@enterprisestandard/react 0.0.5-beta.20260115.1 → 0.0.5-beta.20260115.3

package/dist/iam.js

@@ -0,0 +1,680 @@
+import { groupResourceSchema, userSchema } from './types/scim-schema.js';
+const SCIM_CONTENT_TYPE = 'application/scim+json';
+/**
+ * Send SCIM error response
+ */
+function scimErrorResponse(status, detail, scimType) {
+    return new Response(JSON.stringify({
+        schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'],
+        status: String(status),
+        scimType,
+        detail,
+    }), {
+        status,
+        headers: { 'Content-Type': SCIM_CONTENT_TYPE },
+    });
+}
+/**
+ * Send SCIM list response
+ */
+function scimListResponse(resources) {
+    return new Response(JSON.stringify({
+        schemas: ['urn:ietf:params:scim:api:messages:2.0:ListResponse'],
+        totalResults: resources.length,
+        startIndex: 1,
+        itemsPerPage: resources.length,
+        Resources: resources,
+    }), {
+        status: 200,
+        headers: { 'Content-Type': SCIM_CONTENT_TYPE },
+    });
+}
+/**
+ * Send SCIM resource response
+ */
+function scimResourceResponse(resource, status = 200) {
+    return new Response(JSON.stringify(resource), {
+        status,
+        headers: { 'Content-Type': SCIM_CONTENT_TYPE },
+    });
+}
+/**
+ * Convert StoredGroup to GroupResource for SCIM response
+ */
+function storedGroupToResource(group) {
+    return {
+        schemas: ['urn:ietf:params:scim:schemas:core:2.0:Group'],
+        id: group.id,
+        externalId: group.externalId,
+        displayName: group.displayName,
+        members: group.members,
+        meta: {
+            resourceType: 'Group',
+            created: group.createdAt.toISOString(),
+            lastModified: group.updatedAt.toISOString(),
+        },
+    };
+}
+/**
+ * Generate a UUID for new resources
+ */
+function generateId() {
+    return crypto.randomUUID();
+}
+/**
+ * Creates an IAM service instance.
+ *
+ * - If `url` is configured, enables outbound SCIM operations to external IAM
+ * - If `group_store` is configured, enables inbound SCIM operations from external IAM
+ *
+ * @param config - IAM configuration
+ * @param workload - Workload instance for authentication
+ * @returns IAM service instance
+ */
+export function iam(config, workload) {
+    const { url, group_store } = config;
+    /**
+     * Build headers for outgoing SCIM request using workload auth
+     */
+    async function buildHeaders() {
+        const token = await workload.getToken();
+        return new Headers({
+            'Content-Type': SCIM_CONTENT_TYPE,
+            Accept: SCIM_CONTENT_TYPE,
+            Authorization: `Bearer ${token}`,
+        });
+    }
+    /**
+     * Make an outgoing SCIM request to external IAM
+     */
+    async function scimRequest(method, endpoint, body, validator) {
+        if (!url) {
+            return {
+                success: false,
+                error: {
+                    schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'],
+                    status: '500',
+                    detail: 'IAM URL not configured for outgoing requests',
+                },
+                status: 500,
+            };
+        }
+        const requestUrl = `${url}${endpoint}`;
+        try {
+            const headers = await buildHeaders();
+            const response = await fetch(requestUrl, {
+                method,
+                headers,
+                body: body ? JSON.stringify(body) : undefined,
+            });
+            const responseData = await response.json();
+            if (!response.ok) {
+                return {
+                    success: false,
+                    error: responseData,
+                    status: response.status,
+                };
+            }
+            // Validate response if validator provided
+            if (validator) {
+                const validationResult = await validator['~standard'].validate(responseData);
+                if ('issues' in validationResult) {
+                    return {
+                        success: false,
+                        error: {
+                            schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'],
+                            status: '400',
+                            scimType: 'invalidValue',
+                            detail: `Response validation failed: ${validationResult.issues?.map((i) => i.message).join('; ')}`,
+                        },
+                        status: 400,
+                    };
+                }
+                return {
+                    success: true,
+                    data: validationResult.value,
+                    status: response.status,
+                };
+            }
+            return {
+                success: true,
+                data: responseData,
+                status: response.status,
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: {
+                    schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'],
+                    status: '500',
+                    detail: error instanceof Error ? error.message : 'Unknown error occurred',
+                },
+                status: 500,
+            };
+        }
+    }
+    /**
+     * Get the configured SCIM base URL
+     */
+    function getBaseUrl() {
+        return url;
+    }
+    // Build groups_outbound if url is configured
+    let groups_outbound;
+    let createUser;
+    if (url) {
+        /**
+         * Create a new user/account in the external IAM provider
+         */
+        createUser = async (user, options) => {
+            const userPayload = {
+                ...user,
+                schemas: user.schemas ?? [
+                    'urn:ietf:params:scim:schemas:core:2.0:User',
+                    'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User',
+                ],
+            };
+            const validator = options?.validation ?? userSchema('es-iam');
+            return scimRequest('POST', '/Users', userPayload, validator);
+        };
+        /**
+         * Create a new group in the external IAM provider
+         */
+        async function createGroup(displayName, options) {
+            const groupPayload = {
+                schemas: ['urn:ietf:params:scim:schemas:core:2.0:Group'],
+                displayName,
+                externalId: options?.externalId,
+                members: options?.members,
+            };
+            const validator = options?.validation ?? groupResourceSchema('es-iam');
+            return scimRequest('POST', '/Groups', groupPayload, validator);
+        }
+        groups_outbound = {
+            createGroup,
+        };
+    }
+    // Build groups_inbound if group_store is configured
+    let groups_inbound;
+    if (group_store) {
+        // Capture reference to avoid undefined checks in nested functions
+        const store = group_store;
+        /**
+         * Validate authorization header for inbound requests
+         */
+        const validateAuth = async (request) => {
+            const auth = request.headers.get('Authorization');
+            if (!auth || !auth.startsWith('Bearer ')) {
+                return false;
+            }
+            // Validate the token using workload
+            try {
+                const token = auth.substring(7);
+                const result = await workload.validateToken(token);
+                return result.valid;
+            }
+            catch {
+                return false;
+            }
+        };
+        /**
+         * Handle inbound SCIM requests for group management
+         */
+        const handler = async (request, handlerConfig) => {
+            // Validate auth
+            const isAuthorized = await validateAuth(request);
+            if (!isAuthorized) {
+                return scimErrorResponse(401, 'Authorization required');
+            }
+            const urlObj = new URL(request.url);
+            const basePath = handlerConfig?.basePath ?? '/Groups';
+            let path = urlObj.pathname;
+            // Remove base path to get the resource path
+            if (path.startsWith(basePath)) {
+                path = path.substring(basePath.length);
+            }
+            // Parse group ID from path
+            const groupIdMatch = path.match(/^\/([^/]+)$/);
+            const groupId = groupIdMatch?.[1];
+            const method = request.method;
+            try {
+                // Route to appropriate handler
+                if (groupId) {
+                    // Operations on specific group
+                    switch (method) {
+                        case 'GET':
+                            return await handleGetGroup(groupId);
+                        case 'PUT':
+                            return await handleReplaceGroup(request, groupId);
+                        case 'PATCH':
+                            return await handlePatchGroup(request, groupId);
+                        case 'DELETE':
+                            return await handleDeleteGroup(groupId);
+                        default:
+                            return scimErrorResponse(405, 'Method not allowed');
+                    }
+                }
+                else if (path === '' || path === '/') {
+                    // Operations on groups collection
+                    switch (method) {
+                        case 'GET':
+                            return await handleListGroups();
+                        case 'POST':
+                            return await handleCreateGroup(request);
+                        default:
+                            return scimErrorResponse(405, 'Method not allowed');
+                    }
+                }
+                return scimErrorResponse(404, 'Resource not found');
+            }
+            catch (error) {
+                console.error('Groups inbound handler error:', error);
+                return scimErrorResponse(500, error instanceof Error ? error.message : 'Internal server error');
+            }
+        };
+        /**
+         * List all groups
+         */
+        const handleListGroups = async () => {
+            const groups = await store.list();
+            const resources = groups.map(storedGroupToResource);
+            return scimListResponse(resources);
+        };
+        /**
+         * Get a group by ID
+         */
+        const handleGetGroup = async (id) => {
+            const group = await store.get(id);
+            if (!group) {
+                return scimErrorResponse(404, `Group ${id} not found`, 'invalidValue');
+            }
+            return scimResourceResponse(storedGroupToResource(group));
+        };
+        /**
+         * Create a new group
+         */
+        const handleCreateGroup = async (request) => {
+            const body = (await request.json());
+            if (!body.displayName) {
+                return scimErrorResponse(400, 'displayName is required', 'invalidValue');
+            }
+            const now = new Date();
+            const storedGroup = {
+                id: generateId(),
+                displayName: body.displayName,
+                externalId: body.externalId,
+                members: body.members,
+                createdAt: now,
+                updatedAt: now,
+            };
+            await store.upsert(storedGroup);
+            return scimResourceResponse(storedGroupToResource(storedGroup), 201);
+        };
+        /**
+         * Replace a group (PUT)
+         */
+        const handleReplaceGroup = async (request, id) => {
+            const existing = await store.get(id);
+            if (!existing) {
+                return scimErrorResponse(404, `Group ${id} not found`, 'invalidValue');
+            }
+            const body = (await request.json());
+            const updatedGroup = {
+                ...existing,
+                displayName: body.displayName ?? existing.displayName,
+                externalId: body.externalId,
+                members: body.members,
+                updatedAt: new Date(),
+            };
+            await store.upsert(updatedGroup);
+            return scimResourceResponse(storedGroupToResource(updatedGroup));
+        };
+        /**
+         * Patch a group (PATCH)
+         */
+        const handlePatchGroup = async (request, id) => {
+            const existing = await store.get(id);
+            if (!existing) {
+                return scimErrorResponse(404, `Group ${id} not found`, 'invalidValue');
+            }
+            const body = (await request.json());
+            const operations = body.Operations ?? [];
+            const updated = { ...existing };
+            for (const op of operations) {
+                if (op.op === 'replace' && op.path && op.value !== undefined) {
+                    if (op.path === 'displayName') {
+                        updated.displayName = op.value;
+                    }
+                }
+                else if (op.op === 'add' && op.path && op.value !== undefined) {
+                    if (op.path === 'members') {
+                        const newMembers = op.value;
+                        updated.members = [...(updated.members ?? []), ...newMembers];
+                    }
+                }
+                else if (op.op === 'remove' && op.path) {
+                    if (op.path.startsWith('members[')) {
+                        // Parse member filter like members[value eq "user-id"]
+                        const match = op.path.match(/members\[value eq "([^"]+)"\]/);
+                        if (match) {
+                            updated.members = (updated.members ?? []).filter((m) => m.value !== match[1]);
+                        }
+                    }
+                }
+            }
+            updated.updatedAt = new Date();
+            await store.upsert(updated);
+            return scimResourceResponse(storedGroupToResource(updated));
+        };
+        /**
+         * Delete a group
+         */
+        const handleDeleteGroup = async (id) => {
+            const existing = await store.get(id);
+            if (!existing) {
+                return scimErrorResponse(404, `Group ${id} not found`, 'invalidValue');
+            }
+            await store.delete(id);
+            return new Response(null, { status: 204 });
+        };
+        groups_inbound = {
+            handler,
+        };
+    }
+    // Build users_inbound if user_store is configured
+    let users_inbound;
+    if (config.user_store) {
+        // Capture reference to avoid undefined checks in nested functions
+        const store = config.user_store;
+        /**
+         * Validate authorization header for inbound requests
+         */
+        async function validateAuth(request) {
+            const auth = request.headers.get('Authorization');
+            if (!auth || !auth.startsWith('Bearer ')) {
+                return false;
+            }
+            // Validate the token using workload
+            try {
+                const token = auth.substring(7);
+                const result = await workload.validateToken(token);
+                return result.valid;
+            }
+            catch {
+                return false;
+            }
+        }
+        /**
+         * Convert StoredUser to SCIM User for response
+         */
+        const storedUserToScimUser = (storedUser) => {
+            return {
+                schemas: [
+                    'urn:ietf:params:scim:schemas:core:2.0:User',
+                    'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User',
+                ],
+                id: storedUser.id,
+                userName: storedUser.userName || storedUser.email || storedUser.id,
+                displayName: storedUser.name || storedUser.userName || storedUser.email,
+                name: storedUser.name
+                    ? {
+                        givenName: storedUser.name.split(' ')[0],
+                        familyName: storedUser.name.split(' ').slice(1).join(' ') || undefined,
+                    }
+                    : undefined,
+                emails: storedUser.email ? [{ value: storedUser.email, primary: true }] : [],
+                active: true,
+                meta: {
+                    resourceType: 'User',
+                    created: storedUser.createdAt.toISOString(),
+                    lastModified: storedUser.updatedAt.toISOString(),
+                },
+            };
+        };
+        /**
+         * Convert SCIM User to StoredUser for storage
+         */
+        const scimUserToStoredUser = (scimUser) => {
+            const now = new Date();
+            const primaryEmail = scimUser.emails?.find((e) => e.primary)?.value || scimUser.emails?.[0]?.value;
+            const name = scimUser.name
+                ? `${scimUser.name.givenName || ''} ${scimUser.name.familyName || ''}`.trim()
+                : scimUser.displayName;
+            // Create minimal SSO data for IAM-provisioned users
+            const userId = scimUser.id || generateId();
+            const userName = scimUser.userName || primaryEmail || userId;
+            return {
+                id: userId,
+                userName,
+                name: name || scimUser.displayName || userName,
+                email: primaryEmail || userName,
+                avatarUrl: scimUser.profileUrl,
+                sso: {
+                    profile: {
+                        sub: userId,
+                        iss: 'iam-provisioned',
+                        aud: 'iam-provisioned',
+                        exp: Math.floor(Date.now() / 1000) + 3600,
+                        iat: Math.floor(Date.now() / 1000),
+                        email: primaryEmail || userName,
+                        email_verified: true,
+                        name: name || scimUser.displayName || userName,
+                        preferred_username: userName,
+                    },
+                    tenant: {
+                        id: 'iam-provisioned',
+                        name: 'IAM Provisioned',
+                    },
+                    scope: 'openid profile email',
+                    tokenType: 'Bearer',
+                    expires: new Date(Date.now() + 3600 * 1000),
+                },
+                createdAt: scimUser.meta?.created ? new Date(scimUser.meta.created) : now,
+                updatedAt: scimUser.meta?.lastModified ? new Date(scimUser.meta.lastModified) : now,
+            };
+        };
+        /**
+         * Handle inbound SCIM requests for user management
+         */
+        const handler = async (request, handlerConfig) => {
+            // Validate auth
+            const isAuthorized = await validateAuth(request);
+            if (!isAuthorized) {
+                return scimErrorResponse(401, 'Authorization required');
+            }
+            const urlObj = new URL(request.url);
+            const basePath = handlerConfig?.basePath ?? '/Users';
+            let path = urlObj.pathname;
+            // Remove base path to get the resource path
+            if (path.startsWith(basePath)) {
+                path = path.substring(basePath.length);
+            }
+            // Parse user ID from path
+            const userIdMatch = path.match(/^\/([^/]+)$/);
+            const userId = userIdMatch?.[1];
+            const method = request.method;
+            try {
+                // Route to appropriate handler
+                if (userId) {
+                    // Operations on specific user
+                    switch (method) {
+                        case 'GET':
+                            return await handleGetUser(userId);
+                        case 'PUT':
+                            return await handleReplaceUser(request, userId);
+                        case 'PATCH':
+                            return await handlePatchUser(request, userId);
+                        case 'DELETE':
+                            return await handleDeleteUser(userId);
+                        default:
+                            return scimErrorResponse(405, 'Method not allowed');
+                    }
+                }
+                else if (path === '' || path === '/') {
+                    // Operations on users collection
+                    switch (method) {
+                        case 'GET':
+                            return await handleListUsers();
+                        case 'POST':
+                            return await handleCreateUser(request);
+                        default:
+                            return scimErrorResponse(405, 'Method not allowed');
+                    }
+                }
+                return scimErrorResponse(404, 'Resource not found');
+            }
+            catch (error) {
+                console.error('Users inbound handler error:', error);
+                return scimErrorResponse(500, error instanceof Error ? error.message : 'Internal server error');
+            }
+        };
+        /**
+         * List all users
+         */
+        const handleListUsers = async () => {
+            // Note: UserStore doesn't have a list method, so we'd need to implement it
+            // For now, return empty list - this would need to be enhanced based on UserStore interface
+            return scimListResponse([]);
+        };
+        /**
+         * Get a user by ID
+         */
+        const handleGetUser = async (id) => {
+            const user = await store.get(id);
+            if (!user) {
+                return scimErrorResponse(404, `User ${id} not found`, 'invalidValue');
+            }
+            return scimResourceResponse(storedUserToScimUser(user));
+        };
+        /**
+         * Create a new user
+         */
+        const handleCreateUser = async (request) => {
+            const body = (await request.json());
+            if (!body.userName && !body.emails?.[0]?.value) {
+                return scimErrorResponse(400, 'userName or email is required', 'invalidValue');
+            }
+            const storedUser = scimUserToStoredUser(body);
+            await store.upsert(storedUser);
+            return scimResourceResponse(storedUserToScimUser(storedUser), 201);
+        };
+        /**
+         * Replace a user (PUT)
+         */
+        const handleReplaceUser = async (request, id) => {
+            const existing = await store.get(id);
+            if (!existing) {
+                return scimErrorResponse(404, `User ${id} not found`, 'invalidValue');
+            }
+            const body = (await request.json());
+            const updatedUser = scimUserToStoredUser({ ...body, id });
+            updatedUser.createdAt = existing.createdAt;
+            updatedUser.updatedAt = new Date();
+            await store.upsert(updatedUser);
+            return scimResourceResponse(storedUserToScimUser(updatedUser));
+        };
+        /**
+         * Patch a user (PATCH)
+         */
+        const handlePatchUser = async (request, id) => {
+            const existing = await store.get(id);
+            if (!existing) {
+                return scimErrorResponse(404, `User ${id} not found`, 'invalidValue');
+            }
+            const body = (await request.json());
+            const operations = body.Operations ?? [];
+            const updated = { ...existing };
+            for (const op of operations) {
+                if (op.op === 'replace' && op.path && op.value !== undefined) {
+                    if (op.path === 'displayName') {
+                        updated.name = op.value;
+                    }
+                    else if (op.path === 'userName') {
+                        updated.userName = op.value;
+                    }
+                    else if (op.path.startsWith('name.')) {
+                        const namePart = op.path.split('.')[1];
+                        if (!updated.name)
+                            updated.name = '';
+                        // Simple name handling - in production you'd want more sophisticated parsing
+                        if (namePart === 'givenName') {
+                            updated.name = `${op.value} ${updated.name.split(' ').slice(1).join(' ')}`.trim();
+                        }
+                        else if (namePart === 'familyName') {
+                            updated.name = `${updated.name.split(' ')[0]} ${op.value}`.trim();
+                        }
+                    }
+                    else if (op.path === 'emails') {
+                        // Note: StoredUser doesn't have emails array, only email string
+                        // We'll extract the primary email and update the email field
+                        const emails = op.value;
+                        const primaryEmail = emails?.find((e) => e.primary)?.value || emails?.[0]?.value;
+                        if (primaryEmail)
+                            updated.email = primaryEmail;
+                    }
+                }
+                else if (op.op === 'add' && op.path && op.value !== undefined) {
+                    if (op.path === 'emails') {
+                        // Note: StoredUser doesn't have emails array, only email string
+                        // We'll extract the primary email and update the email field
+                        const newEmails = op.value;
+                        const primaryEmail = newEmails?.find((e) => e.primary)?.value || newEmails?.[0]?.value;
+                        if (primaryEmail)
+                            updated.email = primaryEmail;
+                    }
+                }
+                else if (op.op === 'remove' && op.path) {
+                    if (op.path === 'displayName') {
+                        updated.name = '';
+                    }
+                }
+            }
+            updated.updatedAt = new Date();
+            await store.upsert(updated);
+            return scimResourceResponse(storedUserToScimUser(updated));
+        };
+        /**
+         * Delete a user
+         */
+        const handleDeleteUser = async (id) => {
+            const existing = await store.get(id);
+            if (!existing) {
+                return scimErrorResponse(404, `User ${id} not found`, 'invalidValue');
+            }
+            await store.delete(id);
+            return new Response(null, { status: 204 });
+        };
+        users_inbound = {
+            handler,
+        };
+    }
+    /**
+     * Top-level handler that routes to users_inbound or groups_inbound based on path
+     */
+    async function topLevelHandler(request, handlerConfig) {
+        const urlObj = new URL(request.url);
+        const path = urlObj.pathname;
+        const usersUrl = handlerConfig?.usersUrl ?? config.usersUrl ?? '/api/iam/Users';
+        const groupsUrl = handlerConfig?.groupsUrl ?? config.groupsUrl ?? '/api/iam/Groups';
+        // Route to users handler if path matches usersUrl
+        if (path.startsWith(usersUrl) && users_inbound) {
+            return users_inbound.handler(request, { basePath: usersUrl });
+        }
+        // Route to groups handler if path matches groupsUrl
+        if (path.startsWith(groupsUrl) && groups_inbound) {
+            return groups_inbound.handler(request, { basePath: groupsUrl });
+        }
+        // If neither matches, return 404
+        return scimErrorResponse(404, 'Resource not found');
+    }
+    return {
+        ...config,
+        createUser,
+        getBaseUrl,
+        groups_outbound,
+        groups_inbound,
+        users_inbound,
+        handler: topLevelHandler,
+    };
+}

package/dist/index.d.ts

@@ -24,11 +24,11 @@ export type { GroupStore, StoredGroup } from './group-store';
 export { InMemoryGroupStore } from './group-store';
 export type { CreateGroupOptions, CreateUserOptions, GroupsInboundHandlerConfig, IAM, IAMConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMUsersInbound, ScimError, ScimListResponse, ScimResult, UsersInboundHandlerConfig, } from './iam';
 export { iam } from './iam';
-export * from './sso-server';
 export type { SessionStore } from './session-store';
 export { InMemorySessionStore } from './session-store';
 export type { SSO, SSOConfig, SSOHandlerConfig } from './sso';
 export { sso } from './sso';
+export * from './sso-server';
 export type { CreateTenantRequest, CreateTenantResponse, EnvironmentType, StoredTenant, TenantStatus, TenantStore, TenantWebhookPayload, } from './tenant';
 export { InMemoryTenantStore, parseTenantRequest, sendTenantWebhook, serializeESConfig, TenantRequestError, } from './tenant';
 export type { BaseUser } from './types/base-user';