@estifanos-sh/convex-auth 0.0.2 → 0.0.4

package/dist/component/connection/scim/identity.js

@@ -1,8 +1,10 @@
 import { ErrorCode } from "../../../shared/codes.js";
-import { vGroupConnectionScimIdentityDoc, vPaginated, vScimResourceType } from "../../model.js";
+import { vPaginated, vScimResourceType } from "../../model.js";
 import schema_default from "../../schema.js";
 import { mutation, query } from "../../_generated/server.js";
-import "../../functions.js";
+import { vGroupConnectionScimIdentityDoc } from "../../documents.js";
+import { revokeSessionState } from "../../session.js";
+import { assertBatchSelectorSize } from "../../batch.js";
 import { ConvexError, v } from "convex/values";
 import { paginationOptsValidator } from "convex/server";
 import { paginator } from "convex-helpers/server/pagination";
@@ -17,11 +19,24 @@ import { paginator } from "convex-helpers/server/pagination";
 *
 * @module
 */
-const vScimUserData = v.object(schema_default.tables.User.validator.fields);
+const vScimUserData = schema_default.tables.User.validator.omit("sessionEpoch");
+const vProfileUpdate = v.union(v.literal("never"), v.literal("missing"), v.literal("always"));
+/** Maximum memberships changed by one SCIM group mutation. */
+const SCIM_GROUP_MEMBERSHIP_BATCH_SIZE = 100;
+const vScimMembershipProgress = v.object({
+	isDone: v.boolean(),
+	continueCursor: v.string()
+});
+function assertScimMembershipBatchSize(memberIds) {
+	if (memberIds.length > SCIM_GROUP_MEMBERSHIP_BATCH_SIZE) throw new ConvexError({
+		code: ErrorCode.INVALID_PARAMETERS,
+		message: `SCIM group membership batches are limited to ${SCIM_GROUP_MEMBERSHIP_BATCH_SIZE} members.`
+	});
+}
 /**
 * Read SCIM identities, overloaded by the args supplied. With
 * `{ connectionId, userIds }` it batch-resolves and returns an array aligned to
-* the input order (`null` per missing user). Otherwise it resolves a single
+* the input order (`null` per missing user; max 100 IDs). Otherwise it resolves a single
 * identity by `(connectionId, resourceType, externalId)`, `(connectionId,
 * userId)`, `userId`, or `mappedGroupId`. Returns `null` when nothing matches.
 */
@@ -38,6 +53,7 @@ const get = query({
 	handler: async (ctx, args) => {
 		if (args.connectionId !== void 0 && args.userIds !== void 0) {
 			const userIds = args.userIds;
+			assertBatchSelectorSize(userIds, "userIds");
 			if (userIds.length === 0) return [];
 			const unique = Array.from(new Set(userIds));
 			const docs = await Promise.all(unique.map((userId) => ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_user_id", (idx) => idx.eq("connectionId", args.connectionId).eq("userId", userId)).first()));
@@ -62,43 +78,29 @@ const list = query({
 		return await paginator(ctx.db, schema_default).query("GroupConnectionScimIdentity").withIndex("group_connection_id", (idx) => idx.eq("connectionId", connectionId)).paginate(paginationOpts);
 	}
 });
-/** Insert a SCIM identity, or patch it when it already exists (keyed by `(connectionId, resourceType, externalId)`). */
-const upsert = mutation({
-	args: {
-		connectionId: v.id("GroupConnection"),
-		groupId: v.id("Group"),
-		resourceType: vScimResourceType,
-		externalId: v.string(),
-		userId: v.optional(v.id("User")),
-		mappedGroupId: v.optional(v.id("Group")),
-		lastProvisionedAt: v.optional(v.number()),
-		active: v.optional(v.boolean()),
-		raw: v.optional(v.any())
-	},
-	returns: v.id("GroupConnectionScimIdentity"),
-	handler: async (ctx, args) => {
-		const existing = await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_resource_type_external_id", (idx) => idx.eq("connectionId", args.connectionId).eq("resourceType", args.resourceType).eq("externalId", args.externalId)).first();
-		if (existing) {
-			await ctx.db.patch("GroupConnectionScimIdentity", existing._id, args);
-			return existing._id;
-		}
-		return await ctx.db.insert("GroupConnectionScimIdentity", args);
-	}
-});
+function providerForConnection(connection) {
+	if (connection.protocol === "oidc") return `oidc:${connection._id}`;
+	if (connection.protocol === "saml") return `saml:${connection._id}`;
+	throw new ConvexError({
+		code: ErrorCode.PROVIDER_NOT_CONFIGURED,
+		message: "SCIM requires an OIDC or SAML connection."
+	});
+}
+function patchProfile(current, next, mode) {
+	if (mode === "never") return {};
+	return Object.fromEntries(Object.entries(next).filter(([key, value]) => value === void 0 ? false : mode === "always" || current[key] === void 0 || current[key] === null || current[key] === ""));
+}
 /**
-* Atomically provision or resolve a SCIM user by both of its durable natural
-* keys: the connection-scoped SCIM external id and the provider Account id.
-* A concurrent retry cannot commit a losing User because the identity and
-* Account index reads participate in the same OCC transaction as the inserts.
-* Existing ownership is preserved; conflicting owners are rejected.
+* Atomically provision a directory-managed user, account, SCIM identity, and
+* membership. Group and provider ownership are derived from the connection.
 */
 const provision = mutation({
 	args: {
 		connectionId: v.id("GroupConnection"),
-		groupId: v.id("Group"),
-		externalId: v.string(),
-		provider: v.string(),
+		externalId: v.optional(v.string()),
 		userData: vScimUserData,
+		profileUpdate: vProfileUpdate,
+		roleIds: v.array(v.string()),
 		lastProvisionedAt: v.optional(v.number()),
 		active: v.optional(v.boolean()),
 		raw: v.optional(v.any())
@@ -108,56 +110,402 @@ const provision = mutation({
 		created: v.boolean()
 	}),
 	handler: async (ctx, args) => {
-		const identity = await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_resource_type_external_id", (idx) => idx.eq("connectionId", args.connectionId).eq("resourceType", "user").eq("externalId", args.externalId)).unique();
-		const account = await ctx.db.query("Account").withIndex("provider_account_id", (idx) => idx.eq("provider", args.provider).eq("providerAccountId", args.externalId)).unique();
+		const connection = await activeScimConnection(ctx, args.connectionId);
+		const provider = providerForConnection(connection);
+		const externalId = args.externalId;
+		const identity = externalId === void 0 ? null : await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_resource_type_external_id", (idx) => idx.eq("connectionId", args.connectionId).eq("resourceType", "user").eq("externalId", externalId)).unique();
+		const account = externalId === void 0 ? null : await ctx.db.query("Account").withIndex("provider_account_id", (idx) => idx.eq("provider", provider).eq("providerAccountId", externalId)).unique();
 		if (identity?.userId !== void 0 && account !== null && identity.userId !== account.userId) throw new ConvexError({
 			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
-			message: "The SCIM identity and provider account belong to different users."
+			message: "SCIM account ownership conflicts."
 		});
 		let userId = identity?.userId ?? account?.userId;
 		let created = false;
-		if (userId !== void 0) {
-			if (await ctx.db.get("User", userId) === null) throw new ConvexError({
-				code: ErrorCode.ACCOUNT_NOT_FOUND,
-				message: "The SCIM identity references a user that no longer exists."
+		if (userId === void 0) {
+			userId = await ctx.db.insert("User", {
+				...args.userData,
+				sessionEpoch: 0
 			});
-		} else {
-			userId = await ctx.db.insert("User", args.userData);
 			created = true;
+		} else {
+			const user = await ctx.db.get("User", userId);
+			if (user === null) throw new ConvexError({
+				code: ErrorCode.ACCOUNT_NOT_FOUND,
+				message: "SCIM user not found."
+			});
+			if (await ctx.db.query("GroupConnectionScimIdentity").withIndex("user_id", (idx) => idx.eq("userId", userId)).filter((query$1) => query$1.neq(query$1.field("connectionId"), args.connectionId)).first() !== null) throw new ConvexError({
+				code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+				message: "User is managed by another SCIM connection."
+			});
+			const patch = patchProfile(user, args.userData, args.profileUpdate);
+			if (Object.keys(patch).length > 0) await ctx.db.patch("User", userId, patch);
 		}
-		if (account === null) await ctx.db.insert("Account", {
+		if (externalId !== void 0 && account === null) await ctx.db.insert("Account", {
 			userId,
-			provider: args.provider,
-			providerAccountId: args.externalId
+			provider,
+			providerAccountId: externalId
 		});
 		const identityData = {
 			connectionId: args.connectionId,
-			groupId: args.groupId,
+			groupId: connection.groupId,
 			resourceType: "user",
-			externalId: args.externalId,
-			userId
+			...externalId === void 0 ? {} : { externalId },
+			userId,
+			active: args.active !== false,
+			...args.lastProvisionedAt === void 0 ? {} : { lastProvisionedAt: args.lastProvisionedAt },
+			...args.raw === void 0 ? {} : { raw: args.raw }
 		};
-		if (args.lastProvisionedAt !== void 0) identityData.lastProvisionedAt = args.lastProvisionedAt;
-		if (args.active !== void 0) identityData.active = args.active;
-		if (args.raw !== void 0) identityData.raw = args.raw;
 		if (identity === null) await ctx.db.insert("GroupConnectionScimIdentity", identityData);
-		else await ctx.db.patch("GroupConnectionScimIdentity", identity._id, identityData);
+		else {
+			if (identity.groupId !== connection.groupId) throw new ConvexError({
+				code: ErrorCode.INVALID_PARAMETERS,
+				message: "SCIM identity group mismatch."
+			});
+			await ctx.db.patch("GroupConnectionScimIdentity", identity._id, identityData);
+		}
+		const membership = await ctx.db.query("GroupMember").withIndex("group_id_user_id", (idx) => idx.eq("groupId", connection.groupId).eq("userId", userId)).unique();
+		const membershipPatch = {
+			roleIds: args.roleIds,
+			status: args.active === false ? "inactive" : "active"
+		};
+		if (membership === null) await ctx.db.insert("GroupMember", {
+			groupId: connection.groupId,
+			userId,
+			...membershipPatch
+		});
+		else await ctx.db.patch("GroupMember", membership._id, membershipPatch);
 		return {
 			userId,
 			created
 		};
 	}
 });
-/** Delete a SCIM identity by id. */
-const remove = mutation({
-	args: { id: v.id("GroupConnectionScimIdentity") },
+/** Atomically update a directory-managed user and its connection membership. */
+const update = mutation({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		userId: v.id("User"),
+		externalId: v.optional(v.string()),
+		userData: vScimUserData,
+		profileUpdate: vProfileUpdate,
+		roleIds: v.array(v.string()),
+		active: v.boolean(),
+		lastProvisionedAt: v.optional(v.number()),
+		raw: v.optional(v.any())
+	},
 	returns: v.null(),
-	handler: async (ctx, { id: identityId }) => {
-		await ctx.db.delete("GroupConnectionScimIdentity", identityId);
+	handler: async (ctx, args) => {
+		const connection = await activeScimConnection(ctx, args.connectionId);
+		const externalId = args.externalId;
+		const identity = await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_user_id", (idx) => idx.eq("connectionId", args.connectionId).eq("userId", args.userId)).unique();
+		if (identity === null || identity.resourceType !== "user" || identity.groupId !== connection.groupId) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "SCIM user not found."
+		});
+		if (await ctx.db.query("GroupConnectionScimIdentity").withIndex("user_id", (idx) => idx.eq("userId", args.userId)).filter((query$1) => query$1.neq(query$1.field("connectionId"), args.connectionId)).first() !== null) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+			message: "User is managed by another SCIM connection."
+		});
+		const conflicting = externalId === void 0 ? null : await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_resource_type_external_id", (idx) => idx.eq("connectionId", args.connectionId).eq("resourceType", "user").eq("externalId", externalId)).unique();
+		if (conflicting !== null && conflicting._id !== identity._id) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+			message: "SCIM external id is already linked."
+		});
+		const user = await ctx.db.get("User", args.userId);
+		if (user === null) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "User not found."
+		});
+		const provider = providerForConnection(connection);
+		const currentExternalId = identity.externalId;
+		const [currentAccount, nextAccount] = await Promise.all([currentExternalId === void 0 ? Promise.resolve(null) : ctx.db.query("Account").withIndex("provider_account_id", (idx) => idx.eq("provider", provider).eq("providerAccountId", currentExternalId)).unique(), externalId === void 0 || currentExternalId === externalId ? Promise.resolve(null) : ctx.db.query("Account").withIndex("provider_account_id", (idx) => idx.eq("provider", provider).eq("providerAccountId", externalId)).unique()]);
+		if (nextAccount !== null && nextAccount.userId !== args.userId) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+			message: "The replacement SCIM external id is already linked."
+		});
+		if (currentAccount !== null && currentAccount.userId !== args.userId) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+			message: "The SCIM account belongs to another user."
+		});
+		const patch = patchProfile(user, args.userData, args.profileUpdate);
+		if (Object.keys(patch).length > 0) await ctx.db.patch("User", args.userId, patch);
+		if (currentExternalId === externalId) {
+			if (externalId !== void 0 && currentAccount === null) await ctx.db.insert("Account", {
+				userId: args.userId,
+				provider,
+				providerAccountId: externalId
+			});
+		} else if (currentAccount !== null) if (externalId === void 0) await ctx.db.delete("Account", currentAccount._id);
+		else if (nextAccount === null) await ctx.db.patch("Account", currentAccount._id, { providerAccountId: externalId });
+		else await ctx.db.delete("Account", currentAccount._id);
+		else if (externalId !== void 0 && nextAccount === null) await ctx.db.insert("Account", {
+			userId: args.userId,
+			provider,
+			providerAccountId: externalId
+		});
+		await ctx.db.patch("GroupConnectionScimIdentity", identity._id, {
+			externalId,
+			active: args.active,
+			lastProvisionedAt: args.lastProvisionedAt,
+			raw: args.raw
+		});
+		const membership = await ctx.db.query("GroupMember").withIndex("group_id_user_id", (idx) => idx.eq("groupId", connection.groupId).eq("userId", args.userId)).unique();
+		const membershipPatch = {
+			roleIds: args.roleIds,
+			status: args.active ? "active" : "inactive"
+		};
+		if (membership === null) await ctx.db.insert("GroupMember", {
+			groupId: connection.groupId,
+			userId: args.userId,
+			...membershipPatch
+		});
+		else await ctx.db.patch("GroupMember", membership._id, membershipPatch);
 		return null;
 	}
 });
+/** Atomically revoke a directory-managed user's membership, sessions, and identity. */
+const revoke = mutation({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		userId: v.id("User"),
+		mode: v.union(v.literal("soft"), v.literal("hard"))
+	},
+	returns: v.object({
+		epoch: v.number(),
+		cleanedSessions: v.number(),
+		cleanupPending: v.boolean()
+	}),
+	handler: async (ctx, args) => {
+		const connection = await activeScimConnection(ctx, args.connectionId);
+		const identity = await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_user_id", (idx) => idx.eq("connectionId", args.connectionId).eq("userId", args.userId)).unique();
+		if (identity === null || identity.resourceType !== "user" || identity.groupId !== connection.groupId) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "SCIM user not found."
+		});
+		if (await ctx.db.query("GroupConnectionScimIdentity").withIndex("user_id", (idx) => idx.eq("userId", args.userId)).filter((query$1) => query$1.neq(query$1.field("connectionId"), args.connectionId)).first() !== null) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+			message: "User is managed by another SCIM connection."
+		});
+		const provider = providerForConnection(connection);
+		const externalId = identity.externalId;
+		const account = externalId === void 0 ? null : await ctx.db.query("Account").withIndex("provider_account_id", (idx) => idx.eq("provider", provider).eq("providerAccountId", externalId)).unique();
+		if (account !== null && account.userId !== args.userId) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+			message: "The SCIM account belongs to another user."
+		});
+		const membership = await ctx.db.query("GroupMember").withIndex("group_id_user_id", (idx) => idx.eq("groupId", connection.groupId).eq("userId", args.userId)).unique();
+		if (membership !== null) await ctx.db.delete("GroupMember", membership._id);
+		if (account !== null) await ctx.db.delete("Account", account._id);
+		const { epoch, cleanedSessions, cleanupPending } = await revokeSessionState(ctx, args.userId);
+		if (args.mode === "hard") await ctx.db.delete("GroupConnectionScimIdentity", identity._id);
+		else await ctx.db.patch("GroupConnectionScimIdentity", identity._id, {
+			active: false,
+			lastProvisionedAt: Date.now()
+		});
+		return {
+			epoch,
+			cleanedSessions,
+			cleanupPending
+		};
+	}
+});
+async function activeScimConnection(ctx, connectionId) {
+	const connection = await ctx.db.get("GroupConnection", connectionId);
+	const scim = connection === null ? null : await ctx.db.query("GroupConnectionScimConfig").withIndex("group_connection_id", (idx) => idx.eq("connectionId", connectionId)).unique();
+	if (connection === null || connection.status !== "active" || scim === null || scim.status !== "active" || scim.groupId !== connection.groupId) throw new ConvexError({
+		code: ErrorCode.INVALID_PARAMETERS,
+		message: "SCIM connection is not active."
+	});
+	return connection;
+}
+async function assertScimMembers(ctx, connection, userIds) {
+	for (const userId of new Set(userIds)) {
+		const [user, identity, membership] = await Promise.all([
+			ctx.db.get("User", userId),
+			ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_user_id", (idx) => idx.eq("connectionId", connection._id).eq("userId", userId)).first(),
+			ctx.db.query("GroupMember").withIndex("group_id_user_id", (idx) => idx.eq("groupId", connection.groupId).eq("userId", userId)).first()
+		]);
+		if (user === null || identity === null && membership === null) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "A SCIM group member is not available through this connection."
+		});
+	}
+}
+async function replaceScimGroupMembers(ctx, groupId, memberIds, roleIds, cursor) {
+	assertScimMembershipBatchSize(memberIds);
+	const wanted = new Set(memberIds);
+	const patch = {
+		roleIds,
+		status: "active"
+	};
+	for (const userId of wanted) {
+		const member = await ctx.db.query("GroupMember").withIndex("group_id_user_id", (idx) => idx.eq("groupId", groupId).eq("userId", userId)).unique();
+		if (member === null) await ctx.db.insert("GroupMember", {
+			groupId,
+			userId,
+			...patch
+		});
+		else await ctx.db.patch("GroupMember", member._id, patch);
+	}
+	const current = await paginator(ctx.db, schema_default).query("GroupMember").withIndex("group_id", (idx) => idx.eq("groupId", groupId)).paginate({
+		numItems: SCIM_GROUP_MEMBERSHIP_BATCH_SIZE,
+		cursor: cursor ?? null
+	});
+	for (const member of current.page) if (!wanted.has(member.userId)) await ctx.db.delete("GroupMember", member._id);
+	return {
+		isDone: current.isDone,
+		continueCursor: current.continueCursor
+	};
+}
+/**
+* Provision a SCIM group and one bounded page of its authoritative membership.
+* Repeat with `continueCursor` until `isDone` is true.
+*/
+const provisionGroup = mutation({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		externalId: v.optional(v.string()),
+		name: v.string(),
+		memberIds: v.array(v.id("User")),
+		roleIds: v.array(v.string()),
+		raw: v.optional(v.any()),
+		cursor: v.optional(v.string())
+	},
+	returns: v.object({
+		groupId: v.id("Group"),
+		created: v.boolean(),
+		...vScimMembershipProgress.fields
+	}),
+	handler: async (ctx, args) => {
+		const connection = await activeScimConnection(ctx, args.connectionId);
+		const externalId = args.externalId;
+		assertScimMembershipBatchSize(args.memberIds);
+		await assertScimMembers(ctx, connection, args.memberIds);
+		const identity = externalId === void 0 ? null : await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_resource_type_external_id", (idx) => idx.eq("connectionId", args.connectionId).eq("resourceType", "group").eq("externalId", externalId)).unique();
+		if (identity !== null && identity.groupId !== connection.groupId) throw new ConvexError({
+			code: ErrorCode.INVALID_PARAMETERS,
+			message: "SCIM identity group mismatch."
+		});
+		let groupId = identity?.mappedGroupId;
+		let created = false;
+		if (groupId === void 0) {
+			const parent = await ctx.db.get("Group", connection.groupId);
+			if (parent === null) throw new ConvexError({
+				code: ErrorCode.INVALID_PARAMETERS,
+				message: "Connection group not found."
+			});
+			groupId = await ctx.db.insert("Group", {
+				name: args.name,
+				type: "organization",
+				parentGroupId: connection.groupId,
+				rootGroupId: parent.rootGroupId ?? parent._id,
+				isRoot: false
+			});
+			created = true;
+		} else {
+			const group = await ctx.db.get("Group", groupId);
+			if (group === null || group.parentGroupId !== connection.groupId) throw new ConvexError({
+				code: ErrorCode.INVALID_PARAMETERS,
+				message: "SCIM group ownership mismatch."
+			});
+			await ctx.db.patch("Group", groupId, { name: args.name });
+		}
+		const identityData = {
+			connectionId: args.connectionId,
+			groupId: connection.groupId,
+			resourceType: "group",
+			...externalId === void 0 ? {} : { externalId },
+			mappedGroupId: groupId,
+			active: true,
+			lastProvisionedAt: Date.now(),
+			...args.raw === void 0 ? {} : { raw: args.raw }
+		};
+		if (identity === null) await ctx.db.insert("GroupConnectionScimIdentity", identityData);
+		else await ctx.db.patch("GroupConnectionScimIdentity", identity._id, identityData);
+		return {
+			groupId,
+			created,
+			...await replaceScimGroupMembers(ctx, groupId, args.memberIds, args.roleIds, args.cursor)
+		};
+	}
+});
+/**
+* Update a SCIM group and one bounded page of its authoritative membership.
+* Repeat with `continueCursor` until `isDone` is true.
+*/
+const updateGroup = mutation({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		groupId: v.id("Group"),
+		name: v.optional(v.string()),
+		memberIds: v.array(v.id("User")),
+		roleIds: v.array(v.string()),
+		raw: v.optional(v.any()),
+		cursor: v.optional(v.string())
+	},
+	returns: vScimMembershipProgress,
+	handler: async (ctx, args) => {
+		const connection = await activeScimConnection(ctx, args.connectionId);
+		assertScimMembershipBatchSize(args.memberIds);
+		const identity = await ctx.db.query("GroupConnectionScimIdentity").withIndex("mapped_group_id", (idx) => idx.eq("mappedGroupId", args.groupId)).unique();
+		if (identity === null || identity.connectionId !== args.connectionId || identity.groupId !== connection.groupId || identity.resourceType !== "group") throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "SCIM group not found."
+		});
+		const group = await ctx.db.get("Group", args.groupId);
+		if (group === null || group.parentGroupId !== connection.groupId) throw new ConvexError({
+			code: ErrorCode.INVALID_PARAMETERS,
+			message: "SCIM group ownership mismatch."
+		});
+		await assertScimMembers(ctx, connection, args.memberIds);
+		if (args.name !== void 0) await ctx.db.patch("Group", args.groupId, { name: args.name });
+		await ctx.db.patch("GroupConnectionScimIdentity", identity._id, {
+			active: true,
+			lastProvisionedAt: Date.now(),
+			...args.raw === void 0 ? {} : { raw: args.raw }
+		});
+		return await replaceScimGroupMembers(ctx, args.groupId, args.memberIds, args.roleIds, args.cursor);
+	}
+});
+/**
+* Revoke a SCIM group in bounded membership pages. The identity and group are
+* removed only when the final page returns `isDone`.
+*/
+const revokeGroup = mutation({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		groupId: v.id("Group"),
+		cursor: v.optional(v.string())
+	},
+	returns: vScimMembershipProgress,
+	handler: async (ctx, args) => {
+		const connection = await activeScimConnection(ctx, args.connectionId);
+		const identity = await ctx.db.query("GroupConnectionScimIdentity").withIndex("mapped_group_id", (idx) => idx.eq("mappedGroupId", args.groupId)).unique();
+		if (identity === null || identity.connectionId !== args.connectionId || identity.groupId !== connection.groupId || identity.resourceType !== "group") throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "SCIM group not found."
+		});
+		const group = await ctx.db.get("Group", args.groupId);
+		if (group === null || group.parentGroupId !== identity.groupId) throw new ConvexError({
+			code: ErrorCode.INVALID_PARAMETERS,
+			message: "SCIM group ownership mismatch."
+		});
+		const members = await paginator(ctx.db, schema_default).query("GroupMember").withIndex("group_id", (idx) => idx.eq("groupId", args.groupId)).paginate({
+			numItems: SCIM_GROUP_MEMBERSHIP_BATCH_SIZE,
+			cursor: args.cursor ?? null
+		});
+		for (const member of members.page) await ctx.db.delete("GroupMember", member._id);
+		if (members.isDone) {
+			await ctx.db.delete("GroupConnectionScimIdentity", identity._id);
+			await ctx.db.delete("Group", args.groupId);
+		}
+		return {
+			isDone: members.isDone,
+			continueCursor: members.continueCursor
+		};
+	}
+});
 
 //#endregion
-export { get, list, provision, remove, upsert };
+export { get, list, provision, provisionGroup, revoke, revokeGroup, update, updateGroup };
 //# sourceMappingURL=identity.js.map