@useatlas/create 0.0.6 → 0.0.7

package/templates/nextjs-standalone/src/api/routes/admin-sandbox.ts

@@ -0,0 +1,417 @@
+/**
+ * Admin sandbox routes.
+ *
+ * Mounted under /api/v1/admin/sandbox. All routes require admin role
+ * and org context. Provides sandbox backend status, selection, and
+ * BYOC credential management (connect/disconnect).
+ */
+
+import { Effect } from "effect";
+import { createRoute, z } from "@hono/zod-openapi";
+import { runEffect } from "@atlas/api/lib/effect/hono";
+import { AuthContext } from "@atlas/api/lib/effect/services";
+import { createLogger } from "@atlas/api/lib/logger";
+import { getSetting, deleteSetting } from "@atlas/api/lib/settings";
+import {
+  getExploreBackendType,
+  getActiveSandboxPluginId,
+} from "@atlas/api/lib/tools/explore";
+import { useVercelSandbox, useSidecar } from "@atlas/api/lib/tools/backends/detect";
+import {
+  getSandboxCredentials,
+  saveSandboxCredential,
+  deleteSandboxCredential,
+  SANDBOX_PROVIDERS,
+} from "@atlas/api/lib/sandbox/credentials";
+import { validateCredentials } from "@atlas/api/lib/sandbox/validate";
+import { ErrorSchema, AuthErrorSchema, createParamSchema } from "./shared-schemas";
+import { createAdminRouter, requireOrgContext } from "./admin-router";
+
+const log = createLogger("admin-sandbox");
+
+// ---------------------------------------------------------------------------
+// Schemas
+// ---------------------------------------------------------------------------
+
+const SandboxBackendSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  type: z.enum(["built-in", "plugin"]),
+  available: z.boolean(),
+  description: z.string().optional(),
+});
+
+const ConnectedProviderSchema = z.object({
+  provider: z.enum(SANDBOX_PROVIDERS),
+  displayName: z.string().nullable(),
+  connectedAt: z.string(),
+  validatedAt: z.string().nullable(),
+  isActive: z.boolean(),
+});
+
+const SandboxStatusSchema = z.object({
+  /** Currently active backend for this workspace (after override resolution) */
+  activeBackend: z.string(),
+  /** Platform default backend (no workspace override) */
+  platformDefault: z.string(),
+  /** Workspace override backend (if set) */
+  workspaceOverride: z.string().nullable(),
+  /** Custom sidecar URL (if set at workspace level) */
+  workspaceSidecarUrl: z.string().nullable(),
+  /** All available backends in this deployment */
+  availableBackends: z.array(SandboxBackendSchema),
+  /** Connected BYOC sandbox providers for this org */
+  connectedProviders: z.array(ConnectedProviderSchema),
+});
+
+const ConnectRequestSchema = z.object({
+  credentials: z.record(z.string(), z.unknown()),
+});
+
+const ConnectResponseSchema = z.object({
+  connected: z.boolean(),
+  displayName: z.string().nullable(),
+  validatedAt: z.string(),
+});
+
+const DisconnectResponseSchema = z.object({
+  disconnected: z.boolean(),
+});
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+const getStatusRoute = createRoute({
+  method: "get",
+  path: "/status",
+  tags: ["Admin — Sandbox"],
+  summary: "Get sandbox backend status",
+  description:
+    "Returns the sandbox backend configuration for the current workspace, " +
+    "including available backends, the active backend, any workspace override, " +
+    "and connected BYOC providers.",
+  responses: {
+    200: {
+      description: "Sandbox status",
+      content: {
+        "application/json": { schema: SandboxStatusSchema },
+      },
+    },
+    400: {
+      description: "No active organization",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthErrorSchema } },
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+  },
+});
+
+const connectRoute = createRoute({
+  method: "post",
+  path: "/connect/{provider}",
+  tags: ["Admin — Sandbox"],
+  summary: "Connect a sandbox provider",
+  description:
+    "Validates credentials against the provider API and saves them for this org.",
+  request: {
+    params: createParamSchema("provider", "vercel"),
+    body: {
+      content: {
+        "application/json": { schema: ConnectRequestSchema },
+      },
+    },
+  },
+  responses: {
+    200: {
+      description: "Provider connected",
+      content: { "application/json": { schema: ConnectResponseSchema } },
+    },
+    400: {
+      description: "Invalid provider",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthErrorSchema } },
+    },
+    422: {
+      description: "Credential validation failed",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+  },
+});
+
+const disconnectRoute = createRoute({
+  method: "delete",
+  path: "/disconnect/{provider}",
+  tags: ["Admin — Sandbox"],
+  summary: "Disconnect a sandbox provider",
+  description:
+    "Removes stored credentials for a provider. If this was the active sandbox, " +
+    "the workspace falls back to the platform default.",
+  request: {
+    params: createParamSchema("provider", "vercel"),
+  },
+  responses: {
+    200: {
+      description: "Provider disconnected",
+      content: { "application/json": { schema: DisconnectResponseSchema } },
+    },
+    400: {
+      description: "Invalid provider",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthErrorSchema } },
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+  },
+});
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+interface AvailableBackend {
+  id: string;
+  name: string;
+  type: "built-in" | "plugin";
+  available: boolean;
+  description?: string;
+}
+
+async function getAvailableBackends(): Promise<AvailableBackend[]> {
+  const backends: AvailableBackend[] = [];
+
+  // Built-in backends
+  backends.push({
+    id: "vercel-sandbox",
+    name: "Vercel Sandbox",
+    type: "built-in",
+    available: useVercelSandbox(),
+    description: "Firecracker microVM with network isolation (Vercel)",
+  });
+
+  backends.push({
+    id: "sidecar",
+    name: "Sidecar",
+    type: "built-in",
+    available: useSidecar(),
+    description: "HTTP-isolated container service",
+  });
+
+  // Plugin backends — discover from registry
+  try {
+    const { plugins } = await import("@atlas/api/lib/plugins/registry");
+    const sandboxPlugins = plugins.getByType("sandbox");
+    for (const plugin of sandboxPlugins) {
+      backends.push({
+        id: plugin.id,
+        name: plugin.name ?? plugin.id,
+        type: "plugin",
+        available: true,
+        description: plugin.name ? `${plugin.name} sandbox plugin` : undefined,
+      });
+    }
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    log.warn({ err: detail }, "Plugin registry unavailable — sandbox status will not include plugin backends");
+  }
+
+  return backends;
+}
+
+function isValidProvider(provider: string): provider is (typeof SANDBOX_PROVIDERS)[number] {
+  return (SANDBOX_PROVIDERS as readonly string[]).includes(provider);
+}
+
+// ---------------------------------------------------------------------------
+// Router
+// ---------------------------------------------------------------------------
+
+const adminSandbox = createAdminRouter();
+
+adminSandbox.use(requireOrgContext());
+
+// GET /status — sandbox backend status for this workspace
+adminSandbox.openapi(getStatusRoute, async (c) => {
+  return runEffect(
+    c,
+    Effect.gen(function* () {
+      const { orgId } = yield* AuthContext;
+      if (!orgId) {
+        return c.json({ error: "Bad Request", message: "No active organization." }, 400);
+      }
+
+      // Workspace override
+      const workspaceOverride = getSetting("ATLAS_SANDBOX_BACKEND", orgId) ?? null;
+      const workspaceSidecarUrl = getSetting("ATLAS_SANDBOX_URL", orgId) ?? null;
+
+      // Platform default (the backend that would be used without any workspace override)
+      const platformDefault = getExploreBackendType();
+      const activePluginId = getActiveSandboxPluginId();
+      const [allBackends, credentials] = yield* Effect.promise(() =>
+        Promise.all([getAvailableBackends(), getSandboxCredentials(orgId)]),
+      );
+
+      // Resolve the effective active backend
+      let activeBackend: string;
+      if (workspaceOverride) {
+        // Verify the override backend is actually available
+        const found = allBackends.find((b) => b.id === workspaceOverride && b.available);
+        activeBackend = found ? workspaceOverride : platformDefault;
+      } else {
+        activeBackend = activePluginId ?? platformDefault;
+      }
+
+      // Build connected providers list
+      const connectedProviders = credentials.map((cred) => ({
+        provider: cred.provider,
+        displayName: cred.displayName,
+        connectedAt: cred.connectedAt,
+        validatedAt: cred.validatedAt,
+        isActive: workspaceOverride === cred.provider,
+      }));
+
+      return c.json(
+        {
+          activeBackend,
+          platformDefault: activePluginId ?? platformDefault,
+          workspaceOverride,
+          workspaceSidecarUrl,
+          availableBackends: allBackends,
+          connectedProviders,
+        },
+        200,
+      );
+    }),
+    { label: "get sandbox status" },
+  );
+});
+
+// POST /connect/{provider} — validate and save credentials
+adminSandbox.openapi(connectRoute, async (c) => {
+  return runEffect(
+    c,
+    Effect.gen(function* () {
+      const { orgId } = yield* AuthContext;
+      if (!orgId) {
+        return c.json({ error: "Bad Request", message: "No active organization." }, 400);
+      }
+      const provider = c.req.param("provider");
+
+      if (!isValidProvider(provider)) {
+        return c.json(
+          { error: "Bad Request", message: `Unknown provider: ${provider}. Valid providers: ${SANDBOX_PROVIDERS.join(", ")}` },
+          400,
+        );
+      }
+
+      // Parse body safely — c.req.json() throws on malformed JSON
+      const body = yield* Effect.tryPromise({
+        try: () => c.req.json<{ credentials?: Record<string, unknown> }>(),
+        catch: (err) => new Error(`Invalid JSON body: ${err instanceof Error ? err.message : String(err)}`),
+      }).pipe(Effect.catchAll((err) =>
+        Effect.succeed({ _parseError: err.message } as const),
+      ));
+
+      if ("_parseError" in body) {
+        return c.json(
+          { error: "Bad Request", message: body._parseError },
+          400,
+        );
+      }
+
+      const credentials = body.credentials;
+      if (!credentials || typeof credentials !== "object") {
+        return c.json(
+          { error: "Bad Request", message: "Request body must include a credentials object" },
+          400,
+        );
+      }
+
+      // Validate against the provider API
+      const result = yield* Effect.promise(() => validateCredentials(provider, credentials));
+
+      if (!result.valid) {
+        return c.json(
+          { error: "Validation Failed", message: result.error },
+          422,
+        );
+      }
+
+      // Save credentials
+      yield* Effect.promise(() =>
+        saveSandboxCredential(orgId, provider, credentials, result.displayName),
+      );
+
+      log.info({ orgId, provider }, "Sandbox provider connected");
+
+      return c.json(
+        {
+          connected: true,
+          displayName: result.displayName ?? null,
+          validatedAt: new Date().toISOString(),
+        },
+        200,
+      );
+    }),
+    { label: "connect sandbox provider" },
+  );
+});
+
+// DELETE /disconnect/{provider} — remove credentials
+adminSandbox.openapi(disconnectRoute, async (c) => {
+  return runEffect(
+    c,
+    Effect.gen(function* () {
+      const { orgId } = yield* AuthContext;
+      if (!orgId) {
+        return c.json({ error: "Bad Request", message: "No active organization." }, 400);
+      }
+      const provider = c.req.param("provider");
+
+      if (!isValidProvider(provider)) {
+        return c.json(
+          { error: "Bad Request", message: `Unknown provider: ${provider}. Valid providers: ${SANDBOX_PROVIDERS.join(", ")}` },
+          400,
+        );
+      }
+
+      const deleted = yield* Effect.promise(() =>
+        deleteSandboxCredential(orgId, provider),
+      );
+
+      // If this was the active sandbox, reset to platform default
+      const workspaceOverride = getSetting("ATLAS_SANDBOX_BACKEND", orgId);
+      if (workspaceOverride === provider) {
+        yield* Effect.promise(() => deleteSetting("ATLAS_SANDBOX_BACKEND", undefined, orgId));
+        log.info({ orgId, provider }, "Active sandbox provider disconnected — reset to platform default");
+      }
+
+      if (deleted) {
+        log.info({ orgId, provider }, "Sandbox provider disconnected");
+      }
+
+      return c.json({ disconnected: deleted }, 200);
+    }),
+    { label: "disconnect sandbox provider" },
+  );
+});
+
+export { adminSandbox };

package/templates/nextjs-standalone/src/api/routes/admin-scim.ts

@@ -0,0 +1,262 @@
+/**
+ * Admin SCIM directory sync management routes.
+ *
+ * Mounted under /api/v1/admin/scim. All routes require admin role AND
+ * enterprise license (enforced within the SCIM service layer).
+ *
+ * The actual SCIM 2.0 protocol endpoints (/scim/v2/Users, etc.) are handled
+ * by the @better-auth/scim plugin via the Better Auth catch-all at /api/auth/*.
+ * These admin routes manage SCIM connections, tokens, and group→role mappings.
+ */
+
+import { Effect } from "effect";
+import { createRoute, z } from "@hono/zod-openapi";
+import { runEffect } from "@atlas/api/lib/effect/hono";
+import { AuthContext } from "@atlas/api/lib/effect/services";
+import {
+  listConnections,
+  deleteConnection,
+  getSyncStatus,
+  listGroupMappings,
+  createGroupMapping,
+  deleteGroupMapping,
+  SCIMError,
+} from "@atlas/ee/auth/scim";
+import { ErrorSchema, AuthErrorSchema, isValidId, createIdParamSchema } from "./shared-schemas";
+import { createAdminRouter, requireOrgContext } from "./admin-router";
+
+const SCIM_ERROR_STATUS = { not_found: 404, conflict: 409, validation: 400 } as const;
+
+// ---------------------------------------------------------------------------
+// Schemas
+// ---------------------------------------------------------------------------
+
+const SCIMConnectionSchema = z.object({
+  id: z.string(),
+  providerId: z.string(),
+  organizationId: z.string().nullable(),
+});
+
+const SCIMSyncStatusSchema = z.object({
+  connections: z.number().int().nonnegative(),
+  provisionedUsers: z.number().int().nonnegative(),
+  lastSyncAt: z.string().nullable(),
+});
+
+const SCIMGroupMappingSchema = z.object({
+  id: z.string(),
+  orgId: z.string(),
+  scimGroupName: z.string(),
+  roleName: z.string(),
+  createdAt: z.string(),
+});
+
+const ConnectionIdParamSchema = createIdParamSchema("conn_abc123");
+
+const MappingIdParamSchema = createIdParamSchema("map_abc123");
+
+const CreateGroupMappingBodySchema = z.object({
+  scimGroupName: z.string().min(1).max(255).regex(
+    /^[a-zA-Z0-9]/,
+    "Must start with an alphanumeric character",
+  ),
+  roleName: z.string().min(1).max(63),
+});
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+const getStatusRoute = createRoute({
+  method: "get",
+  path: "/",
+  tags: ["Admin — SCIM"],
+  summary: "Get SCIM status and connections",
+  description:
+    "Returns SCIM provider connections and sync status for the admin's active organization.",
+  responses: {
+    200: {
+      description: "SCIM connections and sync status",
+      content: {
+        "application/json": {
+          schema: z.object({
+            connections: z.array(SCIMConnectionSchema),
+            syncStatus: SCIMSyncStatusSchema,
+          }),
+        },
+      },
+    },
+    400: { description: "No active organization", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden — admin role or enterprise license required", content: { "application/json": { schema: AuthErrorSchema } } },
+    404: { description: "Internal database not configured", content: { "application/json": { schema: ErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+const deleteConnectionRoute = createRoute({
+  method: "delete",
+  path: "/connections/{id}",
+  tags: ["Admin — SCIM"],
+  summary: "Delete SCIM connection",
+  description:
+    "Revokes a SCIM provider connection, invalidating its bearer token.",
+  request: { params: ConnectionIdParamSchema },
+  responses: {
+    200: { description: "SCIM connection deleted", content: { "application/json": { schema: z.object({ message: z.string() }) } } },
+    400: { description: "Invalid connection ID or no active organization", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden — admin role or enterprise license required", content: { "application/json": { schema: AuthErrorSchema } } },
+    404: { description: "Connection not found or internal database not configured", content: { "application/json": { schema: ErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+const listGroupMappingsRoute = createRoute({
+  method: "get",
+  path: "/group-mappings",
+  tags: ["Admin — SCIM"],
+  summary: "List SCIM group mappings",
+  description:
+    "Returns all SCIM group → custom role mappings for the admin's active organization.",
+  responses: {
+    200: {
+      description: "List of group mappings",
+      content: {
+        "application/json": {
+          schema: z.object({
+            mappings: z.array(SCIMGroupMappingSchema),
+            total: z.number(),
+          }),
+        },
+      },
+    },
+    400: { description: "No active organization", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden — admin role or enterprise license required", content: { "application/json": { schema: AuthErrorSchema } } },
+    404: { description: "Internal database not configured", content: { "application/json": { schema: ErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+const createGroupMappingRoute = createRoute({
+  method: "post",
+  path: "/group-mappings",
+  tags: ["Admin — SCIM"],
+  summary: "Create SCIM group mapping",
+  description:
+    "Maps a SCIM group display name to an Atlas custom role. When users are provisioned via SCIM " +
+    "and belong to the mapped group, they are assigned the corresponding role.",
+  request: { body: { required: true, content: { "application/json": { schema: CreateGroupMappingBodySchema } } } },
+  responses: {
+    201: { description: "Group mapping created", content: { "application/json": { schema: z.object({ mapping: SCIMGroupMappingSchema }) } } },
+    400: { description: "Invalid request body or no active organization", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden — admin role or enterprise license required", content: { "application/json": { schema: AuthErrorSchema } } },
+    404: { description: "Role not found or internal database not configured", content: { "application/json": { schema: ErrorSchema } } },
+    409: { description: "Duplicate mapping for this SCIM group", content: { "application/json": { schema: ErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+const deleteGroupMappingRoute = createRoute({
+  method: "delete",
+  path: "/group-mappings/{id}",
+  tags: ["Admin — SCIM"],
+  summary: "Delete SCIM group mapping",
+  description:
+    "Removes a SCIM group → role mapping. Users already assigned via this mapping keep their role.",
+  request: { params: MappingIdParamSchema },
+  responses: {
+    200: { description: "Group mapping deleted", content: { "application/json": { schema: z.object({ message: z.string() }) } } },
+    400: { description: "Invalid mapping ID or no active organization", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden — admin role or enterprise license required", content: { "application/json": { schema: AuthErrorSchema } } },
+    404: { description: "Mapping not found or internal database not configured", content: { "application/json": { schema: ErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+// ---------------------------------------------------------------------------
+// Router
+// ---------------------------------------------------------------------------
+
+const adminScim = createAdminRouter();
+
+adminScim.use(requireOrgContext());
+
+// GET / — SCIM connections and sync status
+adminScim.openapi(getStatusRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+
+    const [scimConnections, syncStatus] = yield* Effect.promise(() => Promise.all([
+      listConnections(orgId!),
+      getSyncStatus(orgId!),
+    ]));
+    return c.json({ connections: scimConnections, syncStatus }, 200);
+  }), { label: "get SCIM status", domainErrors: [[SCIMError, SCIM_ERROR_STATUS]] });
+});
+
+// DELETE /connections/:id — revoke a SCIM connection
+adminScim.openapi(deleteConnectionRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+    const { id: connectionId } = c.req.valid("param");
+
+    if (!isValidId(connectionId)) {
+      return c.json({ error: "bad_request", message: "Invalid connection ID." }, 400);
+    }
+
+    const deleted = yield* Effect.promise(() => deleteConnection(orgId!, connectionId));
+    if (!deleted) {
+      return c.json({ error: "not_found", message: "SCIM connection not found." }, 404);
+    }
+    return c.json({ message: "SCIM connection deleted." }, 200);
+  }), { label: "delete SCIM connection", domainErrors: [[SCIMError, SCIM_ERROR_STATUS]] });
+});
+
+// GET /group-mappings — list group→role mappings
+adminScim.openapi(listGroupMappingsRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+
+    const mappings = yield* Effect.promise(() => listGroupMappings(orgId!));
+    return c.json({ mappings, total: mappings.length }, 200);
+  }), { label: "list SCIM group mappings", domainErrors: [[SCIMError, SCIM_ERROR_STATUS]] });
+});
+
+// POST /group-mappings — create a group→role mapping
+adminScim.openapi(createGroupMappingRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+
+    const { scimGroupName, roleName } = c.req.valid("json");
+    if (!scimGroupName || !roleName) {
+      return c.json({ error: "bad_request", message: "Missing required fields: scimGroupName, roleName." }, 400);
+    }
+
+    const mapping = yield* Effect.promise(() => createGroupMapping(orgId!, scimGroupName, roleName));
+    return c.json({ mapping }, 201);
+  }), { label: "create SCIM group mapping", domainErrors: [[SCIMError, SCIM_ERROR_STATUS]] });
+});
+
+// DELETE /group-mappings/:id — delete a group mapping
+adminScim.openapi(deleteGroupMappingRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+    const { id: mappingId } = c.req.valid("param");
+
+    if (!isValidId(mappingId)) {
+      return c.json({ error: "bad_request", message: "Invalid mapping ID." }, 400);
+    }
+
+    const deleted = yield* Effect.promise(() => deleteGroupMapping(orgId!, mappingId));
+    if (!deleted) {
+      return c.json({ error: "not_found", message: "SCIM group mapping not found." }, 404);
+    }
+    return c.json({ message: "SCIM group mapping deleted." }, 200);
+  }), { label: "delete SCIM group mapping", domainErrors: [[SCIMError, SCIM_ERROR_STATUS]] });
+});
+
+export { adminScim };