@voltro/plugin-scim 0.83.1 → 0.85.0

package/THIRD-PARTY-NOTICES.md

@@ -5,66 +5,10 @@ property of its respective copyright holders and is used under the terms of
 its license. This file is provided for attribution; it grants no rights in
 @voltro/plugin-scim itself, which is proprietary (see LICENSE).
 
-Generated from the resolved runtime dependency closure (7 packages).
+Generated from the resolved runtime dependency closure (5 packages).
 
 ---
 
-## @effect/experimental@0.61.1
-
-License: MIT
-
-```
-MIT License
-
-Copyright (c) 2023-present The Contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
-## @effect/sql@0.52.1
-
-License: MIT
-
-```
-MIT License
-
-Copyright (c) 2023-present The Contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
 ## jose@6.2.12
 
 License: MIT

package/dist/index.d.ts

@@ -90,6 +90,16 @@ export declare const scimList: (resources: ReadonlyArray<Record<string, unknown>
     readonly startIndex?: number;
 }) => Record<string, unknown>;
 
+export declare interface ScimPage<T> {
+    readonly rows: ReadonlyArray<T>;
+    readonly totalResults: number;
+}
+
+export declare interface ScimPageOptions {
+    readonly startIndex: number;
+    readonly count: number;
+}
+
 export declare const scimPlugin: (options: ScimPluginOptions) => VoltroPlugin;
 
 export declare interface ScimPluginOptions {
@@ -119,12 +129,15 @@ export declare const scimSchemas: (location: string) => ReadonlyArray<Record<str
 export declare interface ScimStore {
     /** `filter` is an `<attr> eq "<value>"` equality (userName / externalId), or `null` = all. */
     readonly listUsers: (filter: ScimFilter | null) => Promise<ReadonlyArray<ScimUserRow>>;
+    /** Stable id-ordered page and total matching rows. Do not load all row bodies. */
+    readonly pageUsers: (filter: ScimFilter | null, page: ScimPageOptions) => Promise<ScimPage<ScimUserRow>>;
     readonly getUser: (id: string) => Promise<ScimUserRow | null>;
     readonly createUser: (fields: Omit<ScimUserRow, 'id' | 'createdAt' | 'updatedAt'>) => Promise<ScimUserRow>;
     readonly putUser: (id: string, row: ScimUserRow) => Promise<ScimUserRow | null>;
     readonly deleteUser: (id: string) => Promise<boolean>;
     /** `filter` is displayName / externalId equality, or `null` = all. */
     readonly listGroups: (filter: ScimFilter | null) => Promise<ReadonlyArray<ScimGroupRow>>;
+    readonly pageGroups: (filter: ScimFilter | null, page: ScimPageOptions) => Promise<ScimPage<ScimGroupRow>>;
     readonly getGroup: (id: string) => Promise<ScimGroupRow | null>;
     readonly createGroup: (fields: Omit<ScimGroupRow, 'id' | 'createdAt' | 'updatedAt'>) => Promise<ScimGroupRow>;
     readonly putGroup: (id: string, row: ScimGroupRow) => Promise<ScimGroupRow | null>;

package/dist/index.js

@@ -95,18 +95,18 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 }, D = (e) => {
 	let t = Number(e.get("startIndex")), n = Number(e.get("count"));
 	return {
-		startIndex: Number.isInteger(t) && t >= 1 ? t : 1,
-		count: e.get("count") !== null && Number.isInteger(n) && n >= 0 ? n : null
+		startIndex: Number.isSafeInteger(t) && t >= 1 ? t : 1,
+		count: e.get("count") !== null && Number.isSafeInteger(n) && n >= 0 ? n : null
 	};
 }, O = (e, t) => {
 	let n = t.Operations ?? t.operations ?? [], r = (e) => (Array.isArray(e) ? e : e === void 0 ? [] : [e]).map((e) => String(e?.value ?? e)).filter((e) => e !== "" && e !== "undefined"), i = e;
 	for (let e of n) {
 		let t = (e.op ?? "").toLowerCase(), n = e.path ?? "", a = /^members\[value\s+eq\s+"([^"]*)"\]$/i.exec(n);
 		if (t === "add" && n.toLowerCase() === "members") {
-			let t = r(e.value).filter((e) => !i.members.includes(e));
+			let t = r(e.value), n = t.length > 4 ? new Set(i.members) : void 0, a = t.filter((e) => !(n === void 0 ? i.members.includes(e) : n.has(e)));
 			i = {
 				...i,
-				members: [...i.members, ...t]
+				members: [...i.members, ...a]
 			};
 		} else if (t === "remove" && a) i = {
 			...i,
@@ -254,19 +254,36 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 	members: l().nullable(),
 	createdAt: p().default("now"),
 	updatedAt: p().default("now").onUpdate("now")
-}).renamedFrom("scim_groups"), F = (e, t) => t === null || e[t.attribute] === t.value, I = (e = Date.now) => {
-	let t = /* @__PURE__ */ new Map(), n = /* @__PURE__ */ new Map(), r = 0, i = (e) => `${e}_${++r}`;
+}).renamedFrom("scim_groups"), F = (e) => {
+	if (!Number.isSafeInteger(e.startIndex) || e.startIndex < 1 || !Number.isSafeInteger(e.count) || e.count < 0) throw RangeError("SCIM pages require a positive startIndex and a non-negative count, both safe integers");
+}, I = (e, t) => t === null || e[t.attribute] === t.value, L = (e = Date.now) => {
+	let t = /* @__PURE__ */ new Map(), n = /* @__PURE__ */ new Map(), r = 0, i = 0, a = (e) => `${e}_${++r}`, o = (e) => {
+		let t = -1, n = [];
+		return (r, a) => {
+			F(a), t !== i && (n = [...e.keys()].sort(), t = i);
+			let o = [], s = 0;
+			for (let t of n) {
+				let n = e.get(t);
+				I(n, r) && (s >= a.startIndex - 1 && o.length < a.count && o.push(n), s++);
+			}
+			return {
+				rows: o,
+				totalResults: s
+			};
+		};
+	}, s = o(t), c = o(n);
 	return {
-		listUsers: async (e) => [...t.values()].filter((t) => F(t, e)),
+		listUsers: async (e) => [...t.values()].filter((t) => I(t, e)),
+		pageUsers: async (e, t) => s(e, t),
 		getUser: async (e) => t.get(e) ?? null,
 		createUser: async (n) => {
 			let r = {
 				...n,
-				id: i("user"),
+				id: a("user"),
 				createdAt: e(),
 				updatedAt: e()
 			};
-			return t.set(r.id, r), r;
+			return t.set(r.id, r), i++, r;
 		},
 		putUser: async (n, r) => {
 			if (!t.has(n)) return null;
@@ -277,17 +294,21 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 			};
 			return t.set(n, i), i;
 		},
-		deleteUser: async (e) => t.delete(e),
-		listGroups: async (e) => [...n.values()].filter((t) => F(t, e)),
+		deleteUser: async (e) => {
+			let n = t.delete(e);
+			return n && i++, n;
+		},
+		listGroups: async (e) => [...n.values()].filter((t) => I(t, e)),
+		pageGroups: async (e, t) => c(e, t),
 		getGroup: async (e) => n.get(e) ?? null,
 		createGroup: async (t) => {
 			let r = {
 				...t,
-				id: i("group"),
+				id: a("group"),
 				createdAt: e(),
 				updatedAt: e()
 			};
-			return n.set(r.id, r), r;
+			return n.set(r.id, r), i++, r;
 		},
 		putGroup: async (t, r) => {
 			if (!n.has(t)) return null;
@@ -298,9 +319,12 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 			};
 			return n.set(t, i), i;
 		},
-		deleteGroup: async (e) => n.delete(e)
+		deleteGroup: async (e) => {
+			let t = n.delete(e);
+			return t && i++, t;
+		}
 	};
-}, L = (e) => {
+}, R = (e) => {
 	let t = async (t, n) => {
 		let r = u(t);
 		return e.query((n ? r.where(n) : r).descriptor);
@@ -321,9 +345,17 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 		members: e.members ?? [],
 		createdAt: r(e.createdAt),
 		updatedAt: r(e.updatedAt)
-	});
+	}), a = async (t, n, r, i) => {
+		F(r);
+		let a = u(t), s = n === null ? a : a.where(o(n.attribute, n.value)), [c, l] = await Promise.all([e.query(s.count().descriptor), r.count === 0 ? Promise.resolve([]) : e.query(s.orderBy("id", "asc").offset(r.startIndex - 1).limit(r.count).descriptor)]);
+		return {
+			rows: l.map(i),
+			totalResults: Number(c[0]?.count ?? 0)
+		};
+	};
 	return {
 		listUsers: async (e) => (await t(N, e ? o(e.attribute, e.value) : void 0)).map(n),
+		pageUsers: (e, t) => a(N, e, t, n),
 		getUser: async (e) => {
 			let r = await t(N, o("id", e));
 			return r[0] ? n(r[0]) : null;
@@ -360,6 +392,7 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 		}) : null,
 		deleteUser: async (n) => (await t(N, o("id", n)))[0] ? (await e.delete("_voltro_scim_users", n), !0) : !1,
 		listGroups: async (e) => (await t(P, e ? o(e.attribute, e.value) : void 0)).map(i),
+		pageGroups: (e, t) => a(P, e, t, i),
 		getGroup: async (e) => {
 			let n = await t(P, o("id", e));
 			return n[0] ? i(n[0]) : null;
@@ -393,54 +426,50 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 		}) : null,
 		deleteGroup: async (n) => (await t(P, o("id", n)))[0] ? (await e.delete("_voltro_scim_groups", n), !0) : !1
 	};
-}, R = (e, t) => ({
+}, z = (e, t) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/scim+json"
-}), z = (e) => {
+}), B = (e) => {
 	try {
 		return JSON.parse(new TextDecoder().decode(e.rawBody) || "{}");
 	} catch {
 		return {};
 	}
-}, B = (e, t) => {
-	let { startIndex: n, count: r } = D(t), i = n - 1;
-	return {
-		page: e.slice(i, r === null ? void 0 : i + r),
-		total: e.length,
-		startIndex: n
-	};
-}, V = () => R(400, T(400, "unsupported filter — only `<attribute> eq \"value\"` on the indexed attributes", "invalidFilter")), H = async (e, t, n) => (await e.listUsers({
+}, V = () => z(400, T(400, "unsupported filter — only `<attribute> eq \"value\"` on the indexed attributes", "invalidFilter")), H = async (e, t, n) => (await e.listUsers({
 	attribute: "userName",
 	value: t
-})).some((e) => e.id !== n), U = (e) => R(409, T(409, `a user with userName '${e}' already exists`, "uniqueness")), W = async (e, t, n, r) => {
-	if (!i(r.headers, t)) return R(401, T(401, "invalid or missing bearer token"));
+})).some((e) => e.id !== n), U = (e) => z(409, T(409, `a user with userName '${e}' already exists`, "uniqueness")), W = async (e, t, n, r) => {
+	if (!i(r.headers, t)) return z(401, T(401, "invalid or missing bearer token"));
 	let [, a, o] = r.path.slice(n.length).replace(/\/+$/, "").split("/"), s = r.method.toUpperCase(), c = new URLSearchParams(r.query), l = `${n}/Users`;
 	if (s === "GET" && !o) {
-		if (a === "ServiceProviderConfig") return R(200, k(`${n}/ServiceProviderConfig`));
-		if (a === "Schemas") return R(200, w(j(`${n}/Schemas`)));
-		if (a === "ResourceTypes") return R(200, w(M(n)));
+		if (a === "ServiceProviderConfig") return z(200, k(`${n}/ServiceProviderConfig`));
+		if (a === "Schemas") return z(200, w(j(`${n}/Schemas`)));
+		if (a === "ResourceTypes") return z(200, w(M(n)));
 	}
 	if (a === "Users") {
 		if (s === "GET" && !o) {
 			let t = E(c.get("filter"), ["userName", "externalId"]);
 			if (t.kind === "invalid") return V();
-			let { page: n, total: r, startIndex: i } = B(await e.listUsers(t.kind === "filter" ? t : null), c);
-			return R(200, w(n.map((e) => x(e, l)), {
-				totalResults: r,
-				startIndex: i
+			let { startIndex: n, count: r } = D(c), i = await e.pageUsers(t.kind === "filter" ? t : null, {
+				startIndex: n,
+				count: Math.min(r ?? 100, 1e3)
+			});
+			return z(200, w(i.rows.map((e) => x(e, l)), {
+				totalResults: i.totalResults,
+				startIndex: n
 			}));
 		}
 		if (s === "GET" && o) {
 			let t = await e.getUser(o);
-			return t ? R(200, x(t, l)) : R(404, T(404, "user not found"));
+			return t ? z(200, x(t, l)) : z(404, T(404, "user not found"));
 		}
 		if (s === "POST" && !o) {
-			let t = S(z(r));
-			if (t.userName === "") return R(400, T(400, "userName is required", "invalidValue"));
+			let t = S(B(r));
+			if (t.userName === "") return z(400, T(400, "userName is required", "invalidValue"));
 			if (await H(e, t.userName)) return U(t.userName);
 			try {
-				return R(201, x(await e.createUser(t), l));
+				return z(201, x(await e.createUser(t), l));
 			} catch (n) {
 				if (await H(e, t.userName)) return U(t.userName);
 				throw n;
@@ -448,24 +477,24 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 		}
 		if (s === "PUT" && o) {
 			let t = await e.getUser(o);
-			if (!t) return R(404, T(404, "user not found"));
+			if (!t) return z(404, T(404, "user not found"));
 			let n = {
 				...t,
-				...S(z(r))
+				...S(B(r))
 			};
 			if (await H(e, n.userName, o)) return U(n.userName);
 			let i = await e.putUser(o, n);
-			return i ? R(200, x(i, l)) : R(404, T(404, "user not found"));
+			return i ? z(200, x(i, l)) : z(404, T(404, "user not found"));
 		}
 		if (s === "PATCH" && o) {
 			let t = await e.getUser(o);
-			if (!t) return R(404, T(404, "user not found"));
-			let n = C(t, z(r));
+			if (!t) return z(404, T(404, "user not found"));
+			let n = C(t, B(r));
 			if (n.userName !== t.userName && await H(e, n.userName, o)) return U(n.userName);
 			let i = await e.putUser(o, n);
-			return i ? R(200, x(i, l)) : R(404, T(404, "user not found"));
+			return i ? z(200, x(i, l)) : z(404, T(404, "user not found"));
 		}
-		if (s === "DELETE" && o) return await e.deleteUser(o) ? { status: 204 } : R(404, T(404, "user not found"));
+		if (s === "DELETE" && o) return await e.deleteUser(o) ? { status: 204 } : z(404, T(404, "user not found"));
 	}
 	if (a === "Groups") {
 		let t = `${n}/Groups`, i = (e) => ({
@@ -482,19 +511,22 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 		if (s === "GET" && !o) {
 			let t = E(c.get("filter"), ["displayName", "externalId"]);
 			if (t.kind === "invalid") return V();
-			let { page: n, total: r, startIndex: a } = B(await e.listGroups(t.kind === "filter" ? t : null), c);
-			return R(200, w(n.map(i), {
-				totalResults: r,
-				startIndex: a
+			let { startIndex: n, count: r } = D(c), a = await e.pageGroups(t.kind === "filter" ? t : null, {
+				startIndex: n,
+				count: Math.min(r ?? 100, 1e3)
+			});
+			return z(200, w(a.rows.map(i), {
+				totalResults: a.totalResults,
+				startIndex: n
 			}));
 		}
 		if (s === "GET" && o) {
 			let t = await e.getGroup(o);
-			return t ? R(200, i(t)) : R(404, T(404, "group not found"));
+			return t ? z(200, i(t)) : z(404, T(404, "group not found"));
 		}
 		if (s === "POST" && !o) {
-			let t = z(r), n = (t.members ?? []).map((e) => String(e.value)).filter(Boolean);
-			return R(201, i(await e.createGroup({
+			let t = B(r), n = (t.members ?? []).map((e) => String(e.value)).filter(Boolean);
+			return z(201, i(await e.createGroup({
 				displayName: String(t.displayName ?? ""),
 				externalId: t.externalId ?? null,
 				members: n
@@ -502,24 +534,24 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 		}
 		if (s === "PUT" && o) {
 			let t = await e.getGroup(o);
-			if (!t) return R(404, T(404, "group not found"));
-			let n = z(r), a = (n.members ?? []).map((e) => String(e.value)).filter(Boolean), s = await e.putGroup(o, {
+			if (!t) return z(404, T(404, "group not found"));
+			let n = B(r), a = (n.members ?? []).map((e) => String(e.value)).filter(Boolean), s = await e.putGroup(o, {
 				...t,
 				displayName: String(n.displayName ?? t.displayName),
 				externalId: n.externalId ?? t.externalId,
 				members: a
 			});
-			return s ? R(200, i(s)) : R(404, T(404, "group not found"));
+			return s ? z(200, i(s)) : z(404, T(404, "group not found"));
 		}
 		if (s === "PATCH" && o) {
 			let t = await e.getGroup(o);
-			if (!t) return R(404, T(404, "group not found"));
-			let n = await e.putGroup(o, O(t, z(r)));
-			return n ? R(200, i(n)) : R(404, T(404, "group not found"));
+			if (!t) return z(404, T(404, "group not found"));
+			let n = await e.putGroup(o, O(t, B(r)));
+			return n ? z(200, i(n)) : z(404, T(404, "group not found"));
 		}
-		if (s === "DELETE" && o) return await e.deleteGroup(o) ? { status: 204 } : R(404, T(404, "group not found"));
+		if (s === "DELETE" && o) return await e.deleteGroup(o) ? { status: 204 } : z(404, T(404, "group not found"));
 	}
-	return R(404, T(404, "unsupported SCIM endpoint"));
+	return z(404, T(404, "unsupported SCIM endpoint"));
 }, G = "@voltro/plugin-scim", K = (r) => {
 	if (r.token.trim() === "") throw Error("scimPlugin({ token }) requires a non-empty bearer token — got an empty string. SCIM exposes the full user + group directory and can deactivate accounts, so it is never mounted ungated. Set the environment variable your IdP presents (e.g. SCIM_TOKEN) and pass it through, or remove scimPlugin() from the plugin list.");
 	let i = r.basePath ?? "/scim/v2", a = n({
@@ -537,10 +569,10 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 			method: "*",
 			path: i,
 			originGuard: "exempt",
-			handle: async (e) => o ? W(o, r.token, i, e) : R(503, T(503, "scim store not bound"))
+			handle: async (e) => o ? W(o, r.token, i, e) : z(503, T(503, "scim store not bound"))
 		}],
 		bindDataStore: (e) => {
-			o = L(e);
+			o = R(e);
 		},
 		onActivate: (t) => e.sync(() => {
 			t.logger.info("scim active", { basePath: i });
@@ -548,4 +580,4 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 	});
 };
 //#endregion
-export { _ as SCIM_ERROR_SCHEMA, h as SCIM_GROUP_SCHEMA, g as SCIM_LIST_SCHEMA, m as SCIM_USER_SCHEMA, O as applyScimGroupPatch, C as applyScimPatch, L as dataStoreScimStore, S as fromScimUser, W as handleScim, W as handleScimRequest, I as memoryScimStore, D as parsePagination, E as parseScimFilter, M as resourceTypes, T as scimError, w as scimList, K as scimPlugin, j as scimSchemas, k as serviceProviderConfig, x as toScimUser };
+export { _ as SCIM_ERROR_SCHEMA, h as SCIM_GROUP_SCHEMA, g as SCIM_LIST_SCHEMA, m as SCIM_USER_SCHEMA, O as applyScimGroupPatch, C as applyScimPatch, R as dataStoreScimStore, S as fromScimUser, W as handleScim, W as handleScimRequest, L as memoryScimStore, D as parsePagination, E as parseScimFilter, M as resourceTypes, T as scimError, w as scimList, K as scimPlugin, j as scimSchemas, k as serviceProviderConfig, x as toScimUser };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-scim",
-  "version": "0.83.1",
+  "version": "0.85.0",
   "description": "SCIM 2.0 provisioning — Users + Groups REST endpoints (/scim/v2) so an enterprise IdP (Okta, Entra, OneLogin) can create/update/deactivate users in your app. Bearer-token gated; the SCIM envelope + filtering handled for you.",
   "keywords": [
     "voltro",
@@ -33,11 +33,11 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.83.1",
-    "@voltro/protocol": "0.83.1"
+    "@voltro/database": "0.85.0",
+    "@voltro/protocol": "0.85.0"
   },
   "peerDependencies": {
-    "effect": "^3.22.2"
+    "effect": "4.0.1"
   },
   "publishConfig": {
     "access": "public"