@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/sso/provision.js

@@ -0,0 +1,179 @@
+import { getGroupConnection, getScimConfigByConnection, getScimConfigByTokenHash, getScimIdentity, upsertScimConfig, upsertScimIdentity } from "../contract.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/sso/provision.ts
+function getScimConfigShape(scimConfig) {
+	return typeof scimConfig?.extend === "object" && scimConfig.extend !== null ? scimConfig.extend : {};
+}
+const convexError = (data) => new ConvexError(data);
+function createGroupScimDomain(deps) {
+	const { config, requireEnv, generateRandomString, INVITE_TOKEN_ALPHABET, sha256, loadGroupPolicyOrThrow, recordGroupAuditEvent, emitGroupWebhookDeliveries } = deps;
+	const getScimBasePath = (connectionId) => `${requireEnv("CONVEX_SITE_URL")}/api/auth/connections/${connectionId}/scim/v2`;
+	const validateScim = async (ctx, connectionId) => {
+		const checks = [];
+		const connection = await getGroupConnection(ctx, config.component.public, connectionId);
+		if (!connection) return {
+			ok: false,
+			connectionId,
+			checks: [{
+				name: "group_connection_exists",
+				ok: false,
+				message: "Connection not found."
+			}]
+		};
+		const policy = await loadGroupPolicyOrThrow(ctx, connection.groupId);
+		const scimConfig = await getScimConfigByConnection(ctx, config.component.public, connectionId);
+		const hasConfig = scimConfig !== null && scimConfig !== void 0;
+		checks.push({
+			name: "scim_config_exists",
+			ok: hasConfig,
+			message: hasConfig ? void 0 : "SCIM has not been configured."
+		});
+		const isActive = scimConfig?.status === "active";
+		checks.push({
+			name: "scim_config_active",
+			ok: isActive,
+			message: isActive ? void 0 : `SCIM config status is ${hasConfig ? scimConfig?.status : "unknown"}.`
+		});
+		const hasToken = typeof scimConfig?.tokenHash === "string" && scimConfig.tokenHash.length > 0;
+		checks.push({
+			name: "token_hash_set",
+			ok: hasToken,
+			message: hasToken ? void 0 : "SCIM bearer token has not been set."
+		});
+		const hasBasePath = typeof scimConfig?.basePath === "string" && scimConfig.basePath === getScimBasePath(connection._id);
+		checks.push({
+			name: "base_path_matches_route",
+			ok: hasBasePath,
+			message: hasBasePath ? void 0 : "SCIM basePath does not match the derived route."
+		});
+		const supportsIdempotentExternalId = policy.provisioning.scimReuse.user === "externalId";
+		checks.push({
+			name: "user_external_id_reuse_enabled",
+			ok: supportsIdempotentExternalId,
+			message: supportsIdempotentExternalId ? void 0 : "SCIM user retry-safe provisioning works best with scimReuse.user = externalId."
+		});
+		checks.push({
+			name: "filter_subset_supported",
+			ok: true,
+			message: "Supported filters: eq, co, sw, ew, pr on common user/group fields."
+		});
+		checks.push({
+			name: "protocol_capabilities_declared",
+			ok: true
+		});
+		return {
+			ok: checks.every((c) => c.ok),
+			connectionId: connection._id,
+			basePath: getScimBasePath(connection._id),
+			deprovisionMode: policy.provisioning.deprovision.mode,
+			capabilities: {
+				users: true,
+				groups: true,
+				patch: true,
+				put: true,
+				filters: [
+					"eq",
+					"co",
+					"sw",
+					"ew",
+					"pr"
+				],
+				bulk: false,
+				etag: false
+			},
+			checks
+		};
+	};
+	return {
+		configure: async (ctx, data) => {
+			const connection = await getGroupConnection(ctx, config.component.public, data.connectionId);
+			if (connection === null) throw convexError({
+				code: "INVALID_PARAMETERS",
+				message: "Connection not found."
+			});
+			const rawToken = generateRandomString(48, INVITE_TOKEN_ALPHABET);
+			const tokenHash = await sha256(rawToken);
+			const basePath = getScimBasePath(connection._id);
+			const configId = await upsertScimConfig(ctx, config.component.public, {
+				connectionId: connection._id,
+				groupId: connection.groupId,
+				status: data.status ?? "active",
+				basePath,
+				tokenHash,
+				lastRotatedAt: Date.now(),
+				extend: {
+					security: data.security,
+					profile: data.profile
+				}
+			});
+			const auditEventId = await recordGroupAuditEvent(ctx, {
+				connectionId: connection._id,
+				groupId: connection.groupId,
+				eventType: "group.sso.scim.configured",
+				actorType: "system",
+				subjectType: "group_connection_scim",
+				subjectId: configId,
+				ok: true
+			});
+			await emitGroupWebhookDeliveries(ctx, {
+				connectionId: connection._id,
+				eventType: "group.sso.scim.configured",
+				auditEventId,
+				payload: {
+					connectionId: connection._id,
+					scimConfigId: configId
+				}
+			});
+			return {
+				connectionId: connection._id,
+				configId,
+				basePath,
+				token: rawToken
+			};
+		},
+		get: async (ctx, connectionId) => {
+			const scimConfig = await getScimConfigByConnection(ctx, config.component.public, connectionId);
+			if (!scimConfig) return null;
+			const shape = getScimConfigShape(scimConfig);
+			return {
+				...scimConfig,
+				security: shape.security,
+				profile: shape.profile
+			};
+		},
+		status: async (ctx, connectionId) => {
+			const currentConfig = await getScimConfigByConnection(ctx, config.component.public, connectionId);
+			const result = await validateScim(ctx, connectionId);
+			return {
+				connectionId,
+				configured: currentConfig?.status !== void 0,
+				ready: result.ok,
+				config: currentConfig,
+				checks: result.checks,
+				capabilities: "capabilities" in result ? result.capabilities : void 0
+			};
+		},
+		getConfigByToken: async (ctx, token) => {
+			return await getScimConfigByTokenHash(ctx, config.component.public, await sha256(token));
+		},
+		validate: async (ctx, connectionId) => {
+			return await validateScim(ctx, connectionId);
+		},
+		identity: {
+			get: async (ctx, data) => {
+				return await getScimIdentity(ctx, config.component.public, data);
+			},
+			upsert: async (ctx, data) => {
+				return await upsertScimIdentity(ctx, config.component.public, {
+					...data,
+					lastProvisionedAt: Date.now()
+				});
+			}
+		}
+	};
+}
+
+//#endregion
+export { createGroupScimDomain };
+//# sourceMappingURL=provision.js.map

package/dist/{component/server/enterprise → server/sso}/saml.js

@@ -1,9 +1,11 @@
-import { asRecord, getEnterpriseSamlUrls } from "./shared.js";
+import { log } from "../log.js";
+import { finalizeNormalizedProfile, normalizeStringArray } from "./profile.js";
+import { asRecord, getGroupSamlUrls } from "./shared.js";
 import { getSamlConfig } from "./config.js";
 import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding } from "@oslojs/encoding";
 import { Constants, IdentityProvider, ServiceProvider, setSchemaValidator } from "@robelest/samlify";
 
-//#region src/server/enterprise/saml.ts
+//#region src/server/sso/saml.ts
 const _samlifyPermissiveValidator = { validate: (_xml) => Promise.resolve("OK") };
 function ensureSamlifyValidator() {
 	setSchemaValidator(_samlifyPermissiveValidator);
@@ -26,7 +28,7 @@ function decodeRelayState(value) {
 	}
 }
 /** @internal */
-function encodeEnterpriseSamlRelayState(value) {
+function encodeGroupSamlRelayState(value) {
 	return encodeBase64urlNoPadding(new TextEncoder().encode(JSON.stringify({
 		source: `${value.source.kind}:${value.source.id}`,
 		signature: value.signature,
@@ -36,13 +38,13 @@ function encodeEnterpriseSamlRelayState(value) {
 	})));
 }
 /** @internal */
-function decodeEnterpriseSamlRelayStateOrThrow(value) {
+function decodeGroupSamlRelayStateOrThrow(value) {
 	if (!value) throw new Error("Missing SAML RelayState.");
 	const decoded = decodeRelayState(value);
 	if (typeof decoded.source !== "string" || typeof decoded.signature !== "string" || typeof decoded.requestId !== "string" || typeof decoded.state !== "string") throw new Error("Invalid SAML RelayState.");
 	const [kind, ...rest] = decoded.source.split(":");
 	const id = rest.join(":");
-	if (kind !== "enterprise" || id.length === 0) throw new Error("Invalid enterprise SAML source.");
+	if (kind !== "connection" || id.length === 0) throw new Error("Invalid group connection SAML source.");
 	return {
 		source: {
 			kind,
@@ -68,7 +70,7 @@ async function readRequestBody(request) {
 	return {};
 }
 /** @internal */
-async function readEnterpriseSamlHttpRequest(request) {
+async function readGroupConnectionSamlHttpRequest(request) {
 	const url = new URL(request.url);
 	const body = await readRequestBody(request);
 	return {
@@ -81,32 +83,76 @@ async function readEnterpriseSamlHttpRequest(request) {
 		hasSamlResponse: Boolean(body.SAMLResponse ?? url.searchParams.get("SAMLResponse"))
 	};
 }
+function getSamlSecurityConfig(config) {
+	return asRecord(getSamlConfig(config).security) ?? {};
+}
 /** @internal */
 function parseSamlIdpMetadata(metadata) {
-	const entityMeta = IdentityProvider({ metadata }).entityMeta;
-	const normalizeService = (value) => {
-		return typeof value === "string" && value.length > 0 ? value : void 0;
+	const source = typeof metadata === "string" ? metadata : String(metadata);
+	const entityId = source.match(/<[^>]*EntityDescriptor\b[^>]*\bentityID="([^"]+)"/i)?.[1] ?? null;
+	if (!entityId) throw new Error("SAML metadata is missing EntityDescriptor@entityID.");
+	const parseAttributes = (source$1) => {
+		const attributes = {};
+		for (const match of source$1.matchAll(/([A-Za-z_:][\w:.-]*)="([^"]*)"/g)) attributes[match[1]] = match[2];
+		return attributes;
+	};
+	const readServiceBindings = (tagName) => {
+		const bindings = {};
+		const pattern = new RegExp(`<(?:[A-Za-z0-9_.-]+:)?${tagName}\\b([^>]*)\\/?>(?:<\\/(?:[A-Za-z0-9_.-]+:)?${tagName}>)?`, "gi");
+		for (const match of source.matchAll(pattern)) {
+			const attrs = parseAttributes(match[1] ?? "");
+			const binding = attrs.Binding ?? attrs.binding;
+			const location = attrs.Location ?? attrs.location;
+			if (!binding || !location) continue;
+			if (binding.includes("HTTP-Redirect")) bindings.redirect = location;
+			if (binding.includes("HTTP-POST")) bindings.post = location;
+		}
+		return bindings;
+	};
+	const readCertificates = (use) => {
+		const certs = [];
+		const blockPattern = new RegExp(`<(?:[A-Za-z0-9_.-]+:)?KeyDescriptor\\b([^>]*)>([\\s\\S]*?)<\\/(?:[A-Za-z0-9_.-]+:)?KeyDescriptor>`, "gi");
+		for (const match of source.matchAll(blockPattern)) {
+			const attrs = parseAttributes(match[1] ?? "");
+			if ((attrs.use ?? attrs.Use ?? "signing").toLowerCase() !== use) continue;
+			for (const certMatch of (match[2] ?? "").matchAll(/<(?:[A-Za-z0-9_.-]+:)?X509Certificate>([\s\S]*?)<\/(?:[A-Za-z0-9_.-]+:)?X509Certificate>/gi)) {
+				const certificate = certMatch[1]?.replace(/\s+/g, "").trim();
+				if (certificate) certs.push(certificate);
+			}
+		}
+		if (certs.length === 0) return null;
+		return certs.length === 1 ? certs[0] : certs;
 	};
+	const nameIdFormats = [...source.matchAll(/<(?:[A-Za-z0-9_.-]+:)?NameIDFormat>([\s\S]*?)<\/(?:[A-Za-z0-9_.-]+:)?NameIDFormat>/gi)].map((match) => match[1]?.trim()).filter((value) => Boolean(value));
 	return {
-		issuer: entityMeta.getEntityID(),
-		sso: {
-			redirect: normalizeService(entityMeta.getSingleSignOnService("redirect")),
-			post: normalizeService(entityMeta.getSingleSignOnService("post"))
-		},
-		slo: {
-			redirect: normalizeService(entityMeta.getSingleLogoutService("redirect")),
-			post: normalizeService(entityMeta.getSingleLogoutService("post"))
-		},
-		signingCert: entityMeta.getX509Certificate("signing"),
-		encryptionCert: entityMeta.getX509Certificate("encrypt"),
-		nameIdFormats: (() => {
-			const nameIdFormat = entityMeta.getNameIDFormat();
-			return Array.isArray(nameIdFormat) ? nameIdFormat : [];
-		})(),
-		wantsSignedAuthnRequests: entityMeta.isWantAuthnRequestsSigned()
+		entityId,
+		issuer: entityId,
+		sso: readServiceBindings("SingleSignOnService"),
+		slo: readServiceBindings("SingleLogoutService"),
+		signingCert: readCertificates("signing"),
+		encryptionCert: readCertificates("encryption"),
+		nameIdFormats,
+		wantsSignedAuthnRequests: /WantAuthnRequestsSigned="true"/i.test(source)
 	};
 }
 /** @internal */
+function enforceSamlMetadataSize(opts) {
+	const maxMetadataSize = getSamlSecurityConfig(opts.config).maxMetadataSize;
+	if (typeof maxMetadataSize === "number" && maxMetadataSize > 0 && opts.metadataXml.length > maxMetadataSize) throw new Error("SAML metadata exceeds the configured size limit.");
+}
+/** @internal */
+function parseSamlIdpMetadataChecked(opts) {
+	enforceSamlMetadataSize(opts);
+	return parseSamlIdpMetadata(opts.metadataXml);
+}
+/** @internal */
+function enforceSamlResponseSize(opts) {
+	const maxResponseSize = getSamlSecurityConfig(opts.config).maxResponseSize;
+	if (typeof maxResponseSize !== "number" || maxResponseSize <= 0) return;
+	const encoded = opts.request.body.SAMLResponse ?? opts.request.query.SAMLResponse;
+	if (typeof encoded === "string" && encoded.length > maxResponseSize) throw new Error("SAML response exceeds the configured size limit.");
+}
+/** @internal */
 function createServiceProviderMetadata(opts) {
 	const binding = Constants.namespace.binding;
 	return ServiceProvider({
@@ -132,7 +178,7 @@ function createServiceProviderMetadata(opts) {
 	}).getMetadata();
 }
 /** @internal */
-function createEnterpriseSamlMetadataXml(opts) {
+function createGroupConnectionSamlMetadataXml(opts) {
 	return createServiceProviderMetadata(getSamlServiceProviderOptions({
 		rootUrl: opts.rootUrl,
 		source: opts.source,
@@ -142,8 +188,8 @@ function createEnterpriseSamlMetadataXml(opts) {
 /** @internal */
 function getSamlServiceProviderOptions(opts) {
 	const saml = getSamlConfig(opts.config);
-	const sp = asRecord(saml.sp) ?? {};
-	const urls = getEnterpriseSamlUrls({
+	const sp = asRecord(saml.serviceProvider) ?? {};
+	const urls = getGroupSamlUrls({
 		rootUrl: opts.rootUrl,
 		source: opts.source
 	});
@@ -152,7 +198,7 @@ function getSamlServiceProviderOptions(opts) {
 		acsUrl: opts.overrides?.acsUrl ?? sp.acsUrl ?? urls.acsUrl,
 		sloUrl: opts.overrides?.sloUrl ?? sp.sloUrl ?? urls.sloUrl,
 		relayState: opts.relayState,
-		authnRequestsSigned: saml.signAuthnRequests,
+		authnRequestsSigned: saml.request?.signAuthnRequests,
 		signingCert: sp.signingCert,
 		encryptCert: sp.encryptCert,
 		privateKey: sp.privateKey,
@@ -188,7 +234,7 @@ function createSamlServiceProvider(opts) {
 	});
 }
 /** @internal */
-function createEnterpriseSamlRuntime(opts) {
+function createGroupConnectionSamlRuntime(opts) {
 	const saml = getSamlConfig(opts.config);
 	const spOptions = getSamlServiceProviderOptions({
 		rootUrl: opts.rootUrl,
@@ -202,22 +248,51 @@ function createEnterpriseSamlRuntime(opts) {
 		saml,
 		sp: createSamlServiceProvider(spOptions),
 		idp: IdentityProvider({ metadata: saml.idp.metadataXml }),
-		urls: getEnterpriseSamlUrls({
+		urls: getGroupSamlUrls({
 			rootUrl: opts.rootUrl,
 			source: opts.source
 		})
 	};
 }
+function verifySamlTimeWindow(notBefore, notOnOrAfter, clockSkewSeconds) {
+	const now = Date.now();
+	const drift = clockSkewSeconds * 1e3;
+	if (notBefore) {
+		const notBeforeTime = new Date(notBefore).getTime();
+		if (Number.isFinite(notBeforeTime) && now < notBeforeTime - drift) throw new Error("SAML assertion is not yet valid.");
+	}
+	if (notOnOrAfter) {
+		const notOnOrAfterTime = new Date(notOnOrAfter).getTime();
+		if (Number.isFinite(notOnOrAfterTime) && now >= notOnOrAfterTime + drift) throw new Error("SAML assertion has expired.");
+	}
+}
+/** @internal */
+function enforceGroupConnectionSamlSecurity(opts) {
+	enforceSamlAlgorithmPolicy(opts);
+	const security = asRecord(getSamlConfig(opts.config).security) ?? {};
+	const conditions = opts.extract?.conditions;
+	if (security.requireSignedAssertions === true && typeof opts.extract?.signature?.signatureAlgorithm !== "string") throw new Error("SAML assertion must be signed.");
+	if (security.requireTimestamps === true) {
+		if (!conditions?.notBefore && !conditions?.notOnOrAfter) throw new Error("SAML assertion missing required timestamp conditions.");
+	}
+	if (conditions?.notBefore || conditions?.notOnOrAfter) verifySamlTimeWindow(conditions.notBefore, conditions.notOnOrAfter, security.clockSkewSeconds ?? 300);
+}
+function toSamlHttpRequest(request) {
+	return {
+		query: request.query,
+		body: request.body
+	};
+}
 /** @internal */
-function createEnterpriseSamlSignInRequest(opts) {
-	const runtime = createEnterpriseSamlRuntime({
+function createGroupConnectionSamlSignInRequest(opts) {
+	const runtime = createGroupConnectionSamlRuntime({
 		rootUrl: opts.rootUrl,
 		source: opts.source,
 		config: opts.config
 	});
-	const binding = runtime.saml.idp.sso?.redirect ? "redirect" : "post";
+	const binding = runtime.saml.idp?.sso?.redirect ? "redirect" : "post";
 	const loginRequest = runtime.sp.createLoginRequest(runtime.idp, binding);
-	const relayState = encodeEnterpriseSamlRelayState({
+	const relayState = encodeGroupSamlRelayState({
 		source: opts.source,
 		signature: opts.signature,
 		requestId: loginRequest.id,
@@ -240,24 +315,25 @@ function createEnterpriseSamlSignInRequest(opts) {
 	};
 }
 /** @internal */
-async function parseEnterpriseSamlLoginResponse(opts) {
+async function parseGroupConnectionSamlLoginResponse(opts) {
 	ensureSamlifyValidator();
-	const httpRequest = await readEnterpriseSamlHttpRequest(opts.request);
-	const runtime = createEnterpriseSamlRuntime({
+	const httpRequest = await readGroupConnectionSamlHttpRequest(opts.request);
+	enforceSamlResponseSize({
+		request: httpRequest,
+		config: opts.config
+	});
+	const runtime = createGroupConnectionSamlRuntime({
 		rootUrl: opts.rootUrl,
 		source: opts.source,
 		config: opts.config
 	});
-	const parsed = await runtime.sp.parseLoginResponse(runtime.idp, httpRequest.binding, {
-		query: httpRequest.query,
-		body: httpRequest.body
-	});
+	const parsed = await runtime.sp.parseLoginResponse(runtime.idp, httpRequest.binding, toSamlHttpRequest(httpRequest));
 	warnWeakSamlAlgorithms(parsed);
 	return {
 		...httpRequest,
 		runtime,
 		parsed,
-		relayState: decodeEnterpriseSamlRelayStateOrThrow(httpRequest.relayState ?? null)
+		relayState: decodeGroupSamlRelayStateOrThrow(httpRequest.relayState ?? null)
 	};
 }
 const WEAK_SAML_ALGORITHMS = new Set([
@@ -275,28 +351,32 @@ function warnWeakSamlAlgorithms(parsed) {
 	try {
 		const sigAlg = parsed?.extract?.signature?.signatureAlgorithm ?? parsed?.extract?.response?.signatureAlgorithm;
 		const digestAlg = parsed?.extract?.signature?.digestAlgorithm;
-		if (sigAlg && WEAK_SAML_ALGORITHMS.has(sigAlg)) console.warn(`[convex-auth] SAML response uses weak signature algorithm: ${sigAlg}. Consider upgrading your IdP to use RSA-SHA256 or stronger.`);
-		if (digestAlg && WEAK_SAML_ALGORITHMS.has(digestAlg)) console.warn(`[convex-auth] SAML response uses weak digest algorithm: ${digestAlg}. Consider upgrading your IdP to use SHA-256 or stronger.`);
+		if (sigAlg && WEAK_SAML_ALGORITHMS.has(sigAlg)) log("WARN", `[convex-auth] SAML response uses weak signature algorithm: ${sigAlg}. Consider upgrading your IdP to use RSA-SHA256 or stronger.`);
+		if (digestAlg && WEAK_SAML_ALGORITHMS.has(digestAlg)) log("WARN", `[convex-auth] SAML response uses weak digest algorithm: ${digestAlg}. Consider upgrading your IdP to use SHA-256 or stronger.`);
 	} catch {}
 }
 /** @internal */
-function validateEnterpriseSamlLoginRelayState(opts) {
+function enforceSamlAlgorithmPolicy(opts) {
+	if (getSamlSecurityConfig(opts.config).weakAlgorithmHandling !== "reject") return;
+	const sigAlg = opts.extract?.signature?.signatureAlgorithm ?? opts.extract?.response?.signatureAlgorithm;
+	const digestAlg = opts.extract?.signature?.digestAlgorithm;
+	if (sigAlg && WEAK_SAML_ALGORITHMS.has(sigAlg) || digestAlg && WEAK_SAML_ALGORITHMS.has(digestAlg)) throw new Error("SAML response uses a rejected weak cryptographic algorithm.");
+}
+/** @internal */
+function validateGroupConnectionSamlLoginRelayState(opts) {
 	if (opts.relayState.source.kind !== opts.source.kind || opts.relayState.source.id !== opts.source.id || opts.relayState.requestId !== opts.inResponseTo) throw new Error("SAML RelayState did not match the pending login request.");
 }
 /** @internal */
-async function parseEnterpriseSamlLogoutMessage(opts) {
+async function parseGroupConnectionSamlLogoutMessage(opts) {
 	ensureSamlifyValidator();
-	const httpRequest = await readEnterpriseSamlHttpRequest(opts.request);
-	const runtime = createEnterpriseSamlRuntime({
+	const httpRequest = await readGroupConnectionSamlHttpRequest(opts.request);
+	const runtime = createGroupConnectionSamlRuntime({
 		rootUrl: opts.rootUrl,
 		source: opts.source,
 		config: opts.config,
 		relayState: httpRequest.relayState
 	});
-	const parsedRequest = httpRequest.hasSamlRequest ? await runtime.sp.parseLogoutRequest(runtime.idp, httpRequest.binding, {
-		query: httpRequest.query,
-		body: httpRequest.body
-	}) : void 0;
+	const parsedRequest = httpRequest.hasSamlRequest ? await runtime.sp.parseLogoutRequest(runtime.idp, httpRequest.binding, toSamlHttpRequest(httpRequest)) : void 0;
 	return {
 		...httpRequest,
 		runtime,
@@ -316,23 +396,29 @@ function profileFromSamlExtract(extract, mapping) {
 	};
 	const fieldResolvers = {
 		email: () => resolveFirst(mapping?.email),
+		groups: () => normalizeStringArray(resolveFirst(mapping?.groups)),
 		name: () => resolveFirst(mapping?.name) ?? ([resolveFirst(mapping?.firstName), resolveFirst(mapping?.lastName)].filter(Boolean).join(" ") || void 0),
+		roles: () => normalizeStringArray(resolveFirst(mapping?.roles)),
 		subject: () => resolveFirst(mapping?.subject) ?? extract?.nameID
 	};
 	const subject = fieldResolvers.subject();
 	if (subject === void 0) throw new Error("SAML profile is missing a subject. Configure `attributeMapping.subject` or ensure the assertion includes a NameID.");
 	const email = fieldResolvers.email();
+	const groups = fieldResolvers.groups();
 	const name = fieldResolvers.name();
-	return {
+	const roles = fieldResolvers.roles();
+	return finalizeNormalizedProfile({
 		id: subject,
 		email,
 		emailVerified: typeof email === "string" ? true : void 0,
+		groups,
 		name,
+		roles,
 		samlAttributes: attributes,
 		samlSessionIndex: extract?.sessionIndex?.SessionIndex
-	};
+	});
 }
 
 //#endregion
-export { createEnterpriseSamlMetadataXml, createEnterpriseSamlSignInRequest, createSamlPostBindingResponse, createServiceProviderMetadata, encodeEnterpriseSamlRelayState, getSamlServiceProviderOptions, parseEnterpriseSamlLoginResponse, parseEnterpriseSamlLogoutMessage, parseSamlIdpMetadata, profileFromSamlExtract, validateEnterpriseSamlLoginRelayState };
+export { createGroupConnectionSamlMetadataXml, createGroupConnectionSamlSignInRequest, createSamlPostBindingResponse, createServiceProviderMetadata, encodeGroupSamlRelayState, enforceGroupConnectionSamlSecurity, getSamlServiceProviderOptions, parseGroupConnectionSamlLoginResponse, parseGroupConnectionSamlLogoutMessage, parseSamlIdpMetadataChecked, profileFromSamlExtract, validateGroupConnectionSamlLoginRelayState };
 //# sourceMappingURL=saml.js.map

package/dist/{component/server/enterprise → server/sso}/scim.js

@@ -1,16 +1,16 @@
 import { SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID } from "./shared.js";
 
-//#region src/server/enterprise/scim.ts
+//#region src/server/sso/scim.ts
 /** @internal */
 function parseScimPath(pathname) {
-	const [api, auth, sso, enterpriseId, protocol, version, ...rest] = pathname.split("/").filter(Boolean);
-	if (api !== "api" || auth !== "auth" || sso !== "sso" || !enterpriseId || enterpriseId === "setup" || protocol !== "scim" || version !== "v2") return {
-		enterpriseId: "",
+	const [api, auth, connections, connectionId, protocol, version, ...rest] = pathname.split("/").filter(Boolean);
+	if (api !== "api" || auth !== "auth" || connections !== "connections" || !connectionId || connectionId === "setup" || protocol !== "scim" || version !== "v2") return {
+		connectionId: "",
 		resource: "",
 		resourceId: void 0
 	};
 	return {
-		enterpriseId,
+		connectionId,
 		resource: rest[0] ?? "",
 		resourceId: rest[1]
 	};
@@ -24,11 +24,17 @@ function parseScimListRequest(url) {
 		startIndex,
 		count,
 		filter: filterParam ? (() => {
-			const match = filterParam.match(/^([A-Za-z0-9_.]+)\s+eq\s+"([^"]+)"$/);
+			const presentMatch = filterParam.match(/^([A-Za-z0-9_.]+)\s+pr$/);
+			if (presentMatch) return {
+				attribute: presentMatch[1],
+				operator: "pr"
+			};
+			const match = filterParam.match(/^([A-Za-z0-9_.]+(?:\[value eq "[^"]+"\])?)\s+(eq|co|sw|ew)\s+"([^"]+)"$/);
 			if (!match) throw new Error("Unsupported SCIM filter.");
 			return {
 				attribute: match[1],
-				value: match[2]
+				operator: match[2],
+				value: match[3]
 			};
 		})() : void 0
 	};

package/dist/server/sso/shared.js

@@ -0,0 +1,74 @@
+//#region src/server/sso/shared.ts
+/** @internal */
+const SCIM_USER_SCHEMA_ID = "urn:ietf:params:scim:schemas:core:2.0:User";
+/** @internal */
+const SCIM_GROUP_SCHEMA_ID = "urn:ietf:params:scim:schemas:core:2.0:Group";
+/** @internal */
+const GROUP_OIDC_PROVIDER_PREFIX = "group:oidc:";
+/** @internal */
+const GROUP_SAML_PROVIDER_PREFIX = "group:saml:";
+/** @internal */
+function normalizeDomain(domain) {
+	return domain.trim().toLowerCase().replace(/^@+/, "");
+}
+/** @internal */
+function groupOidcProviderId(connectionId) {
+	return `${GROUP_OIDC_PROVIDER_PREFIX}${connectionId}`;
+}
+/** @internal */
+function groupSamlProviderId(connectionId) {
+	return `${GROUP_SAML_PROVIDER_PREFIX}${connectionId}`;
+}
+/** @internal */
+function getGroupSamlUrls(opts) {
+	const root = opts.rootUrl.replace(/\/$/, "");
+	return {
+		metadataUrl: `${root}/api/auth/connections/${opts.source.id}/saml/metadata`,
+		acsUrl: `${root}/api/auth/connections/${opts.source.id}/saml/acs`,
+		sloUrl: `${root}/api/auth/connections/${opts.source.id}/saml/slo`
+	};
+}
+/** @internal */
+function getGroupOidcUrls(opts) {
+	const root = opts.rootUrl.replace(/\/$/, "");
+	const callbackUrl = (() => {
+		if (typeof opts.sharedRedirectURI !== "string") return `${root}/api/auth/connections/${opts.connectionId}/oidc/callback`;
+		if (/^https?:\/\//.test(opts.sharedRedirectURI)) return opts.sharedRedirectURI;
+		return `${root}${opts.sharedRedirectURI.startsWith("/") ? "" : "/"}${opts.sharedRedirectURI}`;
+	})();
+	return {
+		signInUrl: `${root}/api/auth/connections/${opts.connectionId}/oidc/signin`,
+		callbackUrl
+	};
+}
+/** @internal */
+function encodeGroupOidcState(opts) {
+	const json = JSON.stringify(opts);
+	return (typeof btoa === "function" ? btoa(json) : Buffer.from(json, "utf8").toString("base64")).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+/** @internal */
+function decodeGroupOidcState(value) {
+	if (!value) throw new Error("Missing OIDC state.");
+	const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+	const decoded = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("utf8");
+	const parsed = JSON.parse(decoded);
+	if (typeof parsed.connectionId !== "string" || typeof parsed.state !== "string") throw new Error("Invalid OIDC state.");
+	return {
+		connectionId: parsed.connectionId,
+		state: parsed.state
+	};
+}
+/** @internal */
+function isGroupSamlSourceActive(source) {
+	return source.status === "active";
+}
+/** @internal */
+function isGroupProviderId(providerId) {
+	return providerId.startsWith(GROUP_OIDC_PROVIDER_PREFIX) || providerId.startsWith(GROUP_SAML_PROVIDER_PREFIX);
+}
+const asRecord = (value) => typeof value === "object" && value !== null ? value : null;
+
+//#endregion
+export { GROUP_OIDC_PROVIDER_PREFIX, GROUP_SAML_PROVIDER_PREFIX, SCIM_GROUP_SCHEMA_ID, SCIM_USER_SCHEMA_ID, asRecord, decodeGroupOidcState, encodeGroupOidcState, getGroupOidcUrls, getGroupSamlUrls, groupOidcProviderId, groupSamlProviderId, isGroupProviderId, isGroupSamlSourceActive, normalizeDomain };
+//# sourceMappingURL=shared.js.map