@open-mercato/enterprise 0.4.6-develop-15c18897fc → 0.4.6-develop-34aa847ce6

package/src/modules/sso/api/config/route.ts

@@ -0,0 +1,88 @@
+import { NextResponse } from 'next/server'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { SsoConfigService } from '../../services/ssoConfigService'
+import { ssoConfigAdminCreateSchema, ssoConfigListQuerySchema } from '../../data/validators'
+import { resolveSsoAdminContext } from '../admin-context'
+import { handleSsoAdminApiError } from '../error-handler'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['sso.config.view'] },
+  POST: { requireAuth: true, requireFeatures: ['sso.config.manage'] },
+}
+
+export async function GET(req: Request) {
+  try {
+    const { scope } = await resolveSsoAdminContext(req)
+
+    const url = new URL(req.url)
+    const query = ssoConfigListQuerySchema.parse({
+      page: url.searchParams.get('page') ?? undefined,
+      pageSize: url.searchParams.get('pageSize') ?? undefined,
+      search: url.searchParams.get('search') ?? undefined,
+      organizationId: url.searchParams.get('organizationId') ?? undefined,
+      tenantId: url.searchParams.get('tenantId') ?? undefined,
+    })
+
+    const container = await createRequestContainer()
+    const service = container.resolve<SsoConfigService>('ssoConfigService')
+    const result = await service.list(scope, query)
+
+    return NextResponse.json({ ...result, isSuperAdmin: scope.isSuperAdmin })
+  } catch (err) {
+    return handleSsoAdminApiError(err, 'SSO Config API')
+  }
+}
+
+export async function POST(req: Request) {
+  try {
+    const { scope } = await resolveSsoAdminContext(req)
+
+    const body = await req.json()
+    const parsed = ssoConfigAdminCreateSchema.safeParse(body)
+    if (!parsed.success) {
+      return NextResponse.json({ error: 'Invalid request', details: parsed.error.flatten() }, { status: 400 })
+    }
+
+    const container = await createRequestContainer()
+    const service = container.resolve<SsoConfigService>('ssoConfigService')
+    const config = await service.create(scope, parsed.data)
+
+    return NextResponse.json(config, { status: 201 })
+  } catch (err) {
+    return handleSsoAdminApiError(err, 'SSO Config API')
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'SSO',
+  summary: 'SSO Configuration',
+  methods: {
+    GET: {
+      summary: 'List SSO configurations',
+      description: 'Returns paginated SSO configurations. Admins see their org only; superadmins see all.',
+      tags: ['SSO'],
+      responses: [{ status: 200, description: 'Paginated list of SSO configs' }],
+      errors: [
+        { status: 401, description: 'Unauthorized' },
+        { status: 403, description: 'Forbidden — requires sso.config.view' },
+      ],
+    },
+    POST: {
+      summary: 'Create SSO configuration',
+      description: 'Creates a new SSO configuration for an organization. One config per org.',
+      tags: ['SSO'],
+      requestBody: {
+        contentType: 'application/json',
+        schema: ssoConfigAdminCreateSchema,
+      },
+      responses: [{ status: 201, description: 'SSO config created' }],
+      errors: [
+        { status: 400, description: 'Invalid input' },
+        { status: 401, description: 'Unauthorized' },
+        { status: 403, description: 'Forbidden — requires sso.config.manage' },
+        { status: 409, description: 'Config already exists for this organization' },
+      ],
+    },
+  },
+}

package/src/modules/sso/api/error-handler.ts

@@ -0,0 +1,36 @@
+import { NextResponse } from 'next/server'
+import { SsoAdminAuthError } from './admin-context'
+import { SsoConfigError } from '../services/ssoConfigService'
+import { ScimTokenError } from '../services/scimTokenService'
+import { ScimServiceError } from '../services/scimService'
+import { scimJson, buildScimError } from '../lib/scim-response'
+
+interface SsoHttpError {
+  message: string
+  statusCode: number
+}
+
+function isSsoHttpError(err: unknown): err is SsoHttpError {
+  return (
+    err instanceof SsoAdminAuthError ||
+    err instanceof SsoConfigError ||
+    err instanceof ScimTokenError ||
+    err instanceof ScimServiceError
+  )
+}
+
+export function handleSsoAdminApiError(err: unknown, label: string): NextResponse {
+  if (isSsoHttpError(err)) {
+    return NextResponse.json({ error: err.message }, { status: err.statusCode })
+  }
+  console.error(`[${label}] Error:`, err)
+  return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+}
+
+export function handleScimApiError(err: unknown, label: string): Response {
+  if (err instanceof ScimServiceError) {
+    return scimJson(buildScimError(err.statusCode, err.message), err.statusCode)
+  }
+  console.error(`[${label}] Error:`, err)
+  return scimJson(buildScimError(500, 'Internal server error'), 500)
+}

package/src/modules/sso/api/hrd/route.ts

@@ -0,0 +1,55 @@
+import { NextResponse } from 'next/server'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { HrdService } from '../../services/hrdService'
+import { hrdRequestSchema } from '../../data/validators'
+
+export async function POST(req: Request) {
+  try {
+    const body = await req.json()
+    const parsed = hrdRequestSchema.safeParse(body)
+
+    if (!parsed.success) {
+      return NextResponse.json({ error: 'Invalid request' }, { status: 400 })
+    }
+
+    const container = await createRequestContainer()
+    const hrdService = container.resolve<HrdService>('hrdService')
+    const config = await hrdService.findActiveConfigByEmailDomain(parsed.data.email)
+
+    if (!config) {
+      return NextResponse.json({ hasSso: false })
+    }
+
+    return NextResponse.json({
+      hasSso: true,
+      configId: config.id,
+      protocol: config.protocol,
+    })
+  } catch (err) {
+    console.error('[SSO HRD] Error:', err)
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'SSO',
+  summary: 'Home Realm Discovery',
+  methods: {
+    POST: {
+      summary: 'Check if email domain has SSO configured',
+      description: 'Given an email address, determines if the associated organization has an active SSO configuration. Called from the login page before authentication.',
+      tags: ['SSO'],
+      requestBody: {
+        contentType: 'application/json',
+        schema: hrdRequestSchema,
+      },
+      responses: [
+        { status: 200, description: 'HRD result' },
+      ],
+      errors: [
+        { status: 400, description: 'Invalid request' },
+      ],
+    },
+  },
+}

package/src/modules/sso/api/initiate/route.ts

@@ -0,0 +1,70 @@
+import { NextResponse } from 'next/server'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { toAbsoluteUrl } from '@open-mercato/shared/lib/url'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { SsoService } from '../../services/ssoService'
+import { ssoInitiateSchema } from '../../data/validators'
+import { emitSsoEvent } from '../../events'
+
+function sanitizeReturnUrl(raw: string | null): string {
+  const value = raw || '/backend'
+  if (!value.startsWith('/') || value.startsWith('//')) return '/backend'
+  try {
+    const parsed = new URL(value, 'http://localhost')
+    if (parsed.origin !== 'http://localhost') return '/backend'
+    return parsed.pathname + parsed.search + parsed.hash
+  } catch {
+    return '/backend'
+  }
+}
+
+export async function GET(req: Request) {
+  try {
+    const url = new URL(req.url)
+    const configId = url.searchParams.get('configId')
+    const rawReturnUrl = url.searchParams.get('returnUrl')
+
+    const parsed = ssoInitiateSchema.safeParse({ configId, returnUrl: rawReturnUrl ?? undefined })
+    if (!parsed.success || !parsed.data.configId) {
+      return NextResponse.redirect(toAbsoluteUrl(req, '/login?error=sso_missing_config'))
+    }
+
+    const returnUrl = sanitizeReturnUrl(rawReturnUrl)
+    const redirectUri = toAbsoluteUrl(req, '/api/sso/callback/oidc')
+    const container = await createRequestContainer()
+    const ssoService = container.resolve<SsoService>('ssoService')
+
+    const { redirectUrl, stateCookie } = await ssoService.initiateLogin(parsed.data.configId, returnUrl, redirectUri)
+
+    const res = NextResponse.redirect(redirectUrl)
+    res.cookies.set('sso_state', stateCookie, {
+      httpOnly: true,
+      path: '/',
+      sameSite: 'lax',
+      secure: process.env.NODE_ENV !== 'development',
+      maxAge: 300,
+    })
+    return res
+  } catch (err) {
+    console.error('[SSO Initiate] Error:', err)
+    void emitSsoEvent('sso.login.failed', {
+      reason: err instanceof Error ? err.message : 'initiate_failed',
+    }).catch((e) => console.error('[SSO Event]', e))
+    return NextResponse.redirect(toAbsoluteUrl(req, '/login?error=sso_failed'))
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'SSO',
+  summary: 'Initiate SSO login',
+  methods: {
+    GET: {
+      summary: 'Start SSO login flow',
+      description: 'Redirects the browser to the configured IdP authorization endpoint. Sets an encrypted sso_state cookie for CSRF protection.',
+      tags: ['SSO'],
+      responses: [
+        { status: 302, description: 'Redirect to IdP authorization endpoint', mediaType: 'text/html' },
+      ],
+    },
+  },
+}

package/src/modules/sso/api/scim/context.ts

@@ -0,0 +1,85 @@
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { ScimTokenService } from '../../services/scimTokenService'
+import { SsoConfig } from '../../data/entities'
+import { buildScimError, scimJson } from '../../lib/scim-response'
+import type { EntityManager } from '@mikro-orm/postgresql'
+
+export interface ScimScope {
+  ssoConfigId: string
+  organizationId: string
+  tenantId: string | null
+  config: SsoConfig
+}
+
+export async function resolveScimContext(req: Request): Promise<
+  | { ok: true; scope: ScimScope }
+  | { ok: false; response: Response }
+> {
+  const authHeader = req.headers.get('authorization')
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    return {
+      ok: false,
+      response: scimJson(
+        buildScimError(401, 'Bearer token required'),
+        401,
+      ),
+    }
+  }
+
+  const rawToken = authHeader.slice(7)
+  if (!rawToken) {
+    return {
+      ok: false,
+      response: scimJson(buildScimError(401, 'Bearer token required'), 401),
+    }
+  }
+
+  const container = await createRequestContainer()
+  const scimTokenService = container.resolve<ScimTokenService>('scimTokenService')
+  const verified = await scimTokenService.verifyToken(rawToken)
+
+  if (!verified) {
+    return {
+      ok: false,
+      response: scimJson(buildScimError(401, 'Invalid or revoked token'), 401),
+    }
+  }
+
+  const em = container.resolve<EntityManager>('em')
+  const config = await em.findOne(SsoConfig, {
+    id: verified.ssoConfigId,
+    organizationId: verified.organizationId,
+    deletedAt: null,
+  })
+
+  if (!config) {
+    return {
+      ok: false,
+      response: scimJson(buildScimError(403, 'SSO configuration not found'), 403),
+    }
+  }
+
+  if (!config.isActive) {
+    return {
+      ok: false,
+      response: scimJson(buildScimError(403, 'SSO configuration is not active'), 403),
+    }
+  }
+
+  if (config.jitEnabled) {
+    return {
+      ok: false,
+      response: scimJson(buildScimError(403, 'SCIM provisioning is unavailable — JIT provisioning is enabled on this configuration'), 403),
+    }
+  }
+
+  return {
+    ok: true,
+    scope: {
+      ssoConfigId: config.id,
+      organizationId: config.organizationId,
+      tenantId: verified.tenantId,
+      config,
+    },
+  }
+}

package/src/modules/sso/api/scim/logs/route.ts

@@ -0,0 +1,69 @@
+import { NextResponse } from 'next/server'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { ScimProvisioningLog } from '../../../data/entities'
+import { resolveSsoAdminContext } from '../../admin-context'
+import { handleSsoAdminApiError } from '../../error-handler'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['sso.config.view'] },
+}
+
+export async function GET(req: Request) {
+  try {
+    const { scope } = await resolveSsoAdminContext(req)
+
+    const url = new URL(req.url)
+    const ssoConfigId = url.searchParams.get('ssoConfigId')
+    if (!ssoConfigId) {
+      return NextResponse.json({ error: 'ssoConfigId is required' }, { status: 400 })
+    }
+
+    const where: Record<string, unknown> = { ssoConfigId }
+    if (!scope.isSuperAdmin && scope.organizationId) {
+      where.organizationId = scope.organizationId
+    }
+
+    const container = await createRequestContainer()
+    const em = container.resolve<EntityManager>('em')
+
+    const logs = await em.find(ScimProvisioningLog, where, {
+      orderBy: { createdAt: 'desc' },
+      limit: 50,
+    })
+
+    return NextResponse.json({
+      items: logs.map((log) => ({
+        id: log.id,
+        operation: log.operation,
+        resourceType: log.resourceType,
+        resourceId: log.resourceId,
+        scimExternalId: log.scimExternalId,
+        responseStatus: log.responseStatus,
+        errorMessage: log.errorMessage,
+        createdAt: log.createdAt.toISOString(),
+      })),
+    })
+  } catch (err) {
+    return handleSsoAdminApiError(err, 'SCIM Logs API')
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'SCIM',
+  summary: 'SCIM Provisioning Logs',
+  methods: {
+    GET: {
+      summary: 'List recent provisioning log entries',
+      description: 'Returns the last 50 SCIM provisioning log entries for a given SSO config.',
+      tags: ['SSO', 'SCIM'],
+      responses: [{ status: 200, description: 'List of provisioning log entries' }],
+      errors: [
+        { status: 400, description: 'Missing ssoConfigId' },
+        { status: 401, description: 'Unauthorized' },
+        { status: 403, description: 'Forbidden — requires sso.scim.manage' },
+      ],
+    },
+  },
+}

package/src/modules/sso/api/scim/tokens/[id]/route.ts

@@ -0,0 +1,45 @@
+import { NextResponse } from 'next/server'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { ScimTokenService } from '../../../../services/scimTokenService'
+import { resolveSsoAdminContext } from '../../../admin-context'
+import { handleSsoAdminApiError } from '../../../error-handler'
+
+export const metadata = {
+  DELETE: { requireAuth: true, requireFeatures: ['sso.scim.manage'] },
+}
+
+type RouteContext = { params: Promise<{ id: string }> }
+
+export async function DELETE(req: Request, ctx: RouteContext) {
+  try {
+    const { id } = await ctx.params
+    const { scope } = await resolveSsoAdminContext(req)
+
+    const container = await createRequestContainer()
+    const service = container.resolve<ScimTokenService>('scimTokenService')
+    await service.revokeToken(id, scope)
+
+    return NextResponse.json({ ok: true })
+  } catch (err) {
+    return handleSsoAdminApiError(err, 'SCIM Tokens API')
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'SSO',
+  summary: 'SCIM Token by ID',
+  methods: {
+    DELETE: {
+      summary: 'Revoke SCIM token',
+      description: 'Revokes (deactivates) a SCIM token. The token can no longer be used for authentication.',
+      tags: ['SSO', 'SCIM'],
+      responses: [{ status: 200, description: 'Token revoked' }],
+      errors: [
+        { status: 401, description: 'Unauthorized' },
+        { status: 403, description: 'Forbidden — requires sso.scim.manage' },
+        { status: 404, description: 'Token not found' },
+      ],
+    },
+  },
+}

package/src/modules/sso/api/scim/tokens/route.ts

@@ -0,0 +1,89 @@
+import { NextResponse } from 'next/server'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { ScimTokenService } from '../../../services/scimTokenService'
+import { createScimTokenSchema, scimTokenListSchema } from '../../../data/validators'
+import { resolveSsoAdminContext } from '../../admin-context'
+import { handleSsoAdminApiError } from '../../error-handler'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['sso.config.view'] },
+  POST: { requireAuth: true, requireFeatures: ['sso.scim.manage'] },
+}
+
+export async function GET(req: Request) {
+  try {
+    const { scope } = await resolveSsoAdminContext(req)
+
+    const url = new URL(req.url)
+    const parsed = scimTokenListSchema.safeParse({
+      ssoConfigId: url.searchParams.get('ssoConfigId') ?? undefined,
+    })
+    if (!parsed.success) {
+      return NextResponse.json({ error: 'Invalid request', details: parsed.error.flatten() }, { status: 400 })
+    }
+
+    const container = await createRequestContainer()
+    const service = container.resolve<ScimTokenService>('scimTokenService')
+    const tokens = await service.listTokens(parsed.data.ssoConfigId, scope)
+
+    return NextResponse.json({ items: tokens })
+  } catch (err) {
+    return handleSsoAdminApiError(err, 'SCIM Tokens API')
+  }
+}
+
+export async function POST(req: Request) {
+  try {
+    const { scope } = await resolveSsoAdminContext(req)
+
+    const body = await req.json()
+    const parsed = createScimTokenSchema.safeParse(body)
+    if (!parsed.success) {
+      return NextResponse.json({ error: 'Invalid request', details: parsed.error.flatten() }, { status: 400 })
+    }
+
+    const container = await createRequestContainer()
+    const service = container.resolve<ScimTokenService>('scimTokenService')
+    const result = await service.generateToken(parsed.data.ssoConfigId, parsed.data.name, scope)
+
+    return NextResponse.json(result, { status: 201 })
+  } catch (err) {
+    return handleSsoAdminApiError(err, 'SCIM Tokens API')
+  }
+}
+
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'SSO',
+  summary: 'SCIM Token Management',
+  methods: {
+    GET: {
+      summary: 'List SCIM tokens',
+      description: 'Returns SCIM tokens for a given SSO config. Token hashes are never exposed.',
+      tags: ['SSO', 'SCIM'],
+      responses: [{ status: 200, description: 'List of SCIM tokens' }],
+      errors: [
+        { status: 400, description: 'Missing or invalid ssoConfigId' },
+        { status: 401, description: 'Unauthorized' },
+        { status: 403, description: 'Forbidden — requires sso.scim.manage' },
+      ],
+    },
+    POST: {
+      summary: 'Create SCIM token',
+      description: 'Generates a new SCIM bearer token. The raw token is returned once and cannot be retrieved again.',
+      tags: ['SSO', 'SCIM'],
+      requestBody: {
+        contentType: 'application/json',
+        schema: createScimTokenSchema,
+      },
+      responses: [{ status: 201, description: 'SCIM token created — raw token included in response' }],
+      errors: [
+        { status: 400, description: 'Invalid input' },
+        { status: 401, description: 'Unauthorized' },
+        { status: 403, description: 'Forbidden — requires sso.scim.manage' },
+        { status: 409, description: 'Conflict — cannot create SCIM token while JIT is enabled' },
+      ],
+    },
+  },
+}

package/src/modules/sso/api/scim/v2/ServiceProviderConfig/route.ts

@@ -0,0 +1,40 @@
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { scimJson } from '../../../../lib/scim-response'
+
+export const metadata = {}
+
+export async function GET() {
+  return scimJson({
+    schemas: ['urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig'],
+    documentationUri: 'https://open-mercato.com/docs/scim',
+    patch: { supported: true },
+    bulk: { supported: false, maxOperations: 0, maxPayloadSize: 0 },
+    filter: { supported: true, maxResults: 200 },
+    changePassword: { supported: false },
+    sort: { supported: false },
+    etag: { supported: false },
+    authenticationSchemes: [
+      {
+        type: 'oauthbearertoken',
+        name: 'OAuth Bearer Token',
+        description: 'Authentication scheme using the OAuth Bearer Token standard',
+        specUri: 'https://www.rfc-editor.org/info/rfc6750',
+        primary: true,
+      },
+    ],
+  })
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'SCIM',
+  summary: 'SCIM Service Provider Configuration',
+  methods: {
+    GET: {
+      summary: 'Get SCIM service provider configuration',
+      description: 'Returns SCIM 2.0 ServiceProviderConfig. No authentication required — used by identity providers during connection testing.',
+      tags: ['SSO', 'SCIM'],
+      responses: [{ status: 200, description: 'SCIM ServiceProviderConfig' }],
+      errors: [],
+    },
+  },
+}

package/src/modules/sso/api/scim/v2/Users/[id]/route.ts

@@ -0,0 +1,103 @@
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveScimContext } from '../../../context'
+import { ScimService } from '../../../../../services/scimService'
+import { parseScimPatchOperations } from '../../../../../lib/scim-patch'
+import { scimJson } from '../../../../../lib/scim-response'
+import { handleScimApiError } from '../../../../error-handler'
+
+export const metadata = {}
+
+type RouteContext = { params: Promise<{ id: string }> }
+
+export async function GET(req: Request, ctx: RouteContext) {
+  try {
+    const { id } = await ctx.params
+    const scimCtx = await resolveScimContext(req)
+    if (!scimCtx.ok) return scimCtx.response
+
+    const baseUrl = new URL(req.url).origin
+    const container = await createRequestContainer()
+    const service = container.resolve<ScimService>('scimService')
+    const resource = await service.getUser(id, scimCtx.scope, baseUrl)
+
+    return scimJson(resource)
+  } catch (err) {
+    return handleScimApiError(err, 'SCIM Users API')
+  }
+}
+
+export async function PATCH(req: Request, ctx: RouteContext) {
+  try {
+    const { id } = await ctx.params
+    const scimCtx = await resolveScimContext(req)
+    if (!scimCtx.ok) return scimCtx.response
+
+    const body = await req.json()
+    const operations = parseScimPatchOperations(body)
+    const baseUrl = new URL(req.url).origin
+
+    const container = await createRequestContainer()
+    const service = container.resolve<ScimService>('scimService')
+    const resource = await service.patchUser(id, operations, scimCtx.scope, baseUrl)
+
+    return scimJson(resource)
+  } catch (err) {
+    return handleScimApiError(err, 'SCIM Users API')
+  }
+}
+
+export async function DELETE(req: Request, ctx: RouteContext) {
+  try {
+    const { id } = await ctx.params
+    const scimCtx = await resolveScimContext(req)
+    if (!scimCtx.ok) return scimCtx.response
+
+    const container = await createRequestContainer()
+    const service = container.resolve<ScimService>('scimService')
+    await service.deleteUser(id, scimCtx.scope)
+
+    return new Response(null, { status: 204 })
+  } catch (err) {
+    return handleScimApiError(err, 'SCIM Users API')
+  }
+}
+
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'SCIM',
+  summary: 'SCIM User by ID',
+  methods: {
+    GET: {
+      summary: 'Get SCIM user',
+      description: 'Returns a single provisioned user by SCIM ID.',
+      tags: ['SSO', 'SCIM'],
+      responses: [{ status: 200, description: 'SCIM User resource' }],
+      errors: [
+        { status: 401, description: 'Unauthorized' },
+        { status: 404, description: 'User not found' },
+      ],
+    },
+    PATCH: {
+      summary: 'Patch SCIM user',
+      description: 'Updates user attributes via SCIM PatchOp. Supports active/inactive toggling.',
+      tags: ['SSO', 'SCIM'],
+      responses: [{ status: 200, description: 'Updated SCIM User resource' }],
+      errors: [
+        { status: 400, description: 'Invalid PatchOp' },
+        { status: 401, description: 'Unauthorized' },
+        { status: 404, description: 'User not found' },
+      ],
+    },
+    DELETE: {
+      summary: 'Delete SCIM user',
+      description: 'Deactivates the user and revokes sessions.',
+      tags: ['SSO', 'SCIM'],
+      responses: [{ status: 204, description: 'No content' }],
+      errors: [
+        { status: 401, description: 'Unauthorized' },
+        { status: 404, description: 'User not found' },
+      ],
+    },
+  },
+}