@estifanos-sh/convex-auth 0.0.2 → 0.0.4

package/dist/server/connection/http.js

@@ -1,13 +1,13 @@
 import { ErrorCode } from "../../shared/codes.js";
 import { log } from "../log.js";
 import { convexError } from "../errors.js";
-import { getScimIdentity, getScimIdentityByConnectionAndUser, getScimIdentityByMappedGroup, insertUser, listScimIdentitiesByConnection, provisionScimUser, removeScimIdentity, updateUser, upsertScimIdentity } from "../contract.js";
+import { addConnectionRoutes, convertErrorsToResponse, getCookies } from "../http.js";
+import { redirectToParamCookie, useRedirectToParam } from "../cookies.js";
+import { getScimIdentityByConnectionAndUser, getScimIdentityByMappedGroup, listScimIdentitiesByConnection, provisionScimGroup, provisionScimUser, revokeScimGroup, revokeScimUser, updateScimGroup, updateScimUser } from "../contract.js";
 import { finalizeNormalizedProfile, normalizeStringArray } from "./profile.js";
-import { SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID, decodeGroupOidcState, encodeGroupOidcState, groupOidcProviderId, groupSamlProviderId } from "./shared.js";
+import { SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID, decodeGroupOidcState, encodeGroupOidcState, groupSamlProviderId } from "./shared.js";
 import { createGroupConnectionOidcRuntime } from "./oidc.js";
 import { resolveProvisionedRoleIds } from "./policy.js";
-import { addConnectionRoutes, convertErrorsToResponse, getCookies } from "../http.js";
-import { redirectToParamCookie, useRedirectToParam } from "../cookies.js";
 import { redirectAbsoluteUrl, setURLSearchParam } from "../redirects.js";
 import { createOAuthAuthorizationURL, handleOAuthCallback } from "../oauth/runtime.js";
 import { parseScimListRequest, scimError, scimJson, serializeScimGroup, serializeScimUser } from "./scim.js";
@@ -35,6 +35,8 @@ async function getOidcCallbackParams(request) {
 * warning is logged rather than silently returning a partial first page.
 */
 const SCIM_COLLECT_LIMIT = 5e3;
+/** Maximum members accepted by one authoritative SCIM group replacement. */
+const SCIM_GROUP_MEMBERSHIP_BATCH_SIZE = 100;
 /**
 * Lifetime of a persisted pending SAML AuthnRequest. Bounds how long an ACS
 * response can accept the request; comfortably covers IdP round-trips and the
@@ -53,6 +55,14 @@ const SCIM_FILTER_OPERATORS = {
 	sw: (values, filterValue) => values.some((value) => value.startsWith(filterValue)),
 	ew: (values, filterValue) => values.some((value) => value.endsWith(filterValue))
 };
+/** @internal Post-commit SCIM notifications must never make a committed write retryable. */
+async function notifyScimAfterProvision(notify) {
+	try {
+		await notify?.();
+	} catch (error) {
+		console.error("[auth] SCIM afterProvision hook failed after commit", error);
+	}
+}
 function addGroupHttpRuntime(deps) {
 	if (!deps.hasConnection) return;
 	const { http, auth, config, requireEnv, loadActiveConnectionSamlOrThrow, loadConnectionOidcOrThrow, getGroupConnectionScimContext, loadGroupPolicyOrThrow, emitGroupAuthEvent, generateRandomString, inviteTokenAlphabet: INVITE_TOKEN_ALPHABET, callUserOAuth, callVerifierSignature, sharedOidcRedirectURI } = deps;
@@ -252,16 +262,6 @@ function addGroupHttpRuntime(deps) {
 		if (typeof value === "boolean") return [String(value)];
 		return [];
 	};
-	const applyUserProvisioningPatch = (args) => {
-		const mode = args.policy.updateProfileFromScim ?? "always";
-		if (mode === "never") return {};
-		if (mode === "always") return args.nextUser;
-		return Object.fromEntries(Object.entries(args.nextUser).filter(([key, value]) => {
-			if (value === void 0) return false;
-			const current = args.currentUser[key];
-			return current === void 0 || current === null || current === "";
-		}));
-	};
 	const filterScimCollection = (items, filter, filters) => {
 		if (!filter) return items;
 		const accessor = filters[filter.attribute];
@@ -510,40 +510,35 @@ function addGroupHttpRuntime(deps) {
 				});
 				return out;
 			};
-			/**
-			* Fully enumerate a group's active members for an authoritative
-			* (destructive) membership replace. Unlike {@link collectMembers}, this
-			* refuses to truncate: a `replace` diffs the incoming set against the
-			* current set and removes the difference, so a partial read would
-			* silently drop overflow members. Throws {@link scimCollectOverflow} past
-			* the collect limit so the caller fails the reconcile (413) rather than
-			* completing a partial authoritative replace.
-			*/
+			/** Read a bounded complete snapshot for an authoritative membership replace. */
 			const collectMembersForReplace = async (ctx$1, where) => {
-				const first = await auth.member.list(ctx$1, {
+				const result = await auth.member.list(ctx$1, {
 					where,
 					paginationOpts: {
-						numItems: 200,
+						numItems: SCIM_GROUP_MEMBERSHIP_BATCH_SIZE,
 						cursor: null
 					}
 				});
-				const out = [...first.page];
-				let cursor = first.continueCursor;
-				let done = first.isDone;
-				while (!done) {
-					if (out.length > SCIM_COLLECT_LIMIT) throw scimCollectOverflow();
-					const next = await auth.member.list(ctx$1, {
-						where,
-						paginationOpts: {
-							numItems: 200,
-							cursor
-						}
+				if (!result.isDone) throw scimCollectOverflow();
+				return result.page;
+			};
+			const assertScimMembershipBatchSize = (memberIds) => {
+				let count = 0;
+				for (const _memberId of memberIds) {
+					count += 1;
+					if (count > SCIM_GROUP_MEMBERSHIP_BATCH_SIZE) throw scimCollectOverflow();
+				}
+			};
+			const completeScimGroupReplacement = async (state$1, args) => {
+				let cursor;
+				for (;;) {
+					const result = await updateScimGroup(state$1.ctx, config.component.connection, {
+						...args,
+						cursor
 					});
-					out.push(...next.page);
-					done = next.isDone;
-					cursor = next.continueCursor;
+					if (result.isDone) return;
+					cursor = result.continueCursor;
 				}
-				return out;
 			};
 			const collectGroups = async (ctx$1, where) => {
 				const first = await auth.group.list(ctx$1, {
@@ -574,26 +569,6 @@ function addGroupHttpRuntime(deps) {
 				});
 				return out;
 			};
-			const userInConnectionScope = async (state$1, userId) => {
-				if (await getScimIdentityByConnectionAndUser(state$1.ctx, config.component.connection, {
-					connectionId: state$1.connection._id,
-					userId
-				})) return true;
-				return (await auth.member.list(state$1.ctx, {
-					where: {
-						groupId: state$1.connection.groupId,
-						userId
-					},
-					paginationOpts: {
-						numItems: 1,
-						cursor: null
-					}
-				})).page[0] !== void 0;
-			};
-			const firstInvalidScimMember = async (state$1, userIds) => {
-				for (const userId of userIds) if (!await auth.user.get(state$1.ctx, { id: userId }) || !await userInConnectionScope(state$1, userId)) return userId;
-				return null;
-			};
 			const handleUsersGet = async (state$1) => {
 				if (state$1.parsedPath.resourceId) {
 					const userId = state$1.parsedPath.resourceId;
@@ -693,7 +668,6 @@ function addGroupHttpRuntime(deps) {
 					profile: extracted
 				}) ?? extracted;
 				const externalId = provisionProfile.externalId;
-				const providerId = state$1.connection.protocol === "oidc" ? groupOidcProviderId(state$1.connection._id) : groupSamlProviderId(state$1.connection._id);
 				const provisionedRoleIds = resolveProvisionedRoleIds({
 					policy: state$1.policy,
 					groups: provisionProfile.groups,
@@ -709,71 +683,27 @@ function addGroupHttpRuntime(deps) {
 					...typeof provisionProfile.phone === "string" ? { phoneVerificationTime: Date.now() } : {},
 					...provisionProfile.extend ? { extend: provisionProfile.extend } : {}
 				};
-				const { userId, created } = externalId ? await provisionScimUser(state$1.ctx, config.component.connection, {
+				const { userId, created } = await provisionScimUser(state$1.ctx, config.component.connection, {
 					connectionId: state$1.connection._id,
-					groupId: state$1.connection.groupId,
 					externalId,
-					provider: providerId,
 					userData,
+					profileUpdate: state$1.policy.provisioning.user.updateProfileFromScim,
+					roleIds: provisionedRoleIds,
 					active: provisionProfile.active !== false,
 					raw: body,
 					lastProvisionedAt: Date.now()
-				}) : {
-					userId: await insertUser(state$1.ctx, config.component.user, userData),
-					created: true
-				};
-				const existingUser = created ? null : await auth.user.get(state$1.ctx, { id: userId });
-				if (!created && existingUser === null) throw new ConvexError({
-					code: ErrorCode.ACCOUNT_NOT_FOUND,
-					message: "The SCIM identity references a user that no longer exists."
 				});
-				if (existingUser) {
-					const nextUserData = {
-						name: provisionProfile.name,
-						firstName: provisionProfile.firstName,
-						lastName: provisionProfile.lastName,
-						email: provisionProfile.email,
-						phone: provisionProfile.phone,
-						...provisionProfile.extend ? { extend: provisionProfile.extend } : {}
-					};
-					if (typeof provisionProfile.email === "string") nextUserData.emailVerificationTime = Date.now();
-					if (typeof provisionProfile.phone === "string") nextUserData.phoneVerificationTime = Date.now();
-					const patchData = applyUserProvisioningPatch({
-						currentUser: existingUser,
-						nextUser: nextUserData,
-						policy: state$1.policy.provisioning.user,
-						source: "scim"
-					});
-					if (Object.keys(patchData).length > 0) await updateUser(state$1.ctx, config.component.user, {
-						userId,
-						patch: patchData
-					});
-				}
-				const resolution = await auth.member.get(state$1.ctx, {
-					groupId: state$1.connection.groupId,
-					userId
-				});
-				if (resolution.membership) await auth.member.update(state$1.ctx, {
-					id: resolution.membership._id,
-					patch: { status: body.active === false ? "inactive" : "active" }
-				});
-				else await auth.member.create(state$1.ctx, { data: {
-					groupId: state$1.connection.groupId,
-					userId,
-					roleIds: provisionedRoleIds,
-					status: provisionProfile.active === false ? "inactive" : "active"
-				} });
 				await state$1.recordScimEvent(created ? "connection.scim.user.provisioned" : "connection.scim.user.updated", "success", {
 					type: "user",
 					id: userId
 				});
 				const createdUser = await auth.user.get(state$1.ctx, { id: userId });
-				await config.connection?.hooks?.afterProvision?.({
+				await notifyScimAfterProvision(async () => config.connection?.hooks?.afterProvision?.({
 					protocol: "scim",
 					connectionId: state$1.connection._id,
 					profile: provisionProfile,
 					userId
-				});
+				}));
 				const location = `${state$1.url.origin}${state$1.url.pathname}/${userId}`;
 				return scimJson(serializeScimUser({
 					id: userId,
@@ -793,11 +723,7 @@ function addGroupHttpRuntime(deps) {
 					connectionId: state$1.connection._id,
 					userId
 				});
-				const existingMembership = await auth.member.get(state$1.ctx, {
-					groupId: state$1.connection.groupId,
-					userId
-				});
-				if (!existingIdentity && !existingMembership.membership) return scimError(404, "notFound", "User not found.");
+				if (!existingIdentity) return scimError(404, "notFound", "User not found.");
 				const body = await readScimJson(state$1.request);
 				const extractedBase = extractScimProfile(state$1.scimConfig, body);
 				const extracted = await config.connection?.hooks?.profileResolved?.({
@@ -866,34 +792,18 @@ function addGroupHttpRuntime(deps) {
 						unsupportedScimPatch();
 					}
 				}
-				const nextPatchData = applyUserProvisioningPatch({
-					currentUser: existingUser,
-					nextUser: patchData,
-					policy: state$1.policy.provisioning.user,
-					source: "scim"
-				});
-				if (Object.keys(nextPatchData).length > 0) await updateUser(state$1.ctx, config.component.user, {
-					userId,
-					patch: nextPatchData
-				});
-				const resolution = existingMembership;
-				if (resolution.membership) await auth.member.update(state$1.ctx, {
-					id: resolution.membership._id,
-					patch: {
-						roleIds: resolveProvisionedRoleIds({
-							policy: state$1.policy,
-							groups: provisionProfile.groups,
-							roles: provisionProfile.roles
-						}),
-						status: provisionProfile.active === false || nextActive === false ? "inactive" : "active"
-					}
-				});
-				await upsertScimIdentity(state$1.ctx, config.component.connection, {
+				const resolvedExternalId = externalId ?? existingIdentity.externalId;
+				await updateScimUser(state$1.ctx, config.component.connection, {
 					connectionId: state$1.connection._id,
-					groupId: state$1.connection.groupId,
-					resourceType: "user",
-					externalId: externalId ?? existingIdentity?.externalId ?? userId,
 					userId,
+					externalId: resolvedExternalId,
+					userData: patchData,
+					profileUpdate: state$1.policy.provisioning.user.updateProfileFromScim,
+					roleIds: resolveProvisionedRoleIds({
+						policy: state$1.policy,
+						groups: provisionProfile.groups,
+						roles: provisionProfile.roles
+					}),
 					active: provisionProfile.active !== false && nextActive !== false,
 					raw: body,
 					lastProvisionedAt: Date.now()
@@ -903,12 +813,12 @@ function addGroupHttpRuntime(deps) {
 					id: userId
 				});
 				const updatedUser = await auth.user.get(state$1.ctx, { id: userId });
-				await config.connection?.hooks?.afterProvision?.({
+				await notifyScimAfterProvision(async () => config.connection?.hooks?.afterProvision?.({
 					protocol: "scim",
 					connectionId: state$1.connection._id,
 					profile: provisionProfile,
 					userId
-				});
+				}));
 				const location = `${state$1.url.origin}${state$1.url.pathname}`;
 				return scimJson(serializeScimUser({
 					id: userId,
@@ -922,35 +832,22 @@ function addGroupHttpRuntime(deps) {
 				const missing = requireScimResourceId(state$1.parsedPath.resourceId, "User");
 				if (missing) return missing;
 				const userId = state$1.parsedPath.resourceId;
-				const identity = await getScimIdentityByConnectionAndUser(state$1.ctx, config.component.connection, {
+				if (!await getScimIdentityByConnectionAndUser(state$1.ctx, config.component.connection, {
 					connectionId: state$1.connection._id,
 					userId
+				})) return scimError(404, "notFound", "User not found.");
+				const { cleanupPending } = await revokeScimUser(state$1.ctx, config.component.connection, {
+					connectionId: state$1.connection._id,
+					userId,
+					mode: state$1.policy.provisioning.deprovision.mode
 				});
-				if (!identity) return scimError(404, "notFound", "User not found.");
-				const resolution = await auth.member.get(state$1.ctx, {
-					groupId: state$1.connection.groupId,
-					userId
-				});
-				if (resolution.membership) await auth.member.remove(state$1.ctx, { id: resolution.membership._id });
-				const { revoked } = await state$1.ctx.runMutation(config.component.session.revokeForUser, { userId });
-				if (revoked > 0) await state$1.recordScimEvent("session.invalidated", "success", {
+				await state$1.recordScimEvent("session.invalidated", "success", {
 					type: "user",
 					id: userId
 				}, {
 					userId,
-					reason: "connection_deprovision"
-				});
-				if (state$1.policy.provisioning.deprovision.mode === "hard") await removeScimIdentity(state$1.ctx, config.component.connection, identity._id);
-				else await upsertScimIdentity(state$1.ctx, config.component.connection, {
-					connectionId: identity.connectionId,
-					groupId: identity.groupId,
-					resourceType: identity.resourceType,
-					externalId: identity.externalId,
-					userId: identity.userId,
-					mappedGroupId: identity.mappedGroupId,
-					active: false,
-					raw: identity.raw,
-					lastProvisionedAt: Date.now()
+					reason: "connection_deprovision",
+					cleanupPending
 				});
 				await state$1.recordScimEvent("connection.scim.user.deactivated", "success", {
 					type: "user",
@@ -1031,78 +928,41 @@ function addGroupHttpRuntime(deps) {
 			};
 			const handleGroupsPost = async (state$1) => {
 				const body = await readScimJson(state$1.request);
-				const externalId = typeof body.externalId === "string" ? body.externalId : void 0;
-				const existingIdentity = externalId ? await getScimIdentity(state$1.ctx, config.component.connection, {
-					connectionId: state$1.connection._id,
-					resourceType: "group",
-					externalId
-				}) : null;
-				const existingGroup = existingIdentity?.mappedGroupId ? await auth.group.get(state$1.ctx, { id: existingIdentity.mappedGroupId }) : null;
-				const created = existingGroup === null;
-				const provisionedRoleIds = resolveProvisionedRoleIds({
-					policy: state$1.policy,
-					groups: typeof body.displayName === "string" ? [body.displayName] : void 0,
-					roles: pickStringArray(body.roles)
-				});
-				const groupId = existingGroup?._id ? existingGroup._id : await auth.group.create(state$1.ctx, { data: {
-					name: typeof body.displayName === "string" ? body.displayName : "Group",
-					parentGroupId: state$1.connection.groupId,
-					type: "organization"
-				} });
-				if (!created && existingGroup) {
-					const location$1 = `${state$1.url.origin}${state$1.url.pathname}/${groupId}`;
-					return scimJson(serializeScimGroup({
-						id: groupId,
-						group: existingGroup,
-						externalId,
-						location: location$1,
-						members: (await collectMembers(state$1.ctx, {
-							groupId,
-							status: "active"
-						})).map((member) => ({ value: member.userId }))
-					}), 200, { Location: location$1 });
-				}
-				await upsertScimIdentity(state$1.ctx, config.component.connection, {
-					connectionId: state$1.connection._id,
-					groupId: state$1.connection.groupId,
-					resourceType: "group",
-					externalId: externalId ?? groupId,
-					mappedGroupId: groupId,
-					active: true,
-					raw: body,
-					lastProvisionedAt: Date.now()
-				});
-				const currentMembers = await collectMembersForReplace(state$1.ctx, {
-					groupId,
-					status: "active"
-				});
-				const currentByUserId = new Map(currentMembers.map((member) => [member.userId, member]));
-				const nextUserIds = new Set((Array.isArray(body.members) ? body.members : []).map((member) => String(member.value)));
-				const toAddUserIds = [...nextUserIds].filter((userId) => !currentByUserId.has(userId));
-				const invalidMember = await firstInvalidScimMember(state$1, toAddUserIds);
-				if (invalidMember !== null) return scimError(400, "invalidValue", `Group member user not found: ${invalidMember}`);
-				for (const member of currentMembers) if (!nextUserIds.has(member.userId)) await auth.member.remove(state$1.ctx, { id: member._id });
-				for (const userId of toAddUserIds) await auth.member.create(state$1.ctx, { data: {
-					groupId,
-					userId,
-					roleIds: provisionedRoleIds,
-					status: "active"
-				} });
+				const memberIds = (Array.isArray(body.members) ? body.members : []).map((member) => String(member.value));
+				assertScimMembershipBatchSize(memberIds);
+				const externalIdForGroup = typeof body.externalId === "string" ? body.externalId : void 0;
+				let cursor;
+				let provisioned;
+				let created = false;
+				do {
+					provisioned = await provisionScimGroup(state$1.ctx, config.component.connection, {
+						connectionId: state$1.connection._id,
+						externalId: externalIdForGroup,
+						name: typeof body.displayName === "string" ? body.displayName : "Group",
+						memberIds,
+						roleIds: resolveProvisionedRoleIds({
+							policy: state$1.policy,
+							groups: typeof body.displayName === "string" ? [body.displayName] : void 0,
+							roles: pickStringArray(body.roles)
+						}),
+						raw: body,
+						cursor
+					});
+					created ||= provisioned.created;
+					cursor = provisioned.continueCursor;
+				} while (!provisioned.isDone);
 				await state$1.recordScimEvent(created ? "connection.scim.group.provisioned" : "connection.scim.group.updated", "success", {
 					type: "group",
-					id: groupId
+					id: provisioned.groupId
 				});
-				const group = await auth.group.get(state$1.ctx, { id: groupId });
-				const location = `${state$1.url.origin}${state$1.url.pathname}/${groupId}`;
+				const group = await auth.group.get(state$1.ctx, { id: provisioned.groupId });
+				const location = `${state$1.url.origin}${state$1.url.pathname}/${provisioned.groupId}`;
 				return scimJson(serializeScimGroup({
-					id: groupId,
+					id: provisioned.groupId,
 					group: group ?? {},
-					externalId,
+					externalId: externalIdForGroup,
 					location,
-					members: (await collectMembers(state$1.ctx, {
-						groupId,
-						status: "active"
-					})).map((member) => ({ value: member.userId }))
+					members: memberIds.map((value) => ({ value }))
 				}), created ? 201 : 200, { Location: location });
 			};
 			const handleGroupsPatch = async (state$1) => {
@@ -1111,96 +971,74 @@ function addGroupHttpRuntime(deps) {
 				const groupId = state$1.parsedPath.resourceId;
 				const identity = await getScimIdentityByMappedGroup(state$1.ctx, config.component.connection, groupId);
 				if (!identity || identity.connectionId !== state$1.connection._id) return scimError(404, "notFound", "Group not found.");
+				const group = await auth.group.get(state$1.ctx, { id: groupId });
+				if (!group) return scimError(404, "notFound", "Group not found.");
+				const currentMembers = await collectMembersForReplace(state$1.ctx, { groupId });
+				const nextMemberIds = new Set(currentMembers.map((member) => member.userId));
+				let name = typeof group.name === "string" ? group.name : "Group";
 				const body = await readScimJson(state$1.request);
 				const operations = Array.isArray(body.Operations) ? body.Operations : unsupportedScimPatch();
 				for (const operation of operations) {
 					const op = typeof operation.op === "string" ? operation.op.toLowerCase() : "replace";
 					if (operation.path === void 0 && op === "replace" && typeof operation.value === "object" && operation.value !== null) {
 						const value = operation.value;
-						if (typeof value.displayName === "string") await auth.group.update(state$1.ctx, {
-							id: groupId,
-							patch: { name: value.displayName }
-						});
+						if (typeof value.displayName === "string") name = value.displayName;
+						if (Array.isArray(value.members)) {
+							nextMemberIds.clear();
+							for (const member of value.members) nextMemberIds.add(String(member.value));
+						}
 						continue;
 					}
 					if (operation.path === "displayName") {
 						if (op !== "replace" && op !== "add") unsupportedScimPatch();
-						await auth.group.update(state$1.ctx, {
-							id: groupId,
-							patch: { name: operation.value }
-						});
+						if (typeof operation.value === "string") name = operation.value;
+						else unsupportedScimPatch();
 						continue;
 					}
 					if (operation.path === "members" && op === "add") {
 						const addUserIds = (Array.isArray(operation.value) ? operation.value : []).map((member) => String(member.value));
-						const invalidMember = await firstInvalidScimMember(state$1, addUserIds);
-						if (invalidMember !== null) return scimError(400, "invalidValue", `Group member user not found: ${invalidMember}`);
-						for (const userId of addUserIds) if (!(await auth.member.get(state$1.ctx, {
-							groupId,
-							userId
-						})).membership) await auth.member.create(state$1.ctx, { data: {
-							groupId,
-							userId,
-							roleIds: resolveProvisionedRoleIds({
-								policy: state$1.policy,
-								groups: typeof body.displayName === "string" ? [body.displayName] : void 0,
-								roles: pickStringArray(body.roles)
-							}),
-							status: "active"
-						} });
+						for (const userId of addUserIds) nextMemberIds.add(userId);
 						continue;
 					}
 					if (operation.path === "members" && op === "replace") {
-						const currentMembers = await collectMembersForReplace(state$1.ctx, {
-							groupId,
-							status: "active"
-						});
-						const currentUserIds = new Set(currentMembers.map((member) => member.userId));
-						const nextUserIds = new Set((Array.isArray(operation.value) ? operation.value : []).map((member) => String(member.value)));
-						const toAddUserIds = [...nextUserIds].filter((userId) => !currentUserIds.has(userId));
-						const invalidMember = await firstInvalidScimMember(state$1, toAddUserIds);
-						if (invalidMember !== null) return scimError(400, "invalidValue", `Group member user not found: ${invalidMember}`);
-						for (const member of currentMembers) if (!nextUserIds.has(member.userId)) await auth.member.remove(state$1.ctx, { id: member._id });
-						for (const userId of toAddUserIds) await auth.member.create(state$1.ctx, { data: {
-							groupId,
-							userId,
-							roleIds: resolveProvisionedRoleIds({
-								policy: state$1.policy,
-								groups: typeof body.displayName === "string" ? [body.displayName] : void 0,
-								roles: pickStringArray(body.roles)
-							}),
-							status: "active"
-						} });
+						nextMemberIds.clear();
+						for (const member of Array.isArray(operation.value) ? operation.value : []) nextMemberIds.add(String(member.value));
 						continue;
 					}
 					if (typeof operation.path === "string" && op === "remove" && operation.path.startsWith("members[")) {
 						const userId = operation.path.match(/^members\[value eq "([^"]+)"\]$/)?.[1];
-						if (userId) {
-							const resolution = await auth.member.get(state$1.ctx, {
-								groupId,
-								userId
-							});
-							if (resolution.membership) await auth.member.remove(state$1.ctx, { id: resolution.membership._id });
-						}
+						if (userId) nextMemberIds.delete(userId);
 						continue;
 					}
 					unsupportedScimPatch();
 				}
+				assertScimMembershipBatchSize(nextMemberIds);
+				await completeScimGroupReplacement(state$1, {
+					connectionId: state$1.connection._id,
+					groupId,
+					name,
+					memberIds: [...nextMemberIds],
+					roleIds: resolveProvisionedRoleIds({
+						policy: state$1.policy,
+						groups: [name],
+						roles: pickStringArray(body.roles)
+					}),
+					raw: body
+				});
 				await state$1.recordScimEvent("connection.scim.group.updated", "success", {
 					type: "group",
 					id: groupId
 				});
-				const group = await auth.group.get(state$1.ctx, { id: groupId });
 				const location = `${state$1.url.origin}${state$1.url.pathname}`;
-				const members = await collectMembers(state$1.ctx, {
-					groupId,
-					status: "active"
-				});
 				return scimJson(serializeScimGroup({
 					id: groupId,
-					group: group ?? {},
+					group: {
+						...group,
+						name
+					},
+					externalId: identity.externalId,
 					location,
-					members: members.map((member) => ({ value: member.userId }))
+					members: [...nextMemberIds].map((value) => ({ value }))
 				}), 200, { Location: location });
 			};
 			const handleGroupsDelete = async (state$1) => {
@@ -1209,8 +1047,16 @@ function addGroupHttpRuntime(deps) {
 				const groupId = state$1.parsedPath.resourceId;
 				const identity = await getScimIdentityByMappedGroup(state$1.ctx, config.component.connection, groupId);
 				if (!identity || identity.connectionId !== state$1.connection._id) return scimError(404, "notFound", "Group not found.");
-				await auth.group.remove(state$1.ctx, { id: groupId });
-				await removeScimIdentity(state$1.ctx, config.component.connection, identity._id);
+				let cursor;
+				for (;;) {
+					const result = await revokeScimGroup(state$1.ctx, config.component.connection, {
+						connectionId: state$1.connection._id,
+						groupId,
+						cursor
+					});
+					if (result.isDone) break;
+					cursor = result.continueCursor;
+				}
 				await state$1.recordScimEvent("connection.scim.group.deactivated", "success", {
 					type: "group",
 					id: groupId
@@ -1396,7 +1242,6 @@ function addGroupHttpRuntime(deps) {
 			await ctx.runMutation(config.component.connection.saml.request.create, {
 				connectionId: connection._id,
 				requestId: signInRequest.requestId,
-				createdAt: nowMs,
 				expiresAt: nowMs + SAML_LOGIN_REQUEST_TTL_MS
 			});
 			const redirectTo = url.searchParams.get("redirectTo");