@better-auth/scim 1.5.0-beta.13 → 1.5.0-beta.16

package/.turbo/turbo-build.log

@@ -1,19 +1,19 @@
 
-> @better-auth/scim@1.5.0-beta.13 build /home/runner/work/better-auth/better-auth/packages/scim
+> @better-auth/scim@1.5.0-beta.16 build /home/runner/work/better-auth/better-auth/packages/scim
 > tsdown
 
-ℹ tsdown v0.20.1 powered by rolldown v1.0.0-rc.1
+ℹ tsdown v0.20.3 powered by rolldown v1.0.0-rc.3
 ℹ config file: /home/runner/work/better-auth/better-auth/packages/scim/tsdown.config.ts 
 ℹ entry: src/index.ts, src/client.ts
 ℹ tsconfig: tsconfig.json
 ℹ Build start
-ℹ dist/index.mjs        39.71 kB │ gzip:  8.09 kB
+ℹ dist/index.mjs        45.12 kB │ gzip:  8.92 kB
 ℹ dist/client.mjs        0.19 kB │ gzip:  0.17 kB
-ℹ dist/index.mjs.map    78.91 kB │ gzip: 15.31 kB
+ℹ dist/index.mjs.map    90.39 kB │ gzip: 17.19 kB
 ℹ dist/client.mjs.map    0.46 kB │ gzip:  0.30 kB
-ℹ dist/index.d.mts     108.99 kB │ gzip:  4.52 kB
+ℹ dist/index.d.mts     115.17 kB │ gzip:  4.89 kB
 ℹ dist/client.d.mts      0.24 kB │ gzip:  0.20 kB
-ℹ 6 files, total: 228.50 kB
+ℹ 6 files, total: 251.57 kB
 [PLUGIN_TIMINGS] Warning: Your build spent significant time in plugin `rolldown-plugin-dts:generate`. See https://rolldown.rs/options/checks#plugintimings for more details.
 
-✔ Build complete in 8905ms
+✔ Build complete in 11100ms

package/dist/index.d.mts

@@ -2,7 +2,7 @@ import * as better_auth0 from "better-auth";
 import { User } from "better-auth";
 import * as better_call0 from "better-call";
 import { Member } from "better-auth/plugins";
-import * as zod0 from "zod";
+import * as zod from "zod";
 
 //#region src/types.d.ts
 interface SCIMProvider {
@@ -10,6 +10,7 @@ interface SCIMProvider {
   providerId: string;
   scimToken: string;
   organizationId?: string;
+  userId?: string;
 }
 type SCIMName = {
   formatted?: string;
@@ -21,6 +22,13 @@ type SCIMEmail = {
   primary?: boolean;
 };
 type SCIMOptions = {
+  /**
+   * SCIM provider ownership configuration. When enabled, each provider
+   * connection is linked to the user who generated its token
+   */
+  providerOwnership?: {
+    enabled: boolean;
+  };
   /**
    * Default list of SCIM providers for testing
    * These will take precedence over the database when present
@@ -79,9 +87,9 @@ declare const scim: (options?: SCIMOptions) => {
   endpoints: {
     generateSCIMToken: better_call0.StrictEndpoint<"/scim/generate-token", {
       method: "POST";
-      body: zod0.ZodObject<{
-        providerId: zod0.ZodString;
-        organizationId: zod0.ZodOptional<zod0.ZodString>;
+      body: zod.ZodObject<{
+        providerId: zod.ZodString;
+        organizationId: zod.ZodOptional<zod.ZodString>;
       }, better_auth0.$strip>;
       metadata: {
         openapi: {
@@ -133,6 +141,208 @@ declare const scim: (options?: SCIMOptions) => {
     }, {
       scimToken: string;
     }>;
+    listSCIMProviderConnections: better_call0.StrictEndpoint<"/scim/list-provider-connections", {
+      method: "GET";
+      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>)[];
+      metadata: {
+        openapi: {
+          operationId: string;
+          summary: string;
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      providers: {
+                        type: string;
+                        items: {
+                          type: string;
+                          properties: {
+                            id: {
+                              type: string;
+                            };
+                            providerId: {
+                              type: string;
+                            };
+                            organizationId: {
+                              type: string;
+                              nullable: boolean;
+                            };
+                          };
+                        };
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      providers: {
+        id: string;
+        providerId: string;
+        organizationId: string | null;
+      }[];
+    }>;
+    getSCIMProviderConnection: better_call0.StrictEndpoint<"/scim/get-provider-connection", {
+      method: "GET";
+      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>)[];
+      query: zod.ZodObject<{
+        providerId: zod.ZodString;
+      }, better_auth0.$strip>;
+      metadata: {
+        openapi: {
+          operationId: string;
+          summary: string;
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      id: {
+                        type: string;
+                      };
+                      providerId: {
+                        type: string;
+                      };
+                      organizationId: {
+                        type: string;
+                        nullable: boolean;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+            "404": {
+              description: string;
+            };
+            "403": {
+              description: string;
+            };
+          };
+        };
+      };
+    }, {
+      id: string;
+      providerId: string;
+      organizationId: string | null;
+    }>;
+    deleteSCIMProviderConnection: better_call0.StrictEndpoint<"/scim/delete-provider-connection", {
+      method: "POST";
+      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>)[];
+      body: zod.ZodObject<{
+        providerId: zod.ZodString;
+      }, better_auth0.$strip>;
+      metadata: {
+        openapi: {
+          operationId: string;
+          summary: string;
+          description: string;
+          responses: {
+            "200": {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      success: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+            "404": {
+              description: string;
+            };
+            "403": {
+              description: string;
+            };
+          };
+        };
+      };
+    }, {
+      success: boolean;
+    }>;
     getSCIMUser: better_call0.StrictEndpoint<"/scim/v2/Users/:userId", {
       method: "GET";
       metadata: {
@@ -411,17 +621,17 @@ declare const scim: (options?: SCIMOptions) => {
     }>;
     createSCIMUser: better_call0.StrictEndpoint<"/scim/v2/Users", {
       method: "POST";
-      body: zod0.ZodObject<{
-        userName: zod0.ZodString;
-        externalId: zod0.ZodOptional<zod0.ZodString>;
-        name: zod0.ZodOptional<zod0.ZodObject<{
-          formatted: zod0.ZodOptional<zod0.ZodString>;
-          givenName: zod0.ZodOptional<zod0.ZodString>;
-          familyName: zod0.ZodOptional<zod0.ZodString>;
+      body: zod.ZodObject<{
+        userName: zod.ZodString;
+        externalId: zod.ZodOptional<zod.ZodString>;
+        name: zod.ZodOptional<zod.ZodObject<{
+          formatted: zod.ZodOptional<zod.ZodString>;
+          givenName: zod.ZodOptional<zod.ZodString>;
+          familyName: zod.ZodOptional<zod.ZodString>;
         }, better_auth0.$strip>>;
-        emails: zod0.ZodOptional<zod0.ZodArray<zod0.ZodObject<{
-          value: zod0.ZodEmail;
-          primary: zod0.ZodOptional<zod0.ZodBoolean>;
+        emails: zod.ZodOptional<zod.ZodArray<zod.ZodObject<{
+          value: zod.ZodEmail;
+          primary: zod.ZodOptional<zod.ZodBoolean>;
         }, better_auth0.$strip>>>;
       }, better_auth0.$strip>;
       metadata: {
@@ -700,16 +910,16 @@ declare const scim: (options?: SCIMOptions) => {
     }>;
     patchSCIMUser: better_call0.StrictEndpoint<"/scim/v2/Users/:userId", {
       method: "PATCH";
-      body: zod0.ZodObject<{
-        schemas: zod0.ZodArray<zod0.ZodString>;
-        Operations: zod0.ZodArray<zod0.ZodObject<{
-          op: zod0.ZodPipe<zod0.ZodDefault<zod0.ZodString>, zod0.ZodEnum<{
+      body: zod.ZodObject<{
+        schemas: zod.ZodArray<zod.ZodString>;
+        Operations: zod.ZodArray<zod.ZodObject<{
+          op: zod.ZodPipe<zod.ZodDefault<zod.ZodString>, zod.ZodEnum<{
             add: "add";
             remove: "remove";
             replace: "replace";
           }>>;
-          path: zod0.ZodOptional<zod0.ZodString>;
-          value: zod0.ZodAny;
+          path: zod.ZodOptional<zod.ZodString>;
+          value: zod.ZodAny;
         }, better_auth0.$strip>>;
       }, better_auth0.$strip>;
       metadata: {
@@ -1076,17 +1286,17 @@ declare const scim: (options?: SCIMOptions) => {
     }, void>;
     updateSCIMUser: better_call0.StrictEndpoint<"/scim/v2/Users/:userId", {
       method: "PUT";
-      body: zod0.ZodObject<{
-        userName: zod0.ZodString;
-        externalId: zod0.ZodOptional<zod0.ZodString>;
-        name: zod0.ZodOptional<zod0.ZodObject<{
-          formatted: zod0.ZodOptional<zod0.ZodString>;
-          givenName: zod0.ZodOptional<zod0.ZodString>;
-          familyName: zod0.ZodOptional<zod0.ZodString>;
+      body: zod.ZodObject<{
+        userName: zod.ZodString;
+        externalId: zod.ZodOptional<zod.ZodString>;
+        name: zod.ZodOptional<zod.ZodObject<{
+          formatted: zod.ZodOptional<zod.ZodString>;
+          givenName: zod.ZodOptional<zod.ZodString>;
+          familyName: zod.ZodOptional<zod.ZodString>;
         }, better_auth0.$strip>>;
-        emails: zod0.ZodOptional<zod0.ZodArray<zod0.ZodObject<{
-          value: zod0.ZodEmail;
-          primary: zod0.ZodOptional<zod0.ZodBoolean>;
+        emails: zod.ZodOptional<zod.ZodArray<zod.ZodObject<{
+          value: zod.ZodEmail;
+          primary: zod.ZodOptional<zod.ZodBoolean>;
         }, better_auth0.$strip>>>;
       }, better_auth0.$strip>;
       metadata: {
@@ -1365,8 +1575,8 @@ declare const scim: (options?: SCIMOptions) => {
     }>;
     listSCIMUsers: better_call0.StrictEndpoint<"/scim/v2/Users", {
       method: "GET";
-      query: zod0.ZodOptional<zod0.ZodObject<{
-        filter: zod0.ZodOptional<zod0.ZodString>;
+      query: zod.ZodOptional<zod.ZodObject<{
+        filter: zod.ZodOptional<zod.ZodString>;
       }, better_auth0.$strip>>;
       metadata: {
         allowedMediaTypes: string[];
@@ -3205,6 +3415,10 @@ declare const scim: (options?: SCIMOptions) => {
   schema: {
     scimProvider: {
       fields: {
+        userId?: {
+          type: "string";
+          required: false;
+        } | undefined;
         providerId: {
           type: "string";
           required: true;

package/dist/index.mjs

@@ -618,6 +618,55 @@ const generateSCIMTokenBodySchema = z.object({
 	providerId: z.string().meta({ description: "Unique provider identifier" }),
 	organizationId: z.string().optional().meta({ description: "Optional organization id" })
 });
+const getSCIMProviderConnectionQuerySchema = z.object({ providerId: z.string() });
+const deleteSCIMProviderConnectionBodySchema = z.object({ providerId: z.string() });
+async function getSCIMUserOrgIds(ctx, userId) {
+	const members = await ctx.context.adapter.findMany({
+		model: "member",
+		where: [{
+			field: "userId",
+			value: userId
+		}]
+	});
+	return new Set(members.map((m) => m.organizationId));
+}
+function normalizeSCIMProvider(provider) {
+	return {
+		id: provider.id,
+		providerId: provider.providerId,
+		organizationId: provider.organizationId ?? null
+	};
+}
+async function findOrganizationMember(ctx, userId, organizationId) {
+	return ctx.context.adapter.findOne({
+		model: "member",
+		where: [{
+			field: "userId",
+			value: userId
+		}, {
+			field: "organizationId",
+			value: organizationId
+		}]
+	});
+}
+async function assertSCIMProviderAccess(ctx, userId, provider) {
+	if (provider.organizationId) {
+		if (!ctx.context.hasPlugin("organization")) throw new APIError("FORBIDDEN", { message: "Organization plugin is required to access this SCIM provider" });
+		if (!await findOrganizationMember(ctx, userId, provider.organizationId)) throw new APIError("FORBIDDEN", { message: "You must be a member of the organization to access this provider" });
+	} else if (provider.userId && provider.userId !== userId) throw new APIError("FORBIDDEN", { message: "You must be the owner to access this provider" });
+}
+async function checkSCIMProviderAccess(ctx, userId, providerId) {
+	const provider = await ctx.context.adapter.findOne({
+		model: "scimProvider",
+		where: [{
+			field: "providerId",
+			value: providerId
+		}]
+	});
+	if (!provider) throw new APIError("NOT_FOUND", { message: "SCIM provider not found" });
+	await assertSCIMProviderAccess(ctx, userId, provider);
+	return provider;
+}
 const generateSCIMToken = (opts) => createAuthEndpoint("/scim/generate-token", {
 	method: "POST",
 	body: generateSCIMTokenBodySchema,
@@ -643,16 +692,7 @@ const generateSCIMToken = (opts) => createAuthEndpoint("/scim/generate-token", {
 	if (organizationId && !ctx.context.hasPlugin("organization")) throw new APIError("BAD_REQUEST", { message: "Restricting a token to an organization requires the organization plugin" });
 	let member = null;
 	if (organizationId) {
-		member = await ctx.context.adapter.findOne({
-			model: "member",
-			where: [{
-				field: "userId",
-				value: user.id
-			}, {
-				field: "organizationId",
-				value: organizationId
-			}]
-		});
+		member = await findOrganizationMember(ctx, user.id, organizationId);
 		if (!member) throw new APIError("FORBIDDEN", { message: "You are not a member of the organization" });
 	}
 	const scimProvider = await ctx.context.adapter.findOne({
@@ -665,13 +705,16 @@ const generateSCIMToken = (opts) => createAuthEndpoint("/scim/generate-token", {
 			value: organizationId
 		}] : []]
 	});
-	if (scimProvider) await ctx.context.adapter.delete({
-		model: "scimProvider",
-		where: [{
-			field: "id",
-			value: scimProvider.id
-		}]
-	});
+	if (scimProvider) {
+		await assertSCIMProviderAccess(ctx, user.id, scimProvider);
+		await ctx.context.adapter.delete({
+			model: "scimProvider",
+			where: [{
+				field: "id",
+				value: scimProvider.id
+			}]
+		});
+	}
 	const baseToken = generateRandomString(24);
 	const scimToken = base64Url.encode(`${baseToken}:${providerId}${organizationId ? `:${organizationId}` : ""}`);
 	if (opts.beforeSCIMTokenGenerated) await opts.beforeSCIMTokenGenerated({
@@ -684,7 +727,8 @@ const generateSCIMToken = (opts) => createAuthEndpoint("/scim/generate-token", {
 		data: {
 			providerId,
 			organizationId,
-			scimToken: await storeSCIMToken(ctx, opts, baseToken)
+			scimToken: await storeSCIMToken(ctx, opts, baseToken),
+			...opts.providerOwnership?.enabled ? { userId: user.id } : {}
 		}
 	});
 	if (opts.afterSCIMTokenGenerated) await opts.afterSCIMTokenGenerated({
@@ -696,6 +740,110 @@ const generateSCIMToken = (opts) => createAuthEndpoint("/scim/generate-token", {
 	ctx.setStatus(201);
 	return ctx.json({ scimToken });
 });
+const listSCIMProviderConnections = () => createAuthEndpoint("/scim/list-provider-connections", {
+	method: "GET",
+	use: [sessionMiddleware],
+	metadata: { openapi: {
+		operationId: "listSCIMProviderConnections",
+		summary: "List SCIM providers",
+		description: "Returns SCIM providers for organizations the user is a member of.",
+		responses: { "200": {
+			description: "List of SCIM providers",
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: { providers: {
+					type: "array",
+					items: {
+						type: "object",
+						properties: {
+							id: { type: "string" },
+							providerId: { type: "string" },
+							organizationId: {
+								type: "string",
+								nullable: true
+							}
+						}
+					}
+				} }
+			} } }
+		} }
+	} }
+}, async (ctx) => {
+	const userId = ctx.context.session.user.id;
+	const userOrgIds = ctx.context.hasPlugin("organization") ? await getSCIMUserOrgIds(ctx, userId) : /* @__PURE__ */ new Set();
+	const providers = (await ctx.context.adapter.findMany({ model: "scimProvider" })).filter((p) => {
+		if (p.organizationId) return userOrgIds.has(p.organizationId);
+		if (p.userId === userId) return true;
+		return !p.userId;
+	}).map((p) => normalizeSCIMProvider(p));
+	return ctx.json({ providers });
+});
+const getSCIMProviderConnection = () => createAuthEndpoint("/scim/get-provider-connection", {
+	method: "GET",
+	use: [sessionMiddleware],
+	query: getSCIMProviderConnectionQuerySchema,
+	metadata: { openapi: {
+		operationId: "getSCIMProviderConnection",
+		summary: "Get SCIM provider details",
+		description: "Returns details for a specific SCIM provider",
+		responses: {
+			"200": {
+				description: "SCIM provider details",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: {
+						id: { type: "string" },
+						providerId: { type: "string" },
+						organizationId: {
+							type: "string",
+							nullable: true
+						}
+					}
+				} } }
+			},
+			"404": { description: "Provider not found" },
+			"403": { description: "Access denied" }
+		}
+	} }
+}, async (ctx) => {
+	const { providerId } = ctx.query;
+	const userId = ctx.context.session.user.id;
+	const provider = await checkSCIMProviderAccess(ctx, userId, providerId);
+	return ctx.json(normalizeSCIMProvider(provider));
+});
+const deleteSCIMProviderConnection = () => createAuthEndpoint("/scim/delete-provider-connection", {
+	method: "POST",
+	use: [sessionMiddleware],
+	body: deleteSCIMProviderConnectionBodySchema,
+	metadata: { openapi: {
+		operationId: "deleteSCIMProviderConnection",
+		summary: "Delete SCIM provider",
+		description: "Deletes a SCIM provider and invalidates its token",
+		responses: {
+			"200": {
+				description: "SCIM provider deleted successfully",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: { success: { type: "boolean" } }
+				} } }
+			},
+			"404": { description: "Provider not found" },
+			"403": { description: "Access denied" }
+		}
+	} }
+}, async (ctx) => {
+	const { providerId } = ctx.body;
+	const userId = ctx.context.session.user.id;
+	await checkSCIMProviderAccess(ctx, userId, providerId);
+	await ctx.context.adapter.delete({
+		model: "scimProvider",
+		where: [{
+			field: "providerId",
+			value: providerId
+		}]
+	});
+	return ctx.json({ success: true });
+});
 const createSCIMUser = (authMiddleware) => createAuthEndpoint("/scim/v2/Users", {
 	method: "POST",
 	body: APIUserSchema,
@@ -1276,6 +1424,7 @@ const parseSCIMAPIUserFilter = (filter) => {
 const scim = (options) => {
 	const opts = {
 		storeSCIMToken: "plain",
+		providerOwnership: { enabled: false },
 		...options
 	};
 	const authMiddleware = authMiddlewareFactory(opts);
@@ -1283,6 +1432,9 @@ const scim = (options) => {
 		id: "scim",
 		endpoints: {
 			generateSCIMToken: generateSCIMToken(opts),
+			listSCIMProviderConnections: listSCIMProviderConnections(),
+			getSCIMProviderConnection: getSCIMProviderConnection(),
+			deleteSCIMProviderConnection: deleteSCIMProviderConnection(),
 			getSCIMUser: getSCIMUser(authMiddleware),
 			createSCIMUser: createSCIMUser(authMiddleware),
 			patchSCIMUser: patchSCIMUser(authMiddleware),
@@ -1309,7 +1461,11 @@ const scim = (options) => {
 			organizationId: {
 				type: "string",
 				required: false
-			}
+			},
+			...opts.providerOwnership?.enabled ? { userId: {
+				type: "string",
+				required: false
+			} } : {}
 		} } },
 		options
 	};