@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/sso/http.js

@@ -0,0 +1,1060 @@
+import { deleteScimIdentity, getScimIdentity, getScimIdentityByConnectionAndUser, getScimIdentityByMappedGroup, insertAccount, insertUser, listScimIdentitiesByConnection, patchUser, upsertScimIdentity } from "../contract.js";
+import { finalizeNormalizedProfile, normalizeStringArray } from "./profile.js";
+import { SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID, decodeGroupOidcState, encodeGroupOidcState, groupOidcProviderId, groupSamlProviderId } from "./shared.js";
+import { createGroupConnectionOidcRuntime } from "./oidc.js";
+import { resolveProvisionedRoleIds } from "./policy.js";
+import { redirectToParamCookie, useRedirectToParam } from "../cookies.js";
+import { addSSORoutes, convertErrorsToResponse, getCookies } from "../http.js";
+import { createOAuthAuthorizationURL, handleOAuthCallback } from "../oauth/runtime.js";
+import { redirectAbsoluteUrl, setURLSearchParam } from "../redirects.js";
+import { parseScimListRequest, scimError, scimJson, serializeScimGroup, serializeScimUser } from "./scim.js";
+import { createGroupConnectionSamlMetadataXml, createGroupConnectionSamlSignInRequest, createSamlPostBindingResponse, encodeGroupSamlRelayState, enforceGroupConnectionSamlSecurity, parseGroupConnectionSamlLoginResponse, parseGroupConnectionSamlLogoutMessage, profileFromSamlExtract, validateGroupConnectionSamlLoginRelayState } from "./saml.js";
+import { ConvexError } from "convex/values";
+import { serialize } from "cookie";
+
+//#region src/server/sso/http.ts
+async function getOidcCallbackParams(request) {
+	const url = new URL(request.url);
+	const params = new URLSearchParams(url.searchParams);
+	if (request.headers.get("Content-Type")?.includes("application/x-www-form-urlencoded")) (await request.formData()).forEach((value, key) => {
+		if (typeof value === "string") params.append(key, value);
+	});
+	return params;
+}
+function addGroupHttpRuntime(deps) {
+	if (!deps.hasSSO) return;
+	const { http, auth, config, requireEnv, loadActiveConnectionSamlOrThrow, loadConnectionOidcOrThrow, getGroupConnectionScimContext, loadGroupPolicyOrThrow, recordGroupAuditEvent, emitGroupWebhookDeliveries, generateRandomString, inviteTokenAlphabet: INVITE_TOKEN_ALPHABET, callUserOAuth, callVerifierSignature, sharedOidcRedirectURI } = deps;
+	const GROUP_CONNECTION_ROUTE_BASE = deps.routeBase;
+	const convexError = (code, message) => new ConvexError({
+		code,
+		message
+	});
+	const SCIM_SCHEMAS = [{
+		id: SCIM_USER_SCHEMA_ID,
+		name: "User",
+		description: "User Account",
+		attributes: [
+			{
+				name: "userName",
+				type: "string",
+				required: true
+			},
+			{
+				name: "displayName",
+				type: "string"
+			},
+			{
+				name: "active",
+				type: "boolean"
+			},
+			{
+				name: "emails",
+				type: "complex",
+				multiValued: true
+			}
+		]
+	}, {
+		id: SCIM_GROUP_SCHEMA_ID,
+		name: "Group",
+		description: "Group",
+		attributes: [{
+			name: "displayName",
+			type: "string",
+			required: true
+		}, {
+			name: "members",
+			type: "complex",
+			multiValued: true
+		}]
+	}];
+	const SCIM_RESOURCE_TYPES = [{
+		id: "User",
+		name: "User",
+		endpoint: "/Users",
+		schema: SCIM_USER_SCHEMA_ID
+	}, {
+		id: "Group",
+		name: "Group",
+		endpoint: "/Groups",
+		schema: SCIM_GROUP_SCHEMA_ID
+	}];
+	const handleStaticScimCollection = (items, resourceId, opts) => {
+		if (resourceId !== void 0) {
+			const item = items.find((entry) => entry[opts.by] === decodeURIComponent(resourceId));
+			return item ? scimJson(item) : scimError(404, "notFound", opts.notFound);
+		}
+		return scimJson({
+			schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+			Resources: items,
+			totalResults: items.length,
+			startIndex: 1,
+			itemsPerPage: items.length
+		});
+	};
+	const pickPrimaryEmail = (body) => Array.isArray(body.emails) ? body.emails.find((entry) => entry.primary === true)?.value ?? body.emails[0]?.value : void 0;
+	const pickDisplayName = (body) => {
+		const name = typeof body.name === "object" && body.name !== null ? body.name : void 0;
+		const derivedName = [name?.givenName, name?.familyName].filter(Boolean).join(" ");
+		if (body.displayName !== void 0) return body.displayName;
+		if (name?.formatted !== void 0) return name.formatted;
+		return derivedName !== "" ? derivedName : void 0;
+	};
+	const pickPhone = (body) => Array.isArray(body.phoneNumbers) ? body.phoneNumbers[0]?.value : void 0;
+	const getScimProfileConfig = (scimConfig) => {
+		const extend = typeof scimConfig?.extend === "object" && scimConfig.extend !== null ? scimConfig.extend : {};
+		const profile = typeof extend.profile === "object" && extend.profile !== null ? extend.profile : {};
+		return {
+			mapping: typeof profile.mapping === "object" && profile.mapping !== null ? profile.mapping : {},
+			extraFields: typeof profile.extraFields === "object" && profile.extraFields !== null ? profile.extraFields : {}
+		};
+	};
+	const resolveScimField = (body, key) => {
+		switch (key) {
+			case "userName": return body.userName;
+			case "externalId": return body.externalId;
+			case "displayName": return body.displayName;
+			case "name.formatted": return body.name?.formatted;
+			case "name.givenName": return body.name?.givenName;
+			case "name.familyName": return body.name?.familyName;
+			case "emails.primary": return pickPrimaryEmail(body);
+			case "emails.value": return Array.isArray(body.emails) ? body.emails.map((entry) => entry.value).filter(Boolean) : void 0;
+			case "phoneNumbers.primary":
+			case "phoneNumbers.value": return pickPhone(body);
+			case "active": return body.active;
+			case "groups": return body.groups;
+			case "roles": return body.roles;
+			default: return key ? body[key] : void 0;
+		}
+	};
+	const extractScimProfile = (scimConfig, body) => {
+		const { mapping, extraFields } = getScimProfileConfig(scimConfig);
+		const extend = Object.fromEntries(Object.entries(extraFields).map(([fieldName, source]) => [fieldName, resolveScimField(body, source)]).filter(([, value]) => value !== void 0));
+		return finalizeNormalizedProfile({
+			externalId: resolveScimField(body, mapping.externalId) ?? (typeof body.externalId === "string" ? body.externalId : void 0),
+			name: resolveScimField(body, mapping.name) ?? pickDisplayName(body),
+			firstName: resolveScimField(body, mapping.firstName),
+			lastName: resolveScimField(body, mapping.lastName),
+			email: resolveScimField(body, mapping.email) ?? pickPrimaryEmail(body) ?? body.userName,
+			phone: resolveScimField(body, mapping.phone) ?? pickPhone(body),
+			active: resolveScimField(body, mapping.active) ?? body.active,
+			groups: pickStringArray(resolveScimField(body, mapping.groups)),
+			roles: pickStringArray(resolveScimField(body, mapping.roles)),
+			extend: Object.keys(extend).length > 0 ? extend : void 0
+		});
+	};
+	const pickStringArray = (value) => {
+		return normalizeStringArray(Array.isArray(value) ? value.map((entry) => {
+			if (typeof entry === "string") return entry;
+			if (typeof entry === "object" && entry !== null && typeof entry.value === "string") return entry.value;
+		}) : value);
+	};
+	const normalizeScimValues = (value) => {
+		if (Array.isArray(value)) return value.flatMap((entry) => normalizeScimValues(entry));
+		if (typeof value === "string") return [value];
+		if (typeof value === "boolean") return [String(value)];
+		return [];
+	};
+	const applyUserProvisioningPatch = (args) => {
+		const mode = args.policy.updateProfileFromScim ?? "always";
+		if (mode === "never") return {};
+		if (mode === "always") return args.nextUser;
+		return Object.fromEntries(Object.entries(args.nextUser).filter(([key, value]) => {
+			if (value === void 0) return false;
+			const current = args.currentUser[key];
+			return current === void 0 || current === null || current === "";
+		}));
+	};
+	const filterScimCollection = (items, filter, filters) => {
+		if (!filter) return items;
+		const accessor = filters[filter.attribute];
+		if (!accessor) throw new Error("Unsupported SCIM filter.");
+		return items.filter((item) => {
+			const values = normalizeScimValues(accessor(item));
+			switch (filter.operator) {
+				case "pr": return values.length > 0;
+				case "eq": return values.includes(filter.value ?? "");
+				case "co": return values.some((value) => value.includes(filter.value ?? ""));
+				case "sw": return values.some((value) => value.startsWith(filter.value ?? ""));
+				case "ew": return values.some((value) => value.endsWith(filter.value ?? ""));
+			}
+		});
+	};
+	const paginateScimCollection = (items, listRequest) => {
+		const start = listRequest.startIndex - 1;
+		return items.slice(start, start + listRequest.count);
+	};
+	const requireScimResourceId = (resourceId, label) => {
+		if (!resourceId) return scimError(400, "invalidPath", `${label} resource ID is required.`);
+		return null;
+	};
+	const readScimJson = async (request) => await request.json();
+	const handleSamlAcs = async (ctx, request, runtimeRoute) => {
+		if (runtimeRoute.protocol !== "saml" || runtimeRoute.rest.length !== 1 || runtimeRoute.rest[0] !== "acs") throw convexError("INVALID_PARAMETERS", "Invalid connection runtime path.");
+		const connectionId = runtimeRoute.connectionId;
+		const { loaded, connection, saml } = await loadActiveConnectionSamlOrThrow(ctx, connectionId);
+		let parsedResponse;
+		try {
+			parsedResponse = await parseGroupConnectionSamlLoginResponse({
+				request,
+				rootUrl: requireEnv("CONVEX_SITE_URL"),
+				source: {
+					kind: "connection",
+					id: connection._id
+				},
+				config: loaded.config
+			});
+		} catch (error) {
+			throw convexError("OAUTH_PROVIDER_ERROR", `SAML response parse failed: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		try {
+			enforceGroupConnectionSamlSecurity({
+				extract: parsedResponse.parsed.extract,
+				config: loaded.config
+			});
+		} catch (error) {
+			throw convexError("OAUTH_PROVIDER_ERROR", error instanceof Error ? error.message : "SAML assertion failed security validation.");
+		}
+		try {
+			validateGroupConnectionSamlLoginRelayState({
+				relayState: parsedResponse.relayState,
+				source: {
+					kind: "connection",
+					id: connection._id
+				},
+				inResponseTo: parsedResponse.parsed.extract?.response?.inResponseTo
+			});
+		} catch {
+			throw convexError("OAUTH_INVALID_STATE", "SAML RelayState did not match the pending login request.");
+		}
+		const { samlAttributes, samlSessionIndex, ...userProfile } = profileFromSamlExtract(parsedResponse.parsed.extract, saml.profile?.mapping ?? {});
+		const profile = userProfile;
+		const extraFields = typeof saml.profile === "object" && saml.profile !== null ? saml.profile.extraFields : void 0;
+		if (extraFields) {
+			const extend = {};
+			for (const [fieldName, attributeName] of Object.entries(extraFields)) {
+				const value = samlAttributes[attributeName];
+				if (value !== void 0) extend[fieldName] = value;
+			}
+			if (Object.keys(extend).length > 0) profile.extend = extend;
+		}
+		const maybeRedirectTo = useRedirectToParam(groupSamlProviderId(connection._id), getCookies(request));
+		const verificationCode = await callUserOAuth(ctx, {
+			provider: groupSamlProviderId(connection._id),
+			providerAccountId: profile.id,
+			profile,
+			signature: parsedResponse.relayState.signature,
+			accountExtend: {
+				identity: {
+					protocol: "saml",
+					connectionId: connection._id,
+					subject: profile.id,
+					entityId: typeof saml.entityId === "string" ? saml.entityId : void 0
+				},
+				saml: {
+					attributes: samlAttributes,
+					sessionIndex: samlSessionIndex
+				}
+			}
+		});
+		const vurl = setURLSearchParam(await redirectAbsoluteUrl(config, { redirectTo: maybeRedirectTo?.redirectTo ?? (typeof parsedResponse.relayState.redirectTo === "string" ? parsedResponse.relayState.redirectTo : void 0) }), "code", verificationCode);
+		const vheaders = new Headers({ Location: vurl });
+		vheaders.set("Cache-Control", "must-revalidate");
+		for (const { name, value, options } of maybeRedirectTo !== null ? [maybeRedirectTo.updatedCookie] : []) vheaders.append("Set-Cookie", serialize(name, value, options));
+		return new Response(null, {
+			status: 302,
+			headers: vheaders
+		});
+	};
+	const handleSamlSlo = async (ctx, request, runtimeRoute) => {
+		if (runtimeRoute.protocol !== "saml" || runtimeRoute.rest.length !== 1 || runtimeRoute.rest[0] !== "slo") throw convexError("INVALID_PARAMETERS", "Invalid connection runtime path.");
+		const { loaded, connection } = await loadActiveConnectionSamlOrThrow(ctx, runtimeRoute.connectionId);
+		const parsedMessage = await parseGroupConnectionSamlLogoutMessage({
+			request,
+			rootUrl: requireEnv("CONVEX_SITE_URL"),
+			source: {
+				kind: "connection",
+				id: connection._id
+			},
+			config: loaded.config
+		});
+		if (parsedMessage.hasSamlRequest) {
+			if (!parsedMessage.parsedRequest) throw convexError("INVALID_PARAMETERS", "Missing SAML logout payload.");
+			const responseContext = parsedMessage.runtime.sp.createLogoutResponse(parsedMessage.runtime.idp, parsedMessage.parsedRequest.extract, parsedMessage.binding, parsedMessage.relayState ?? "");
+			if (parsedMessage.binding === "redirect") return new Response(null, {
+				status: 302,
+				headers: { Location: responseContext.context }
+			});
+			return createSamlPostBindingResponse({
+				endpoint: responseContext.entityEndpoint,
+				parameter: "SAMLResponse",
+				value: responseContext.context,
+				relayState: parsedMessage.relayState
+			});
+		} else if (parsedMessage.hasSamlResponse) return new Response(null, { status: 204 });
+		else throw convexError("INVALID_PARAMETERS", "Missing SAML logout payload.");
+	};
+	const handleScimRequest = async (ctx, request) => {
+		try {
+			const { scimConfig, connection, parsedPath } = await getGroupConnectionScimContext(ctx, request);
+			const state = {
+				ctx,
+				request,
+				url: new URL(request.url),
+				parsedPath,
+				connection,
+				scimConfig,
+				policy: await loadGroupPolicyOrThrow(ctx, connection.groupId),
+				recordScimEvent: async (eventType, ok, subjectType, subjectId, metadata) => {
+					const auditEventId = await recordGroupAuditEvent(ctx, {
+						connectionId: connection._id,
+						groupId: connection.groupId,
+						eventType,
+						actorType: "scim",
+						subjectType,
+						subjectId,
+						ok,
+						metadata
+					});
+					await emitGroupWebhookDeliveries(ctx, {
+						connectionId: connection._id,
+						eventType,
+						auditEventId,
+						payload: {
+							connectionId: connection._id,
+							subjectId,
+							metadata
+						}
+					});
+				}
+			};
+			const handleUsersGet = async (state$1) => {
+				const members = await auth.member.list(state$1.ctx, {
+					where: { groupId: state$1.connection.groupId },
+					limit: 100
+				});
+				const identities = await listScimIdentitiesByConnection(state$1.ctx, config.component.public, state$1.connection._id);
+				const identityByUserId = new Map(identities.filter((identity) => typeof identity.userId === "string").map((identity) => [identity.userId, identity]));
+				const users = (await Promise.all(members.items.map(async (member) => {
+					const user = await auth.user.get(state$1.ctx, member.userId);
+					const typedUser = user;
+					return user ? {
+						user: typedUser,
+						member,
+						identity: identityByUserId.get(typedUser._id)
+					} : null;
+				}))).filter(Boolean);
+				const listRequest = parseScimListRequest(state$1.url);
+				const filtered = filterScimCollection(users, listRequest.filter, {
+					id: (item) => item.user._id,
+					externalId: (item) => item.identity?.externalId,
+					userName: (item) => item.user.email ?? item.user.phone ?? item.user.name ?? item.user._id,
+					displayName: (item) => item.user.name,
+					name: (item) => item.user.name,
+					"name.formatted": (item) => item.user.name,
+					"name.givenName": (item) => item.user.name,
+					"name.familyName": (item) => item.user.name,
+					"emails.value": (item) => item.user.email,
+					"phoneNumbers.value": (item) => item.user.phone,
+					active: (item) => item.identity?.active ?? item.member.status === "active"
+				});
+				if (state$1.parsedPath.resourceId) {
+					const resource = filtered.find(({ user }) => user._id === state$1.parsedPath.resourceId);
+					return resource ? scimJson(serializeScimUser({
+						id: resource.user._id,
+						user: resource.user,
+						externalId: resource.identity?.externalId,
+						location: `${state$1.url.origin}${state$1.url.pathname.replace(/\/[^/]+$/, "")}/${resource.user._id}`,
+						active: resource.identity?.active ?? resource.member.status === "active"
+					}), 200, { Location: `${state$1.url.origin}${state$1.url.pathname.replace(/\/[^/]+$/, "")}/${resource.user._id}` }) : scimError(404, "notFound", "User not found.");
+				}
+				const paged = paginateScimCollection(filtered, listRequest);
+				await state$1.recordScimEvent("group.sso.scim.read", true, "group_connection_scim", state$1.scimConfig._id);
+				return scimJson({
+					schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+					Resources: paged.map(({ user, identity, member }) => serializeScimUser({
+						id: user._id,
+						user,
+						externalId: identity?.externalId,
+						location: `${state$1.url.origin}${state$1.url.pathname}/${user._id}`,
+						active: identity?.active ?? member.status === "active"
+					})),
+					totalResults: filtered.length,
+					startIndex: listRequest.startIndex,
+					itemsPerPage: paged.length
+				});
+			};
+			const handleUsersPost = async (state$1) => {
+				const body = await readScimJson(state$1.request);
+				const extractedBase = extractScimProfile(state$1.scimConfig, body);
+				const extracted = await config.sso?.hooks?.profileResolved?.({
+					protocol: "scim",
+					connectionId: state$1.connection._id,
+					profile: extractedBase
+				}) ?? extractedBase;
+				const provisionProfile = await config.sso?.hooks?.beforeProvision?.({
+					protocol: "scim",
+					connectionId: state$1.connection._id,
+					profile: extracted
+				}) ?? extracted;
+				const externalId = provisionProfile.externalId;
+				const existingIdentity = externalId ? await getScimIdentity(state$1.ctx, config.component.public, {
+					connectionId: state$1.connection._id,
+					resourceType: "user",
+					externalId
+				}) : null;
+				const existingUser = existingIdentity?.userId ? await auth.user.get(state$1.ctx, existingIdentity.userId) : null;
+				const created = existingUser === null;
+				const provisionedRoleIds = resolveProvisionedRoleIds({
+					policy: state$1.policy,
+					groups: provisionProfile.groups,
+					roles: provisionProfile.roles
+				});
+				const userId = existingUser?._id ? existingUser._id : await insertUser(state$1.ctx, config.component.public, {
+					name: provisionProfile.name,
+					...typeof provisionProfile.firstName === "string" ? { firstName: provisionProfile.firstName } : {},
+					...typeof provisionProfile.lastName === "string" ? { lastName: provisionProfile.lastName } : {},
+					email: provisionProfile.email,
+					...typeof provisionProfile.email === "string" ? { emailVerificationTime: Date.now() } : {},
+					phone: provisionProfile.phone,
+					...typeof provisionProfile.phone === "string" ? { phoneVerificationTime: Date.now() } : {},
+					...provisionProfile.extend ? { extend: provisionProfile.extend } : {}
+				});
+				if (created && externalId) {
+					const providerId = state$1.connection.protocol === "oidc" ? groupOidcProviderId(state$1.connection._id) : groupSamlProviderId(state$1.connection._id);
+					await insertAccount(state$1.ctx, config.component.public, {
+						userId,
+						provider: providerId,
+						providerAccountId: externalId
+					});
+				}
+				if (existingUser) {
+					const nextUserData = {
+						name: provisionProfile.name,
+						firstName: provisionProfile.firstName,
+						lastName: provisionProfile.lastName,
+						email: provisionProfile.email,
+						phone: provisionProfile.phone,
+						...provisionProfile.extend ? { extend: provisionProfile.extend } : {}
+					};
+					if (typeof provisionProfile.email === "string") nextUserData.emailVerificationTime = Date.now();
+					if (typeof provisionProfile.phone === "string") nextUserData.phoneVerificationTime = Date.now();
+					const patchData = applyUserProvisioningPatch({
+						currentUser: existingUser,
+						nextUser: nextUserData,
+						policy: state$1.policy.provisioning.user,
+						source: "scim"
+					});
+					if (Object.keys(patchData).length > 0) await patchUser(state$1.ctx, config.component.public, {
+						userId,
+						data: patchData
+					});
+				}
+				const resolution = await auth.member.inspect(state$1.ctx, {
+					groupId: state$1.connection.groupId,
+					userId
+				});
+				if (resolution.membership) await auth.member.update(state$1.ctx, resolution.membership._id, { status: body.active === false ? "inactive" : "active" });
+				else await auth.member.create(state$1.ctx, {
+					groupId: state$1.connection.groupId,
+					userId,
+					roleIds: provisionedRoleIds,
+					status: provisionProfile.active === false ? "inactive" : "active"
+				});
+				if (externalId) await upsertScimIdentity(state$1.ctx, config.component.public, {
+					connectionId: state$1.connection._id,
+					groupId: state$1.connection.groupId,
+					resourceType: "user",
+					externalId,
+					userId,
+					active: provisionProfile.active !== false,
+					raw: body,
+					lastProvisionedAt: Date.now()
+				});
+				await state$1.recordScimEvent(created ? "group.sso.scim.user.created" : "group.sso.scim.user.updated", true, "user", userId);
+				const createdUser = await auth.user.get(state$1.ctx, userId);
+				await config.sso?.hooks?.afterProvision?.({
+					protocol: "scim",
+					connectionId: state$1.connection._id,
+					profile: provisionProfile,
+					userId
+				});
+				const location = `${state$1.url.origin}${state$1.url.pathname}/${userId}`;
+				return scimJson(serializeScimUser({
+					id: userId,
+					user: createdUser ?? {},
+					externalId,
+					location,
+					active: provisionProfile.active !== false
+				}), created ? 201 : 200, { Location: location });
+			};
+			const handleUsersUpsert = async (state$1) => {
+				const missing = requireScimResourceId(state$1.parsedPath.resourceId, "User");
+				if (missing) return missing;
+				const userId = state$1.parsedPath.resourceId;
+				const existingUser = await auth.user.get(state$1.ctx, userId);
+				if (!existingUser) return scimError(404, "notFound", "User not found.");
+				const body = await readScimJson(state$1.request);
+				const extractedBase = extractScimProfile(state$1.scimConfig, body);
+				const extracted = await config.sso?.hooks?.profileResolved?.({
+					protocol: "scim",
+					connectionId: state$1.connection._id,
+					profile: extractedBase
+				}) ?? extractedBase;
+				const provisionProfile = await config.sso?.hooks?.beforeProvision?.({
+					protocol: "scim",
+					connectionId: state$1.connection._id,
+					profile: extracted
+				}) ?? extracted;
+				const externalId = provisionProfile.externalId;
+				const patchData = {};
+				let nextActive;
+				if (state$1.request.method === "PUT") {
+					patchData.name = provisionProfile.name;
+					patchData.firstName = provisionProfile.firstName;
+					patchData.lastName = provisionProfile.lastName;
+					patchData.email = provisionProfile.email;
+					patchData.phone = provisionProfile.phone;
+					if (provisionProfile.extend) patchData.extend = provisionProfile.extend;
+					if (typeof patchData.email === "string") patchData.emailVerificationTime = Date.now();
+					if (typeof patchData.phone === "string") patchData.phoneVerificationTime = Date.now();
+				} else for (const operation of Array.isArray(body.Operations) ? body.Operations : []) {
+					if (operation.path === "active") nextActive = typeof operation.value === "boolean" ? operation.value : void 0;
+					if (operation.path === "displayName" || operation.path === "name.formatted") patchData.name = operation.value;
+					if (operation.path === "name.givenName") patchData.firstName = operation.value;
+					if (operation.path === "name.familyName") patchData.lastName = operation.value;
+					if (operation.path === "userName" || operation.path === "emails.value") {
+						patchData.email = operation.value;
+						if (typeof operation.value === "string") patchData.emailVerificationTime = Date.now();
+					}
+					if (operation.path === "phoneNumbers.value") {
+						patchData.phone = operation.value;
+						if (typeof operation.value === "string") patchData.phoneVerificationTime = Date.now();
+					}
+				}
+				const nextPatchData = applyUserProvisioningPatch({
+					currentUser: existingUser,
+					nextUser: patchData,
+					policy: state$1.policy.provisioning.user,
+					source: "scim"
+				});
+				if (Object.keys(nextPatchData).length > 0) await patchUser(state$1.ctx, config.component.public, {
+					userId,
+					data: nextPatchData
+				});
+				const resolution = await auth.member.inspect(state$1.ctx, {
+					groupId: state$1.connection.groupId,
+					userId
+				});
+				if (resolution.membership) await auth.member.update(state$1.ctx, resolution.membership._id, {
+					roleIds: resolveProvisionedRoleIds({
+						policy: state$1.policy,
+						groups: provisionProfile.groups,
+						roles: provisionProfile.roles
+					}),
+					status: provisionProfile.active === false || nextActive === false ? "inactive" : "active"
+				});
+				await upsertScimIdentity(state$1.ctx, config.component.public, {
+					connectionId: state$1.connection._id,
+					groupId: state$1.connection.groupId,
+					resourceType: "user",
+					externalId: externalId !== void 0 ? externalId : (await getScimIdentityByConnectionAndUser(state$1.ctx, config.component.public, {
+						connectionId: state$1.connection._id,
+						userId
+					}))?.externalId ?? userId,
+					userId,
+					active: provisionProfile.active !== false && nextActive !== false,
+					raw: body,
+					lastProvisionedAt: Date.now()
+				});
+				await state$1.recordScimEvent("group.sso.scim.user.updated", true, "user", userId);
+				const updatedUser = await auth.user.get(state$1.ctx, userId);
+				await config.sso?.hooks?.afterProvision?.({
+					protocol: "scim",
+					connectionId: state$1.connection._id,
+					profile: provisionProfile,
+					userId
+				});
+				const location = `${state$1.url.origin}${state$1.url.pathname}`;
+				return scimJson(serializeScimUser({
+					id: userId,
+					user: updatedUser ?? existingUser,
+					externalId,
+					location,
+					active: provisionProfile.active !== false && nextActive !== false
+				}), 200, { Location: location });
+			};
+			const handleUsersDelete = async (state$1) => {
+				const missing = requireScimResourceId(state$1.parsedPath.resourceId, "User");
+				if (missing) return missing;
+				const userId = state$1.parsedPath.resourceId;
+				const resolution = await auth.member.inspect(state$1.ctx, {
+					groupId: state$1.connection.groupId,
+					userId
+				});
+				if (resolution.membership) await auth.member.delete(state$1.ctx, resolution.membership._id);
+				const identity = await getScimIdentityByConnectionAndUser(state$1.ctx, config.component.public, {
+					connectionId: state$1.connection._id,
+					userId
+				});
+				if (identity) if (state$1.policy.provisioning.deprovision.mode === "hard") await deleteScimIdentity(state$1.ctx, config.component.public, identity._id);
+				else await upsertScimIdentity(state$1.ctx, config.component.public, {
+					connectionId: identity.connectionId,
+					groupId: identity.groupId,
+					resourceType: identity.resourceType,
+					externalId: identity.externalId,
+					userId: identity.userId,
+					mappedGroupId: identity.mappedGroupId,
+					active: false,
+					raw: identity.raw,
+					lastProvisionedAt: Date.now()
+				});
+				await state$1.recordScimEvent("group.sso.scim.user.deleted", true, "user", userId);
+				return new Response(null, { status: 204 });
+			};
+			const handleGroupsGet = async (state$1) => {
+				const groupsList = await auth.group.list(state$1.ctx, {
+					where: { parentGroupId: state$1.connection.groupId },
+					limit: 100
+				});
+				const identities = await listScimIdentitiesByConnection(state$1.ctx, config.component.public, state$1.connection._id);
+				const identityByGroupId = new Map(identities.filter((identity) => typeof identity.mappedGroupId === "string").map((identity) => [identity.mappedGroupId, identity]));
+				const groups = await Promise.all(groupsList.items.map(async (group) => {
+					const typedGroup = group;
+					const members = await auth.member.list(state$1.ctx, {
+						where: {
+							groupId: typedGroup._id,
+							status: "active"
+						},
+						limit: 100
+					});
+					return {
+						group: typedGroup,
+						identity: identityByGroupId.get(typedGroup._id),
+						memberIds: members.items.map((member) => member.userId)
+					};
+				}));
+				const listRequest = parseScimListRequest(state$1.url);
+				const filtered = filterScimCollection(groups, listRequest.filter, {
+					id: (item) => item.group._id,
+					externalId: (item) => item.identity?.externalId,
+					displayName: (item) => item.group.name,
+					"members.value": (item) => item.memberIds
+				});
+				if (state$1.parsedPath.resourceId) {
+					const resource = filtered.find(({ group }) => group._id === state$1.parsedPath.resourceId);
+					if (!resource) return scimError(404, "notFound", "Group not found.");
+					const members = (await auth.member.list(state$1.ctx, {
+						where: {
+							groupId: resource.group._id,
+							status: "active"
+						},
+						limit: 100
+					})).items.map((member) => ({ value: member.userId }));
+					const location = `${state$1.url.origin}${state$1.url.pathname.replace(/\/[^/]+$/, "")}/${resource.group._id}`;
+					return scimJson(serializeScimGroup({
+						id: resource.group._id,
+						group: resource.group,
+						externalId: resource.identity?.externalId,
+						location,
+						members
+					}), 200, { Location: location });
+				}
+				const paged = paginateScimCollection(filtered, listRequest);
+				return scimJson({
+					schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+					Resources: paged.map(({ group, identity }) => serializeScimGroup({
+						id: group._id,
+						group,
+						externalId: identity?.externalId,
+						location: `${state$1.url.origin}${state$1.url.pathname}/${group._id}`
+					})),
+					totalResults: filtered.length,
+					startIndex: listRequest.startIndex,
+					itemsPerPage: paged.length
+				});
+			};
+			const handleGroupsPost = async (state$1) => {
+				const body = await readScimJson(state$1.request);
+				const externalId = typeof body.externalId === "string" ? body.externalId : void 0;
+				const existingIdentity = externalId ? await getScimIdentity(state$1.ctx, config.component.public, {
+					connectionId: state$1.connection._id,
+					resourceType: "group",
+					externalId
+				}) : null;
+				const existingGroup = existingIdentity?.mappedGroupId ? await auth.group.get(state$1.ctx, existingIdentity.mappedGroupId) : null;
+				const created = existingGroup === null;
+				const provisionedRoleIds = resolveProvisionedRoleIds({
+					policy: state$1.policy,
+					groups: typeof body.displayName === "string" ? [body.displayName] : void 0,
+					roles: pickStringArray(body.roles)
+				});
+				const groupId = existingGroup?._id ? existingGroup._id : (await auth.group.create(state$1.ctx, {
+					name: typeof body.displayName === "string" ? body.displayName : "Group",
+					parentGroupId: state$1.connection.groupId,
+					type: "organization"
+				})).groupId;
+				if (!created && existingGroup) {
+					const location$1 = `${state$1.url.origin}${state$1.url.pathname}/${groupId}`;
+					return scimJson(serializeScimGroup({
+						id: groupId,
+						group: existingGroup,
+						externalId,
+						location: location$1,
+						members: (await auth.member.list(state$1.ctx, {
+							where: {
+								groupId,
+								status: "active"
+							},
+							limit: 100
+						})).items.map((member) => ({ value: member.userId }))
+					}), 200, { Location: location$1 });
+				}
+				await upsertScimIdentity(state$1.ctx, config.component.public, {
+					connectionId: state$1.connection._id,
+					groupId: state$1.connection.groupId,
+					resourceType: "group",
+					externalId: externalId ?? groupId,
+					mappedGroupId: groupId,
+					active: true,
+					raw: body,
+					lastProvisionedAt: Date.now()
+				});
+				const currentMembers = (await auth.member.list(state$1.ctx, {
+					where: {
+						groupId,
+						status: "active"
+					},
+					limit: 100
+				})).items;
+				const currentByUserId = new Map(currentMembers.map((member) => [member.userId, member]));
+				const nextUserIds = new Set((Array.isArray(body.members) ? body.members : []).map((member) => String(member.value)));
+				for (const member of currentMembers) if (!nextUserIds.has(member.userId)) await auth.member.delete(state$1.ctx, member._id);
+				for (const userId of nextUserIds.values()) if (!currentByUserId.has(userId)) try {
+					await auth.member.create(state$1.ctx, {
+						groupId,
+						userId,
+						roleIds: provisionedRoleIds,
+						status: "active"
+					});
+				} catch {}
+				await state$1.recordScimEvent(created ? "group.sso.scim.group.created" : "group.sso.scim.group.updated", true, "group", groupId);
+				const group = await auth.group.get(state$1.ctx, groupId);
+				const location = `${state$1.url.origin}${state$1.url.pathname}/${groupId}`;
+				return scimJson(serializeScimGroup({
+					id: groupId,
+					group: group ?? {},
+					externalId,
+					location,
+					members: (await auth.member.list(state$1.ctx, {
+						where: {
+							groupId,
+							status: "active"
+						},
+						limit: 100
+					})).items.map((member) => ({ value: member.userId }))
+				}), created ? 201 : 200, { Location: location });
+			};
+			const handleGroupsPatch = async (state$1) => {
+				const missing = requireScimResourceId(state$1.parsedPath.resourceId, "Group");
+				if (missing) return missing;
+				const groupId = state$1.parsedPath.resourceId;
+				const body = await readScimJson(state$1.request);
+				for (const operation of Array.isArray(body.Operations) ? body.Operations : []) {
+					if (operation.path === "displayName") await auth.group.update(state$1.ctx, groupId, { name: operation.value });
+					if (operation.path === "members" && operation.op === "add") for (const member of Array.isArray(operation.value) ? operation.value : []) try {
+						await auth.member.create(state$1.ctx, {
+							groupId,
+							userId: String(member.value),
+							roleIds: resolveProvisionedRoleIds({
+								policy: state$1.policy,
+								groups: typeof body.displayName === "string" ? [body.displayName] : void 0,
+								roles: pickStringArray(body.roles)
+							}),
+							status: "active"
+						});
+					} catch {}
+					if (operation.path === "members" && operation.op === "replace") {
+						const currentMembers = (await auth.member.list(state$1.ctx, {
+							where: {
+								groupId,
+								status: "active"
+							},
+							limit: 100
+						})).items;
+						const currentUserIds = new Set(currentMembers.map((member) => member.userId));
+						const nextUserIds = new Set((Array.isArray(operation.value) ? operation.value : []).map((member) => String(member.value)));
+						for (const member of currentMembers) if (!nextUserIds.has(member.userId)) await auth.member.delete(state$1.ctx, member._id);
+						for (const userId of nextUserIds.values()) if (!currentUserIds.has(userId)) try {
+							await auth.member.create(state$1.ctx, {
+								groupId,
+								userId,
+								roleIds: resolveProvisionedRoleIds({
+									policy: state$1.policy,
+									groups: typeof body.displayName === "string" ? [body.displayName] : void 0,
+									roles: pickStringArray(body.roles)
+								}),
+								status: "active"
+							});
+						} catch {}
+					}
+					if (typeof operation.path === "string" && operation.op === "remove" && operation.path.startsWith("members[")) {
+						const userId = operation.path.match(/^members\[value eq "([^"]+)"\]$/)?.[1];
+						if (userId) {
+							const resolution = await auth.member.inspect(state$1.ctx, {
+								groupId,
+								userId
+							});
+							if (resolution.membership) await auth.member.delete(state$1.ctx, resolution.membership._id);
+						}
+					}
+				}
+				await state$1.recordScimEvent("group.sso.scim.group.updated", true, "group", groupId);
+				const group = await auth.group.get(state$1.ctx, groupId);
+				const location = `${state$1.url.origin}${state$1.url.pathname}`;
+				const members = (await auth.member.list(state$1.ctx, {
+					where: {
+						groupId,
+						status: "active"
+					},
+					limit: 100
+				})).items;
+				return scimJson(serializeScimGroup({
+					id: groupId,
+					group: group ?? {},
+					location,
+					members: members.map((member) => ({ value: member.userId }))
+				}), 200, { Location: location });
+			};
+			const handleGroupsDelete = async (state$1) => {
+				const missing = requireScimResourceId(state$1.parsedPath.resourceId, "Group");
+				if (missing) return missing;
+				const groupId = state$1.parsedPath.resourceId;
+				await auth.group.delete(state$1.ctx, groupId);
+				const identity = await getScimIdentityByMappedGroup(state$1.ctx, config.component.public, groupId);
+				if (identity) await deleteScimIdentity(state$1.ctx, config.component.public, identity._id);
+				await state$1.recordScimEvent("group.sso.scim.group.deleted", true, "group", groupId);
+				return new Response(null, { status: 204 });
+			};
+			const handler = {
+				ServiceProviderConfig: { GET: async () => scimJson({
+					schemas: ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],
+					patch: { supported: true },
+					bulk: {
+						supported: false,
+						maxOperations: 0,
+						maxPayloadSize: 0
+					},
+					filter: {
+						supported: true,
+						maxResults: 100
+					},
+					changePassword: { supported: false },
+					sort: { supported: false },
+					etag: { supported: false },
+					authenticationSchemes: [{
+						type: "oauthbearertoken",
+						name: "Bearer Token",
+						description: "Use the SCIM token generated by Convex Auth connection."
+					}]
+				}) },
+				Schemas: { GET: async (state$1) => handleStaticScimCollection(SCIM_SCHEMAS, state$1.parsedPath.resourceId, {
+					by: "id",
+					notFound: "Schema not found."
+				}) },
+				ResourceTypes: { GET: async (state$1) => handleStaticScimCollection(SCIM_RESOURCE_TYPES, state$1.parsedPath.resourceId, {
+					by: "name",
+					notFound: "Resource type not found."
+				}) },
+				Users: {
+					GET: handleUsersGet,
+					POST: handleUsersPost,
+					PATCH: handleUsersUpsert,
+					PUT: handleUsersUpsert,
+					DELETE: handleUsersDelete
+				},
+				Groups: {
+					GET: handleGroupsGet,
+					POST: handleGroupsPost,
+					PATCH: handleGroupsPatch,
+					DELETE: handleGroupsDelete
+				}
+			}[state.parsedPath.resource]?.[state.request.method];
+			return handler ? await handler(state) : scimError(404, "notFound", "SCIM resource not found.");
+		} catch (error) {
+			if (error instanceof Error && error.message === "Unsupported SCIM filter.") return scimError(400, "invalidFilter", error.message);
+			if (error instanceof ConvexError && typeof error.data === "object" && error.data !== null && "code" in error.data && "message" in error.data) {
+				const code = error.data.code;
+				return scimError(code === "MISSING_BEARER_TOKEN" || code === "INVALID_API_KEY" ? 401 : 400, code, error.data.message);
+			}
+			throw error;
+		}
+	};
+	const handleOidcCallbackForConnection = async (ctx, request, connectionId) => {
+		const url = new URL(request.url);
+		const { connection, oidc } = await loadConnectionOidcOrThrow(ctx, connectionId);
+		const { providerId, provider, oauthConfig } = await createGroupConnectionOidcRuntime({
+			rootUrl: requireEnv("CONVEX_SITE_URL"),
+			connectionId: connection._id,
+			oidc,
+			sharedRedirectURI: sharedOidcRedirectURI
+		});
+		const cookies = getCookies(request);
+		const maybeRedirectTo = useRedirectToParam(providerId, cookies);
+		const destinationUrl = await redirectAbsoluteUrl(config, { redirectTo: maybeRedirectTo?.redirectTo });
+		const result = await handleOAuthCallback(providerId, {
+			...oauthConfig,
+			provider
+		}, Object.fromEntries(url.searchParams.entries()), cookies);
+		const extraFields = typeof oidc.profile === "object" && oidc.profile !== null ? oidc.profile.extraFields : void 0;
+		let profile = result.profile;
+		if (extraFields && typeof profile === "object" && profile) {
+			const extend = {};
+			for (const [claimName, fieldName] of Object.entries(extraFields)) if (claimName in profile) extend[fieldName] = profile[claimName];
+			if (Object.keys(extend).length > 0) profile = {
+				...profile,
+				extend
+			};
+		}
+		const verificationCode = await callUserOAuth(ctx, {
+			provider: providerId,
+			providerAccountId: result.providerAccountId,
+			profile,
+			signature: result.signature,
+			accountExtend: { identity: {
+				protocol: "oidc",
+				connectionId: connection._id,
+				subject: result.providerAccountId,
+				issuer: typeof oidc.discovery?.issuer === "string" ? oidc.discovery.issuer : void 0,
+				discoveryUrl: typeof oidc.discovery?.discoveryUrl === "string" ? oidc.discovery.discoveryUrl : void 0
+			} }
+		});
+		const headers = new Headers({ Location: setURLSearchParam(destinationUrl, "code", verificationCode) });
+		for (const { name, value, options } of result.cookies) headers.append("Set-Cookie", serialize(name, value, options));
+		if (maybeRedirectTo) headers.append("Set-Cookie", serialize(maybeRedirectTo.updatedCookie.name, maybeRedirectTo.updatedCookie.value, maybeRedirectTo.updatedCookie.options));
+		return new Response(null, {
+			status: 302,
+			headers
+		});
+	};
+	addSSORoutes(http, {
+		routeBase: GROUP_CONNECTION_ROUTE_BASE,
+		convertErrorsToResponse,
+		handleSamlMetadata: async (ctx, _request, runtimeRoute) => {
+			const { loaded } = await loadActiveConnectionSamlOrThrow(ctx, runtimeRoute.connectionId);
+			return new Response(createGroupConnectionSamlMetadataXml({
+				rootUrl: requireEnv("CONVEX_SITE_URL"),
+				source: loaded.source,
+				config: loaded.config
+			}), {
+				status: 200,
+				headers: { "Content-Type": "application/xml" }
+			});
+		},
+		handleSamlSignIn: async (ctx, request, runtimeRoute) => {
+			const url = new URL(request.url);
+			const verifier = url.searchParams.get("code");
+			if (!verifier) throw convexError("OAUTH_MISSING_VERIFIER", "Missing sign-in verifier.");
+			const { loaded, connection } = await loadActiveConnectionSamlOrThrow(ctx, runtimeRoute.connectionId);
+			const state = generateRandomString(24, INVITE_TOKEN_ALPHABET);
+			const signInRequest = createGroupConnectionSamlSignInRequest({
+				rootUrl: requireEnv("CONVEX_SITE_URL"),
+				source: {
+					kind: "connection",
+					id: connection._id
+				},
+				config: loaded.config,
+				state,
+				signature: `saml ${connection._id} pending ${state}`,
+				redirectTo: url.searchParams.get("redirectTo") ?? void 0
+			});
+			const signature = `saml ${connection._id} ${signInRequest.requestId} ${state}`;
+			await callVerifierSignature(ctx, {
+				verifier,
+				signature
+			});
+			const redirectTo = url.searchParams.get("redirectTo");
+			const redirectCookies = redirectTo !== null ? [redirectToParamCookie(groupSamlProviderId(connection._id), redirectTo)] : [];
+			const relayState = encodeGroupSamlRelayState({
+				source: {
+					kind: "connection",
+					id: connection._id
+				},
+				signature,
+				requestId: signInRequest.requestId,
+				state,
+				redirectTo: url.searchParams.get("redirectTo") ?? void 0
+			});
+			if (signInRequest.binding === "redirect" && signInRequest.redirectUrl) {
+				const redirectUrl = new URL(signInRequest.redirectUrl);
+				redirectUrl.searchParams.set("RelayState", relayState);
+				const headers = new Headers({ Location: redirectUrl.toString() });
+				for (const { name, value, options } of redirectCookies) headers.append("Set-Cookie", serialize(name, value, options));
+				return new Response(null, {
+					status: 302,
+					headers
+				});
+			}
+			const response = createSamlPostBindingResponse({
+				endpoint: signInRequest.post.endpoint,
+				parameter: "SAMLRequest",
+				value: signInRequest.post.value,
+				relayState
+			});
+			for (const { name, value, options } of redirectCookies) response.headers.append("Set-Cookie", serialize(name, value, options));
+			return response;
+		},
+		handleOidcSignIn: async (ctx, request, runtimeRoute) => {
+			const url = new URL(request.url);
+			const verifier = url.searchParams.get("code");
+			if (!verifier) throw convexError("OAUTH_MISSING_VERIFIER", "Missing sign-in verifier.");
+			const { connection, oidc } = await loadConnectionOidcOrThrow(ctx, runtimeRoute.connectionId);
+			const { providerId, provider, oauthConfig } = await createGroupConnectionOidcRuntime({
+				rootUrl: requireEnv("CONVEX_SITE_URL"),
+				connectionId: connection._id,
+				oidc,
+				sharedRedirectURI: sharedOidcRedirectURI
+			});
+			const { redirect, cookies, signature } = await createOAuthAuthorizationURL(providerId, {
+				...oauthConfig,
+				provider
+			}, {
+				loginHint: url.searchParams.get("loginHint") ?? (typeof oidc.request?.loginHint === "string" ? oidc.request.loginHint : void 0),
+				stateTransform: typeof sharedOidcRedirectURI === "string" ? (state) => encodeGroupOidcState({
+					connectionId: connection._id,
+					state
+				}) : void 0
+			});
+			await callVerifierSignature(ctx, {
+				verifier,
+				signature
+			});
+			const redirectTo = url.searchParams.get("redirectTo");
+			const headers_ = new Headers({ Location: redirect });
+			for (const { name, value, options } of [...cookies, ...redirectTo !== null ? [redirectToParamCookie(providerId, redirectTo)] : []]) headers_.append("Set-Cookie", serialize(name, value, options));
+			return new Response(null, {
+				status: 302,
+				headers: headers_
+			});
+		},
+		handleOidcCallback: async (ctx, request, runtimeRoute) => {
+			return await handleOidcCallbackForConnection(ctx, request, runtimeRoute.connectionId);
+		},
+		handleSamlAcs,
+		handleSamlSlo,
+		handleScimRequest,
+		sharedOidcCallbackPath: sharedOidcRedirectURI,
+		handleOidcSharedCallback: async (ctx, request) => {
+			const url = new URL(request.url);
+			const params = await getOidcCallbackParams(request);
+			const { connectionId, state } = decodeGroupOidcState(params.get("state"));
+			params.set("state", state);
+			url.search = params.toString();
+			return await handleOidcCallbackForConnection(ctx, new Request(url, request), connectionId);
+		},
+		scimError
+	});
+}
+
+//#endregion
+export { addGroupHttpRuntime };
+//# sourceMappingURL=http.js.map