@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/component/server/enterprise/http.js

@@ -0,0 +1,766 @@
+import { isAuthError } from "../errors.js";
+import { AuthError } from "../authError.js";
+import { SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID, enterpriseSamlProviderId } from "./shared.js";
+import { createEnterpriseOidcRuntime } from "./oidc.js";
+import { redirectAbsoluteUrl, setURLSearchParam } from "../redirects.js";
+import { redirectToParamCookie, useRedirectToParam } from "../cookies.js";
+import { addSSORoutes, convertErrorsToResponse, getCookies } from "../http.js";
+import { createOAuthAuthorizationURL, handleOAuthCallback } from "../oauth.js";
+import { createEnterpriseSamlMetadataXml, createEnterpriseSamlSignInRequest, createSamlPostBindingResponse, encodeEnterpriseSamlRelayState, parseEnterpriseSamlLoginResponse, parseEnterpriseSamlLogoutMessage, profileFromSamlExtract, validateEnterpriseSamlLoginRelayState } from "./saml.js";
+import { parseScimListRequest, scimError, scimJson, serializeScimGroup, serializeScimUser } from "./scim.js";
+import { serialize } from "cookie";
+import { Fx } from "@robelest/fx";
+
+//#region src/server/enterprise/http.ts
+function addEnterpriseHttpRuntime(deps) {
+	if (!deps.hasSSO) return;
+	const { http, auth, config, requireEnv, loadActiveEnterpriseSamlOrThrow, loadEnterpriseOidcOrThrow, getEnterpriseScimContext, getPolicyFromEnterprise, recordEnterpriseAuditEvent, emitEnterpriseWebhookDeliveries, generateRandomString, inviteTokenAlphabet: INVITE_TOKEN_ALPHABET, callUserOAuth, callVerifierSignature } = deps;
+	const ENTERPRISE_CONTROL_ROUTE_BASE = deps.routeBase;
+	const SCIM_SCHEMAS = [{
+		id: SCIM_USER_SCHEMA_ID,
+		name: "User",
+		description: "User Account",
+		attributes: [
+			{
+				name: "userName",
+				type: "string",
+				required: true
+			},
+			{
+				name: "displayName",
+				type: "string"
+			},
+			{
+				name: "active",
+				type: "boolean"
+			},
+			{
+				name: "emails",
+				type: "complex",
+				multiValued: true
+			}
+		]
+	}, {
+		id: SCIM_GROUP_SCHEMA_ID,
+		name: "Group",
+		description: "Group",
+		attributes: [{
+			name: "displayName",
+			type: "string",
+			required: true
+		}, {
+			name: "members",
+			type: "complex",
+			multiValued: true
+		}]
+	}];
+	const SCIM_RESOURCE_TYPES = [{
+		id: "User",
+		name: "User",
+		endpoint: "/Users",
+		schema: SCIM_USER_SCHEMA_ID
+	}, {
+		id: "Group",
+		name: "Group",
+		endpoint: "/Groups",
+		schema: SCIM_GROUP_SCHEMA_ID
+	}];
+	const handleStaticScimCollection = (items, resourceId, opts) => {
+		if (resourceId !== void 0) {
+			const item = items.find((entry) => entry[opts.by] === decodeURIComponent(resourceId));
+			return item ? scimJson(item) : scimError(404, "notFound", opts.notFound);
+		}
+		return scimJson({
+			schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+			Resources: items,
+			totalResults: items.length,
+			startIndex: 1,
+			itemsPerPage: items.length
+		});
+	};
+	const filterScimCollection = (items, filter, filters) => {
+		if (!filter) return items;
+		const predicate = filters[filter.attribute];
+		if (!predicate) throw new Error("Unsupported SCIM filter.");
+		return items.filter((item) => predicate(item, filter.value));
+	};
+	const paginateScimCollection = (items, listRequest) => {
+		const start = listRequest.startIndex - 1;
+		return items.slice(start, start + listRequest.count);
+	};
+	const requireScimResourceId = (resourceId, label) => {
+		if (!resourceId) return scimError(400, "invalidPath", `${label} resource ID is required.`);
+		return null;
+	};
+	const readScimJson = async (request) => await request.json();
+	const handleSamlAcs = async (ctx, request, runtimeRoute) => Fx.run(Fx.gen(function* () {
+		yield* Fx.guard(runtimeRoute.protocol !== "saml" || runtimeRoute.rest.length !== 1 || runtimeRoute.rest[0] !== "acs", Fx.fail(new AuthError("INVALID_PARAMETERS", "Invalid enterprise runtime path.").toConvexError()));
+		const enterpriseId = runtimeRoute.enterpriseId;
+		const { loaded, enterprise, saml } = yield* Fx.from({
+			ok: () => loadActiveEnterpriseSamlOrThrow(ctx, enterpriseId),
+			err: (e) => e
+		});
+		const parsedResponse = yield* Fx.from({
+			ok: () => parseEnterpriseSamlLoginResponse({
+				request,
+				rootUrl: requireEnv("CONVEX_SITE_URL"),
+				source: {
+					kind: "enterprise",
+					id: enterprise._id
+				},
+				config: loaded.config
+			}),
+			err: (e) => new AuthError("OAUTH_PROVIDER_ERROR", `SAML response parse failed: ${e instanceof Error ? e.message : String(e)}`).toConvexError()
+		});
+		yield* Fx.from({
+			ok: () => {
+				validateEnterpriseSamlLoginRelayState({
+					relayState: parsedResponse.relayState,
+					source: {
+						kind: "enterprise",
+						id: enterprise._id
+					},
+					inResponseTo: parsedResponse.parsed.extract?.response?.inResponseTo
+				});
+				return Promise.resolve();
+			},
+			err: () => new AuthError("OAUTH_INVALID_STATE", "SAML RelayState did not match the pending login request.").toConvexError()
+		});
+		const { samlAttributes, samlSessionIndex, ...userProfile } = profileFromSamlExtract(parsedResponse.parsed.extract, saml.attributeMapping);
+		const profile = userProfile;
+		const maybeRedirectTo = useRedirectToParam(enterpriseSamlProviderId(enterprise._id), getCookies(request));
+		const verificationCode = yield* Fx.from({
+			ok: () => callUserOAuth(ctx, {
+				provider: enterpriseSamlProviderId(enterprise._id),
+				providerAccountId: profile.id,
+				profile,
+				signature: parsedResponse.relayState.signature,
+				accountExtend: {
+					identity: {
+						protocol: "saml",
+						enterpriseId: enterprise._id,
+						subject: profile.id,
+						entityId: typeof saml.entityId === "string" ? saml.entityId : void 0
+					},
+					saml: {
+						attributes: samlAttributes,
+						sessionIndex: samlSessionIndex
+					}
+				}
+			}),
+			err: (e) => e
+		});
+		const vurl = setURLSearchParam(yield* Fx.from({
+			ok: () => redirectAbsoluteUrl(config, { redirectTo: maybeRedirectTo?.redirectTo ?? (typeof parsedResponse.relayState.redirectTo === "string" ? parsedResponse.relayState.redirectTo : void 0) }),
+			err: (e) => e
+		}), "code", verificationCode);
+		const vheaders = new Headers({ Location: vurl });
+		vheaders.set("Cache-Control", "must-revalidate");
+		for (const { name, value, options } of maybeRedirectTo !== null ? [maybeRedirectTo.updatedCookie] : []) vheaders.append("Set-Cookie", serialize(name, value, options));
+		return new Response(null, {
+			status: 302,
+			headers: vheaders
+		});
+	}).pipe(Fx.recover((e) => Fx.fatal(e))));
+	const handleSamlSlo = async (ctx, request, runtimeRoute) => {
+		if (runtimeRoute.protocol !== "saml" || runtimeRoute.rest.length !== 1 || runtimeRoute.rest[0] !== "slo") throw new AuthError("INVALID_PARAMETERS", "Invalid enterprise runtime path.").toConvexError();
+		const { loaded, enterprise } = await loadActiveEnterpriseSamlOrThrow(ctx, runtimeRoute.enterpriseId);
+		const parsedMessage = await parseEnterpriseSamlLogoutMessage({
+			request,
+			rootUrl: requireEnv("CONVEX_SITE_URL"),
+			source: {
+				kind: "enterprise",
+				id: enterprise._id
+			},
+			config: loaded.config
+		});
+		if (parsedMessage.hasSamlRequest && parsedMessage.parsedRequest) {
+			const responseContext = parsedMessage.runtime.sp.createLogoutResponse(parsedMessage.runtime.idp, parsedMessage.parsedRequest.extract, parsedMessage.binding, parsedMessage.relayState ?? "");
+			if (parsedMessage.binding === "redirect") return new Response(null, {
+				status: 302,
+				headers: { Location: responseContext.context }
+			});
+			return createSamlPostBindingResponse({
+				endpoint: responseContext.entityEndpoint,
+				parameter: "SAMLResponse",
+				value: responseContext.context,
+				relayState: parsedMessage.relayState
+			});
+		}
+		if (parsedMessage.hasSamlResponse) return new Response(null, { status: 204 });
+		throw new AuthError("INVALID_PARAMETERS", "Missing SAML logout payload.").toConvexError();
+	};
+	const handleScimRequest = async (ctx, request) => {
+		try {
+			const { scimConfig, enterprise, parsedPath } = await getEnterpriseScimContext(ctx, request);
+			const state = {
+				ctx,
+				request,
+				url: new URL(request.url),
+				parsedPath,
+				enterprise,
+				scimConfig,
+				policy: getPolicyFromEnterprise(enterprise),
+				recordScimEvent: async (eventType, ok, subjectType, subjectId, metadata) => {
+					const auditEventId = await recordEnterpriseAuditEvent(ctx, {
+						enterpriseId: enterprise._id,
+						groupId: enterprise.groupId,
+						eventType,
+						actorType: "scim",
+						subjectType,
+						subjectId,
+						ok,
+						metadata
+					});
+					await emitEnterpriseWebhookDeliveries(ctx, {
+						enterpriseId: enterprise._id,
+						eventType,
+						auditEventId,
+						payload: {
+							enterpriseId: enterprise._id,
+							subjectId,
+							metadata
+						}
+					});
+				}
+			};
+			const handleUsersGet = async (state$1) => {
+				const members = await auth.member.list(state$1.ctx, {
+					where: { groupId: state$1.enterprise.groupId },
+					limit: 100
+				});
+				const identities = await state$1.ctx.runQuery(config.component.public.enterpriseScimIdentityListByEnterprise, { enterpriseId: state$1.enterprise._id });
+				const identityByUserId = new Map(identities.filter((identity) => identity.userId !== void 0).map((identity) => [identity.userId, identity]));
+				const users = (await Promise.all(members.items.map(async (member) => {
+					const user = await auth.user.get(state$1.ctx, member.userId);
+					return user ? {
+						user,
+						member,
+						identity: identityByUserId.get(user._id)
+					} : null;
+				}))).filter(Boolean);
+				const listRequest = parseScimListRequest(state$1.url);
+				const filtered = filterScimCollection(users, listRequest.filter, {
+					id: (item, value) => item.user._id === value,
+					externalId: (item, value) => item.identity?.externalId === value,
+					userName: (item, value) => item.user.email === value,
+					"emails.value": (item, value) => item.user.email === value,
+					active: (item, value) => String(item.identity?.active ?? item.member.status === "active") === value
+				});
+				if (state$1.parsedPath.resourceId) {
+					const resource = filtered.find(({ user }) => user._id === state$1.parsedPath.resourceId);
+					return resource ? scimJson(serializeScimUser({
+						id: resource.user._id,
+						user: resource.user,
+						externalId: resource.identity?.externalId,
+						location: `${state$1.url.origin}${state$1.url.pathname.replace(/\/[^/]+$/, "")}/${resource.user._id}`,
+						active: resource.identity?.active ?? resource.member.status === "active"
+					}), 200, { Location: `${state$1.url.origin}${state$1.url.pathname.replace(/\/[^/]+$/, "")}/${resource.user._id}` }) : scimError(404, "notFound", "User not found.");
+				}
+				const paged = paginateScimCollection(filtered, listRequest);
+				await state$1.recordScimEvent("enterprise.scim.read", true, "enterprise_scim", state$1.scimConfig._id);
+				return scimJson({
+					schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+					Resources: paged.map(({ user, identity, member }) => serializeScimUser({
+						id: user._id,
+						user,
+						externalId: identity?.externalId,
+						location: `${state$1.url.origin}${state$1.url.pathname}/${user._id}`,
+						active: identity?.active ?? member.status === "active"
+					})),
+					totalResults: filtered.length,
+					startIndex: listRequest.startIndex,
+					itemsPerPage: paged.length
+				});
+			};
+			const handleUsersPost = async (state$1) => {
+				const body = await readScimJson(state$1.request);
+				const primaryEmail = Array.isArray(body.emails) ? body.emails.find((entry) => entry.primary === true)?.value ?? body.emails[0]?.value : void 0;
+				const phone = Array.isArray(body.phoneNumbers) ? body.phoneNumbers[0]?.value : void 0;
+				const userId = await state$1.ctx.runMutation(config.component.public.userInsert, { data: {
+					name: body.displayName ?? body.name?.formatted,
+					email: primaryEmail ?? body.userName,
+					...typeof (primaryEmail ?? body.userName) === "string" ? { emailVerificationTime: Date.now() } : {},
+					phone,
+					...typeof phone === "string" ? { phoneVerificationTime: Date.now() } : {}
+				} });
+				try {
+					await auth.member.create(state$1.ctx, {
+						groupId: state$1.enterprise.groupId,
+						userId,
+						roleIds: state$1.policy.provisioning.jit.defaultRoleIds,
+						status: body.active === false ? "inactive" : "active"
+					});
+				} catch {}
+				if (typeof body.externalId === "string") await state$1.ctx.runMutation(config.component.public.enterpriseScimIdentityUpsert, {
+					enterpriseId: state$1.enterprise._id,
+					groupId: state$1.enterprise.groupId,
+					resourceType: "user",
+					externalId: body.externalId,
+					userId,
+					active: body.active !== false,
+					raw: body,
+					lastProvisionedAt: Date.now()
+				});
+				await state$1.recordScimEvent("enterprise.scim.user.created", true, "user", userId);
+				const createdUser = await auth.user.get(state$1.ctx, userId);
+				const location = `${state$1.url.origin}${state$1.url.pathname}/${userId}`;
+				return scimJson(serializeScimUser({
+					id: userId,
+					user: createdUser ?? {},
+					externalId: body.externalId,
+					location,
+					active: body.active !== false
+				}), 201, { Location: location });
+			};
+			const handleUsersUpsert = async (state$1) => {
+				const missing = requireScimResourceId(state$1.parsedPath.resourceId, "User");
+				if (missing) return missing;
+				const userId = state$1.parsedPath.resourceId;
+				const existingUser = await auth.user.get(state$1.ctx, userId);
+				if (!existingUser) return scimError(404, "notFound", "User not found.");
+				const body = await readScimJson(state$1.request);
+				const patchData = {};
+				let nextActive;
+				if (state$1.request.method === "PUT") {
+					patchData.name = body.displayName ?? body.name?.formatted;
+					patchData.email = body.userName ?? (Array.isArray(body.emails) ? body.emails[0]?.value : void 0);
+					patchData.phone = Array.isArray(body.phoneNumbers) ? body.phoneNumbers[0]?.value : void 0;
+					if (typeof patchData.email === "string") patchData.emailVerificationTime = Date.now();
+					if (typeof patchData.phone === "string") patchData.phoneVerificationTime = Date.now();
+				} else for (const operation of Array.isArray(body.Operations) ? body.Operations : []) {
+					if (operation.path === "active") nextActive = operation.value;
+					if (operation.path === "displayName" || operation.path === "name.formatted") patchData.name = operation.value;
+					if (operation.path === "userName" || operation.path === "emails.value") {
+						patchData.email = operation.value;
+						if (typeof operation.value === "string") patchData.emailVerificationTime = Date.now();
+					}
+					if (operation.path === "phoneNumbers.value") {
+						patchData.phone = operation.value;
+						if (typeof operation.value === "string") patchData.phoneVerificationTime = Date.now();
+					}
+				}
+				await state$1.ctx.runMutation(config.component.public.userPatch, {
+					userId,
+					data: patchData
+				});
+				const resolution = await auth.member.resolve(state$1.ctx, {
+					groupId: state$1.enterprise.groupId,
+					userId
+				});
+				if (resolution.membership) await auth.member.update(state$1.ctx, resolution.membership._id, { status: body.active === false || nextActive === false ? "inactive" : "active" });
+				await state$1.ctx.runMutation(config.component.public.enterpriseScimIdentityUpsert, {
+					enterpriseId: state$1.enterprise._id,
+					groupId: state$1.enterprise.groupId,
+					resourceType: "user",
+					externalId: typeof body.externalId === "string" ? body.externalId : (await state$1.ctx.runQuery(config.component.public.enterpriseScimIdentityGetByEnterpriseAndUser, {
+						enterpriseId: state$1.enterprise._id,
+						userId
+					}))?.externalId ?? userId,
+					userId,
+					active: body.active !== false && nextActive !== false,
+					raw: body,
+					lastProvisionedAt: Date.now()
+				});
+				await state$1.recordScimEvent("enterprise.scim.user.updated", true, "user", userId);
+				const updatedUser = await auth.user.get(state$1.ctx, userId);
+				const location = `${state$1.url.origin}${state$1.url.pathname}`;
+				return scimJson(serializeScimUser({
+					id: userId,
+					user: updatedUser ?? existingUser,
+					externalId: typeof body.externalId === "string" ? body.externalId : void 0,
+					location,
+					active: body.active !== false && nextActive !== false
+				}), 200, { Location: location });
+			};
+			const handleUsersDelete = async (state$1) => {
+				const missing = requireScimResourceId(state$1.parsedPath.resourceId, "User");
+				if (missing) return missing;
+				const userId = state$1.parsedPath.resourceId;
+				const resolution = await auth.member.resolve(state$1.ctx, {
+					groupId: state$1.enterprise.groupId,
+					userId
+				});
+				if (resolution.membership) await auth.member.delete(state$1.ctx, resolution.membership._id);
+				const identity = await state$1.ctx.runQuery(config.component.public.enterpriseScimIdentityGetByEnterpriseAndUser, {
+					enterpriseId: state$1.enterprise._id,
+					userId
+				});
+				if (identity) if (state$1.policy.provisioning.deprovision.mode === "hard") await state$1.ctx.runMutation(config.component.public.enterpriseScimIdentityDelete, { identityId: identity._id });
+				else await state$1.ctx.runMutation(config.component.public.enterpriseScimIdentityUpsert, {
+					enterpriseId: identity.enterpriseId,
+					groupId: identity.groupId,
+					resourceType: identity.resourceType,
+					externalId: identity.externalId,
+					userId: identity.userId,
+					mappedGroupId: identity.mappedGroupId,
+					active: false,
+					raw: identity.raw,
+					lastProvisionedAt: Date.now()
+				});
+				await state$1.recordScimEvent("enterprise.scim.user.deleted", true, "user", userId);
+				return new Response(null, { status: 204 });
+			};
+			const handleGroupsGet = async (state$1) => {
+				const groupsList = await auth.group.list(state$1.ctx, {
+					where: { parentGroupId: state$1.enterprise.groupId },
+					limit: 100
+				});
+				const identities = await state$1.ctx.runQuery(config.component.public.enterpriseScimIdentityListByEnterprise, { enterpriseId: state$1.enterprise._id });
+				const identityByGroupId = new Map(identities.filter((identity) => identity.mappedGroupId !== void 0).map((identity) => [identity.mappedGroupId, identity]));
+				const groups = groupsList.items.map((group) => ({
+					group,
+					identity: identityByGroupId.get(group._id)
+				}));
+				const listRequest = parseScimListRequest(state$1.url);
+				const filtered = filterScimCollection(groups, listRequest.filter, {
+					id: (item, value) => item.group._id === value,
+					externalId: (item, value) => item.identity?.externalId === value,
+					displayName: (item, value) => item.group.name === value
+				});
+				if (state$1.parsedPath.resourceId) {
+					const resource = filtered.find(({ group }) => group._id === state$1.parsedPath.resourceId);
+					if (!resource) return scimError(404, "notFound", "Group not found.");
+					const members = (await auth.member.list(state$1.ctx, {
+						where: {
+							groupId: resource.group._id,
+							status: "active"
+						},
+						limit: 100
+					})).items.map((member) => ({ value: member.userId }));
+					const location = `${state$1.url.origin}${state$1.url.pathname.replace(/\/[^/]+$/, "")}/${resource.group._id}`;
+					return scimJson(serializeScimGroup({
+						id: resource.group._id,
+						group: resource.group,
+						externalId: resource.identity?.externalId,
+						location,
+						members
+					}), 200, { Location: location });
+				}
+				const paged = paginateScimCollection(filtered, listRequest);
+				return scimJson({
+					schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+					Resources: paged.map(({ group, identity }) => serializeScimGroup({
+						id: group._id,
+						group,
+						externalId: identity?.externalId,
+						location: `${state$1.url.origin}${state$1.url.pathname}/${group._id}`
+					})),
+					totalResults: filtered.length,
+					startIndex: listRequest.startIndex,
+					itemsPerPage: paged.length
+				});
+			};
+			const handleGroupsPost = async (state$1) => {
+				const body = await readScimJson(state$1.request);
+				const { groupId } = await auth.group.create(state$1.ctx, {
+					name: String(body.displayName ?? "Group"),
+					parentGroupId: state$1.enterprise.groupId,
+					type: "organization"
+				});
+				await state$1.ctx.runMutation(config.component.public.enterpriseScimIdentityUpsert, {
+					enterpriseId: state$1.enterprise._id,
+					groupId: state$1.enterprise.groupId,
+					resourceType: "group",
+					externalId: body.externalId ?? groupId,
+					mappedGroupId: groupId,
+					active: true,
+					raw: body,
+					lastProvisionedAt: Date.now()
+				});
+				for (const member of Array.isArray(body.members) ? body.members : []) try {
+					await auth.member.create(state$1.ctx, {
+						groupId,
+						userId: String(member.value),
+						roleIds: state$1.policy.provisioning.jit.defaultRoleIds,
+						status: "active"
+					});
+				} catch {}
+				await state$1.recordScimEvent("enterprise.scim.group.created", true, "group", groupId);
+				const group = await auth.group.get(state$1.ctx, groupId);
+				const location = `${state$1.url.origin}${state$1.url.pathname}/${groupId}`;
+				return scimJson(serializeScimGroup({
+					id: groupId,
+					group: group ?? {},
+					externalId: body.externalId,
+					location,
+					members: (await auth.member.list(state$1.ctx, {
+						where: {
+							groupId,
+							status: "active"
+						},
+						limit: 100
+					})).items.map((member) => ({ value: member.userId }))
+				}), 201, { Location: location });
+			};
+			const handleGroupsPatch = async (state$1) => {
+				const missing = requireScimResourceId(state$1.parsedPath.resourceId, "Group");
+				if (missing) return missing;
+				const groupId = state$1.parsedPath.resourceId;
+				const body = await readScimJson(state$1.request);
+				for (const operation of Array.isArray(body.Operations) ? body.Operations : []) {
+					if (operation.path === "displayName") await auth.group.update(state$1.ctx, groupId, { name: operation.value });
+					if (operation.path === "members" && operation.op === "add") for (const member of Array.isArray(operation.value) ? operation.value : []) try {
+						await auth.member.create(state$1.ctx, {
+							groupId,
+							userId: String(member.value),
+							roleIds: state$1.policy.provisioning.jit.defaultRoleIds,
+							status: "active"
+						});
+					} catch {}
+					if (operation.path === "members" && operation.op === "replace") {
+						const currentMembers = (await auth.member.list(state$1.ctx, {
+							where: {
+								groupId,
+								status: "active"
+							},
+							limit: 100
+						})).items;
+						const currentUserIds = new Set(currentMembers.map((member) => member.userId));
+						const nextUserIds = new Set((Array.isArray(operation.value) ? operation.value : []).map((member) => String(member.value)));
+						for (const member of currentMembers) if (!nextUserIds.has(member.userId)) await auth.member.delete(state$1.ctx, member._id);
+						for (const userId of nextUserIds.values()) if (!currentUserIds.has(userId)) try {
+							await auth.member.create(state$1.ctx, {
+								groupId,
+								userId,
+								roleIds: state$1.policy.provisioning.jit.defaultRoleIds,
+								status: "active"
+							});
+						} catch {}
+					}
+					if (typeof operation.path === "string" && operation.op === "remove" && operation.path.startsWith("members[")) {
+						const userId = operation.path.match(/^members\[value eq "([^"]+)"\]$/)?.[1];
+						if (userId) {
+							const resolution = await auth.member.resolve(state$1.ctx, {
+								groupId,
+								userId
+							});
+							if (resolution.membership) await auth.member.delete(state$1.ctx, resolution.membership._id);
+						}
+					}
+				}
+				await state$1.recordScimEvent("enterprise.scim.group.updated", true, "group", groupId);
+				const group = await auth.group.get(state$1.ctx, groupId);
+				const location = `${state$1.url.origin}${state$1.url.pathname}`;
+				const members = (await auth.member.list(state$1.ctx, {
+					where: {
+						groupId,
+						status: "active"
+					},
+					limit: 100
+				})).items;
+				return scimJson(serializeScimGroup({
+					id: groupId,
+					group: group ?? {},
+					location,
+					members: members.map((member) => ({ value: member.userId }))
+				}), 200, { Location: location });
+			};
+			const handleGroupsDelete = async (state$1) => {
+				const missing = requireScimResourceId(state$1.parsedPath.resourceId, "Group");
+				if (missing) return missing;
+				const groupId = state$1.parsedPath.resourceId;
+				await auth.group.delete(state$1.ctx, groupId);
+				const identity = await state$1.ctx.runQuery(config.component.public.enterpriseScimIdentityGetByMappedGroup, { mappedGroupId: groupId });
+				if (identity) await state$1.ctx.runMutation(config.component.public.enterpriseScimIdentityDelete, { identityId: identity._id });
+				await state$1.recordScimEvent("enterprise.scim.group.deleted", true, "group", groupId);
+				return new Response(null, { status: 204 });
+			};
+			const handler = {
+				ServiceProviderConfig: { GET: async () => scimJson({
+					schemas: ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],
+					patch: { supported: true },
+					bulk: {
+						supported: false,
+						maxOperations: 0,
+						maxPayloadSize: 0
+					},
+					filter: {
+						supported: true,
+						maxResults: 100
+					},
+					changePassword: { supported: false },
+					sort: { supported: false },
+					etag: { supported: false },
+					authenticationSchemes: [{
+						type: "oauthbearertoken",
+						name: "Bearer Token",
+						description: "Use the SCIM token generated by Convex Auth enterprise."
+					}]
+				}) },
+				Schemas: { GET: async (state$1) => handleStaticScimCollection(SCIM_SCHEMAS, state$1.parsedPath.resourceId, {
+					by: "id",
+					notFound: "Schema not found."
+				}) },
+				ResourceTypes: { GET: async (state$1) => handleStaticScimCollection(SCIM_RESOURCE_TYPES, state$1.parsedPath.resourceId, {
+					by: "name",
+					notFound: "Resource type not found."
+				}) },
+				Users: {
+					GET: handleUsersGet,
+					POST: handleUsersPost,
+					PATCH: handleUsersUpsert,
+					PUT: handleUsersUpsert,
+					DELETE: handleUsersDelete
+				},
+				Groups: {
+					GET: handleGroupsGet,
+					POST: handleGroupsPost,
+					PATCH: handleGroupsPatch,
+					DELETE: handleGroupsDelete
+				}
+			}[state.parsedPath.resource]?.[state.request.method];
+			return handler ? await handler(state) : scimError(404, "notFound", "SCIM resource not found.");
+		} catch (error) {
+			if (error instanceof Error && error.message === "Unsupported SCIM filter.") return scimError(400, "invalidFilter", error.message);
+			if (isAuthError(error)) {
+				const code = error.data.code;
+				return scimError(code === "MISSING_BEARER_TOKEN" || code === "INVALID_API_KEY" ? 401 : 400, code, error.data.message);
+			}
+			throw error;
+		}
+	};
+	addSSORoutes(http, {
+		routeBase: ENTERPRISE_CONTROL_ROUTE_BASE,
+		convertErrorsToResponse,
+		handleSamlMetadata: async (ctx, _request, runtimeRoute) => {
+			const { loaded } = await loadActiveEnterpriseSamlOrThrow(ctx, runtimeRoute.enterpriseId);
+			return new Response(createEnterpriseSamlMetadataXml({
+				rootUrl: requireEnv("CONVEX_SITE_URL"),
+				source: loaded.source,
+				config: loaded.config
+			}), {
+				status: 200,
+				headers: { "Content-Type": "application/xml" }
+			});
+		},
+		handleSamlSignIn: async (ctx, request, runtimeRoute) => {
+			const url = new URL(request.url);
+			const verifier = url.searchParams.get("code");
+			if (!verifier) throw new AuthError("OAUTH_MISSING_VERIFIER").toConvexError();
+			const { loaded, enterprise } = await loadActiveEnterpriseSamlOrThrow(ctx, runtimeRoute.enterpriseId);
+			const state = generateRandomString(24, INVITE_TOKEN_ALPHABET);
+			const signInRequest = createEnterpriseSamlSignInRequest({
+				rootUrl: requireEnv("CONVEX_SITE_URL"),
+				source: {
+					kind: "enterprise",
+					id: enterprise._id
+				},
+				config: loaded.config,
+				state,
+				signature: `saml ${enterprise._id} pending ${state}`,
+				redirectTo: url.searchParams.get("redirectTo") ?? void 0
+			});
+			const signature = `saml ${enterprise._id} ${signInRequest.requestId} ${state}`;
+			await callVerifierSignature(ctx, {
+				verifier,
+				signature
+			});
+			const redirectTo = url.searchParams.get("redirectTo");
+			const redirectCookies = redirectTo !== null ? [redirectToParamCookie(enterpriseSamlProviderId(enterprise._id), redirectTo)] : [];
+			const relayState = encodeEnterpriseSamlRelayState({
+				source: {
+					kind: "enterprise",
+					id: enterprise._id
+				},
+				signature,
+				requestId: signInRequest.requestId,
+				state,
+				redirectTo: url.searchParams.get("redirectTo") ?? void 0
+			});
+			if (signInRequest.binding === "redirect" && signInRequest.redirectUrl) {
+				const redirectUrl = new URL(signInRequest.redirectUrl);
+				redirectUrl.searchParams.set("RelayState", relayState);
+				const headers = new Headers({ Location: redirectUrl.toString() });
+				for (const { name, value, options } of redirectCookies) headers.append("Set-Cookie", serialize(name, value, options));
+				return new Response(null, {
+					status: 302,
+					headers
+				});
+			}
+			const response = createSamlPostBindingResponse({
+				endpoint: signInRequest.post.endpoint,
+				parameter: "SAMLRequest",
+				value: signInRequest.post.value,
+				relayState
+			});
+			for (const { name, value, options } of redirectCookies) response.headers.append("Set-Cookie", serialize(name, value, options));
+			return response;
+		},
+		handleOidcSignIn: async (ctx, request, runtimeRoute) => {
+			const url = new URL(request.url);
+			const verifier = url.searchParams.get("code");
+			if (!verifier) throw new AuthError("OAUTH_MISSING_VERIFIER").toConvexError();
+			const { enterprise, oidc } = await loadEnterpriseOidcOrThrow(ctx, runtimeRoute.enterpriseId);
+			const { providerId, provider, oauthConfig } = await createEnterpriseOidcRuntime({
+				rootUrl: requireEnv("CONVEX_SITE_URL"),
+				enterpriseId: enterprise._id,
+				oidc
+			});
+			const { redirect, cookies, signature } = await createOAuthAuthorizationURL(providerId, provider, oauthConfig);
+			await callVerifierSignature(ctx, {
+				verifier,
+				signature
+			});
+			const redirectTo = url.searchParams.get("redirectTo");
+			const headers_ = new Headers({ Location: redirect });
+			for (const { name, value, options } of [...cookies, ...redirectTo !== null ? [redirectToParamCookie(providerId, redirectTo)] : []]) headers_.append("Set-Cookie", serialize(name, value, options));
+			return new Response(null, {
+				status: 302,
+				headers: headers_
+			});
+		},
+		handleOidcCallback: async (ctx, request, runtimeRoute) => {
+			const url = new URL(request.url);
+			const { enterprise, oidc } = await loadEnterpriseOidcOrThrow(ctx, runtimeRoute.enterpriseId);
+			const { providerId, provider, oauthConfig } = await createEnterpriseOidcRuntime({
+				rootUrl: requireEnv("CONVEX_SITE_URL"),
+				enterpriseId: enterprise._id,
+				oidc
+			});
+			const cookies = getCookies(request);
+			const maybeRedirectTo = useRedirectToParam(providerId, cookies);
+			const destinationUrl = await redirectAbsoluteUrl(config, { redirectTo: maybeRedirectTo?.redirectTo });
+			const params = url.searchParams;
+			const result = await Fx.run(handleOAuthCallback(providerId, provider, oauthConfig, Object.fromEntries(params.entries()), cookies));
+			const extraFields = oidc.extraFields;
+			let profile = result.profile;
+			if (extraFields && typeof profile === "object" && profile) {
+				const extend = {};
+				for (const [claimName, fieldName] of Object.entries(extraFields)) if (claimName in profile) extend[fieldName] = profile[claimName];
+				if (Object.keys(extend).length > 0) profile = {
+					...profile,
+					extend
+				};
+			}
+			const verificationCode = await callUserOAuth(ctx, {
+				provider: providerId,
+				providerAccountId: result.providerAccountId,
+				profile,
+				signature: result.signature,
+				accountExtend: { identity: {
+					protocol: "oidc",
+					enterpriseId: enterprise._id,
+					subject: result.providerAccountId,
+					issuer: typeof oidc.issuer === "string" ? oidc.issuer : void 0,
+					discoveryUrl: typeof oidc.discoveryUrl === "string" ? oidc.discoveryUrl : void 0
+				} }
+			});
+			const headers = new Headers({ Location: setURLSearchParam(destinationUrl, "code", verificationCode) });
+			for (const { name, value, options } of result.cookies) headers.append("Set-Cookie", serialize(name, value, options));
+			if (maybeRedirectTo) headers.append("Set-Cookie", serialize(maybeRedirectTo.updatedCookie.name, maybeRedirectTo.updatedCookie.value, maybeRedirectTo.updatedCookie.options));
+			return new Response(null, {
+				status: 302,
+				headers
+			});
+		},
+		handleSamlAcs,
+		handleSamlSlo,
+		handleScimRequest,
+		scimError
+	});
+}
+
+//#endregion
+export { addEnterpriseHttpRuntime };
+//# sourceMappingURL=http.js.map