@maroonedsoftware/scim 0.1.0

package/dist/index.js

@@ -0,0 +1,2153 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/types/list.response.ts
+var ListResponseSchema = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
+
+// src/types/patch.op.ts
+var PatchOpSchema = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
+
+// src/schemas/user.schema.ts
+var UserSchemaId = "urn:ietf:params:scim:schemas:core:2.0:User";
+var userSchema = {
+  id: UserSchemaId,
+  name: "User",
+  description: "User Account",
+  meta: {
+    resourceType: "Schema",
+    location: `/Schemas/${UserSchemaId}`
+  },
+  attributes: [
+    {
+      name: "userName",
+      type: "string",
+      multiValued: false,
+      description: "Unique identifier for the User, typically used by the user to directly authenticate.",
+      required: true,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "server"
+    },
+    {
+      name: "name",
+      type: "complex",
+      multiValued: false,
+      description: "The components of the user's real name.",
+      required: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none",
+      subAttributes: [
+        {
+          name: "formatted",
+          type: "string",
+          multiValued: false,
+          description: "Full name formatted for display.",
+          required: false,
+          caseExact: false,
+          mutability: "readWrite",
+          returned: "default",
+          uniqueness: "none"
+        },
+        {
+          name: "familyName",
+          type: "string",
+          multiValued: false,
+          description: "Family name (last name).",
+          required: false,
+          caseExact: false,
+          mutability: "readWrite",
+          returned: "default",
+          uniqueness: "none"
+        },
+        {
+          name: "givenName",
+          type: "string",
+          multiValued: false,
+          description: "Given name (first name).",
+          required: false,
+          caseExact: false,
+          mutability: "readWrite",
+          returned: "default",
+          uniqueness: "none"
+        },
+        {
+          name: "middleName",
+          type: "string",
+          multiValued: false,
+          description: "Middle name.",
+          required: false,
+          caseExact: false,
+          mutability: "readWrite",
+          returned: "default",
+          uniqueness: "none"
+        },
+        {
+          name: "honorificPrefix",
+          type: "string",
+          multiValued: false,
+          description: "Honorific prefix (e.g., Ms., Dr.).",
+          required: false,
+          caseExact: false,
+          mutability: "readWrite",
+          returned: "default",
+          uniqueness: "none"
+        },
+        {
+          name: "honorificSuffix",
+          type: "string",
+          multiValued: false,
+          description: "Honorific suffix (e.g., Jr., III).",
+          required: false,
+          caseExact: false,
+          mutability: "readWrite",
+          returned: "default",
+          uniqueness: "none"
+        }
+      ]
+    },
+    {
+      name: "displayName",
+      type: "string",
+      multiValued: false,
+      description: "Name displayed to end-users.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "nickName",
+      type: "string",
+      multiValued: false,
+      description: "Casual name of the User.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "profileUrl",
+      type: "reference",
+      multiValued: false,
+      description: "URL of the User's online profile.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none",
+      referenceTypes: [
+        "external"
+      ]
+    },
+    {
+      name: "title",
+      type: "string",
+      multiValued: false,
+      description: "Title of the User.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "userType",
+      type: "string",
+      multiValued: false,
+      description: "Used to identify the relationship between the organization and the user.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "preferredLanguage",
+      type: "string",
+      multiValued: false,
+      description: "Preferred language as per RFC 7231.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "locale",
+      type: "string",
+      multiValued: false,
+      description: "Default location of the User.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "timezone",
+      type: "string",
+      multiValued: false,
+      description: "Time zone in IANA format.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "active",
+      type: "boolean",
+      multiValued: false,
+      description: "Whether the user is active.",
+      required: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "password",
+      type: "string",
+      multiValued: false,
+      description: "Cleartext password (write-only).",
+      required: false,
+      caseExact: false,
+      mutability: "writeOnly",
+      returned: "never",
+      uniqueness: "none"
+    },
+    {
+      name: "emails",
+      type: "complex",
+      multiValued: true,
+      description: "Email addresses for the user.",
+      required: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none",
+      subAttributes: multiValuedSubAttrs("email")
+    },
+    {
+      name: "phoneNumbers",
+      type: "complex",
+      multiValued: true,
+      description: "Phone numbers for the user.",
+      required: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none",
+      subAttributes: multiValuedSubAttrs("phone")
+    },
+    {
+      name: "groups",
+      type: "complex",
+      multiValued: true,
+      description: "Groups the user is a member of (read-only).",
+      required: false,
+      mutability: "readOnly",
+      returned: "default",
+      uniqueness: "none",
+      subAttributes: [
+        {
+          name: "value",
+          type: "string",
+          multiValued: false,
+          description: "Identifier of the Group.",
+          required: false,
+          caseExact: true,
+          mutability: "readOnly",
+          returned: "default",
+          uniqueness: "none"
+        },
+        {
+          name: "$ref",
+          type: "reference",
+          multiValued: false,
+          description: "URI of the Group resource.",
+          required: false,
+          caseExact: true,
+          mutability: "readOnly",
+          returned: "default",
+          uniqueness: "none",
+          referenceTypes: [
+            "Group"
+          ]
+        },
+        {
+          name: "display",
+          type: "string",
+          multiValued: false,
+          description: "Human-readable Group name.",
+          required: false,
+          caseExact: false,
+          mutability: "readOnly",
+          returned: "default",
+          uniqueness: "none"
+        },
+        {
+          name: "type",
+          type: "string",
+          multiValued: false,
+          description: "Membership type.",
+          required: false,
+          caseExact: false,
+          mutability: "readOnly",
+          returned: "default",
+          uniqueness: "none",
+          canonicalValues: [
+            "direct",
+            "indirect"
+          ]
+        }
+      ]
+    }
+  ]
+};
+function multiValuedSubAttrs(kind) {
+  return [
+    {
+      name: "value",
+      type: "string",
+      multiValued: false,
+      description: `${kind} value.`,
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "display",
+      type: "string",
+      multiValued: false,
+      description: "Human-readable display value.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "type",
+      type: "string",
+      multiValued: false,
+      description: `Function of the ${kind} (e.g., work, home).`,
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "primary",
+      type: "boolean",
+      multiValued: false,
+      description: "Whether this is the primary value.",
+      required: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    }
+  ];
+}
+__name(multiValuedSubAttrs, "multiValuedSubAttrs");
+
+// src/schemas/group.schema.ts
+var GroupSchemaId = "urn:ietf:params:scim:schemas:core:2.0:Group";
+var groupSchema = {
+  id: GroupSchemaId,
+  name: "Group",
+  description: "Group",
+  meta: {
+    resourceType: "Schema",
+    location: `/Schemas/${GroupSchemaId}`
+  },
+  attributes: [
+    {
+      name: "displayName",
+      type: "string",
+      multiValued: false,
+      description: "Human-readable name for the Group.",
+      required: true,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "members",
+      type: "complex",
+      multiValued: true,
+      description: "List of Group members.",
+      required: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none",
+      subAttributes: [
+        {
+          name: "value",
+          type: "string",
+          multiValued: false,
+          description: "Identifier of the member.",
+          required: false,
+          caseExact: true,
+          mutability: "immutable",
+          returned: "default",
+          uniqueness: "none"
+        },
+        {
+          name: "$ref",
+          type: "reference",
+          multiValued: false,
+          description: "URI of the member resource.",
+          required: false,
+          caseExact: true,
+          mutability: "immutable",
+          returned: "default",
+          uniqueness: "none",
+          referenceTypes: [
+            "User",
+            "Group"
+          ]
+        },
+        {
+          name: "display",
+          type: "string",
+          multiValued: false,
+          description: "Human-readable name of the member.",
+          required: false,
+          caseExact: false,
+          mutability: "immutable",
+          returned: "default",
+          uniqueness: "none"
+        },
+        {
+          name: "type",
+          type: "string",
+          multiValued: false,
+          description: "Member type.",
+          required: false,
+          caseExact: false,
+          mutability: "immutable",
+          returned: "default",
+          uniqueness: "none",
+          canonicalValues: [
+            "User",
+            "Group"
+          ]
+        }
+      ]
+    }
+  ]
+};
+
+// src/schemas/enterprise.user.schema.ts
+var EnterpriseUserSchemaId = "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";
+var enterpriseUserSchema = {
+  id: EnterpriseUserSchemaId,
+  name: "EnterpriseUser",
+  description: "Enterprise User extension",
+  meta: {
+    resourceType: "Schema",
+    location: `/Schemas/${EnterpriseUserSchemaId}`
+  },
+  attributes: [
+    {
+      name: "employeeNumber",
+      type: "string",
+      multiValued: false,
+      description: "Employee number.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "costCenter",
+      type: "string",
+      multiValued: false,
+      description: "Cost center.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "organization",
+      type: "string",
+      multiValued: false,
+      description: "Organization name.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "division",
+      type: "string",
+      multiValued: false,
+      description: "Division name.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "department",
+      type: "string",
+      multiValued: false,
+      description: "Department name.",
+      required: false,
+      caseExact: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none"
+    },
+    {
+      name: "manager",
+      type: "complex",
+      multiValued: false,
+      description: "The manager of the user.",
+      required: false,
+      mutability: "readWrite",
+      returned: "default",
+      uniqueness: "none",
+      subAttributes: [
+        {
+          name: "value",
+          type: "string",
+          multiValued: false,
+          description: "Manager user id.",
+          required: false,
+          caseExact: true,
+          mutability: "readWrite",
+          returned: "default",
+          uniqueness: "none"
+        },
+        {
+          name: "$ref",
+          type: "reference",
+          multiValued: false,
+          description: "URI of the manager User resource.",
+          required: false,
+          caseExact: true,
+          mutability: "readWrite",
+          returned: "default",
+          uniqueness: "none",
+          referenceTypes: [
+            "User"
+          ]
+        },
+        {
+          name: "displayName",
+          type: "string",
+          multiValued: false,
+          description: "Manager display name.",
+          required: false,
+          caseExact: false,
+          mutability: "readOnly",
+          returned: "default",
+          uniqueness: "none"
+        }
+      ]
+    }
+  ]
+};
+
+// src/schemas/resource.type.schema.ts
+var ResourceTypeSchemaId = "urn:ietf:params:scim:schemas:core:2.0:ResourceType";
+var userResourceType = {
+  schemas: [
+    ResourceTypeSchemaId
+  ],
+  id: "User",
+  name: "User",
+  endpoint: "/Users",
+  description: "User Account",
+  schema: UserSchemaId,
+  schemaExtensions: [
+    {
+      schema: EnterpriseUserSchemaId,
+      required: false
+    }
+  ],
+  meta: {
+    resourceType: "ResourceType",
+    location: "/ResourceTypes/User"
+  }
+};
+var groupResourceType = {
+  schemas: [
+    ResourceTypeSchemaId
+  ],
+  id: "Group",
+  name: "Group",
+  endpoint: "/Groups",
+  description: "Group",
+  schema: GroupSchemaId,
+  meta: {
+    resourceType: "ResourceType",
+    location: "/ResourceTypes/Group"
+  }
+};
+
+// src/schemas/service.provider.config.schema.ts
+var ServiceProviderConfigSchemaId = "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig";
+var defaultBearer = {
+  type: "oauthbearertoken",
+  name: "OAuth Bearer Token",
+  description: "Authentication scheme using the OAuth Bearer Token Standard.",
+  specUri: "https://www.rfc-editor.org/info/rfc6750",
+  primary: true
+};
+var buildServiceProviderConfig = /* @__PURE__ */ __name((options = {}) => ({
+  schemas: [
+    ServiceProviderConfigSchemaId
+  ],
+  documentationUri: options.documentationUri,
+  patch: options.patch ?? {
+    supported: true
+  },
+  bulk: options.bulk ?? {
+    supported: false,
+    maxOperations: 0,
+    maxPayloadSize: 0
+  },
+  filter: options.filter ?? {
+    supported: true,
+    maxResults: 200
+  },
+  changePassword: options.changePassword ?? {
+    supported: false
+  },
+  sort: options.sort ?? {
+    supported: true
+  },
+  etag: options.etag ?? {
+    supported: false
+  },
+  authenticationSchemes: options.authenticationSchemes ?? [
+    defaultBearer
+  ],
+  meta: {
+    resourceType: "ServiceProviderConfig",
+    location: "/ServiceProviderConfig"
+  }
+}), "buildServiceProviderConfig");
+
+// src/schemas/index.ts
+var coreSchemas = [
+  userSchema,
+  groupSchema,
+  enterpriseUserSchema
+];
+
+// src/errors/scim.error.ts
+import { HttpError } from "@maroonedsoftware/errors";
+var ScimErrorSchema = "urn:ietf:params:scim:api:messages:2.0:Error";
+var ScimError = class _ScimError extends HttpError {
+  static {
+    __name(this, "ScimError");
+  }
+  /** SCIM-specific error subtype, see RFC 7644 §3.12. */
+  scimType;
+  constructor(statusCode, scimType, message) {
+    super(statusCode, message);
+    this.scimType = scimType;
+    Object.setPrototypeOf(this, _ScimError.prototype);
+  }
+  /** Build the SCIM error JSON body for this error. */
+  toScimBody() {
+    return {
+      schemas: [
+        ScimErrorSchema
+      ],
+      status: String(this.statusCode),
+      ...this.scimType ? {
+        scimType: this.scimType
+      } : {},
+      detail: this.message
+    };
+  }
+};
+var IsScimError = /* @__PURE__ */ __name((error) => error instanceof ScimError, "IsScimError");
+var scimError = /* @__PURE__ */ __name((statusCode, scimType, message) => new ScimError(statusCode, scimType, message), "scimError");
+
+// src/filter/filter.tokenizer.ts
+var COMPARISON_OPS = /* @__PURE__ */ new Set([
+  "eq",
+  "ne",
+  "co",
+  "sw",
+  "ew",
+  "gt",
+  "ge",
+  "lt",
+  "le",
+  "pr"
+]);
+var tokenizeScimFilter = /* @__PURE__ */ __name((input) => {
+  const tokens = [];
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (ch === " " || ch === "	" || ch === "\n" || ch === "\r") {
+      i += 1;
+      continue;
+    }
+    if (ch === "(") {
+      tokens.push({
+        kind: "lparen",
+        value: "(",
+        start: i
+      });
+      i += 1;
+      continue;
+    }
+    if (ch === ")") {
+      tokens.push({
+        kind: "rparen",
+        value: ")",
+        start: i
+      });
+      i += 1;
+      continue;
+    }
+    if (ch === "[") {
+      tokens.push({
+        kind: "lbracket",
+        value: "[",
+        start: i
+      });
+      i += 1;
+      continue;
+    }
+    if (ch === "]") {
+      tokens.push({
+        kind: "rbracket",
+        value: "]",
+        start: i
+      });
+      i += 1;
+      continue;
+    }
+    if (ch === '"') {
+      const start = i;
+      i += 1;
+      let value = "";
+      while (i < input.length && input[i] !== '"') {
+        if (input[i] === "\\" && i + 1 < input.length) {
+          const next = input[i + 1];
+          if (next === '"' || next === "\\" || next === "/") {
+            value += next;
+            i += 2;
+            continue;
+          }
+          if (next === "n") {
+            value += "\n";
+            i += 2;
+            continue;
+          }
+          if (next === "t") {
+            value += "	";
+            i += 2;
+            continue;
+          }
+          if (next === "r") {
+            value += "\r";
+            i += 2;
+            continue;
+          }
+          if (next === "b") {
+            value += "\b";
+            i += 2;
+            continue;
+          }
+          if (next === "f") {
+            value += "\f";
+            i += 2;
+            continue;
+          }
+          throw scimError(400, "invalidFilter", "Bad Request").withDetails({
+            position: i,
+            message: `Unsupported escape sequence \\${next}`
+          });
+        }
+        value += input[i];
+        i += 1;
+      }
+      if (i >= input.length) {
+        throw scimError(400, "invalidFilter", "Bad Request").withDetails({
+          position: start,
+          message: "Unterminated string literal"
+        });
+      }
+      i += 1;
+      tokens.push({
+        kind: "string",
+        value,
+        start
+      });
+      continue;
+    }
+    if (ch === "-" || ch >= "0" && ch <= "9") {
+      const start = i;
+      let raw = "";
+      if (ch === "-") {
+        raw += ch;
+        i += 1;
+      }
+      while (i < input.length && /[0-9]/.test(input[i])) {
+        raw += input[i];
+        i += 1;
+      }
+      if (input[i] === ".") {
+        raw += ".";
+        i += 1;
+        while (i < input.length && /[0-9]/.test(input[i])) {
+          raw += input[i];
+          i += 1;
+        }
+      }
+      if (input[i] === "e" || input[i] === "E") {
+        raw += input[i];
+        i += 1;
+        if (input[i] === "+" || input[i] === "-") {
+          raw += input[i];
+          i += 1;
+        }
+        while (i < input.length && /[0-9]/.test(input[i])) {
+          raw += input[i];
+          i += 1;
+        }
+      }
+      const num = Number(raw);
+      if (Number.isNaN(num)) {
+        throw scimError(400, "invalidFilter", "Bad Request").withDetails({
+          position: start,
+          message: `Invalid numeric literal "${raw}"`
+        });
+      }
+      tokens.push({
+        kind: "number",
+        value: num,
+        start
+      });
+      continue;
+    }
+    if (isIdentifierStart(ch)) {
+      const start = i;
+      let raw = "";
+      while (i < input.length && isIdentifierPart(input[i])) {
+        raw += input[i];
+        i += 1;
+      }
+      const lower = raw.toLowerCase();
+      switch (lower) {
+        case "true":
+          tokens.push({
+            kind: "true",
+            value: true,
+            start
+          });
+          continue;
+        case "false":
+          tokens.push({
+            kind: "false",
+            value: false,
+            start
+          });
+          continue;
+        case "null":
+          tokens.push({
+            kind: "null",
+            value: null,
+            start
+          });
+          continue;
+        case "and":
+        case "or":
+        case "not":
+          tokens.push({
+            kind: lower,
+            value: lower,
+            start
+          });
+          continue;
+      }
+      if (COMPARISON_OPS.has(lower)) {
+        tokens.push({
+          kind: "op",
+          value: lower,
+          start
+        });
+        continue;
+      }
+      tokens.push({
+        kind: "identifier",
+        value: raw,
+        start
+      });
+      continue;
+    }
+    throw scimError(400, "invalidFilter", "Bad Request").withDetails({
+      position: i,
+      message: `Unexpected character "${ch}"`
+    });
+  }
+  return tokens;
+}, "tokenizeScimFilter");
+var isIdentifierStart = /* @__PURE__ */ __name((ch) => /[A-Za-z_$]/.test(ch), "isIdentifierStart");
+var isIdentifierPart = /* @__PURE__ */ __name((ch) => /[A-Za-z0-9_.\-:$]/.test(ch), "isIdentifierPart");
+
+// src/filter/filter.parser.ts
+var parseScimFilter = /* @__PURE__ */ __name((input) => {
+  const trimmed = input.trim();
+  if (trimmed.length === 0) {
+    throw scimError(400, "invalidFilter", "Bad Request").withDetails({
+      message: "Filter is empty"
+    });
+  }
+  const tokens = tokenizeScimFilter(trimmed);
+  const parser = new Parser(tokens);
+  const node = parser.parseOr();
+  parser.expectEnd();
+  return node;
+}, "parseScimFilter");
+var Parser = class Parser2 {
+  static {
+    __name(this, "Parser");
+  }
+  tokens;
+  pos = 0;
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  parseOr() {
+    let left = this.parseAnd();
+    while (this.peek()?.kind === "or") {
+      this.consume();
+      const right = this.parseAnd();
+      left = {
+        kind: "logical",
+        operator: "or",
+        left,
+        right
+      };
+    }
+    return left;
+  }
+  parseAnd() {
+    let left = this.parseUnary();
+    while (this.peek()?.kind === "and") {
+      this.consume();
+      const right = this.parseUnary();
+      left = {
+        kind: "logical",
+        operator: "and",
+        left,
+        right
+      };
+    }
+    return left;
+  }
+  parseUnary() {
+    const token = this.peek();
+    if (token?.kind === "not") {
+      this.consume();
+      this.expect("lparen", 'Expected "(" after "not"');
+      const inner = this.parseOr();
+      this.expect("rparen", 'Expected ")" to close "not(...)"');
+      return {
+        kind: "not",
+        filter: inner
+      };
+    }
+    if (token?.kind === "lparen") {
+      this.consume();
+      const inner = this.parseOr();
+      this.expect("rparen", 'Expected ")"');
+      return inner;
+    }
+    return this.parseComparisonOrValuePath();
+  }
+  parseComparisonOrValuePath() {
+    const token = this.peek();
+    if (!token || token.kind !== "identifier") {
+      throw this.error(token, "Expected attribute path");
+    }
+    this.consume();
+    const attribute = String(token.value);
+    const next = this.peek();
+    if (next?.kind === "lbracket") {
+      this.consume();
+      const inner = this.parseOr();
+      this.expect("rbracket", 'Expected "]" to close value-path filter');
+      return {
+        kind: "valuePath",
+        attribute,
+        filter: inner
+      };
+    }
+    if (!next || next.kind !== "op") {
+      throw this.error(next, "Expected comparison operator");
+    }
+    this.consume();
+    const operator = String(next.value);
+    if (operator === "pr") {
+      return {
+        kind: "comparison",
+        attribute,
+        operator
+      };
+    }
+    const valueToken = this.peek();
+    if (!valueToken) {
+      throw this.error(valueToken, `Expected value after operator "${operator}"`);
+    }
+    this.consume();
+    if (valueToken.kind === "string" || valueToken.kind === "number" || valueToken.kind === "true" || valueToken.kind === "false" || valueToken.kind === "null") {
+      return {
+        kind: "comparison",
+        attribute,
+        operator,
+        value: valueToken.value
+      };
+    }
+    throw this.error(valueToken, `Expected literal value after operator "${operator}"`);
+  }
+  expectEnd() {
+    const remaining = this.peek();
+    if (remaining) {
+      throw this.error(remaining, "Unexpected trailing tokens");
+    }
+  }
+  peek() {
+    return this.tokens[this.pos];
+  }
+  consume() {
+    const token = this.tokens[this.pos];
+    this.pos += 1;
+    return token;
+  }
+  expect(kind, message) {
+    const token = this.peek();
+    if (!token || token.kind !== kind) {
+      throw this.error(token, message);
+    }
+    this.consume();
+    return token;
+  }
+  error(token, message) {
+    return scimError(400, "invalidFilter", "Bad Request").withDetails({
+      message,
+      position: token?.start ?? -1
+    });
+  }
+};
+
+// src/patch/patch.applier.ts
+var applyScimPatch = /* @__PURE__ */ __name((resource, ops) => {
+  let next = structuredClone(resource);
+  for (const op of ops) {
+    next = applyOne(next, op);
+  }
+  return next;
+}, "applyScimPatch");
+var applyOne = /* @__PURE__ */ __name((resource, op) => {
+  const kind = normaliseOpKind(op.op);
+  if (op.path === void 0 || op.path === "") {
+    if (kind === "remove") {
+      throw scimError(400, "noTarget", "Bad Request").withDetails({
+        message: '"remove" requires a path'
+      });
+    }
+    if (typeof op.value !== "object" || op.value === null || Array.isArray(op.value)) {
+      throw scimError(400, "invalidValue", "Bad Request").withDetails({
+        message: "Pathless add/replace requires an object value"
+      });
+    }
+    return mergeObject(resource, op.value, kind);
+  }
+  const path = parsePatchPath(op.path);
+  return applyAtPath(resource, path, kind, op.value);
+}, "applyOne");
+var normaliseOpKind = /* @__PURE__ */ __name((op) => {
+  const lower = String(op).toLowerCase();
+  if (lower === "add" || lower === "replace" || lower === "remove") return lower;
+  throw scimError(400, "invalidSyntax", "Bad Request").withDetails({
+    message: `Unknown PATCH op "${op}"`
+  });
+}, "normaliseOpKind");
+var parsePatchPath = /* @__PURE__ */ __name((raw) => {
+  const bracketStart = raw.indexOf("[");
+  if (bracketStart === -1) {
+    return {
+      segments: raw.split(".").filter(Boolean)
+    };
+  }
+  const bracketEnd = findMatchingBracket(raw, bracketStart);
+  if (bracketEnd === -1) {
+    throw scimError(400, "invalidPath", "Bad Request").withDetails({
+      message: "Unterminated value-path filter"
+    });
+  }
+  const head = raw.slice(0, bracketStart);
+  const filterSrc = raw.slice(bracketStart + 1, bracketEnd);
+  const tail = raw.slice(bracketEnd + 1);
+  const segments = head.split(".").filter(Boolean);
+  if (segments.length === 0) {
+    throw scimError(400, "invalidPath", "Bad Request").withDetails({
+      message: "Value-path filter requires a target attribute"
+    });
+  }
+  const filter = parseScimFilter(filterSrc);
+  let filterSubAttr;
+  if (tail.length > 0) {
+    if (!tail.startsWith(".")) {
+      throw scimError(400, "invalidPath", "Bad Request").withDetails({
+        message: 'Expected "." after value-path filter'
+      });
+    }
+    filterSubAttr = tail.slice(1);
+    if (filterSubAttr.length === 0 || filterSubAttr.includes("[")) {
+      throw scimError(400, "invalidPath", "Bad Request").withDetails({
+        message: "Invalid sub-attribute after value-path filter"
+      });
+    }
+  }
+  return {
+    segments,
+    filter,
+    filterSubAttr
+  };
+}, "parsePatchPath");
+var findMatchingBracket = /* @__PURE__ */ __name((input, openIndex) => {
+  let depth = 0;
+  let inString = false;
+  for (let i = openIndex; i < input.length; i += 1) {
+    const ch = input[i];
+    if (inString) {
+      if (ch === "\\") {
+        i += 1;
+        continue;
+      }
+      if (ch === '"') inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      continue;
+    }
+    if (ch === "[") depth += 1;
+    else if (ch === "]") {
+      depth -= 1;
+      if (depth === 0) return i;
+    }
+  }
+  return -1;
+}, "findMatchingBracket");
+var applyAtPath = /* @__PURE__ */ __name((resource, path, kind, value) => {
+  const [head, ...rest] = path.segments;
+  if (!head) {
+    throw scimError(400, "invalidPath", "Bad Request").withDetails({
+      message: "Empty PATCH path"
+    });
+  }
+  if (path.filter && rest.length === 0) {
+    return applyFilteredOp(resource, head, path.filter, path.filterSubAttr, kind, value);
+  }
+  if (rest.length === 0) {
+    return applySimpleOp(resource, head, kind, value);
+  }
+  const child = resource[head];
+  const childObj = isPlainObject(child) ? {
+    ...child
+  } : {};
+  const updated = applyAtPath(childObj, {
+    ...path,
+    segments: rest
+  }, kind, value);
+  return {
+    ...resource,
+    [head]: updated
+  };
+}, "applyAtPath");
+var applySimpleOp = /* @__PURE__ */ __name((resource, attr, kind, value) => {
+  if (kind === "remove") {
+    const next = {
+      ...resource
+    };
+    delete next[attr];
+    return next;
+  }
+  if (kind === "replace") {
+    return {
+      ...resource,
+      [attr]: value
+    };
+  }
+  const existing = resource[attr];
+  if (Array.isArray(existing) && Array.isArray(value)) {
+    return {
+      ...resource,
+      [attr]: [
+        ...existing,
+        ...value
+      ]
+    };
+  }
+  if (Array.isArray(existing) && value !== void 0) {
+    return {
+      ...resource,
+      [attr]: [
+        ...existing,
+        value
+      ]
+    };
+  }
+  if (existing === void 0 && Array.isArray(value)) {
+    return {
+      ...resource,
+      [attr]: [
+        ...value
+      ]
+    };
+  }
+  if (isPlainObject(existing) && isPlainObject(value)) {
+    return {
+      ...resource,
+      [attr]: {
+        ...existing,
+        ...value
+      }
+    };
+  }
+  return {
+    ...resource,
+    [attr]: value
+  };
+}, "applySimpleOp");
+var applyFilteredOp = /* @__PURE__ */ __name((resource, attr, filter, subAttr, kind, value) => {
+  const collection = resource[attr];
+  if (!Array.isArray(collection)) {
+    if (kind === "add") {
+      return {
+        ...resource,
+        [attr]: [
+          {
+            ...value
+          }
+        ]
+      };
+    }
+    throw scimError(400, "noTarget", "Bad Request").withDetails({
+      message: `Attribute "${attr}" is not multi-valued`
+    });
+  }
+  const matched = [];
+  collection.forEach((item, index) => {
+    if (isPlainObject(item) && evaluateFilter(item, filter)) matched.push(index);
+  });
+  if (matched.length === 0 && kind !== "add") {
+    throw scimError(400, "noTarget", "Bad Request").withDetails({
+      message: `No items matched value-path filter on "${attr}"`
+    });
+  }
+  if (kind === "remove") {
+    const next2 = collection.filter((_, idx) => !matched.includes(idx));
+    return {
+      ...resource,
+      [attr]: next2
+    };
+  }
+  if (kind === "add" && matched.length === 0) {
+    const seed = isPlainObject(value) ? {
+      ...value
+    } : {
+      value
+    };
+    return {
+      ...resource,
+      [attr]: [
+        ...collection,
+        seed
+      ]
+    };
+  }
+  const next = collection.map((item, idx) => {
+    if (!matched.includes(idx) || !isPlainObject(item)) return item;
+    if (subAttr !== void 0) {
+      if (kind === "replace" || kind === "add") {
+        return {
+          ...item,
+          [subAttr]: value
+        };
+      }
+    }
+    if (kind === "replace") {
+      return isPlainObject(value) ? {
+        ...item,
+        ...value
+      } : value;
+    }
+    return isPlainObject(value) ? {
+      ...item,
+      ...value
+    } : item;
+  });
+  return {
+    ...resource,
+    [attr]: next
+  };
+}, "applyFilteredOp");
+var mergeObject = /* @__PURE__ */ __name((target, source, kind) => {
+  if (kind === "replace") {
+    return {
+      ...target,
+      ...source
+    };
+  }
+  const out = {
+    ...target
+  };
+  for (const [key, val] of Object.entries(source)) {
+    const existing = out[key];
+    if (Array.isArray(existing) && Array.isArray(val)) {
+      out[key] = [
+        ...existing,
+        ...val
+      ];
+    } else if (isPlainObject(existing) && isPlainObject(val)) {
+      out[key] = mergeObject(existing, val, kind);
+    } else {
+      out[key] = val;
+    }
+  }
+  return out;
+}, "mergeObject");
+var evaluateFilter = /* @__PURE__ */ __name((item, filter) => {
+  switch (filter.kind) {
+    case "comparison":
+      return evaluateComparison(item, filter.attribute, filter.operator, filter.value);
+    case "logical":
+      return filter.operator === "and" ? evaluateFilter(item, filter.left) && evaluateFilter(item, filter.right) : evaluateFilter(item, filter.left) || evaluateFilter(item, filter.right);
+    case "not":
+      return !evaluateFilter(item, filter.filter);
+    case "valuePath": {
+      const nested = item[filter.attribute];
+      if (!Array.isArray(nested)) return false;
+      return nested.some((child) => isPlainObject(child) && evaluateFilter(child, filter.filter));
+    }
+  }
+}, "evaluateFilter");
+var evaluateComparison = /* @__PURE__ */ __name((item, attr, op, value) => {
+  const segments = attr.split(".");
+  let current = item;
+  for (const seg of segments) {
+    if (!isPlainObject(current)) return false;
+    current = current[seg];
+  }
+  if (op === "pr") return current !== void 0 && current !== null && current !== "";
+  if (current === void 0 || current === null) return false;
+  switch (op) {
+    case "eq":
+      return current === value;
+    case "ne":
+      return current !== value;
+    case "co":
+      return typeof current === "string" && typeof value === "string" && current.toLowerCase().includes(value.toLowerCase());
+    case "sw":
+      return typeof current === "string" && typeof value === "string" && current.toLowerCase().startsWith(value.toLowerCase());
+    case "ew":
+      return typeof current === "string" && typeof value === "string" && current.toLowerCase().endsWith(value.toLowerCase());
+    case "gt":
+      return compareScalar(current, value) > 0;
+    case "ge":
+      return compareScalar(current, value) >= 0;
+    case "lt":
+      return compareScalar(current, value) < 0;
+    case "le":
+      return compareScalar(current, value) <= 0;
+    default:
+      return false;
+  }
+}, "evaluateComparison");
+var compareScalar = /* @__PURE__ */ __name((a, b) => {
+  if (typeof a === "number" && typeof b === "number") return a - b;
+  const sa = String(a);
+  const sb = String(b);
+  if (sa < sb) return -1;
+  if (sa > sb) return 1;
+  return 0;
+}, "compareScalar");
+var isPlainObject = /* @__PURE__ */ __name((value) => {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}, "isPlainObject");
+
+// src/repositories/scim.user.repository.ts
+var ScimUserRepository = class {
+  static {
+    __name(this, "ScimUserRepository");
+  }
+};
+
+// src/repositories/scim.group.repository.ts
+var ScimGroupRepository = class {
+  static {
+    __name(this, "ScimGroupRepository");
+  }
+};
+
+// src/services/scim.user.service.ts
+import { randomUUID } from "crypto";
+import { Injectable } from "injectkit";
+import { Logger } from "@maroonedsoftware/logger";
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+var ScimUserService = class {
+  static {
+    __name(this, "ScimUserService");
+  }
+  repository;
+  logger;
+  constructor(repository, logger) {
+    this.repository = repository;
+    this.logger = logger;
+  }
+  /**
+  * Fetch a single user by id.
+  *
+  * @throws {ScimError} 404 if no user exists with the given id.
+  */
+  async get(id) {
+    const user = await this.repository.findById(id);
+    if (!user) throw scimError(404, void 0, "Not Found").withDetails({
+      message: `User "${id}" not found`
+    });
+    return user;
+  }
+  /**
+  * List users matching a parsed SCIM query, returning the page plus the
+  * total number of matches (for the `totalResults` envelope field).
+  */
+  async list(query) {
+    return this.repository.list(query);
+  }
+  /**
+  * Create a new user. Assigns a server-generated `id`, fills `meta.created`
+  * and `meta.lastModified`, and ensures the resource's `schemas` includes the
+  * core User URN (and the EnterpriseUser URN when the extension is present).
+  *
+  * @throws {ScimError} 400 `invalidValue` when `userName` is missing.
+  * @throws {ScimError} 409 `uniqueness` when `userName` already exists.
+  */
+  async create(payload) {
+    if (!payload.userName) {
+      throw scimError(400, "invalidValue", "Bad Request").withDetails({
+        message: '"userName" is required'
+      });
+    }
+    const existing = await this.repository.findByUserName(payload.userName);
+    if (existing) {
+      throw scimError(409, "uniqueness", "Conflict").withDetails({
+        message: `userName "${payload.userName}" already exists`
+      });
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const id = payload.id ?? randomUUID();
+    const user = {
+      ...payload,
+      id,
+      userName: payload.userName,
+      schemas: this.normaliseSchemas(payload.schemas, payload),
+      meta: {
+        resourceType: "User",
+        created: now,
+        lastModified: now,
+        location: `/Users/${id}`
+      }
+    };
+    this.logger.debug("scim: creating user", {
+      id,
+      userName: user.userName
+    });
+    return this.repository.create(user);
+  }
+  /**
+  * Replace an existing user wholesale (PUT semantics). Preserves the original
+  * `id` and `meta.created`; updates `meta.lastModified`.
+  *
+  * @throws {ScimError} 404 when no user exists with the given id.
+  * @throws {ScimError} 400 `invalidValue` when `userName` is missing.
+  * @throws {ScimError} 409 `uniqueness` when changing `userName` would collide
+  *   with another existing user.
+  */
+  async replace(id, payload) {
+    const existing = await this.repository.findById(id);
+    if (!existing) throw scimError(404, void 0, "Not Found").withDetails({
+      message: `User "${id}" not found`
+    });
+    if (!payload.userName) {
+      throw scimError(400, "invalidValue", "Bad Request").withDetails({
+        message: '"userName" is required'
+      });
+    }
+    if (payload.userName !== existing.userName) {
+      const conflict = await this.repository.findByUserName(payload.userName);
+      if (conflict && conflict.id !== id) {
+        throw scimError(409, "uniqueness", "Conflict").withDetails({
+          message: `userName "${payload.userName}" already exists`
+        });
+      }
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const user = {
+      ...payload,
+      id,
+      userName: payload.userName,
+      schemas: this.normaliseSchemas(payload.schemas, payload),
+      meta: {
+        ...existing.meta,
+        lastModified: now,
+        location: existing.meta.location ?? `/Users/${id}`
+      }
+    };
+    return this.repository.replace(id, user);
+  }
+  /**
+  * Apply a sequence of SCIM PATCH ops (RFC 7644 §3.5.2) and persist the
+  * result via `replace`. Updates `meta.lastModified`.
+  *
+  * @throws {ScimError} 404 when no user exists with the given id.
+  * @throws {ScimError} 400 propagated from {@link applyScimPatch} for invalid
+  *   paths, unknown ops, or no-target failures.
+  */
+  async patch(id, ops) {
+    const existing = await this.repository.findById(id);
+    if (!existing) throw scimError(404, void 0, "Not Found").withDetails({
+      message: `User "${id}" not found`
+    });
+    const patched = applyScimPatch(existing, ops);
+    patched.id = existing.id;
+    patched.meta = {
+      ...existing.meta,
+      lastModified: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    return this.repository.replace(id, patched);
+  }
+  /**
+  * Delete a user by id.
+  *
+  * @throws {ScimError} 404 when no user exists with the given id.
+  */
+  async delete(id) {
+    const existing = await this.repository.findById(id);
+    if (!existing) throw scimError(404, void 0, "Not Found").withDetails({
+      message: `User "${id}" not found`
+    });
+    await this.repository.delete(id);
+  }
+  normaliseSchemas(provided, payload) {
+    const schemas = new Set(provided ?? []);
+    schemas.add(UserSchemaId);
+    if (payload[EnterpriseUserSchemaId]) {
+      schemas.add(EnterpriseUserSchemaId);
+    }
+    return Array.from(schemas);
+  }
+};
+ScimUserService = _ts_decorate([
+  Injectable(),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof ScimUserRepository === "undefined" ? Object : ScimUserRepository,
+    typeof Logger === "undefined" ? Object : Logger
+  ])
+], ScimUserService);
+
+// src/services/scim.group.service.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { Injectable as Injectable2 } from "injectkit";
+import { Logger as Logger2 } from "@maroonedsoftware/logger";
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+var ScimGroupService = class {
+  static {
+    __name(this, "ScimGroupService");
+  }
+  repository;
+  logger;
+  constructor(repository, logger) {
+    this.repository = repository;
+    this.logger = logger;
+  }
+  /**
+  * Fetch a single group by id.
+  *
+  * @throws {ScimError} 404 when no group exists with the given id.
+  */
+  async get(id) {
+    const group = await this.repository.findById(id);
+    if (!group) throw scimError(404, void 0, "Not Found").withDetails({
+      message: `Group "${id}" not found`
+    });
+    return group;
+  }
+  /**
+  * List groups matching a parsed SCIM query, returning the page plus the
+  * total number of matches.
+  */
+  async list(query) {
+    return this.repository.list(query);
+  }
+  /**
+  * Create a new group. Assigns a server-generated `id` and fills `meta`
+  * timestamps.
+  *
+  * @throws {ScimError} 400 `invalidValue` when `displayName` is missing.
+  * @throws {ScimError} 409 `uniqueness` when `displayName` already exists.
+  */
+  async create(payload) {
+    if (!payload.displayName) {
+      throw scimError(400, "invalidValue", "Bad Request").withDetails({
+        message: '"displayName" is required'
+      });
+    }
+    const existing = await this.repository.findByDisplayName(payload.displayName);
+    if (existing) {
+      throw scimError(409, "uniqueness", "Conflict").withDetails({
+        message: `displayName "${payload.displayName}" already exists`
+      });
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const id = payload.id ?? randomUUID2();
+    const group = {
+      ...payload,
+      id,
+      displayName: payload.displayName,
+      schemas: this.normaliseSchemas(payload.schemas),
+      meta: {
+        resourceType: "Group",
+        created: now,
+        lastModified: now,
+        location: `/Groups/${id}`
+      }
+    };
+    this.logger.debug("scim: creating group", {
+      id,
+      displayName: group.displayName
+    });
+    return this.repository.create(group);
+  }
+  /**
+  * Replace an existing group wholesale (PUT semantics). Preserves `id` and
+  * `meta.created`; updates `meta.lastModified`.
+  *
+  * @throws {ScimError} 404 when no group exists with the given id.
+  * @throws {ScimError} 400 `invalidValue` when `displayName` is missing.
+  * @throws {ScimError} 409 `uniqueness` when changing `displayName` would collide.
+  */
+  async replace(id, payload) {
+    const existing = await this.repository.findById(id);
+    if (!existing) throw scimError(404, void 0, "Not Found").withDetails({
+      message: `Group "${id}" not found`
+    });
+    if (!payload.displayName) {
+      throw scimError(400, "invalidValue", "Bad Request").withDetails({
+        message: '"displayName" is required'
+      });
+    }
+    if (payload.displayName !== existing.displayName) {
+      const conflict = await this.repository.findByDisplayName(payload.displayName);
+      if (conflict && conflict.id !== id) {
+        throw scimError(409, "uniqueness", "Conflict").withDetails({
+          message: `displayName "${payload.displayName}" already exists`
+        });
+      }
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const group = {
+      ...payload,
+      id,
+      displayName: payload.displayName,
+      schemas: this.normaliseSchemas(payload.schemas),
+      meta: {
+        ...existing.meta,
+        lastModified: now,
+        location: existing.meta.location ?? `/Groups/${id}`
+      }
+    };
+    return this.repository.replace(id, group);
+  }
+  /**
+  * Apply a sequence of SCIM PATCH ops and persist the result. Updates
+  * `meta.lastModified`.
+  *
+  * @throws {ScimError} 404 when no group exists with the given id.
+  * @throws {ScimError} 400 propagated from {@link applyScimPatch}.
+  */
+  async patch(id, ops) {
+    const existing = await this.repository.findById(id);
+    if (!existing) throw scimError(404, void 0, "Not Found").withDetails({
+      message: `Group "${id}" not found`
+    });
+    const patched = applyScimPatch(existing, ops);
+    patched.id = existing.id;
+    patched.meta = {
+      ...existing.meta,
+      lastModified: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    return this.repository.replace(id, patched);
+  }
+  /**
+  * Delete a group by id.
+  *
+  * @throws {ScimError} 404 when no group exists with the given id.
+  */
+  async delete(id) {
+    const existing = await this.repository.findById(id);
+    if (!existing) throw scimError(404, void 0, "Not Found").withDetails({
+      message: `Group "${id}" not found`
+    });
+    await this.repository.delete(id);
+  }
+  normaliseSchemas(provided) {
+    const schemas = new Set(provided ?? []);
+    schemas.add(GroupSchemaId);
+    return Array.from(schemas);
+  }
+};
+ScimGroupService = _ts_decorate2([
+  Injectable2(),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof ScimGroupRepository === "undefined" ? Object : ScimGroupRepository,
+    typeof Logger2 === "undefined" ? Object : Logger2
+  ])
+], ScimGroupService);
+
+// src/services/scim.service.provider.service.ts
+import { Injectable as Injectable3 } from "injectkit";
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+var ScimServiceProviderService = class {
+  static {
+    __name(this, "ScimServiceProviderService");
+  }
+  config;
+  schemas;
+  resourceTypes;
+  constructor(options = {}) {
+    this.config = buildServiceProviderConfig(options);
+    this.schemas = coreSchemas;
+    this.resourceTypes = [
+      userResourceType,
+      groupResourceType
+    ];
+  }
+  /** The materialised `/ServiceProviderConfig` response. */
+  getServiceProviderConfig() {
+    return this.config;
+  }
+  /** Every schema known to this server, served from `/Schemas`. */
+  listSchemas() {
+    return this.schemas;
+  }
+  /**
+  * Look up a single schema by its URN.
+  *
+  * @throws {ScimError} 404 if the URN is not registered.
+  */
+  getSchema(id) {
+    const found = this.schemas.find((s) => s.id === id);
+    if (!found) throw scimError(404, void 0, "Not Found").withDetails({
+      message: `Schema "${id}" not found`
+    });
+    return found;
+  }
+  /** Every resource type known to this server, served from `/ResourceTypes`. */
+  listResourceTypes() {
+    return this.resourceTypes;
+  }
+  /**
+  * Look up a single resource type by id (e.g. `User`, `Group`).
+  *
+  * @throws {ScimError} 404 if the id is not registered.
+  */
+  getResourceType(id) {
+    const found = this.resourceTypes.find((rt) => rt.id === id);
+    if (!found) throw scimError(404, void 0, "Not Found").withDetails({
+      message: `ResourceType "${id}" not found`
+    });
+    return found;
+  }
+};
+ScimServiceProviderService = _ts_decorate3([
+  Injectable3(),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof ScimServiceProviderConfigOptions === "undefined" ? Object : ScimServiceProviderConfigOptions
+  ])
+], ScimServiceProviderService);
+
+// src/middleware/scim.content.type.middleware.ts
+var SCIM_MEDIA_TYPE = "application/scim+json";
+var scimContentTypeMiddleware = /* @__PURE__ */ __name(() => {
+  return async (ctx, next) => {
+    const method = ctx.method.toUpperCase();
+    if (method === "POST" || method === "PUT" || method === "PATCH") {
+      const contentType = (ctx.request.headers["content-type"] ?? "").toLowerCase();
+      if (contentType && !contentType.includes(SCIM_MEDIA_TYPE) && !contentType.includes("application/json")) {
+        throw scimError(415, void 0, "Unsupported Media Type").withDetails({
+          message: `Content-Type must be ${SCIM_MEDIA_TYPE}`
+        });
+      }
+    }
+    await next();
+    if (ctx.body !== void 0 && ctx.body !== null) {
+      ctx.type = SCIM_MEDIA_TYPE;
+    }
+  };
+}, "scimContentTypeMiddleware");
+
+// src/middleware/scim.error.middleware.ts
+import { IsHttpError, IsServerkitError } from "@maroonedsoftware/errors";
+var scimErrorMiddleware = /* @__PURE__ */ __name(() => {
+  return async (ctx, next) => {
+    try {
+      await next();
+      if (ctx.status === 404 && !ctx.body) {
+        const status = 404;
+        ctx.status = status;
+        ctx.type = SCIM_MEDIA_TYPE;
+        ctx.body = {
+          schemas: [
+            ScimErrorSchema
+          ],
+          status: String(status),
+          detail: `Not Found: ${ctx.URL.pathname}`
+        };
+      }
+    } catch (error) {
+      if (IsScimError(error)) {
+        respondWithScimError(ctx, error);
+        ctx.app.emit("error", error, ctx);
+        return;
+      }
+      if (IsHttpError(error)) {
+        respondWithScimError(ctx, new ScimError(error.statusCode).withDetails(error.details ?? {}).withCause(error));
+        ctx.app.emit("error", error, ctx);
+        return;
+      }
+      const status = 500;
+      const detail = IsServerkitError(error) ? error.message : "Internal Server Error";
+      ctx.status = status;
+      ctx.type = SCIM_MEDIA_TYPE;
+      ctx.body = {
+        schemas: [
+          ScimErrorSchema
+        ],
+        status: String(status),
+        detail
+      };
+      ctx.app.emit("error", error, ctx);
+    }
+  };
+}, "scimErrorMiddleware");
+var respondWithScimError = /* @__PURE__ */ __name((ctx, error) => {
+  ctx.status = error.statusCode;
+  ctx.type = SCIM_MEDIA_TYPE;
+  ctx.body = error.toScimBody();
+  if (error.headers) {
+    for (const [name, value] of Object.entries(error.headers)) {
+      ctx.set(name, value);
+    }
+  }
+}, "respondWithScimError");
+
+// src/middleware/require.scim.scope.middleware.ts
+import { invalidAuthenticationSession } from "@maroonedsoftware/authentication";
+var requireScimScope = /* @__PURE__ */ __name((scope) => {
+  return async (ctx, next) => {
+    const session = ctx.authenticationSession;
+    if (!session || session === invalidAuthenticationSession) {
+      throw scimError(401, void 0, "Unauthorized").addHeader("WWW-Authenticate", 'Bearer error="invalid_token"').withDetails({
+        message: "Missing or invalid bearer token"
+      });
+    }
+    const granted = session.claims?.scimScopes;
+    if (!Array.isArray(granted) || !granted.includes("*") && !granted.includes(scope)) {
+      throw scimError(403, "insufficientScope", "Forbidden").withDetails({
+        message: `Scope "${scope}" required`
+      });
+    }
+    await next();
+  };
+}, "requireScimScope");
+
+// src/router/scim.router.ts
+import { bodyParserMiddleware, ServerKitRouter } from "@maroonedsoftware/koa";
+var createScimRouter = /* @__PURE__ */ __name((options) => {
+  const router = ServerKitRouter();
+  const guards = options.routeGuards ?? [];
+  const json = bodyParserMiddleware([
+    SCIM_MEDIA_TYPE,
+    "application/json"
+  ]);
+  const maxResults = options.maxResults ?? options.serviceProviderService.getServiceProviderConfig().filter.maxResults ?? 200;
+  router.get("/ServiceProviderConfig", ...guards, async (ctx) => {
+    ctx.body = options.serviceProviderService.getServiceProviderConfig();
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.get("/Schemas", ...guards, async (ctx) => {
+    ctx.body = listEnvelope(options.serviceProviderService.listSchemas());
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.get("/Schemas/:id", ...guards, async (ctx) => {
+    ctx.body = options.serviceProviderService.getSchema(ctx.params.id);
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.get("/ResourceTypes", ...guards, async (ctx) => {
+    ctx.body = listEnvelope(options.serviceProviderService.listResourceTypes());
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.get("/ResourceTypes/:id", ...guards, async (ctx) => {
+    ctx.body = options.serviceProviderService.getResourceType(ctx.params.id);
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.get("/Users", ...guards, async (ctx) => {
+    const query = parseListQueryFromUrl(ctx.query, maxResults);
+    const result = await options.userService.list(query);
+    ctx.body = listEnvelope(result.resources, query, result.totalResults);
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.post("/Users/.search", ...guards, json, async (ctx) => {
+    const requestBody = takeRequestBody(ctx);
+    const query = parseListQueryFromBody(requestBody, maxResults);
+    const result = await options.userService.list(query);
+    ctx.body = listEnvelope(result.resources, query, result.totalResults);
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.post("/Users", ...guards, json, async (ctx) => {
+    const payload = takeRequestBody(ctx);
+    const created = await options.userService.create(payload);
+    ctx.status = 201;
+    ctx.body = created;
+    ctx.type = SCIM_MEDIA_TYPE;
+    if (created.meta.location) ctx.set("Location", created.meta.location);
+  });
+  router.get("/Users/:id", ...guards, async (ctx) => {
+    ctx.body = await options.userService.get(ctx.params.id);
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.put("/Users/:id", ...guards, json, async (ctx) => {
+    const payload = takeRequestBody(ctx);
+    ctx.body = await options.userService.replace(ctx.params.id, payload);
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.patch("/Users/:id", ...guards, json, async (ctx) => {
+    const requestBody = takeRequestBody(ctx);
+    const ops = validatePatchRequest(requestBody);
+    ctx.body = await options.userService.patch(ctx.params.id, ops);
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.delete("/Users/:id", ...guards, async (ctx) => {
+    await options.userService.delete(ctx.params.id);
+    ctx.status = 204;
+  });
+  router.get("/Groups", ...guards, async (ctx) => {
+    const query = parseListQueryFromUrl(ctx.query, maxResults);
+    const result = await options.groupService.list(query);
+    ctx.body = listEnvelope(result.resources, query, result.totalResults);
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.post("/Groups/.search", ...guards, json, async (ctx) => {
+    const requestBody = takeRequestBody(ctx);
+    const query = parseListQueryFromBody(requestBody, maxResults);
+    const result = await options.groupService.list(query);
+    ctx.body = listEnvelope(result.resources, query, result.totalResults);
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.post("/Groups", ...guards, json, async (ctx) => {
+    const payload = takeRequestBody(ctx);
+    const created = await options.groupService.create(payload);
+    ctx.status = 201;
+    ctx.body = created;
+    ctx.type = SCIM_MEDIA_TYPE;
+    if (created.meta.location) ctx.set("Location", created.meta.location);
+  });
+  router.get("/Groups/:id", ...guards, async (ctx) => {
+    ctx.body = await options.groupService.get(ctx.params.id);
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.put("/Groups/:id", ...guards, json, async (ctx) => {
+    const payload = takeRequestBody(ctx);
+    ctx.body = await options.groupService.replace(ctx.params.id, payload);
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.patch("/Groups/:id", ...guards, json, async (ctx) => {
+    const requestBody = takeRequestBody(ctx);
+    const ops = validatePatchRequest(requestBody);
+    ctx.body = await options.groupService.patch(ctx.params.id, ops);
+    ctx.type = SCIM_MEDIA_TYPE;
+  });
+  router.delete("/Groups/:id", ...guards, async (ctx) => {
+    await options.groupService.delete(ctx.params.id);
+    ctx.status = 204;
+  });
+  return router;
+}, "createScimRouter");
+var takeRequestBody = /* @__PURE__ */ __name((ctx) => {
+  const body = ctx.body;
+  ctx.body = void 0;
+  return body;
+}, "takeRequestBody");
+var parseListQueryFromUrl = /* @__PURE__ */ __name((query, maxResults) => {
+  const filterRaw = pickStringParam(query, "filter");
+  return {
+    filter: filterRaw ? parseScimFilter(filterRaw) : void 0,
+    startIndex: parsePositiveInt(pickStringParam(query, "startIndex"), 1),
+    count: clamp(parsePositiveInt(pickStringParam(query, "count"), maxResults), 0, maxResults),
+    sortBy: pickStringParam(query, "sortBy"),
+    sortOrder: parseSortOrder(pickStringParam(query, "sortOrder")),
+    attributes: parseCsvParam(pickStringParam(query, "attributes")),
+    excludedAttributes: parseCsvParam(pickStringParam(query, "excludedAttributes"))
+  };
+}, "parseListQueryFromUrl");
+var parseListQueryFromBody = /* @__PURE__ */ __name((body, maxResults) => {
+  if (!isPlainObject2(body)) {
+    throw scimError(400, "invalidSyntax", "Bad Request").withDetails({
+      message: "Search body must be a JSON object"
+    });
+  }
+  const filterRaw = typeof body.filter === "string" ? body.filter : void 0;
+  return {
+    filter: filterRaw ? parseScimFilter(filterRaw) : void 0,
+    startIndex: typeof body.startIndex === "number" && body.startIndex > 0 ? Math.floor(body.startIndex) : 1,
+    count: clamp(typeof body.count === "number" ? Math.floor(body.count) : maxResults, 0, maxResults),
+    sortBy: typeof body.sortBy === "string" ? body.sortBy : void 0,
+    sortOrder: parseSortOrder(typeof body.sortOrder === "string" ? body.sortOrder : void 0),
+    attributes: Array.isArray(body.attributes) ? body.attributes.filter((a) => typeof a === "string") : void 0,
+    excludedAttributes: Array.isArray(body.excludedAttributes) ? body.excludedAttributes.filter((a) => typeof a === "string") : void 0
+  };
+}, "parseListQueryFromBody");
+var parseSortOrder = /* @__PURE__ */ __name((raw) => {
+  if (raw === "ascending" || raw === "descending") return raw;
+  return void 0;
+}, "parseSortOrder");
+var parsePositiveInt = /* @__PURE__ */ __name((raw, fallback) => {
+  if (raw === void 0) return fallback;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 1) return fallback;
+  return Math.floor(n);
+}, "parsePositiveInt");
+var clamp = /* @__PURE__ */ __name((value, min, max) => Math.max(min, Math.min(max, value)), "clamp");
+var parseCsvParam = /* @__PURE__ */ __name((raw) => {
+  if (!raw) return void 0;
+  const parts = raw.split(",").map((s) => s.trim()).filter(Boolean);
+  return parts.length > 0 ? parts : void 0;
+}, "parseCsvParam");
+var pickStringParam = /* @__PURE__ */ __name((query, key) => {
+  const value = query[key];
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && typeof value[0] === "string") return value[0];
+  return void 0;
+}, "pickStringParam");
+var validatePatchRequest = /* @__PURE__ */ __name((body) => {
+  if (!isPlainObject2(body)) {
+    throw scimError(400, "invalidSyntax", "Bad Request").withDetails({
+      message: "PATCH request must be a JSON object"
+    });
+  }
+  if (!Array.isArray(body.schemas) || !body.schemas.includes(PatchOpSchema)) {
+    throw scimError(400, "invalidSyntax", "Bad Request").withDetails({
+      message: `PATCH request schemas must include "${PatchOpSchema}"`
+    });
+  }
+  if (!Array.isArray(body.Operations) || body.Operations.length === 0) {
+    throw scimError(400, "invalidValue", "Bad Request").withDetails({
+      message: '"Operations" must be a non-empty array'
+    });
+  }
+  return body.Operations;
+}, "validatePatchRequest");
+var listEnvelope = /* @__PURE__ */ __name((resources, query, total) => ({
+  schemas: [
+    ListResponseSchema
+  ],
+  totalResults: total ?? resources.length,
+  startIndex: query?.startIndex ?? 1,
+  itemsPerPage: resources.length,
+  Resources: resources
+}), "listEnvelope");
+var isPlainObject2 = /* @__PURE__ */ __name((value) => {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}, "isPlainObject");
+export {
+  EnterpriseUserSchemaId,
+  GroupSchemaId,
+  IsScimError,
+  ListResponseSchema,
+  PatchOpSchema,
+  ResourceTypeSchemaId,
+  SCIM_MEDIA_TYPE,
+  ScimError,
+  ScimErrorSchema,
+  ScimGroupRepository,
+  ScimGroupService,
+  ScimServiceProviderService,
+  ScimUserRepository,
+  ScimUserService,
+  ServiceProviderConfigSchemaId,
+  UserSchemaId,
+  applyScimPatch,
+  buildServiceProviderConfig,
+  coreSchemas,
+  createScimRouter,
+  enterpriseUserSchema,
+  groupResourceType,
+  groupSchema,
+  parseScimFilter,
+  requireScimScope,
+  scimContentTypeMiddleware,
+  scimError,
+  scimErrorMiddleware,
+  userResourceType,
+  userSchema
+};
+//# sourceMappingURL=index.js.map