@maroonedsoftware/scim 0.2.23 → 0.3.0

package/AGENTS.md

@@ -83,7 +83,7 @@ contract is inseparable from HTTP.
 | Export            | Kind       | Shape                                                       | Notes                                        |
 | ----------------- | ---------- | ----------------------------------------------------------- | -------------------------------------------- |
 | `ScimError`       | class      | `extends HttpError`                                         | So `errorMiddleware` already understands it. |
-| `scimError`       | function   | `(status, scimType?, detail?) => ScimError`                 | The factory to use.                          |
+| `scimError`       | function   | `(status, scimType?, statusText?) => ScimError`             | The factory to use. The third argument is the HTTP status text; put the operator-facing reason on `.withDetails({ message })`, which `toScimBody` renders as `detail`. |
 | `IsScimError`     | type guard | —                                                           | —                                            |
 | `ScimErrorType`   | type       | `'invalidFilter'`, `'insufficientScope'`, `'mutability'`, … | RFC 7644 §3.12 `scimType` values.            |
 | `ScimErrorSchema` | constant   | The error envelope URN                                      | —                                            |
@@ -95,6 +95,8 @@ contract is inseparable from HTTP.
 | `ScimUserRepository`                                                  | abstract class | Implement over your datastore.                                                                                                                      |
 | `ScimGroupRepository`                                                 | abstract class | Implement over your datastore.                                                                                                                      |
 | `ScimListQuery`                                                       | interface      | `{ filter?: ScimFilterNode; startIndex; count; sortBy?; sortOrder?; attributes?; excludedAttributes? }` — **the parsed AST**, never the raw string. |
+| `projectScimResource`                                                 | function       | `(resource, schemas: ScimSchema[], projection?) => resource` — applies `attributes` / `excludedAttributes` and strips `returned: 'never'`. |
+| `ScimProjection`                                                      | interface      | `{ attributes?: string[]; excludedAttributes?: string[] }` |
 | `ScimListResult<TResource>`                                           | interface      | `{ resources; totalResults }` — `totalResults` is the **filter-matching total**, not the page size.                                                 |
 | `ScimSortOrder`                                                       | type           | `'ascending' \| 'descending'`                                                                                                                       |
 | `ScimUserService` / `ScimGroupService` / `ScimServiceProviderService` | class          | Sit between the router and the repositories.                                                                                                        |
@@ -108,7 +110,7 @@ contract is inseparable from HTTP.
 | `SCIM_MEDIA_TYPE`           | constant  | `'application/scim+json'`                                                          | —                                                                                     |
 | `requireScimScope`          | function  | `(scope: string) => ServerKitRouterMiddleware`                                     | Reads `ctx.authenticationSession.claims.scimScopes`. `*` grants everything.           |
 | `createScimRouter`          | function  | `(options: CreateScimRouterOptions) => Router<unknown, ServerKitContext>`          | Mounts every endpoint below.                                                          |
-| `CreateScimRouterOptions`   | interface | `{ userService, groupService, serviceProviderService, routeGuards?, maxResults? }` | `maxResults` defaults to the service-provider config's `filter.maxResults`, then 200. |
+| `CreateScimRouterOptions`   | interface | `{ userService, groupService, serviceProviderService, routeGuards?, maxResults?, baseUrl? }` | `maxResults` defaults to the service-provider config's `filter.maxResults`, then 200. Set `baseUrl` whenever the router is mounted under a prefix. |
 
 Endpoints mounted: `GET|POST /Users`, `GET|PUT|PATCH|DELETE /Users/:id`, `POST /Users/.search`, the
 same six plus `.search` for `/Groups`, and `GET /Schemas`, `/Schemas/:id`, `/ResourceTypes`,
@@ -145,6 +147,7 @@ const router = createScimRouter({
   groupService: new ScimGroupService(groupRepository, logger),
   serviceProviderService: new ScimServiceProviderService(config),
   routeGuards: [requireScimScope('scim:write')],
+  baseUrl: 'https://api.example.com/scim/v2',
 });
 
 // SCIM mountpoint — note scimErrorMiddleware, not errorMiddleware
@@ -166,12 +169,18 @@ app.use(router.routes()).use(router.allowedMethods());
   Provisioning clients paginate on it, and a wrong value makes Okta or Entra loop or truncate.
 - Populate `claims.scimScopes` (a string array) when minting the bearer session, or every request
   gets a 403.
+- Honour `count: 0` by returning an empty `Resources` array with the real `totalResults`, per RFC
+  7644 §3.4.2.4. The router already parses it that way from both the query string and a `.search`
+  body; a repository that treats `0` as "unset" breaks the count probe Okta and Entra make on
+  connection setup.
 - Honour `startIndex` as **1-based**, per RFC 7644 §3.4.2.4. Off-by-one here silently skips or
   repeats the first record.
 - Apply PATCH with `applyScimPatch` rather than hand-rolling op semantics — value-path filters
   (`emails[type eq "work"].value`) are easy to get subtly wrong.
-- Throw `scimError(status, scimType, detail)` with the right RFC 7644 §3.12 `scimType`. Clients
-  branch on it.
+- Throw `scimError(status, scimType, statusText).withDetails({ message })` with the right RFC 7644
+  §3.12 `scimType`. Clients branch on `scimType`, and `toScimBody` renders `details.message` as the
+  envelope's `detail` (falling back to the status text), which is what an operator reads in Okta or
+  Entra when provisioning fails.
 - Serve `/Schemas`, `/ResourceTypes`, and `/ServiceProviderConfig`. Provisioning clients call them
   during setup and fail the connection without them.
 
@@ -201,6 +210,15 @@ app.use(router.routes()).use(router.allowedMethods());
   `scimContentTypeMiddleware` is what actually enforces the media type if you want strictness.
 - **`schemas` on a resource is a required array of URNs**, not decoration. Omitting the enterprise
   URN on a user with enterprise attributes makes clients ignore them.
+- **`meta.location` needs `baseUrl` to be right.** The services assign a root-relative
+  `/Users/{id}`, because they cannot know where the router is mounted. `createScimRouter` rewrites
+  it (and the `Location` header) against `options.baseUrl`; without that option a deployment under
+  `/scim/v2` emits URIs that provisioning clients then follow to a 404.
+- **Responses are projected by the router, not the repository.** `createScimRouter` runs every user
+  and group response through `projectScimResource`, which applies `attributes` /
+  `excludedAttributes` and strips attributes the schema declares `returned: 'never'`. A repository
+  that stores and returns `password` verbatim is therefore safe on the wire — but do not rely on
+  that if you serve resources through your own routes, and prefer not to store it at all.
 
 ## Working inside this package
 
@@ -227,7 +245,7 @@ Invariants a change must not break:
 - Repositories receive the **parsed AST**, never the raw filter string. That is what keeps backend
   translation the only concern a consumer has.
 - `totalResults` is the filter-matching total. Provisioning clients' pagination depends on it.
-- `startIndex` is 1-based throughout.
+- `startIndex` is 1-based throughout, and `count: 0` means "none, but tell me the total".
 - The SCIM error envelope (`ScimErrorSchema`, `scimType`, `detail`) is a wire contract with Okta,
   Entra ID, and every other provisioning client. It is not ServerKit's error shape.
 - The filter grammar and the PATCH value-path semantics follow RFC 7644. Divergence shows up as an

package/README.md

@@ -9,7 +9,8 @@ This package provides the protocol layer — schemas, filter parser, PATCH appli
 - **Resource schemas** — `User`, `Group`, and the `EnterpriseUser` extension (RFC 7643).
 - **Filter parser** — full SCIM filter grammar (RFC 7644 §3.4.2.2) returning a typed AST.
 - **PATCH applier** — `add` / `replace` / `remove` ops with the path mini-language (RFC 7644 §3.5.2).
-- **Error envelope** — `scimError(status, scimType?)` builder producing the SCIM error JSON.
+- **Attribute projection** — `projectScimResource(resource, schemas, projection)` applies `attributes` / `excludedAttributes` (RFC 7644 §3.9) and always strips `returned: 'never'` attributes such as `password`. The router applies it to every user and group response.
+- **Error envelope** — `scimError(status, scimType?, statusText?)` builder producing the SCIM error JSON; the operator-facing reason goes on `.withDetails({ message })` and is rendered as the envelope's `detail`.
 - **Abstract repositories** — `ScimUserRepository`, `ScimGroupRepository`. The consumer implements these against their datastore.
 - **Services** — `ScimUserService`, `ScimGroupService`, `ScimServiceProviderService`.
 - **Koa middleware** — `scimErrorMiddleware()`, `scimContentTypeMiddleware()`, `requireScimScope(scope)`.
@@ -20,7 +21,16 @@ This package provides the protocol layer — schemas, filter parser, PATCH appli
 ```ts
 import Koa from 'koa';
 import { ServerKitContext, serverKitContextMiddleware, authenticationMiddleware } from '@maroonedsoftware/koa';
-import { createScimRouter, ScimUserRepository, ScimGroupRepository, scimErrorMiddleware } from '@maroonedsoftware/scim';
+import {
+  createScimRouter,
+  requireScimScope,
+  ScimGroupRepository,
+  ScimGroupService,
+  ScimServiceProviderService,
+  ScimUserRepository,
+  ScimUserService,
+  scimErrorMiddleware,
+} from '@maroonedsoftware/scim';
 
 class MyScimUserRepository extends ScimUserRepository {
   // implement against your datastore
@@ -34,23 +44,28 @@ const app = new Koa();
 app.use(serverKitContextMiddleware(container));
 app.use(authenticationMiddleware());
 
+// The router takes services, not repositories: the service owns id and meta
+// assignment, uniqueness, and PATCH application.
+const serviceProviderService = new ScimServiceProviderService({
+  documentationUri: 'https://example.com/scim/docs',
+  patch: { supported: true },
+  filter: { supported: true, maxResults: 200 },
+  sort: { supported: true },
+});
+
 const scimRouter = createScimRouter({
-  userRepository: new MyScimUserRepository(),
-  groupRepository: new MyScimGroupRepository(),
-  basePath: '/scim/v2',
-  serviceProviderConfig: {
-    documentationUri: 'https://example.com/scim/docs',
-    patch: { supported: true },
-    bulk: { supported: false, maxOperations: 0, maxPayloadSize: 0 },
-    filter: { supported: true, maxResults: 200 },
-    changePassword: { supported: false },
-    sort: { supported: true },
-    etag: { supported: false },
-  },
+  userService: new ScimUserService(new MyScimUserRepository(), logger),
+  groupService: new ScimGroupService(new MyScimGroupRepository(), logger),
+  serviceProviderService,
+  routeGuards: [requireScimScope('scim')],
+  // Where this router is reachable. Set it whenever you mount under a prefix,
+  // or `meta.location` and the `Location` header will be wrong.
+  baseUrl: 'https://api.example.com/scim/v2',
 });
 
 app.use(scimErrorMiddleware());
 app.use(scimRouter.routes());
+app.use(scimRouter.allowedMethods());
 ```
 
 ## Authentication

package/dist/errors/scim.error.d.ts

@@ -18,7 +18,16 @@ export declare class ScimError extends HttpError {
     /** SCIM-specific error subtype, see RFC 7644 §3.12. */
     readonly scimType?: ScimErrorType;
     constructor(statusCode: HttpStatusCodes, scimType?: ScimErrorType, message?: HttpStatusMessage<HttpStatusCodes>);
-    /** Build the SCIM error JSON body for this error. */
+    /**
+     * Build the SCIM error JSON body for this error.
+     *
+     * `detail` prefers a string `message` from {@link ServerkitError.details}, falling
+     * back to the error's own message. The package raises errors as
+     * `scimError(409, 'uniqueness', 'Conflict').withDetails({ message: '...' })`, where
+     * the constructor's third argument is only the HTTP status text; without this
+     * preference every provisioning client would see `"detail": "Conflict"` and never
+     * the reason.
+     */
     toScimBody(): {
         schemas: [typeof ScimErrorSchema];
         status: string;

package/dist/errors/scim.error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim.error.d.ts","sourceRoot":"","sources":["../../src/errors/scim.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE9F,6CAA6C;AAC7C,eAAO,MAAM,eAAe,gDAAgD,CAAC;AAE7E;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,SAAS,GACT,YAAY,GACZ,YAAY,GACZ,eAAe,GACf,aAAa,GACb,UAAU,GACV,cAAc,GACd,aAAa,GACb,WAAW,GACX,mBAAmB,GACnB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;GAOG;AACH,qBAAa,SAAU,SAAQ,SAAS;IACtC,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;gBAEtB,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,iBAAiB,CAAC,eAAe,CAAC;IAQ/G,qDAAqD;IACrD,UAAU,IAAI;QAAE,OAAO,EAAE,CAAC,OAAO,eAAe,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;CAQ/G;AAED,wCAAwC;AACxC,eAAO,MAAM,WAAW,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,SAAuC,CAAC;AAE9F;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,GAAI,MAAM,SAAS,eAAe,EACtD,YAAY,MAAM,EAClB,WAAW,aAAa,EACxB,UAAU,iBAAiB,CAAC,MAAM,CAAC,KAClC,SAAyD,CAAC"}
+{"version":3,"file":"scim.error.d.ts","sourceRoot":"","sources":["../../src/errors/scim.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE9F,6CAA6C;AAC7C,eAAO,MAAM,eAAe,gDAAgD,CAAC;AAE7E;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,SAAS,GACT,YAAY,GACZ,YAAY,GACZ,eAAe,GACf,aAAa,GACb,UAAU,GACV,cAAc,GACd,aAAa,GACb,WAAW,GACX,mBAAmB,GACnB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;GAOG;AACH,qBAAa,SAAU,SAAQ,SAAS;IACtC,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;gBAEtB,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,iBAAiB,CAAC,eAAe,CAAC;IAQ/G;;;;;;;;;OASG;IACH,UAAU,IAAI;QAAE,OAAO,EAAE,CAAC,OAAO,eAAe,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;CAS/G;AAED,wCAAwC;AACxC,eAAO,MAAM,WAAW,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,SAAuC,CAAC;AAE9F;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,GAAI,MAAM,SAAS,eAAe,EACtD,YAAY,MAAM,EAClB,WAAW,aAAa,EACxB,UAAU,iBAAiB,CAAC,MAAM,CAAC,KAClC,SAAyD,CAAC"}

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export * from './types/patch.op.js';
 export * from './schemas/index.js';
 export * from './filter/index.js';
 export * from './patch/index.js';
+export * from './projection/index.js';
 export * from './errors/scim.error.js';
 export * from './repositories/index.js';
 export * from './services/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AAGpC,cAAc,oBAAoB,CAAC;AAGnC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,yBAAyB,CAAC;AAGxC,cAAc,qBAAqB,CAAC;AAGpC,cAAc,uBAAuB,CAAC;AAGtC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AAGpC,cAAc,oBAAoB,CAAC;AAGnC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,uBAAuB,CAAC;AAGtC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,yBAAyB,CAAC;AAGxC,cAAc,qBAAqB,CAAC;AAGpC,cAAc,uBAAuB,CAAC;AAGtC,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -662,8 +662,18 @@ var ScimError = class extends HttpError {
     super(statusCode, message);
     this.scimType = scimType;
   }
-  /** Build the SCIM error JSON body for this error. */
+  /**
+  * Build the SCIM error JSON body for this error.
+  *
+  * `detail` prefers a string `message` from {@link ServerkitError.details}, falling
+  * back to the error's own message. The package raises errors as
+  * `scimError(409, 'uniqueness', 'Conflict').withDetails({ message: '...' })`, where
+  * the constructor's third argument is only the HTTP status text; without this
+  * preference every provisioning client would see `"detail": "Conflict"` and never
+  * the reason.
+  */
   toScimBody() {
+    const detailFromDetails = this.details?.message;
     return {
       schemas: [
         ScimErrorSchema
@@ -672,7 +682,7 @@ var ScimError = class extends HttpError {
       ...this.scimType ? {
         scimType: this.scimType
       } : {},
-      detail: this.message
+      detail: typeof detailFromDetails === "string" ? detailFromDetails : this.message
     };
   }
 };
@@ -1320,18 +1330,26 @@ var mergeObject = /* @__PURE__ */ __name((target, source, kind) => {
   for (const [key, val] of Object.entries(source)) {
     const existing = out[key];
     if (Array.isArray(existing) && Array.isArray(val)) {
-      out[key] = [
+      defineOwn(out, key, [
         ...existing,
         ...val
-      ];
+      ]);
     } else if (isPlainObject(existing) && isPlainObject(val)) {
-      out[key] = mergeObject(existing, val, kind);
+      defineOwn(out, key, mergeObject(existing, val, kind));
     } else {
-      out[key] = val;
+      defineOwn(out, key, val);
     }
   }
   return out;
 }, "mergeObject");
+var defineOwn = /* @__PURE__ */ __name((target, key, value) => {
+  Object.defineProperty(target, key, {
+    value,
+    writable: true,
+    enumerable: true,
+    configurable: true
+  });
+}, "defineOwn");
 var evaluateFilter = /* @__PURE__ */ __name((item, filter) => {
   switch (filter.kind) {
     case "comparison":
@@ -1391,6 +1409,98 @@ var isPlainObject = /* @__PURE__ */ __name((value) => {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }, "isPlainObject");
 
+// src/projection/attribute.projection.ts
+var ALWAYS_RETURNED = /* @__PURE__ */ new Set([
+  "id",
+  "schemas",
+  "meta"
+]);
+var isPlainObject2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isPlainObject");
+var splitPath = /* @__PURE__ */ __name((path) => {
+  const urnBoundary = path.lastIndexOf(":");
+  if (urnBoundary === -1) return path.split(".");
+  return [
+    path.slice(0, urnBoundary),
+    ...path.slice(urnBoundary + 1).split(".")
+  ];
+}, "splitPath");
+var PathSet = class PathSet2 {
+  static {
+    __name(this, "PathSet");
+  }
+  paths;
+  constructor(paths) {
+    this.paths = paths.map((p) => splitPath(p).map((s) => s.toLowerCase()));
+  }
+  get empty() {
+    return this.paths.length === 0;
+  }
+  /** Whether `segments` is at or above a requested path — `name` matches a request for `name.givenName`. */
+  coversOrLeadsTo(segments) {
+    const target = segments.map((s) => s.toLowerCase());
+    return this.paths.some((path) => {
+      const shared = Math.min(path.length, target.length);
+      for (let i = 0; i < shared; i++) {
+        if (path[i] !== target[i]) return false;
+      }
+      return true;
+    });
+  }
+  /** Whether `segments` is at or below a requested path — `name.givenName` matches a request for `name`. */
+  isAtOrBelow(segments) {
+    const target = segments.map((s) => s.toLowerCase());
+    return this.paths.some((path) => {
+      if (path.length > target.length) return false;
+      return path.every((segment, i) => segment === target[i]);
+    });
+  }
+};
+var findDefinition = /* @__PURE__ */ __name((definitions, name) => definitions.find((d) => d.name.toLowerCase() === name.toLowerCase()), "findDefinition");
+var projectScimResource = /* @__PURE__ */ __name((resource, schemas, projection = {}) => {
+  const requested = new PathSet(projection.attributes ?? []);
+  const excluded = new PathSet(projection.excludedAttributes ?? []);
+  const mode = !requested.empty ? "include" : !excluded.empty ? "exclude" : "default";
+  const [core, ...extensions] = schemas;
+  const extensionsById = new Map(extensions.map((schema) => [
+    schema.id.toLowerCase(),
+    schema
+  ]));
+  return projectObject(resource, core?.attributes ?? [], extensionsById, [], mode, requested, excluded);
+}, "projectScimResource");
+var projectObject = /* @__PURE__ */ __name((source, definitions, extensionsById, prefix, mode, requested, excluded) => {
+  const out = {};
+  for (const [key, value] of Object.entries(source)) {
+    const segments = [
+      ...prefix,
+      key
+    ];
+    const extension = prefix.length === 0 ? extensionsById.get(key.toLowerCase()) : void 0;
+    const definition = findDefinition(definitions, key);
+    const alwaysReturned = definition?.returned === "always" || prefix.length === 0 && ALWAYS_RETURNED.has(key.toLowerCase());
+    if (definition?.returned === "never") continue;
+    if (!alwaysReturned) {
+      if (mode === "include" && !requested.coversOrLeadsTo(segments)) continue;
+      if (mode === "exclude" && excluded.isAtOrBelow(segments)) continue;
+      if (mode !== "include" && definition?.returned === "request") continue;
+    }
+    if (extension && isPlainObject2(value)) {
+      out[key] = projectObject(value, extension.attributes, extensionsById, segments, mode, requested, excluded);
+      continue;
+    }
+    const subDefinitions = definition?.subAttributes;
+    if (subDefinitions && Array.isArray(value)) {
+      out[key] = value.map((entry) => isPlainObject2(entry) ? projectObject(entry, subDefinitions, extensionsById, segments, mode, requested, excluded) : entry);
+      continue;
+    }
+    if (subDefinitions && isPlainObject2(value)) {
+      out[key] = projectObject(value, subDefinitions, extensionsById, segments, mode, requested, excluded);
+      continue;
+    }
+    out[key] = value;
+  }
+  return out;
+}, "projectObject");
+
 // src/repositories/scim.user.repository.ts
 var ScimUserRepository = class {
   static {
@@ -1455,6 +1565,9 @@ var ScimUserService = class {
   * and `meta.lastModified`, and ensures the resource's `schemas` includes the
   * core User URN (and the EnterpriseUser URN when the extension is present).
   *
+  * An `id` on the payload is ignored: RFC 7643 §3.1 makes it readOnly and
+  * server-assigned.
+  *
   * @throws {ScimError} 400 `invalidValue` when `userName` is missing.
   * @throws {ScimError} 409 `uniqueness` when `userName` already exists.
   */
@@ -1471,7 +1584,7 @@ var ScimUserService = class {
       });
     }
     const now = DateTime.utc().toISO();
-    const id = payload.id ?? randomUUID();
+    const id = randomUUID();
     const user = {
       ...payload,
       id,
@@ -1645,7 +1758,8 @@ var ScimGroupService = class {
   }
   /**
   * Create a new group. Assigns a server-generated `id` and fills `meta`
-  * timestamps.
+  * timestamps. An `id` on the payload is ignored: RFC 7643 §3.1 makes it
+  * readOnly and server-assigned.
   *
   * @throws {ScimError} 400 `invalidValue` when `displayName` is missing.
   * @throws {ScimError} 409 `uniqueness` when `displayName` already exists.
@@ -1663,7 +1777,7 @@ var ScimGroupService = class {
       });
     }
     const now = DateTime2.utc().toISO();
-    const id = payload.id ?? randomUUID2();
+    const id = randomUUID2();
     const group = {
       ...payload,
       id,
@@ -1947,6 +2061,14 @@ var createScimRouter = /* @__PURE__ */ __name((options) => {
     "application/json"
   ]);
   const maxResults = options.maxResults ?? options.serviceProviderService.getServiceProviderConfig().filter.maxResults ?? 200;
+  const baseUrl = options.baseUrl?.replace(/\/+$/, "");
+  const withLocation = /* @__PURE__ */ __name((resource, endpoint) => baseUrl ? {
+    ...resource,
+    meta: {
+      ...resource.meta,
+      location: `${baseUrl}/${endpoint}/${resource.id}`
+    }
+  } : resource, "withLocation");
   router.get("/ServiceProviderConfig", ...guards, async (ctx) => {
     ctx.body = options.serviceProviderService.getServiceProviderConfig();
     ctx.type = SCIM_MEDIA_TYPE;
@@ -1970,37 +2092,38 @@ var createScimRouter = /* @__PURE__ */ __name((options) => {
   router.get("/Users", ...guards, async (ctx) => {
     const query = parseListQueryFromUrl(ctx.query, maxResults);
     const result = await options.userService.list(query);
-    ctx.body = listEnvelope(result.resources, query, result.totalResults);
+    ctx.body = listEnvelope(result.resources.map((user) => projectUser(withLocation(user, "Users"), query)), query, result.totalResults);
     ctx.type = SCIM_MEDIA_TYPE;
   });
   router.post("/Users/.search", ...guards, json, async (ctx) => {
     const requestBody = takeRequestBody(ctx);
     const query = parseListQueryFromBody(requestBody, maxResults);
     const result = await options.userService.list(query);
-    ctx.body = listEnvelope(result.resources, query, result.totalResults);
+    ctx.body = listEnvelope(result.resources.map((user) => projectUser(withLocation(user, "Users"), query)), query, result.totalResults);
     ctx.type = SCIM_MEDIA_TYPE;
   });
   router.post("/Users", ...guards, json, async (ctx) => {
     const payload = takeRequestBody(ctx);
     const created = await options.userService.create(payload);
     ctx.status = 201;
-    ctx.body = created;
+    const located = withLocation(created, "Users");
+    ctx.body = projectUser(located, parseProjectionFromUrl(ctx.query));
     ctx.type = SCIM_MEDIA_TYPE;
-    if (created.meta.location) ctx.set("Location", created.meta.location);
+    if (located.meta.location) ctx.set("Location", located.meta.location);
   });
   router.get("/Users/:id", ...guards, async (ctx) => {
-    ctx.body = await options.userService.get(ctx.params.id);
+    ctx.body = projectUser(withLocation(await options.userService.get(ctx.params.id), "Users"), parseProjectionFromUrl(ctx.query));
     ctx.type = SCIM_MEDIA_TYPE;
   });
   router.put("/Users/:id", ...guards, json, async (ctx) => {
     const payload = takeRequestBody(ctx);
-    ctx.body = await options.userService.replace(ctx.params.id, payload);
+    ctx.body = projectUser(withLocation(await options.userService.replace(ctx.params.id, payload), "Users"), parseProjectionFromUrl(ctx.query));
     ctx.type = SCIM_MEDIA_TYPE;
   });
   router.patch("/Users/:id", ...guards, json, async (ctx) => {
     const requestBody = takeRequestBody(ctx);
     const ops = validatePatchRequest(requestBody);
-    ctx.body = await options.userService.patch(ctx.params.id, ops);
+    ctx.body = projectUser(withLocation(await options.userService.patch(ctx.params.id, ops), "Users"), parseProjectionFromUrl(ctx.query));
     ctx.type = SCIM_MEDIA_TYPE;
   });
   router.delete("/Users/:id", ...guards, async (ctx) => {
@@ -2010,37 +2133,38 @@ var createScimRouter = /* @__PURE__ */ __name((options) => {
   router.get("/Groups", ...guards, async (ctx) => {
     const query = parseListQueryFromUrl(ctx.query, maxResults);
     const result = await options.groupService.list(query);
-    ctx.body = listEnvelope(result.resources, query, result.totalResults);
+    ctx.body = listEnvelope(result.resources.map((group) => projectGroup(withLocation(group, "Groups"), query)), query, result.totalResults);
     ctx.type = SCIM_MEDIA_TYPE;
   });
   router.post("/Groups/.search", ...guards, json, async (ctx) => {
     const requestBody = takeRequestBody(ctx);
     const query = parseListQueryFromBody(requestBody, maxResults);
     const result = await options.groupService.list(query);
-    ctx.body = listEnvelope(result.resources, query, result.totalResults);
+    ctx.body = listEnvelope(result.resources.map((group) => projectGroup(withLocation(group, "Groups"), query)), query, result.totalResults);
     ctx.type = SCIM_MEDIA_TYPE;
   });
   router.post("/Groups", ...guards, json, async (ctx) => {
     const payload = takeRequestBody(ctx);
     const created = await options.groupService.create(payload);
     ctx.status = 201;
-    ctx.body = created;
+    const located = withLocation(created, "Groups");
+    ctx.body = projectGroup(located, parseProjectionFromUrl(ctx.query));
     ctx.type = SCIM_MEDIA_TYPE;
-    if (created.meta.location) ctx.set("Location", created.meta.location);
+    if (located.meta.location) ctx.set("Location", located.meta.location);
   });
   router.get("/Groups/:id", ...guards, async (ctx) => {
-    ctx.body = await options.groupService.get(ctx.params.id);
+    ctx.body = projectGroup(withLocation(await options.groupService.get(ctx.params.id), "Groups"), parseProjectionFromUrl(ctx.query));
     ctx.type = SCIM_MEDIA_TYPE;
   });
   router.put("/Groups/:id", ...guards, json, async (ctx) => {
     const payload = takeRequestBody(ctx);
-    ctx.body = await options.groupService.replace(ctx.params.id, payload);
+    ctx.body = projectGroup(withLocation(await options.groupService.replace(ctx.params.id, payload), "Groups"), parseProjectionFromUrl(ctx.query));
     ctx.type = SCIM_MEDIA_TYPE;
   });
   router.patch("/Groups/:id", ...guards, json, async (ctx) => {
     const requestBody = takeRequestBody(ctx);
     const ops = validatePatchRequest(requestBody);
-    ctx.body = await options.groupService.patch(ctx.params.id, ops);
+    ctx.body = projectGroup(withLocation(await options.groupService.patch(ctx.params.id, ops), "Groups"), parseProjectionFromUrl(ctx.query));
     ctx.type = SCIM_MEDIA_TYPE;
   });
   router.delete("/Groups/:id", ...guards, async (ctx) => {
@@ -2049,6 +2173,18 @@ var createScimRouter = /* @__PURE__ */ __name((options) => {
   });
   return router;
 }, "createScimRouter");
+var userSchemas = [
+  userSchema,
+  enterpriseUserSchema
+];
+var projectUser = /* @__PURE__ */ __name((user, projection) => projectScimResource(user, userSchemas, projection), "projectUser");
+var projectGroup = /* @__PURE__ */ __name((group, projection) => projectScimResource(group, [
+  groupSchema
+], projection), "projectGroup");
+var parseProjectionFromUrl = /* @__PURE__ */ __name((query) => ({
+  attributes: parseCsvParam(pickStringParam(query, "attributes")),
+  excludedAttributes: parseCsvParam(pickStringParam(query, "excludedAttributes"))
+}), "parseProjectionFromUrl");
 var takeRequestBody = /* @__PURE__ */ __name((ctx) => {
   return ctx.parsedBody;
 }, "takeRequestBody");
@@ -2057,7 +2193,7 @@ var parseListQueryFromUrl = /* @__PURE__ */ __name((query, maxResults) => {
   return {
     filter: filterRaw ? parseScimFilter(filterRaw) : void 0,
     startIndex: parsePositiveInt(pickStringParam(query, "startIndex"), 1),
-    count: clamp(parsePositiveInt(pickStringParam(query, "count"), maxResults), 0, maxResults),
+    count: clamp(parseCount(pickStringParam(query, "count"), maxResults), 0, maxResults),
     sortBy: pickStringParam(query, "sortBy"),
     sortOrder: parseSortOrder(pickStringParam(query, "sortOrder")),
     attributes: parseCsvParam(pickStringParam(query, "attributes")),
@@ -2065,7 +2201,7 @@ var parseListQueryFromUrl = /* @__PURE__ */ __name((query, maxResults) => {
   };
 }, "parseListQueryFromUrl");
 var parseListQueryFromBody = /* @__PURE__ */ __name((body, maxResults) => {
-  if (!isPlainObject2(body)) {
+  if (!isPlainObject3(body)) {
     throw scimError(400, "invalidSyntax", "Bad Request").withDetails({
       message: "Search body must be a JSON object"
     });
@@ -2085,6 +2221,12 @@ var parseSortOrder = /* @__PURE__ */ __name((raw) => {
   if (raw === "ascending" || raw === "descending") return raw;
   return void 0;
 }, "parseSortOrder");
+var parseCount = /* @__PURE__ */ __name((raw, fallback) => {
+  if (raw === void 0) return fallback;
+  const n = Number(raw);
+  if (!Number.isFinite(n)) return fallback;
+  return n < 1 ? 0 : Math.floor(n);
+}, "parseCount");
 var parsePositiveInt = /* @__PURE__ */ __name((raw, fallback) => {
   if (raw === void 0) return fallback;
   const n = Number(raw);
@@ -2104,7 +2246,7 @@ var pickStringParam = /* @__PURE__ */ __name((query, key) => {
   return void 0;
 }, "pickStringParam");
 var validatePatchRequest = /* @__PURE__ */ __name((body) => {
-  if (!isPlainObject2(body)) {
+  if (!isPlainObject3(body)) {
     throw scimError(400, "invalidSyntax", "Bad Request").withDetails({
       message: "PATCH request must be a JSON object"
     });
@@ -2130,7 +2272,7 @@ var listEnvelope = /* @__PURE__ */ __name((resources, query, total) => ({
   itemsPerPage: resources.length,
   Resources: resources
 }), "listEnvelope");
-var isPlainObject2 = /* @__PURE__ */ __name((value) => {
+var isPlainObject3 = /* @__PURE__ */ __name((value) => {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }, "isPlainObject");
 export {
@@ -2158,6 +2300,7 @@ export {
   groupResourceType,
   groupSchema,
   parseScimFilter,
+  projectScimResource,
   requireScimScope,
   scimContentTypeMiddleware,
   scimError,