@robelest/convex-auth 0.0.4-preview.30 → 0.0.4-preview.31

package/dist/server/sso/domain.d.ts

@@ -1,6 +1,6 @@
-import { ConvexAuthMaterializedConfig, GroupConnectionDeprovisionMode, GroupConnectionPolicy, GroupConnectionPolicyPatch, OIDCClaimMapping } from "../types.js";
-import { ComponentCtx, ComponentReadCtx } from "../componentContext.js";
-import { AuditEventRecord, ConnectionDomainRecord, GroupConnectionDomainLookupRecord, GroupConnectionListResult, GroupConnectionRecord, ScimConfigRecord, ScimIdentityRecord, WebhookDeliveryRecord, WebhookEndpointRecord } from "../contract.js";
+import { ConvexAuthMaterializedConfig, GroupConnectionPolicy, GroupConnectionPolicyPatch, OIDCClaimMapping } from "../types.js";
+import { ComponentCtx, ComponentReadCtx } from "../component/context.js";
+import { ScimIdentityRecord } from "../contract.js";
 import { GenericActionCtx, GenericDataModel } from "convex/server";
 
 //#region src/server/sso/domain.d.ts
@@ -67,8 +67,39 @@ declare function createGroupConnectionDomain<TDeps extends DomainDeps>(deps: TDe
       connectionId: string;
       groupId: string;
     }>;
-    get: (ctx: ComponentReadCtx, connectionId: string) => Promise<GroupConnectionRecord | null>;
-    getByDomain: (ctx: ComponentReadCtx, domain: string) => Promise<GroupConnectionDomainLookupRecord | null>;
+    get: (ctx: ComponentReadCtx, connectionId: string) => Promise<{
+      _id: string;
+      _creationTime: number;
+      groupId: string;
+      slug?: string;
+      name?: string;
+      protocol: "oidc" | "saml";
+      status: "draft" | "active" | "disabled";
+      config?: unknown;
+      extend?: unknown;
+    } | null>;
+    getByDomain: (ctx: ComponentReadCtx, domain: string) => Promise<{
+      connection: {
+        _id: string;
+        _creationTime: number;
+        groupId: string;
+        slug?: string;
+        name?: string;
+        protocol: "oidc" | "saml";
+        status: "draft" | "active" | "disabled";
+        config?: unknown;
+        extend?: unknown;
+      } | null;
+      domain: {
+        _id: string;
+        _creationTime: number;
+        connectionId: string;
+        groupId: string;
+        domain: string;
+        isPrimary: boolean;
+        verifiedAt?: number;
+      } | null;
+    } | null>;
     list: (ctx: ComponentReadCtx, opts?: {
       where?: {
         groupId?: string;
@@ -79,7 +110,20 @@ declare function createGroupConnectionDomain<TDeps extends DomainDeps>(deps: TDe
       cursor?: string | null;
       orderBy?: "_creationTime" | "name" | "slug" | "status";
       order?: "asc" | "desc";
-    }) => Promise<GroupConnectionListResult>;
+    }) => Promise<{
+      items: {
+        _id: string;
+        _creationTime: number;
+        groupId: string;
+        slug?: string;
+        name?: string;
+        protocol: "oidc" | "saml";
+        status: "draft" | "active" | "disabled";
+        config?: unknown;
+        extend?: unknown;
+      }[];
+      nextCursor: string | null;
+    }>;
     update: (ctx: ComponentCtx, connectionId: string, data: Record<string, unknown>) => Promise<{
       connectionId: string;
     }>;
@@ -115,7 +159,7 @@ declare function createGroupConnectionDomain<TDeps extends DomainDeps>(deps: TDe
           configured: boolean;
           ready: boolean;
           basePath: string | null;
-          deprovisionMode: GroupConnectionDeprovisionMode;
+          deprovisionMode: "soft" | "hard";
         };
       };
     }>;
@@ -127,7 +171,15 @@ declare function createGroupConnectionDomain<TDeps extends DomainDeps>(deps: TDe
       domain: string;
       isPrimary?: boolean;
     }) => Promise<string>;
-    list: (ctx: ComponentReadCtx, connectionId: string) => Promise<ConnectionDomainRecord[]>;
+    list: (ctx: ComponentReadCtx, connectionId: string) => Promise<{
+      _id: string;
+      _creationTime: number;
+      connectionId: string;
+      groupId: string;
+      domain: string;
+      isPrimary: boolean;
+      verifiedAt?: number;
+    }[]>;
     validate: (ctx: ComponentReadCtx, connectionId: string) => Promise<{
       connectionId: string;
       ready: boolean;
@@ -480,7 +532,17 @@ declare function createGroupConnectionDomain<TDeps extends DomainDeps>(deps: TDe
       connectionId: string;
       configured: boolean;
       ready: boolean;
-      config: ScimConfigRecord | null;
+      config: {
+        _id: string;
+        _creationTime: number;
+        connectionId: string;
+        groupId: string;
+        status: string;
+        basePath: string;
+        tokenHash: string;
+        lastRotatedAt?: number;
+        extend?: unknown;
+      } | null;
       checks: {
         name: string;
         ok: boolean;
@@ -500,7 +562,17 @@ declare function createGroupConnectionDomain<TDeps extends DomainDeps>(deps: TDe
         etag: boolean;
       } | undefined;
     }>;
-    getConfigByToken: (ctx: ComponentReadCtx, token: string) => Promise<ScimConfigRecord | null>;
+    getConfigByToken: (ctx: ComponentReadCtx, token: string) => Promise<{
+      _id: string;
+      _creationTime: number;
+      connectionId: string;
+      groupId: string;
+      status: string;
+      basePath: string;
+      tokenHash: string;
+      lastRotatedAt?: number;
+      extend?: unknown;
+    } | null>;
     validate: (ctx: ComponentReadCtx, connectionId: string) => Promise<{
       ok: boolean;
       connectionId: string;
@@ -516,7 +588,7 @@ declare function createGroupConnectionDomain<TDeps extends DomainDeps>(deps: TDe
       ok: boolean;
       connectionId: string;
       basePath: string;
-      deprovisionMode: GroupConnectionDeprovisionMode;
+      deprovisionMode: "soft" | "hard";
       capabilities: {
         users: boolean;
         groups: boolean;
@@ -568,11 +640,40 @@ declare function createGroupConnectionDomain<TDeps extends DomainDeps>(deps: TDe
       connectionId?: string;
       groupId?: string;
       limit?: number;
-    }) => Promise<AuditEventRecord[]>;
+    }) => Promise<{
+      _id: string;
+      _creationTime: number;
+      connectionId?: string;
+      groupId: string;
+      eventType: string;
+      actorType: string;
+      actorId?: string;
+      subjectType: string;
+      subjectId?: string;
+      status: string;
+      occurredAt: number;
+      requestId?: string;
+      ip?: string;
+      metadata?: Record<string, unknown>;
+    }[]>;
   };
   webhook: {
     endpoint: {
-      get: (ctx: ComponentReadCtx, endpointId: string) => Promise<WebhookEndpointRecord | null>;
+      get: (ctx: ComponentReadCtx, endpointId: string) => Promise<{
+        _id: string;
+        _creationTime: number;
+        connectionId: string;
+        groupId: string;
+        url: string;
+        status: string;
+        secretHash: string;
+        subscriptions: string[];
+        createdByUserId?: string;
+        lastSuccessAt?: number;
+        lastFailureAt?: number;
+        failureCount: number;
+        extend?: unknown;
+      } | null>;
       create: (ctx: ComponentCtx, data: {
         connectionId: string;
         url: string;
@@ -582,7 +683,21 @@ declare function createGroupConnectionDomain<TDeps extends DomainDeps>(deps: TDe
       }) => Promise<{
         endpointId: string;
       }>;
-      list: (ctx: ComponentReadCtx, connectionId: string) => Promise<WebhookEndpointRecord[]>;
+      list: (ctx: ComponentReadCtx, connectionId: string) => Promise<{
+        _id: string;
+        _creationTime: number;
+        connectionId: string;
+        groupId: string;
+        url: string;
+        status: string;
+        secretHash: string;
+        subscriptions: string[];
+        createdByUserId?: string;
+        lastSuccessAt?: number;
+        lastFailureAt?: number;
+        failureCount: number;
+        extend?: unknown;
+      }[]>;
       disable: (ctx: ComponentCtx, endpointId: string) => Promise<{
         endpointId: string;
       }>;
@@ -597,8 +712,36 @@ declare function createGroupConnectionDomain<TDeps extends DomainDeps>(deps: TDe
       list: (ctx: ComponentReadCtx, data: {
         connectionId: string;
         limit?: number;
-      }) => Promise<WebhookDeliveryRecord[]>;
-      listReady: (ctx: ComponentReadCtx, limit?: number) => Promise<WebhookDeliveryRecord[]>;
+      }) => Promise<{
+        _id: string;
+        _creationTime: number;
+        connectionId: string;
+        endpointId: string;
+        auditEventId?: string;
+        eventType: string;
+        status: string;
+        attemptCount: number;
+        nextAttemptAt: number;
+        lastAttemptAt?: number;
+        lastResponseStatus?: number;
+        lastError?: string;
+        payload: unknown;
+      }[]>;
+      listReady: (ctx: ComponentReadCtx, limit?: number) => Promise<{
+        _id: string;
+        _creationTime: number;
+        connectionId: string;
+        endpointId: string;
+        auditEventId?: string;
+        eventType: string;
+        status: string;
+        attemptCount: number;
+        nextAttemptAt: number;
+        lastAttemptAt?: number;
+        lastResponseStatus?: number;
+        lastError?: string;
+        payload: unknown;
+      }[]>;
       markDelivered: (ctx: ComponentCtx, deliveryId: string, responseStatus?: number) => Promise<void>;
       markFailed: (ctx: ComponentCtx, deliveryId: string, data: {
         attemptCount: number;

package/dist/server/sso/domain.js

@@ -1041,7 +1041,7 @@ function createGroupConnectionDomain(deps) {
 						}
 					});
 					return {
-						signInPath: `${requireEnv("CONVEX_SITE_URL")}/api/auth/connections/${connection._id}/saml/signin`,
+						signInPath: `${requireEnv("CONVEX_SITE_URL")}/connections/${connection._id}/saml/signin`,
 						callbackPath: urls.acsUrl,
 						providerId: groupSamlProviderId(connection._id)
 					};

package/dist/server/sso/http.js

@@ -13,12 +13,16 @@ import { ConvexError } from "convex/values";
 import { serialize } from "cookie";
 
 //#region src/server/sso/http.ts
+function formDataEntries(formData) {
+	return formData;
+}
 async function getOidcCallbackParams(request) {
 	const url = new URL(request.url);
 	const params = new URLSearchParams(url.searchParams);
-	if (request.headers.get("Content-Type")?.includes("application/x-www-form-urlencoded")) (await request.formData()).forEach((value, key) => {
-		if (typeof value === "string") params.append(key, value);
-	});
+	if (request.headers.get("Content-Type")?.includes("application/x-www-form-urlencoded")) {
+		const formData = await request.formData();
+		for (const [key, value] of formDataEntries(formData)) if (typeof value === "string") params.append(key, value);
+	}
 	return params;
 }
 function addGroupHttpRuntime(deps) {
@@ -187,7 +191,18 @@ function addGroupHttpRuntime(deps) {
 		if (!resourceId) return scimError(400, "invalidPath", `${label} resource ID is required.`);
 		return null;
 	};
-	const readScimJson = async (request) => await request.json();
+	const readScimJson = async (request) => {
+		const contentType = request.headers.get("Content-Type") ?? "";
+		if (contentType && !contentType.includes("application/scim+json") && !contentType.includes("application/json")) throw new Error("Unsupported SCIM content type.");
+		try {
+			return await request.json();
+		} catch {
+			throw new Error("Invalid SCIM JSON.");
+		}
+	};
+	const unsupportedScimPatch = () => {
+		throw new Error("Unsupported SCIM PATCH operation.");
+	};
 	const handleSamlAcs = async (ctx, request, runtimeRoute) => {
 		if (runtimeRoute.protocol !== "saml" || runtimeRoute.rest.length !== 1 || runtimeRoute.rest[0] !== "acs") throw convexError("INVALID_PARAMETERS", "Invalid connection runtime path.");
 		const connectionId = runtimeRoute.connectionId;
@@ -256,7 +271,7 @@ function addGroupHttpRuntime(deps) {
 				}
 			}
 		});
-		const vurl = setURLSearchParam(await redirectAbsoluteUrl(config, { redirectTo: maybeRedirectTo?.redirectTo ?? (typeof parsedResponse.relayState.redirectTo === "string" ? parsedResponse.relayState.redirectTo : void 0) }), "code", verificationCode);
+		const vurl = setURLSearchParam(await redirectAbsoluteUrl(ctx, config, { redirectTo: maybeRedirectTo?.redirectTo ?? (typeof parsedResponse.relayState.redirectTo === "string" ? parsedResponse.relayState.redirectTo : void 0) }), "code", verificationCode);
 		const vheaders = new Headers({ Location: vurl });
 		vheaders.set("Cache-Control", "must-revalidate");
 		for (const { name, value, options } of maybeRedirectTo !== null ? [maybeRedirectTo.updatedCookie] : []) vheaders.append("Set-Cookie", serialize(name, value, options));
@@ -290,8 +305,10 @@ function addGroupHttpRuntime(deps) {
 				value: responseContext.context,
 				relayState: parsedMessage.relayState
 			});
-		} else if (parsedMessage.hasSamlResponse) return new Response(null, { status: 204 });
-		else throw convexError("INVALID_PARAMETERS", "Missing SAML logout payload.");
+		} else if (parsedMessage.hasSamlResponse) {
+			if (!parsedMessage.parsedResponse) throw convexError("INVALID_PARAMETERS", "Missing SAML logout response payload.");
+			return new Response(null, { status: 204 });
+		} else throw convexError("INVALID_PARAMETERS", "Missing SAML logout payload.");
 	};
 	const handleScimRequest = async (ctx, request) => {
 		try {
@@ -493,6 +510,15 @@ function addGroupHttpRuntime(deps) {
 				const userId = state$1.parsedPath.resourceId;
 				const existingUser = await auth.user.get(state$1.ctx, userId);
 				if (!existingUser) return scimError(404, "notFound", "User not found.");
+				const existingIdentity = await getScimIdentityByConnectionAndUser(state$1.ctx, config.component.public, {
+					connectionId: state$1.connection._id,
+					userId
+				});
+				const existingMembership = await auth.member.inspect(state$1.ctx, {
+					groupId: state$1.connection.groupId,
+					userId
+				});
+				if (!existingIdentity && !existingMembership.membership) return scimError(404, "notFound", "User not found.");
 				const body = await readScimJson(state$1.request);
 				const extractedBase = extractScimProfile(state$1.scimConfig, body);
 				const extracted = await config.sso?.hooks?.profileResolved?.({
@@ -517,18 +543,48 @@ function addGroupHttpRuntime(deps) {
 					if (provisionProfile.extend) patchData.extend = provisionProfile.extend;
 					if (typeof patchData.email === "string") patchData.emailVerificationTime = Date.now();
 					if (typeof patchData.phone === "string") patchData.phoneVerificationTime = Date.now();
-				} else for (const operation of Array.isArray(body.Operations) ? body.Operations : []) {
-					if (operation.path === "active") nextActive = typeof operation.value === "boolean" ? operation.value : void 0;
-					if (operation.path === "displayName" || operation.path === "name.formatted") patchData.name = operation.value;
-					if (operation.path === "name.givenName") patchData.firstName = operation.value;
-					if (operation.path === "name.familyName") patchData.lastName = operation.value;
-					if (operation.path === "userName" || operation.path === "emails.value") {
-						patchData.email = operation.value;
-						if (typeof operation.value === "string") patchData.emailVerificationTime = Date.now();
-					}
-					if (operation.path === "phoneNumbers.value") {
-						patchData.phone = operation.value;
-						if (typeof operation.value === "string") patchData.phoneVerificationTime = Date.now();
+				} else {
+					const operations = Array.isArray(body.Operations) ? body.Operations : unsupportedScimPatch();
+					for (const operation of operations) {
+						const op = typeof operation.op === "string" ? operation.op.toLowerCase() : "replace";
+						if (op !== "replace" && op !== "add") unsupportedScimPatch();
+						if (operation.path === void 0 && typeof operation.value === "object" && operation.value !== null) {
+							const value = operation.value;
+							if (typeof value.active === "boolean") nextActive = value.active;
+							if (typeof value.displayName === "string") patchData.name = value.displayName;
+							if (typeof value.userName === "string") {
+								patchData.email = value.userName;
+								patchData.emailVerificationTime = Date.now();
+							}
+							continue;
+						}
+						if (operation.path === "active") {
+							nextActive = typeof operation.value === "boolean" ? operation.value : void 0;
+							continue;
+						}
+						if (operation.path === "displayName" || operation.path === "name.formatted") {
+							patchData.name = operation.value;
+							continue;
+						}
+						if (operation.path === "name.givenName") {
+							patchData.firstName = operation.value;
+							continue;
+						}
+						if (operation.path === "name.familyName") {
+							patchData.lastName = operation.value;
+							continue;
+						}
+						if (operation.path === "userName" || operation.path === "emails.value") {
+							patchData.email = operation.value;
+							if (typeof operation.value === "string") patchData.emailVerificationTime = Date.now();
+							continue;
+						}
+						if (operation.path === "phoneNumbers.value") {
+							patchData.phone = operation.value;
+							if (typeof operation.value === "string") patchData.phoneVerificationTime = Date.now();
+							continue;
+						}
+						unsupportedScimPatch();
 					}
 				}
 				const nextPatchData = applyUserProvisioningPatch({
@@ -541,10 +597,7 @@ function addGroupHttpRuntime(deps) {
 					userId,
 					data: nextPatchData
 				});
-				const resolution = await auth.member.inspect(state$1.ctx, {
-					groupId: state$1.connection.groupId,
-					userId
-				});
+				const resolution = existingMembership;
 				if (resolution.membership) await auth.member.update(state$1.ctx, resolution.membership._id, {
 					roleIds: resolveProvisionedRoleIds({
 						policy: state$1.policy,
@@ -557,10 +610,7 @@ function addGroupHttpRuntime(deps) {
 					connectionId: state$1.connection._id,
 					groupId: state$1.connection.groupId,
 					resourceType: "user",
-					externalId: externalId !== void 0 ? externalId : (await getScimIdentityByConnectionAndUser(state$1.ctx, config.component.public, {
-						connectionId: state$1.connection._id,
-						userId
-					}))?.externalId ?? userId,
+					externalId: externalId ?? existingIdentity?.externalId ?? userId,
 					userId,
 					active: provisionProfile.active !== false && nextActive !== false,
 					raw: body,
@@ -587,16 +637,17 @@ function addGroupHttpRuntime(deps) {
 				const missing = requireScimResourceId(state$1.parsedPath.resourceId, "User");
 				if (missing) return missing;
 				const userId = state$1.parsedPath.resourceId;
+				const identity = await getScimIdentityByConnectionAndUser(state$1.ctx, config.component.public, {
+					connectionId: state$1.connection._id,
+					userId
+				});
+				if (!identity) return scimError(404, "notFound", "User not found.");
 				const resolution = await auth.member.inspect(state$1.ctx, {
 					groupId: state$1.connection.groupId,
 					userId
 				});
 				if (resolution.membership) await auth.member.delete(state$1.ctx, resolution.membership._id);
-				const identity = await getScimIdentityByConnectionAndUser(state$1.ctx, config.component.public, {
-					connectionId: state$1.connection._id,
-					userId
-				});
-				if (identity) if (state$1.policy.provisioning.deprovision.mode === "hard") await deleteScimIdentity(state$1.ctx, config.component.public, identity._id);
+				if (state$1.policy.provisioning.deprovision.mode === "hard") await deleteScimIdentity(state$1.ctx, config.component.public, identity._id);
 				else await upsertScimIdentity(state$1.ctx, config.component.public, {
 					connectionId: identity.connectionId,
 					groupId: identity.groupId,
@@ -729,14 +780,15 @@ function addGroupHttpRuntime(deps) {
 				const currentByUserId = new Map(currentMembers.map((member) => [member.userId, member]));
 				const nextUserIds = new Set((Array.isArray(body.members) ? body.members : []).map((member) => String(member.value)));
 				for (const member of currentMembers) if (!nextUserIds.has(member.userId)) await auth.member.delete(state$1.ctx, member._id);
-				for (const userId of nextUserIds.values()) if (!currentByUserId.has(userId)) try {
+				for (const userId of nextUserIds.values()) if (!currentByUserId.has(userId)) {
+					if (!await auth.user.get(state$1.ctx, userId)) return scimError(400, "invalidValue", `Group member user not found: ${userId}`);
 					await auth.member.create(state$1.ctx, {
 						groupId,
 						userId,
 						roleIds: provisionedRoleIds,
 						status: "active"
 					});
-				} catch {}
+				}
 				await state$1.recordScimEvent(created ? "group.sso.scim.group.created" : "group.sso.scim.group.updated", true, "group", groupId);
 				const group = await auth.group.get(state$1.ctx, groupId);
 				const location = `${state$1.url.origin}${state$1.url.pathname}/${groupId}`;
@@ -758,22 +810,43 @@ function addGroupHttpRuntime(deps) {
 				const missing = requireScimResourceId(state$1.parsedPath.resourceId, "Group");
 				if (missing) return missing;
 				const groupId = state$1.parsedPath.resourceId;
+				const identity = await getScimIdentityByMappedGroup(state$1.ctx, config.component.public, groupId);
+				if (!identity || identity.connectionId !== state$1.connection._id) return scimError(404, "notFound", "Group not found.");
 				const body = await readScimJson(state$1.request);
-				for (const operation of Array.isArray(body.Operations) ? body.Operations : []) {
-					if (operation.path === "displayName") await auth.group.update(state$1.ctx, groupId, { name: operation.value });
-					if (operation.path === "members" && operation.op === "add") for (const member of Array.isArray(operation.value) ? operation.value : []) try {
-						await auth.member.create(state$1.ctx, {
-							groupId,
-							userId: String(member.value),
-							roleIds: resolveProvisionedRoleIds({
-								policy: state$1.policy,
-								groups: typeof body.displayName === "string" ? [body.displayName] : void 0,
-								roles: pickStringArray(body.roles)
-							}),
-							status: "active"
-						});
-					} catch {}
-					if (operation.path === "members" && operation.op === "replace") {
+				const operations = Array.isArray(body.Operations) ? body.Operations : unsupportedScimPatch();
+				for (const operation of operations) {
+					const op = typeof operation.op === "string" ? operation.op.toLowerCase() : "replace";
+					if (operation.path === void 0 && op === "replace" && typeof operation.value === "object" && operation.value !== null) {
+						const value = operation.value;
+						if (typeof value.displayName === "string") await auth.group.update(state$1.ctx, groupId, { name: value.displayName });
+						continue;
+					}
+					if (operation.path === "displayName") {
+						if (op !== "replace" && op !== "add") unsupportedScimPatch();
+						await auth.group.update(state$1.ctx, groupId, { name: operation.value });
+						continue;
+					}
+					if (operation.path === "members" && op === "add") {
+						for (const member of Array.isArray(operation.value) ? operation.value : []) {
+							const userId = String(member.value);
+							if (!await auth.user.get(state$1.ctx, userId)) return scimError(400, "invalidValue", `Group member user not found: ${userId}`);
+							if (!(await auth.member.inspect(state$1.ctx, {
+								groupId,
+								userId
+							})).membership) await auth.member.create(state$1.ctx, {
+								groupId,
+								userId,
+								roleIds: resolveProvisionedRoleIds({
+									policy: state$1.policy,
+									groups: typeof body.displayName === "string" ? [body.displayName] : void 0,
+									roles: pickStringArray(body.roles)
+								}),
+								status: "active"
+							});
+						}
+						continue;
+					}
+					if (operation.path === "members" && op === "replace") {
 						const currentMembers = (await auth.member.list(state$1.ctx, {
 							where: {
 								groupId,
@@ -784,7 +857,8 @@ function addGroupHttpRuntime(deps) {
 						const currentUserIds = new Set(currentMembers.map((member) => member.userId));
 						const nextUserIds = new Set((Array.isArray(operation.value) ? operation.value : []).map((member) => String(member.value)));
 						for (const member of currentMembers) if (!nextUserIds.has(member.userId)) await auth.member.delete(state$1.ctx, member._id);
-						for (const userId of nextUserIds.values()) if (!currentUserIds.has(userId)) try {
+						for (const userId of nextUserIds.values()) if (!currentUserIds.has(userId)) {
+							if (!await auth.user.get(state$1.ctx, userId)) return scimError(400, "invalidValue", `Group member user not found: ${userId}`);
 							await auth.member.create(state$1.ctx, {
 								groupId,
 								userId,
@@ -795,9 +869,10 @@ function addGroupHttpRuntime(deps) {
 								}),
 								status: "active"
 							});
-						} catch {}
+						}
+						continue;
 					}
-					if (typeof operation.path === "string" && operation.op === "remove" && operation.path.startsWith("members[")) {
+					if (typeof operation.path === "string" && op === "remove" && operation.path.startsWith("members[")) {
 						const userId = operation.path.match(/^members\[value eq "([^"]+)"\]$/)?.[1];
 						if (userId) {
 							const resolution = await auth.member.inspect(state$1.ctx, {
@@ -806,7 +881,9 @@ function addGroupHttpRuntime(deps) {
 							});
 							if (resolution.membership) await auth.member.delete(state$1.ctx, resolution.membership._id);
 						}
+						continue;
 					}
+					unsupportedScimPatch();
 				}
 				await state$1.recordScimEvent("group.sso.scim.group.updated", true, "group", groupId);
 				const group = await auth.group.get(state$1.ctx, groupId);
@@ -829,9 +906,10 @@ function addGroupHttpRuntime(deps) {
 				const missing = requireScimResourceId(state$1.parsedPath.resourceId, "Group");
 				if (missing) return missing;
 				const groupId = state$1.parsedPath.resourceId;
-				await auth.group.delete(state$1.ctx, groupId);
 				const identity = await getScimIdentityByMappedGroup(state$1.ctx, config.component.public, groupId);
-				if (identity) await deleteScimIdentity(state$1.ctx, config.component.public, identity._id);
+				if (!identity || identity.connectionId !== state$1.connection._id) return scimError(404, "notFound", "Group not found.");
+				await auth.group.delete(state$1.ctx, groupId);
+				await deleteScimIdentity(state$1.ctx, config.component.public, identity._id);
 				await state$1.recordScimEvent("group.sso.scim.group.deleted", true, "group", groupId);
 				return new Response(null, { status: 204 });
 			};
@@ -882,15 +960,22 @@ function addGroupHttpRuntime(deps) {
 			return handler ? await handler(state) : scimError(404, "notFound", "SCIM resource not found.");
 		} catch (error) {
 			if (error instanceof Error && error.message === "Unsupported SCIM filter.") return scimError(400, "invalidFilter", error.message);
+			if (error instanceof Error && error.message === "Invalid SCIM pagination.") return scimError(400, "invalidValue", error.message);
+			if (error instanceof Error && error.message === "Invalid SCIM JSON.") return scimError(400, "invalidSyntax", error.message);
+			if (error instanceof Error && error.message === "Unsupported SCIM content type.") return scimError(415, "invalidSyntax", error.message);
+			if (error instanceof Error && error.message === "Unsupported SCIM PATCH operation.") return scimError(400, "invalidSyntax", error.message);
 			if (error instanceof ConvexError && typeof error.data === "object" && error.data !== null && "code" in error.data && "message" in error.data) {
 				const code = error.data.code;
-				return scimError(code === "MISSING_BEARER_TOKEN" || code === "INVALID_API_KEY" ? 401 : 400, code, error.data.message);
+				const status = code === "MISSING_BEARER_TOKEN" || code === "INVALID_API_KEY" ? 401 : 400;
+				const response = scimError(status, status === 401 ? "invalidValue" : code, error.data.message);
+				if (status === 401) response.headers.set("WWW-Authenticate", "Bearer");
+				return response;
 			}
 			throw error;
 		}
 	};
 	const handleOidcCallbackForConnection = async (ctx, request, connectionId) => {
-		const url = new URL(request.url);
+		const params = await getOidcCallbackParams(request);
 		const { connection, oidc } = await loadConnectionOidcOrThrow(ctx, connectionId);
 		const { providerId, provider, oauthConfig } = await createGroupConnectionOidcRuntime({
 			rootUrl: requireEnv("CONVEX_SITE_URL"),
@@ -900,11 +985,11 @@ function addGroupHttpRuntime(deps) {
 		});
 		const cookies = getCookies(request);
 		const maybeRedirectTo = useRedirectToParam(providerId, cookies);
-		const destinationUrl = await redirectAbsoluteUrl(config, { redirectTo: maybeRedirectTo?.redirectTo });
+		const destinationUrl = await redirectAbsoluteUrl(ctx, config, { redirectTo: maybeRedirectTo?.redirectTo });
 		const result = await handleOAuthCallback(providerId, {
 			...oauthConfig,
 			provider
-		}, Object.fromEntries(url.searchParams.entries()), cookies);
+		}, Object.fromEntries(params.entries()), cookies);
 		const extraFields = typeof oidc.profile === "object" && oidc.profile !== null ? oidc.profile.extraFields : void 0;
 		let profile = result.profile;
 		if (extraFields && typeof profile === "object" && profile) {
@@ -1046,8 +1131,7 @@ function addGroupHttpRuntime(deps) {
 		handleOidcSharedCallback: async (ctx, request) => {
 			const url = new URL(request.url);
 			const params = await getOidcCallbackParams(request);
-			const { connectionId, state } = decodeGroupOidcState(params.get("state"));
-			params.set("state", state);
+			const { connectionId } = decodeGroupOidcState(params.get("state"));
 			url.search = params.toString();
 			return await handleOidcCallbackForConnection(ctx, new Request(url, request), connectionId);
 		},