@syndew/oluso-plugin-scim 0.0.0-stage → 0.0.1

package/types/syndew-oluso-plugin-scim.d.ts

@@ -0,0 +1,735 @@
+import { AdminPlugin, NavItem, PaginatedResponse } from '@syndew/oluso-ui-core';
+import { Routes } from '@angular/router';
+import { Observable } from 'rxjs';
+import * as _angular_core from '@angular/core';
+import { OnInit } from '@angular/core';
+import * as _syndew_oluso_plugin_scim from '@syndew/oluso-plugin-scim';
+import { RoleDto, TeamSummary } from '@syndew/oluso-admin-ui';
+
+/**
+ * SCIM Admin Plugin
+ *
+ * Provides SCIM provisioning management functionality:
+ * - SCIM client management (CRUD): identity providers that push into us
+ * - Token management and rotation
+ * - Attribute mapping configuration
+ * - Provisioning activity logs
+ * - SCIM providers: downstream systems we push users and groups to
+ */
+declare const SCIM_PLUGIN: AdminPlugin;
+/**
+ * Helper function to get SCIM navigation items
+ */
+declare function getScimNavItems(): NavItem[];
+
+declare const SCIM_ROUTES: Routes;
+
+/**
+ * SCIM Client configuration
+ */
+interface ScimClient {
+    id: string;
+    name: string;
+    description?: string;
+    isEnabled: boolean;
+    tokenCreatedAt: string;
+    tokenExpiresAt?: string;
+    allowedIpRanges?: string;
+    rateLimitPerMinute: number;
+    canCreateUsers: boolean;
+    canUpdateUsers: boolean;
+    canDeleteUsers: boolean;
+    canManageGroups: boolean;
+    defaultRoleId?: string;
+    /** Optional OAuth client (clientId) linked for client-credentials JWT auth. */
+    oauthClientId?: string;
+    createdAt: string;
+    lastActivityAt?: string;
+    successCount: number;
+    errorCount: number;
+}
+/**
+ * Request to create a new SCIM client
+ */
+interface CreateScimClientRequest {
+    name: string;
+    description?: string;
+    isEnabled?: boolean;
+    tokenExpiresAt?: string;
+    allowedIpRanges?: string;
+    rateLimitPerMinute?: number;
+    canCreateUsers?: boolean;
+    canUpdateUsers?: boolean;
+    canDeleteUsers?: boolean;
+    canManageGroups?: boolean;
+    defaultRoleId?: string;
+    oauthClientId?: string;
+}
+/**
+ * Response when creating a SCIM client (includes the token)
+ */
+interface CreateScimClientResponse {
+    client: ScimClient;
+    token: string;
+}
+/**
+ * SCIM provisioning log entry
+ */
+interface ScimProvisioningLog {
+    id: string;
+    method: string;
+    path: string;
+    resourceType?: string;
+    resourceId?: string;
+    operation: string;
+    statusCode: number;
+    success: boolean;
+    errorMessage?: string;
+    clientIp?: string;
+    durationMs: number;
+    timestamp: string;
+}
+/**
+ * Inbound attribute mapping: how an attribute of the SCIM resource an
+ * identity provider sends is written onto the internal user.
+ */
+interface ScimAttributeMapping {
+    id: string;
+    scimClientId: string;
+    /** The SCIM attribute path (e.g., "userName", "emails[type eq \"work\"].value", "name.familyName") */
+    scimAttribute: string;
+    /** The internal user property to write (e.g., "Email", "LastName", "custom:department") */
+    internalProperty: string;
+    /** Scriban template computing the value; read from the attribute path when empty. Model: scim, enterprise, attr, client. */
+    expression?: string;
+    /** Scriban boolean expression; the mapping is skipped when false */
+    condition?: string;
+    /** Whether this mapping must resolve when a user is created */
+    isRequired: boolean;
+    /** Default value if the SCIM attribute is not provided */
+    defaultValue?: string;
+    /** Optional transformation function name to apply */
+    transformation?: string;
+    /** Among mappings writing the same property, higher priority is tried first; the first with a value wins */
+    priority: number;
+    /** Whether this mapping is enabled */
+    isEnabled: boolean;
+    createdAt: string;
+    updatedAt?: string;
+}
+/**
+ * Request to create or update a SCIM attribute mapping
+ */
+interface SaveScimAttributeMappingRequest {
+    scimAttribute: string;
+    internalProperty: string;
+    expression?: string;
+    condition?: string;
+    isRequired?: boolean;
+    defaultValue?: string;
+    transformation?: string;
+    priority?: number;
+    isEnabled?: boolean;
+}
+/** @deprecated use SaveScimAttributeMappingRequest */
+type CreateScimAttributeMappingRequest = SaveScimAttributeMappingRequest;
+interface ScimMappingOptions {
+    internalProperties: string[];
+    transformations: string[];
+    presets: string[];
+    /** The mappings in force when a client has none configured */
+    defaults: ScimAttributeMapping[];
+}
+interface ScimMappingPreview {
+    success: boolean;
+    error?: string;
+    /** Internal property to the value that would be written; null means cleared */
+    fields: Record<string, string | null>;
+    usingDefaults: boolean;
+}
+/**
+ * Predefined SCIM attribute suggestions for common providers
+ */
+interface ScimAttributeSuggestion {
+    attribute: string;
+    description: string;
+    example?: string;
+    provider?: 'azure' | 'okta' | 'google' | 'standard';
+}
+/**
+ * Internal user property options
+ */
+interface InternalPropertyOption {
+    name: string;
+    displayName: string;
+}
+/**
+ * Transformation option for attribute mapping
+ */
+interface TransformationOption {
+    name: string;
+    description: string;
+}
+
+/**
+ * Outbound SCIM provider: a downstream system this tenant pushes users
+ * (and optionally groups) to. The counterpart of ScimClient, which is an
+ * identity provider that pushes into us.
+ */
+interface ScimProvider {
+    id: string;
+    name: string;
+    description?: string;
+    isEnabled: boolean;
+    flavor: string;
+    baseUrl: string;
+    authType: ScimProviderAuthType;
+    oauthTokenEndpoint?: string;
+    oauthClientId?: string;
+    oauthScope?: string;
+    /** A secret is stored. The value itself is never returned. */
+    hasSecret: boolean;
+    secretUpdatedAt?: string;
+    syncUsers: boolean;
+    syncGroups: boolean;
+    /** What a SCIM Group is built from. */
+    groupSource: ScimProviderGroupSource;
+    scopeRoleIds: string[];
+    /** Team membership includes sub-teams. */
+    scopeTeamIds: string[];
+    userNameSource: ScimProviderUserNameSource;
+    /** Scriban template used when userNameSource is 'expression'. */
+    userNameExpression?: string;
+    deprovisionMode: ScimProviderDeprovisionMode;
+    reconcileIntervalMinutes: number;
+    /** Inbound SCIM client that is this same system; its changes are not pushed back here. */
+    linkedScimClientId?: string;
+    createdAt: string;
+    updatedAt?: string;
+    lastReconcileAt?: string;
+    lastReconcileSummary?: string;
+    lastSuccessAt?: string;
+    lastErrorAt?: string;
+    lastError?: string;
+    successCount: number;
+    errorCount: number;
+}
+type ScimProviderAuthType = 'bearer' | 'oauth_client_credentials';
+type ScimProviderUserNameSource = 'userName' | 'email' | 'expression';
+type ScimProviderDeprovisionMode = 'deactivate' | 'delete';
+type ScimProviderGroupSource = 'roles' | 'teams' | 'both';
+interface CreateScimProviderRequest {
+    name: string;
+    description?: string;
+    isEnabled?: boolean;
+    flavor: string;
+    baseUrl: string;
+    authType: ScimProviderAuthType;
+    oauthTokenEndpoint?: string;
+    oauthClientId?: string;
+    oauthScope?: string;
+    secret?: string;
+    syncUsers?: boolean;
+    syncGroups?: boolean;
+    groupSource?: ScimProviderGroupSource;
+    scopeRoleIds?: string[];
+    scopeTeamIds?: string[];
+    userNameSource?: ScimProviderUserNameSource;
+    userNameExpression?: string;
+    deprovisionMode?: ScimProviderDeprovisionMode;
+    reconcileIntervalMinutes?: number;
+    linkedScimClientId?: string;
+}
+interface UpdateScimProviderRequest {
+    name: string;
+    description?: string;
+    isEnabled: boolean;
+    flavor: string;
+    baseUrl: string;
+    authType: ScimProviderAuthType;
+    oauthTokenEndpoint?: string;
+    oauthClientId?: string;
+    oauthScope?: string;
+    syncUsers: boolean;
+    syncGroups: boolean;
+    groupSource: ScimProviderGroupSource;
+    scopeRoleIds: string[];
+    scopeTeamIds: string[];
+    userNameSource: ScimProviderUserNameSource;
+    userNameExpression?: string;
+    deprovisionMode: ScimProviderDeprovisionMode;
+    reconcileIntervalMinutes: number;
+    linkedScimClientId?: string;
+}
+interface ScimProviderFlavor {
+    key: string;
+    displayName: string;
+    description: string;
+    notes?: string;
+    defaultUserNameSource: ScimProviderUserNameSource;
+    requiresEmailUserName: boolean;
+    supportsPhoneNumbers: boolean;
+    supportsEnterpriseExtension: boolean;
+    supportsGroups: boolean;
+    defaultUserMappings: {
+        scimAttribute: string;
+        internalProperty: string;
+    }[];
+}
+interface ScimProviderOptions {
+    flavors: ScimProviderFlavor[];
+    internalProperties: string[];
+    transformations: string[];
+    authTypes: ScimProviderAuthType[];
+    userNameSources: ScimProviderUserNameSource[];
+    deprovisionModes: ScimProviderDeprovisionMode[];
+    groupSources: ScimProviderGroupSource[];
+}
+interface ScimProviderAttributeMapping {
+    id: string;
+    scimProviderId: string;
+    scimAttribute: string;
+    /** Empty when the value comes from an expression. */
+    internalProperty: string;
+    /** Scriban template computing the value; takes precedence over internalProperty. */
+    expression?: string;
+    /** Scriban boolean expression; the attribute is omitted when false. */
+    condition?: string;
+    transformation?: string;
+    defaultValue?: string;
+    isEnabled: boolean;
+    createdAt: string;
+    updatedAt?: string;
+}
+interface SaveScimProviderAttributeMappingRequest {
+    scimAttribute: string;
+    internalProperty?: string;
+    expression?: string;
+    condition?: string;
+    transformation?: string;
+    defaultValue?: string;
+    isEnabled: boolean;
+}
+interface ScimProviderPreview {
+    userId: string;
+    userName?: string;
+    inScope: boolean;
+    error?: string;
+    payload?: Record<string, unknown>;
+}
+interface ScimProviderTestResult {
+    success: boolean;
+    message: string;
+    discoveryReachable: boolean;
+    discoveryStatusCode: number;
+    authenticationOk: boolean;
+    authenticationStatusCode: number;
+    authenticationError?: string;
+    patchSupported?: boolean;
+    bulkSupported?: boolean;
+    filterSupported?: boolean;
+    filterMaxResults?: number;
+    etagSupported?: boolean;
+    authenticationSchemes: string[];
+}
+interface ScimProviderReconcileResult {
+    usersQueued: number;
+    userRemovalsQueued: number;
+    groupsQueued: number;
+    groupRemovalsQueued: number;
+    summary: string;
+}
+type ScimQueueStatus = 'pending' | 'processing' | 'succeeded' | 'failed' | 'dead' | 'superseded';
+interface ScimProviderQueueSummary {
+    pending: number;
+    processing: number;
+    failed: number;
+    dead: number;
+    succeededLast24h: number;
+    oldestPendingAt?: string;
+}
+interface ScimProviderQueueItem {
+    id: string;
+    resourceType: 'User' | 'Group';
+    internalId: string;
+    operation: 'upsert' | 'remove';
+    status: ScimQueueStatus;
+    attempts: number;
+    nextAttemptAt: string;
+    lastStatusCode?: number;
+    lastError?: string;
+    reason?: string;
+    createdAt: string;
+    updatedAt?: string;
+    completedAt?: string;
+}
+interface ScimProviderQueueResponse {
+    summary: ScimProviderQueueSummary;
+    total: number;
+    skip: number;
+    take: number;
+    items: ScimProviderQueueItem[];
+}
+interface ScimProviderLog {
+    id: string;
+    operation: string;
+    resourceType?: string;
+    internalId?: string;
+    remoteId?: string;
+    method: string;
+    path: string;
+    statusCode: number;
+    success: boolean;
+    errorMessage?: string;
+    durationMs: number;
+    timestamp: string;
+}
+interface ScimProviderResource {
+    id: string;
+    resourceType: 'User' | 'Group';
+    internalId: string;
+    remoteId: string;
+    remoteVersion?: string;
+    isDeprovisioned: boolean;
+    createdAt: string;
+    lastSyncedAt?: string;
+}
+
+declare class ScimService {
+    private readonly api;
+    getClients(): Observable<ScimClient[]>;
+    getClient(id: string): Observable<ScimClient>;
+    createClient(request: CreateScimClientRequest): Observable<CreateScimClientResponse>;
+    updateClient(id: string, request: ScimClient): Observable<ScimClient>;
+    deleteClient(id: string): Observable<void>;
+    rotateToken(id: string): Observable<{
+        token: string;
+    }>;
+    getLogs(clientId: string, page?: number, pageSize?: number): Observable<PaginatedResponse<ScimProvisioningLog>>;
+    getMappings(clientId: string): Observable<ScimAttributeMapping[]>;
+    getMapping(clientId: string, mappingId: string): Observable<ScimAttributeMapping>;
+    getMappingOptions(): Observable<ScimMappingOptions>;
+    previewMappings(clientId: string, resource: Record<string, unknown>, mode?: 'create' | 'replace' | 'patch'): Observable<ScimMappingPreview>;
+    createMapping(clientId: string, request: SaveScimAttributeMappingRequest): Observable<ScimAttributeMapping>;
+    updateMapping(clientId: string, mappingId: string, request: SaveScimAttributeMappingRequest): Observable<ScimAttributeMapping>;
+    deleteMapping(clientId: string, mappingId: string): Observable<void>;
+    applyDefaultMappings(clientId: string, provider?: string): Observable<ScimAttributeMapping[]>;
+    getProviderOptions(): Observable<ScimProviderOptions>;
+    getProviders(): Observable<ScimProvider[]>;
+    getProvider(id: string): Observable<ScimProvider>;
+    createProvider(request: CreateScimProviderRequest): Observable<ScimProvider>;
+    updateProvider(id: string, request: UpdateScimProviderRequest): Observable<ScimProvider>;
+    deleteProvider(id: string): Observable<void>;
+    setProviderSecret(id: string, secret: string): Observable<ScimProvider>;
+    testProvider(id: string): Observable<ScimProviderTestResult>;
+    reconcileProvider(id: string): Observable<ScimProviderReconcileResult>;
+    previewProvider(id: string, userId: string): Observable<ScimProviderPreview>;
+    getProviderQueue(id: string, status?: string, skip?: number, take?: number): Observable<ScimProviderQueueResponse>;
+    retryProviderQueue(id: string): Observable<{
+        requeued: number;
+    }>;
+    /** A provider's calls, newest first; `success` false returns only the failed ones. */
+    getProviderLogs(id: string, page?: number, pageSize?: number, success?: boolean): Observable<PaginatedResponse<ScimProviderLog>>;
+    getProviderResources(id: string, type?: 'User' | 'Group', page?: number, pageSize?: number): Observable<PaginatedResponse<ScimProviderResource>>;
+    getProviderMappings(id: string): Observable<ScimProviderAttributeMapping[]>;
+    createProviderMapping(id: string, request: SaveScimProviderAttributeMappingRequest): Observable<ScimProviderAttributeMapping>;
+    updateProviderMapping(id: string, mappingId: string, request: SaveScimProviderAttributeMappingRequest): Observable<ScimProviderAttributeMapping>;
+    deleteProviderMapping(id: string, mappingId: string): Observable<void>;
+    applyProviderDefaultMappings(id: string): Observable<ScimProviderAttributeMapping[]>;
+    getScimAttributeSuggestions(): ScimAttributeSuggestion[];
+    /**
+     * The tenant-specific SCIM base URL to configure in an upstream provisioning
+     * client. Resolved server-side from the tenant's issuer (custom domain /
+     * subdomain), not the admin portal's origin.
+     */
+    getScimEndpointUrl(): Observable<{
+        url: string;
+    }>;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<ScimService, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<ScimService>;
+}
+
+declare class ScimClientsComponent implements OnInit {
+    private readonly scimService;
+    clients: _angular_core.WritableSignal<ScimClient[]>;
+    loading: _angular_core.WritableSignal<boolean>;
+    error: _angular_core.WritableSignal<string | null>;
+    showCreateModal: _angular_core.WritableSignal<boolean>;
+    newToken: _angular_core.WritableSignal<string | null>;
+    copiedToken: _angular_core.WritableSignal<boolean>;
+    createForm: {
+        name: string;
+        description: string;
+    };
+    scimEndpointUrl: string;
+    ngOnInit(): void;
+    loadClients(): void;
+    handleCreate(): void;
+    handleDelete(id: string): void;
+    handleRotateToken(id: string): void;
+    copyToken(): void;
+    formatDate(dateString: string): string;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<ScimClientsComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<ScimClientsComponent, "lib-scim-clients", never, {}, {}, never, never, true, never>;
+}
+
+declare class ScimClientDetailComponent implements OnInit {
+    private readonly scimService;
+    private readonly clientService;
+    private readonly route;
+    private readonly router;
+    client: _angular_core.WritableSignal<ScimClient | null>;
+    logs: _angular_core.WritableSignal<ScimProvisioningLog[]>;
+    mappings: _angular_core.WritableSignal<ScimAttributeMapping[]>;
+    oauthClients: _angular_core.WritableSignal<{
+        clientId: string;
+        clientName: string;
+    }[]>;
+    loading: _angular_core.WritableSignal<boolean>;
+    loadingMappings: _angular_core.WritableSignal<boolean>;
+    saving: _angular_core.WritableSignal<boolean>;
+    saveError: _angular_core.WritableSignal<string | null>;
+    clientId: string;
+    formData: {
+        name: string;
+        description: string;
+        isEnabled: boolean;
+        allowedIpRanges: string;
+        rateLimitPerMinute: number;
+        canCreateUsers: boolean;
+        canUpdateUsers: boolean;
+        canDeleteUsers: boolean;
+        canManageGroups: boolean;
+        oauthClientId: string;
+    };
+    ngOnInit(): void;
+    loadOAuthClients(): void;
+    loadClient(): void;
+    loadLogs(): void;
+    loadMappings(): void;
+    handleSave(): void;
+    goBack(): void;
+    formatDate(dateString: string): string;
+    formatDateShort(dateString: string): string;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<ScimClientDetailComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<ScimClientDetailComponent, "lib-scim-client-detail", never, {}, {}, never, never, true, never>;
+}
+
+interface MappingFormData {
+    scimAttribute: string;
+    internalProperty: string;
+    source: 'attribute' | 'expression';
+    expression: string;
+    condition: string;
+    isRequired: boolean;
+    defaultValue: string;
+    transformation: string;
+    priority: number;
+    isEnabled: boolean;
+}
+declare class ScimMappingsComponent implements OnInit {
+    private readonly scimService;
+    private readonly route;
+    client: _angular_core.WritableSignal<ScimClient | null>;
+    mappings: _angular_core.WritableSignal<ScimAttributeMapping[]>;
+    options: _angular_core.WritableSignal<ScimMappingOptions | null>;
+    loading: _angular_core.WritableSignal<boolean>;
+    error: _angular_core.WritableSignal<string | null>;
+    formError: _angular_core.WritableSignal<string | null>;
+    showForm: _angular_core.WritableSignal<boolean>;
+    editingMapping: _angular_core.WritableSignal<ScimAttributeMapping | null>;
+    saving: _angular_core.WritableSignal<boolean>;
+    showDefaultsModal: _angular_core.WritableSignal<boolean>;
+    selectedProvider: string;
+    clientId: string;
+    previewJson: string;
+    previewMode: 'create' | 'replace' | 'patch';
+    previewing: _angular_core.WritableSignal<boolean>;
+    preview: _angular_core.WritableSignal<ScimMappingPreview | null>;
+    previewError: _angular_core.WritableSignal<string | null>;
+    previewFields: _angular_core.WritableSignal<{
+        key: string;
+        value: string | null;
+    }[]>;
+    formData: MappingFormData;
+    scimSuggestions: ScimAttributeSuggestion[];
+    /** The server's mapping-options decide which properties and transformations are offered. */
+    internalProperties: _angular_core.Signal<_syndew_oluso_plugin_scim.InternalPropertyOption[]>;
+    transformations: _angular_core.Signal<_syndew_oluso_plugin_scim.TransformationOption[]>;
+    ngOnInit(): void;
+    loadData(): void;
+    openCreateForm(): void;
+    closeForm(): void;
+    handleEdit(mapping: ScimAttributeMapping): void;
+    handleSubmit(): void;
+    handleDelete(mappingId: string): void;
+    handleToggleEnabled(mapping: ScimAttributeMapping): void;
+    handleApplyDefaults(): void;
+    runPreview(): void;
+    private toRequest;
+    private messageOf;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<ScimMappingsComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<ScimMappingsComponent, "lib-scim-mappings", never, {}, {}, never, never, true, never>;
+}
+
+declare class ScimProvidersComponent implements OnInit {
+    private readonly scimService;
+    private readonly router;
+    providers: _angular_core.WritableSignal<ScimProvider[]>;
+    options: _angular_core.WritableSignal<ScimProviderOptions | null>;
+    flavors: _angular_core.Signal<ScimProviderFlavor[]>;
+    loading: _angular_core.WritableSignal<boolean>;
+    error: _angular_core.WritableSignal<string | null>;
+    showCreateModal: _angular_core.WritableSignal<boolean>;
+    creating: _angular_core.WritableSignal<boolean>;
+    createError: _angular_core.WritableSignal<string | null>;
+    showSecret: _angular_core.WritableSignal<boolean>;
+    selectedFlavorKey: _angular_core.WritableSignal<string>;
+    selectedFlavor: _angular_core.Signal<ScimProviderFlavor | null>;
+    createForm: {
+        name: string;
+        description: string;
+        flavor: string;
+        baseUrl: string;
+        authType: ScimProviderAuthType;
+        oauthTokenEndpoint: string;
+        oauthClientId: string;
+        oauthScope: string;
+        secret: string;
+    };
+    activityProvider: _angular_core.WritableSignal<ScimProvider | null>;
+    activityErrorsOnly: _angular_core.WritableSignal<boolean>;
+    activityLogs: _angular_core.WritableSignal<ScimProviderLog[]>;
+    activityPage: _angular_core.WritableSignal<number>;
+    activityTotal: _angular_core.WritableSignal<number>;
+    activityTotalPages: _angular_core.WritableSignal<number>;
+    activityLoading: _angular_core.WritableSignal<boolean>;
+    activityError: _angular_core.WritableSignal<string | null>;
+    private readonly activityPageSize;
+    private activityRequest?;
+    ngOnInit(): void;
+    loadProviders(): void;
+    openCreate(): void;
+    onFlavorChange(key: string): void;
+    handleCreate(): void;
+    handleDelete(p: ScimProvider): void;
+    openActivity(p: ScimProvider, errorsOnly: boolean): void;
+    closeActivity(): void;
+    setActivityErrorsOnly(errorsOnly: boolean): void;
+    goToActivityPage(page: number): void;
+    loadActivity(): void;
+    flavorName(key: string): string;
+    formatDate(dateString: string): string;
+    private emptyForm;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<ScimProvidersComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<ScimProvidersComponent, "lib-scim-providers", never, {}, {}, never, never, true, never>;
+}
+
+interface MappingForm {
+    id: string | null;
+    scimAttribute: string;
+    source: 'property' | 'expression';
+    internalProperty: string;
+    expression: string;
+    condition: string;
+    transformation: string;
+    defaultValue: string;
+    isEnabled: boolean;
+}
+declare class ScimProviderDetailComponent implements OnInit {
+    private readonly scimService;
+    private readonly roleService;
+    private readonly teamService;
+    private readonly route;
+    private readonly router;
+    providerId: string;
+    provider: _angular_core.WritableSignal<ScimProvider | null>;
+    options: _angular_core.WritableSignal<ScimProviderOptions | null>;
+    flavors: _angular_core.Signal<ScimProviderFlavor[]>;
+    internalProperties: _angular_core.Signal<string[]>;
+    transformations: _angular_core.Signal<string[]>;
+    roles: _angular_core.WritableSignal<RoleDto[]>;
+    teams: _angular_core.WritableSignal<TeamSummary[]>;
+    inboundClients: _angular_core.WritableSignal<ScimClient[]>;
+    loading: _angular_core.WritableSignal<boolean>;
+    saving: _angular_core.WritableSignal<boolean>;
+    saveError: _angular_core.WritableSignal<string | null>;
+    selectedFlavorKey: _angular_core.WritableSignal<string>;
+    selectedFlavor: _angular_core.Signal<ScimProviderFlavor | null>;
+    groupsUnsupported: _angular_core.Signal<boolean>;
+    scopeRoleIds: _angular_core.WritableSignal<Set<string>>;
+    scopeTeamIds: _angular_core.WritableSignal<Set<string>>;
+    mappings: _angular_core.WritableSignal<ScimProviderAttributeMapping[]>;
+    loadingMappings: _angular_core.WritableSignal<boolean>;
+    mappingForm: _angular_core.WritableSignal<MappingForm | null>;
+    mappingError: _angular_core.WritableSignal<string | null>;
+    savingMapping: _angular_core.WritableSignal<boolean>;
+    previewUserId: string;
+    previewing: _angular_core.WritableSignal<boolean>;
+    preview: _angular_core.WritableSignal<ScimProviderPreview | null>;
+    queue: _angular_core.WritableSignal<ScimProviderQueueResponse | null>;
+    queueFilter: string;
+    queueMessage: _angular_core.WritableSignal<string | null>;
+    reconciling: _angular_core.WritableSignal<boolean>;
+    logs: _angular_core.WritableSignal<ScimProviderLog[]>;
+    resourceCounts: _angular_core.WritableSignal<{
+        users: number;
+        groups: number;
+    }>;
+    newSecret: string;
+    showSecret: _angular_core.WritableSignal<boolean>;
+    savingSecret: _angular_core.WritableSignal<boolean>;
+    secretError: _angular_core.WritableSignal<string | null>;
+    testing: _angular_core.WritableSignal<boolean>;
+    testResult: _angular_core.WritableSignal<ScimProviderTestResult | null>;
+    readonly attributeSuggestions: string[];
+    form: {
+        name: string;
+        description: string;
+        isEnabled: boolean;
+        flavor: string;
+        baseUrl: string;
+        authType: ScimProviderAuthType;
+        oauthTokenEndpoint: string;
+        oauthClientId: string;
+        oauthScope: string;
+        syncUsers: boolean;
+        syncGroups: boolean;
+        groupSource: ScimProviderGroupSource;
+        userNameSource: ScimProviderUserNameSource;
+        userNameExpression: string;
+        deprovisionMode: ScimProviderDeprovisionMode;
+        reconcileIntervalMinutes: number;
+        linkedScimClientId: string;
+    };
+    ngOnInit(): void;
+    loadProvider(): void;
+    private applyProvider;
+    onFlavorChange(key: string): void;
+    toggleScopeRole(id: string): void;
+    toggleScopeTeam(id: string): void;
+    handleSave(): void;
+    saveSecret(): void;
+    testConnection(): void;
+    loadMappings(): void;
+    startNewMapping(): void;
+    editMapping(m: ScimProviderAttributeMapping): void;
+    saveMapping(): void;
+    deleteMapping(m: ScimProviderAttributeMapping): void;
+    applyDefaults(): void;
+    runPreview(): void;
+    loadQueue(): void;
+    retryFailed(): void;
+    runReconcile(): void;
+    loadLogs(): void;
+    loadResourceCounts(): void;
+    statusClass(status: ScimQueueStatus): string;
+    flavorName(key: string): string;
+    goBack(): void;
+    formatDate(dateString: string): string;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<ScimProviderDetailComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<ScimProviderDetailComponent, "lib-scim-provider-detail", never, {}, {}, never, never, true, never>;
+}
+
+export { SCIM_PLUGIN, SCIM_ROUTES, ScimClientDetailComponent, ScimClientsComponent, ScimMappingsComponent, ScimProviderDetailComponent, ScimProvidersComponent, ScimService, getScimNavItems };
+export type { CreateScimAttributeMappingRequest, CreateScimClientRequest, CreateScimClientResponse, CreateScimProviderRequest, InternalPropertyOption, SaveScimAttributeMappingRequest, SaveScimProviderAttributeMappingRequest, ScimAttributeMapping, ScimAttributeSuggestion, ScimClient, ScimMappingOptions, ScimMappingPreview, ScimProvider, ScimProviderAttributeMapping, ScimProviderAuthType, ScimProviderDeprovisionMode, ScimProviderFlavor, ScimProviderGroupSource, ScimProviderLog, ScimProviderOptions, ScimProviderPreview, ScimProviderQueueItem, ScimProviderQueueResponse, ScimProviderQueueSummary, ScimProviderReconcileResult, ScimProviderResource, ScimProviderTestResult, ScimProviderUserNameSource, ScimProvisioningLog, ScimQueueStatus, TransformationOption, UpdateScimProviderRequest };