute}/ResourceTypes/:id`;
+  const extensionSchemas = customAttributes?.schemas ?? [];
   const userLocation = (requestUrl, id) => `${new URL(requestUrl).origin}${scimRoute}/Users/${id}`;
   const groupLocation = (requestUrl, id) => `${new URL(requestUrl).origin}${scimRoute}/Groups/${id}`;
+  const schemasLocation = (requestUrl) => `${new URL(requestUrl).origin}${scimRoute}/Schemas`;
+  const resourceTypesLocation = (requestUrl) => `${new URL(requestUrl).origin}${scimRoute}/ResourceTypes`;
+  const usersEndpoint = `${scimRoute}/Users`;
+  const groupsEndpoint = `${scimRoute}/Groups`;
   return new Elysia29().onParse(({ request }, contentType) => contentType === SCIM_CONTENT_TYPE2 ? request.json() : undefined).get(spcRoute, async ({ headers, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
@@ -8606,12 +8754,12 @@ var scimRoutes = ({
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
-    const input = parseUserInput(body);
+    const input = parseUserInput(body, customAttributes);
     if (input === undefined) {
       return scimError(SCIM_BAD_REQUEST, "Request body is not a valid SCIM User", "invalidValue");
     }
     const user = await onScimUserCreate({ input, organizationId });
-    return scimJson(toUserResource(user, userLocation(request.url, user.id)), SCIM_CREATED);
+    return scimJson(toUserResource(user, userLocation(request.url, user.id), customAttributes), SCIM_CREATED);
   }).get(usersRoute, async ({ headers, query, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
@@ -8620,7 +8768,7 @@ var scimRoutes = ({
       filter: parseFilter(query.filter),
       organizationId
     });
-    const resources = users.map((user) => toUserResource(user, userLocation(request.url, user.id)));
+    const resources = users.map((user) => toUserResource(user, userLocation(request.url, user.id), customAttributes));
     return scimJson(listResponse(resources), SCIM_OK);
   }, { query: t26.Object({ filter: t26.Optional(t26.String()) }) }).get(userRoute, async ({ headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
@@ -8630,12 +8778,12 @@ var scimRoutes = ({
     if (user === undefined) {
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
-    return scimJson(toUserResource(user, userLocation(request.url, id)), SCIM_OK);
+    return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
   }, { params: t26.Object({ id: t26.String() }) }).put(userRoute, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
-    const input = parseUserInput(body);
+    const input = parseUserInput(body, customAttributes);
     if (input === undefined) {
       return scimError(SCIM_BAD_REQUEST, "Request body is not a valid SCIM User", "invalidValue");
     }
@@ -8647,7 +8795,7 @@ var scimRoutes = ({
     if (user === undefined) {
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
-    return scimJson(toUserResource(user, userLocation(request.url, id)), SCIM_OK);
+    return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
   }, { params: t26.Object({ id: t26.String() }) }).patch(userRoute, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
@@ -8664,7 +8812,7 @@ var scimRoutes = ({
     if (user === undefined) {
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
-    return scimJson(toUserResource(user, userLocation(request.url, id)), SCIM_OK);
+    return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
   }, { params: t26.Object({ id: t26.String() }) }).delete(userRoute, async ({ headers, params: { id } }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
@@ -8756,6 +8904,34 @@ var scimRoutes = ({
       return notImplemented();
     await onScimGroupDelete({ id, organizationId });
     return new Response(null, { status: SCIM_NO_CONTENT });
+  }, { params: t26.Object({ id: t26.String() }) }).get(schemasRoute, async ({ headers, request }) => {
+    const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
+    if (organizationId === undefined)
+      return unauthorized();
+    return scimJson(schemaList(schemasLocation(request.url), extensionSchemas), SCIM_OK);
+  }).get(schemaRoute, async ({ headers, params: { id }, request }) => {
+    const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
+    if (organizationId === undefined)
+      return unauthorized();
+    const schema = schemaOne(`${schemasLocation(request.url)}/${id}`, id, extensionSchemas);
+    if (schema === undefined) {
+      return scimError(SCIM_NOT_FOUND, "Schema not found");
+    }
+    return scimJson(schema, SCIM_OK);
+  }, { params: t26.Object({ id: t26.String() }) }).get(resourceTypesRoute, async ({ headers, request }) => {
+    const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
+    if (organizationId === undefined)
+      return unauthorized();
+    return scimJson(resourceTypeList(resourceTypesLocation(request.url), usersEndpoint, groupsEndpoint, extensionSchemas), SCIM_OK);
+  }).get(resourceTypeRoute, async ({ headers, params: { id }, request }) => {
+    const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
+    if (organizationId === undefined)
+      return unauthorized();
+    const resourceType = resourceTypeOne(`${resourceTypesLocation(request.url)}/${id}`, id, usersEndpoint, groupsEndpoint, extensionSchemas);
+    if (resourceType === undefined) {
+      return scimError(SCIM_NOT_FOUND, "ResourceType not found");
+    }
+    return scimJson(resourceType, SCIM_OK);
   }, { params: t26.Object({ id: t26.String() }) });
 };
 
@@ -21715,6 +21891,15 @@ var createPostgresAuditSink = (db) => ({
     return deleted.length;
   }
 });
+// src/scim/extensions.ts
+var defineScimAttributeMap = (map) => map;
+var diffScimGroupMembers = (current, next) => {
+  const currentValues = new Set(current.map((member) => member.value));
+  const nextValues = new Set(next.map((member) => member.value));
+  const added = next.filter((member) => !currentValues.has(member.value));
+  const removed = current.filter((member) => !nextValues.has(member.value));
+  return { added, removed };
+};
 // src/scim/inMemoryScimTokenStore.ts
 var createInMemoryScimTokenStore = () => {
   const tokens = new Map;
@@ -24641,10 +24826,12 @@ export {
   endImpersonation,
   encryptTotpSecret,
   encryptSecret,
+  diffScimGroupMembers,
   denyDeviceAuthorization,
   denyBackchannelAuth,
   deleteWarrant,
   deleteRegisteredClient,
+  defineScimAttributeMap,
   defineProvidersConfiguration,
   defineAuthSettings,
   defineAuthHtmxConfig,
@@ -24846,5 +25033,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=26C38ACE51F8A69A64756E2164756E21
+//# debugId=5A0B79F67182545764756E2164756E21
 //# sourceMappingURL=index.js.map