@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/security/scim/controllers/scim.backend.controller.js

@@ -0,0 +1,863 @@
+/**
+ * SCIM 2.0 User Provisioning Controller — Step 20
+ *
+ * Receives user lifecycle events from identity providers (Okta, Azure AD, OneLogin)
+ * via SCIM 2.0 protocol (RFC 7643 Core Schema, RFC 7644 Protocol).
+ *
+ * Decision 13: Lean SCIM — Users only in v1, no Groups, no generic adapter.
+ * Critical Note #8: One controller, Users only, future extensions documented in code comments.
+ * Critical Note #9: Follows billing's ManualControllersOptions pattern for conditional mounting.
+ *
+ * Bearer token auth: extracts token from Authorization header, hashes it,
+ * looks up ScimTokenBase, validates isActive/expiresAt,
+ * creates ExecutionContext with executionType: ORG_API_KEY.
+ *
+ * Reuses EnterpriseUserProvisioningService from Step 15 for:
+ * - createOrgUser() — user + profile + org member + identity link creation
+ * - updateOrgUser() — profile attribute updates
+ * - deactivateOrgUser() — set user status to INACTIVE
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import 'reflect-metadata';
+import { injectable, inject } from 'inversify';
+import { createHash } from 'crypto';
+import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
+import { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
+import { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service.js';
+import { ErrorHandlerService } from '../../../errors/services/error-handler.backend.service.js';
+import { AuthExecutionContextFactoryBackendService } from '../../../security/authentications/services/auth-execution-context-factory.backend.service.js';
+import { EnterpriseUserProvisioningBackendService } from '../../../security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.js';
+import { AuditLogsBackendService } from '../../../compliance/audit-trails/services/audit-logs.backend.service.js';
+import { AbstractControllerBackendService } from '../../../base-classes/services/controllers/abstract-controller.backend.service.js';
+import { CoreResourceType, UserStatus, ErrorType, isWildoBackendError, AuthScopeType, WildoHeaderKeys, } from '@wildo-ai/saas-models';
+import { SCIM_USER_ATTRIBUTE_MAP, SCIM_SCHEMAS, SCIM_CONTENT_TYPE, SCIM_SERVICE_PROVIDER_CONFIG, SCIM_USER_SCHEMA_DEFINITION, SCIM_RESOURCE_TYPES, } from '../../../security/scim/models/scim-protocol.backend.schemas.js';
+import { parseSCIMFilter } from '../../../security/scim/utils/scim-filter-parser.js';
+import { formatUserAsSCIM, formatListAsSCIM, formatSCIMError } from '../../../security/scim/utils/scim-response-formatter.js';
+import { AuthOrganizationConfigurationService } from '../../../security/authentications/services/admin-config/auth-organization-configuration.service.js';
+import { RateLimitBackendService } from '../../../errors/services/rate-limit.backend.service.js';
+import { isScimProvisioningEnabledForOrg } from '../../../organizations/services/scim-provisioning-gate.backend.utils.js';
+let SCIMControllerBackendService = class SCIMControllerBackendService extends AbstractControllerBackendService {
+    servicesRegistryHandler;
+    authEcFactory;
+    provisioningService;
+    auditLogsService;
+    orgConfigService;
+    rateLimitService;
+    appConfigService;
+    SCIM_RATE_LIMIT_MAX_REQUESTS = 300; // per token per minute
+    SCIM_RATE_LIMIT_WINDOW_SECONDS = 60;
+    constructor(logger, errorBuilder, errorHandler, servicesRegistryHandler, authEcFactory, provisioningService, auditLogsService, orgConfigService, rateLimitService, appConfigService) {
+        super(logger, errorBuilder, errorHandler, 'SCIMController');
+        this.servicesRegistryHandler = servicesRegistryHandler;
+        this.authEcFactory = authEcFactory;
+        this.provisioningService = provisioningService;
+        this.auditLogsService = auditLogsService;
+        this.orgConfigService = orgConfigService;
+        this.rateLimitService = rateLimitService;
+        this.appConfigService = appConfigService;
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Route Setup
+    // ═══════════════════════════════════════════════════════════════
+    setupRoutes() {
+        // SCIM Discovery endpoints (no auth required for ServiceProviderConfig per RFC 7644 §4)
+        this.router.get('/scim/v2/ServiceProviderConfig', this.asyncHandler(this._handleServiceProviderConfig.bind(this)));
+        this.logRouteRegistration('GET', '/scim/v2/ServiceProviderConfig', 'SCIM ServiceProviderConfig');
+        this.router.get('/scim/v2/Schemas', this.asyncHandler(this._handleSchemas.bind(this)));
+        this.logRouteRegistration('GET', '/scim/v2/Schemas', 'SCIM Schemas');
+        this.router.get('/scim/v2/ResourceTypes', this.asyncHandler(this._handleResourceTypes.bind(this)));
+        this.logRouteRegistration('GET', '/scim/v2/ResourceTypes', 'SCIM ResourceTypes');
+        // All /Users endpoints require bearer token auth
+        const authMiddleware = this._scimBearerAuthMiddleware.bind(this);
+        this.router.post('/scim/v2/Users', authMiddleware, this.asyncHandler(this._handleCreateUser.bind(this)));
+        this.logRouteRegistration('POST', '/scim/v2/Users', 'SCIM Create User');
+        this.router.get('/scim/v2/Users', authMiddleware, this.asyncHandler(this._handleListUsers.bind(this)));
+        this.logRouteRegistration('GET', '/scim/v2/Users', 'SCIM List Users');
+        this.router.get('/scim/v2/Users/:id', authMiddleware, this.asyncHandler(this._handleGetUser.bind(this)));
+        this.logRouteRegistration('GET', '/scim/v2/Users/:id', 'SCIM Get User');
+        this.router.put('/scim/v2/Users/:id', authMiddleware, this.asyncHandler(this._handleReplaceUser.bind(this)));
+        this.logRouteRegistration('PUT', '/scim/v2/Users/:id', 'SCIM Replace User');
+        this.router.patch('/scim/v2/Users/:id', authMiddleware, this.asyncHandler(this._handlePatchUser.bind(this)));
+        this.logRouteRegistration('PATCH', '/scim/v2/Users/:id', 'SCIM Patch User');
+        this.router.delete('/scim/v2/Users/:id', authMiddleware, this.asyncHandler(this._handleDeleteUser.bind(this)));
+        this.logRouteRegistration('DELETE', '/scim/v2/Users/:id', 'SCIM Delete User');
+        // Bulk operations (Step 21)
+        this.router.post('/scim/v2/Bulk', authMiddleware, this.asyncHandler(this._handleBulk.bind(this)));
+        this.logRouteRegistration('POST', '/scim/v2/Bulk', 'SCIM Bulk Operations');
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Bearer Token Auth Middleware
+    // ═══════════════════════════════════════════════════════════════
+    async _scimBearerAuthMiddleware(req, res, next) {
+        const authHeader = req.headers[WildoHeaderKeys.AUTHORIZATION];
+        if (!authHeader || !authHeader.startsWith('Bearer ')) {
+            res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(401, 'Bearer token required', 'invalidValue'));
+            return;
+        }
+        const plainToken = authHeader.substring(7);
+        if (!plainToken) {
+            res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(401, 'Bearer token is empty', 'invalidValue'));
+            return;
+        }
+        const tokenHash = this._hashToken(plainToken);
+        try {
+            const ec = await this._getInternalExecutionContext();
+            const token = await this.servicesRegistryHandler.read(CoreResourceType.ORGANIZATION_SCIM_TOKENS, ec, { tokenHash });
+            if (!token) {
+                this._logSCIMOperation('auth_failed', { reason: 'token_not_found' });
+                res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(401, 'Invalid bearer token'));
+                return;
+            }
+            if (!token.isActive) {
+                this._logSCIMOperation('auth_failed', { reason: 'token_inactive', tokenId: token._id });
+                res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(401, 'Token has been revoked'));
+                return;
+            }
+            if (token.expiresAt && new Date(token.expiresAt) < new Date()) {
+                this._logSCIMOperation('auth_failed', { reason: 'token_expired', tokenId: token._id });
+                res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(401, 'Token has expired'));
+                return;
+            }
+            // Per-token rate limiting (Step 21 — CORE-9: Redis-backed, distributed)
+            try {
+                await this.rateLimitService.checkRateLimit(`scim:token:${token._id}`, this.SCIM_RATE_LIMIT_MAX_REQUESTS, this.SCIM_RATE_LIMIT_WINDOW_SECONDS);
+            }
+            catch (e) {
+                if (isWildoBackendError(e) && e.type === ErrorType.RATE_LIMIT) {
+                    this._logSCIMOperation('rate_limited', { tokenId: token._id, organizationId: token.organizationId });
+                    res.status(429).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(429, 'Rate limit exceeded. Try again later.', 'tooMany'));
+                    return;
+                }
+                throw e;
+            }
+            // Attach org + scope context and EC to request for downstream handlers
+            const tokenRecord = token;
+            req.scimContext = {
+                organizationId: token.organizationId,
+                scopeType: tokenRecord.scopeType ?? AuthScopeType.ORGANIZATION,
+                scopeId: tokenRecord.scopeId ?? token.organizationId,
+                tokenId: token._id,
+                tokenDisplayName: token.displayName,
+            };
+            req.scimEc = ec;
+            // W5.10: Check if SCIM provisioning is enabled for this org's type
+            const scimEnabled = await this._isScimProvisioningEnabledForOrg(ec, token.organizationId);
+            if (!scimEnabled) {
+                this._logSCIMOperation('scim_disabled_for_org_type', { organizationId: token.organizationId });
+                res.status(403).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(403, 'SCIM provisioning is not enabled for this organization type', 'invalidValue'));
+                return;
+            }
+            // Update lastUsedAt asynchronously (fire-and-forget)
+            this.servicesRegistryHandler.update(CoreResourceType.ORGANIZATION_SCIM_TOKENS, ec, token._id, { lastUsedAt: new Date() }).catch(() => {
+                // Non-fatal — don't fail the request if lastUsedAt update fails
+            });
+            const scimCtx = req.scimContext;
+            this._logSCIMOperation('auth_success', {
+                tokenId: token._id,
+                organizationId: token.organizationId,
+                scopeType: scimCtx.scopeType,
+                scopeId: scimCtx.scopeId,
+                method: req.method,
+                path: req.path,
+            });
+            next();
+        }
+        catch (error) {
+            if (isWildoBackendError(error)) {
+                res.status(500).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(500, 'Internal authentication error'));
+                return;
+            }
+            res.status(500).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(500, 'Internal server error'));
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Discovery Endpoints
+    // ═══════════════════════════════════════════════════════════════
+    async _handleServiceProviderConfig(_req, res) {
+        res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(SCIM_SERVICE_PROVIDER_CONFIG);
+    }
+    async _handleSchemas(_req, res) {
+        res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json({
+            schemas: [SCIM_SCHEMAS.LIST_RESPONSE],
+            totalResults: 1,
+            startIndex: 1,
+            itemsPerPage: 1,
+            Resources: [SCIM_USER_SCHEMA_DEFINITION],
+        });
+    }
+    async _handleResourceTypes(_req, res) {
+        res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json({
+            schemas: [SCIM_SCHEMAS.LIST_RESPONSE],
+            totalResults: SCIM_RESOURCE_TYPES.length,
+            startIndex: 1,
+            itemsPerPage: SCIM_RESOURCE_TYPES.length,
+            Resources: SCIM_RESOURCE_TYPES,
+        });
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // POST /scim/v2/Users — Create User
+    // ═══════════════════════════════════════════════════════════════
+    async _handleCreateUser(req, res) {
+        const ctx = this._getSCIMContext(req);
+        const body = req.body;
+        this._logSCIMOperation('create_user', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, tokenId: ctx.tokenId });
+        const profile = this._mapSCIMBodyToProfile(body);
+        if (!profile.email) {
+            res.status(400).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(400, 'userName (email) is required', 'invalidValue'));
+            return;
+        }
+        try {
+            const ec = req.scimEc;
+            const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);
+            const connection = this._buildSCIMConnection(ctx);
+            const result = await this.provisioningService.createOrgUser(profile, connection, orgConfig);
+            const userProfile = await this._getUserProfile(ec, result.user._id);
+            const baseUrl = this._getBaseUrl(req);
+            const scimUser = formatUserAsSCIM(result.user, userProfile, baseUrl, body.externalId);
+            this._logSCIMOperation('user_created', {
+                organizationId: ctx.organizationId,
+                scopeType: ctx.scopeType,
+                scopeId: ctx.scopeId,
+                userId: result.user._id,
+                isNew: result.isNew,
+                tokenId: ctx.tokenId,
+            });
+            // H8: Audit SCIM user provisioned
+            this.auditLogsService.logSCIMUserProvisioned({
+                organizationId: ctx.organizationId,
+                userId: result.user._id,
+                email: profile.email,
+                isNewUser: result.isNew,
+                provisionedVia: `scim:${ctx.tokenDisplayName}`,
+                authSource: 'scim',
+            }).catch(() => { });
+            res.status(201).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).set(WildoHeaderKeys.LOCATION, scimUser.meta.location).json(scimUser);
+        }
+        catch (error) {
+            this._handleSCIMError(res, error, 'create_user');
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // GET /scim/v2/Users/:id — Get User
+    // ═══════════════════════════════════════════════════════════════
+    async _handleGetUser(req, res) {
+        const ctx = this._getSCIMContext(req);
+        const userId = req.params.id;
+        try {
+            const ec = req.scimEc;
+            const user = await this._findUserInOrg(ec, userId, ctx.organizationId);
+            if (!user) {
+                res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(404, `User ${userId} not found`));
+                return;
+            }
+            const profile = await this._getUserProfile(ec, userId);
+            const identityLink = await this._getUserIdentityLink(ec, userId, ctx.organizationId);
+            const baseUrl = this._getBaseUrl(req);
+            const scimUser = formatUserAsSCIM(user, profile, baseUrl, identityLink?.providerUserId);
+            res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(scimUser);
+        }
+        catch (error) {
+            this._handleSCIMError(res, error, 'get_user');
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // GET /scim/v2/Users — List Users (with filter + pagination)
+    // ═══════════════════════════════════════════════════════════════
+    async _handleListUsers(req, res) {
+        const ctx = this._getSCIMContext(req);
+        const filter = req.query.filter;
+        const startIndex = Math.max(1, parseInt(req.query.startIndex) || 1);
+        const count = Math.min(200, Math.max(1, parseInt(req.query.count) || 100));
+        try {
+            const ec = req.scimEc;
+            const mongoFilter = parseSCIMFilter(filter);
+            // Scope to organization via org member lookup
+            const orgMembers = await this.servicesRegistryHandler.list(CoreResourceType.ORGANIZATION_MEMBERS, ec, { organizationId: ctx.organizationId }, undefined, { paginated: false });
+            const memberUserIds = orgMembers.map((m) => m.userId);
+            if (memberUserIds.length === 0) {
+                const baseUrl = this._getBaseUrl(req);
+                res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatListAsSCIM([], 0, startIndex, baseUrl));
+                return;
+            }
+            // Combine SCIM filter with org scope
+            const combinedFilter = {
+                ...mongoFilter,
+                _id: { $in: memberUserIds },
+            };
+            const page = Math.max(1, Math.floor((startIndex - 1) / count) + 1);
+            const usersResult = await this.servicesRegistryHandler.list(CoreResourceType.USERS, ec, combinedFilter, { page, limit: count }, { paginated: true });
+            const users = (usersResult.data || []);
+            const totalCount = usersResult.pagination?.total ?? users.length;
+            // Hydrate profiles
+            const usersWithProfiles = await Promise.all(users.map(async (user) => {
+                const profile = await this._getUserProfile(ec, user._id);
+                const identityLink = await this._getUserIdentityLink(ec, user._id, ctx.organizationId);
+                return { user, profile, externalId: identityLink?.providerUserId };
+            }));
+            const baseUrl = this._getBaseUrl(req);
+            const response = formatListAsSCIM(usersWithProfiles, totalCount, startIndex, baseUrl);
+            res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(response);
+        }
+        catch (error) {
+            this._handleSCIMError(res, error, 'list_users');
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // PUT /scim/v2/Users/:id — Replace User (full update)
+    // ═══════════════════════════════════════════════════════════════
+    async _handleReplaceUser(req, res) {
+        const ctx = this._getSCIMContext(req);
+        const userId = req.params.id;
+        const body = req.body;
+        this._logSCIMOperation('replace_user', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });
+        try {
+            const ec = req.scimEc;
+            const user = await this._findUserInOrg(ec, userId, ctx.organizationId);
+            if (!user) {
+                res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(404, `User ${userId} not found`));
+                return;
+            }
+            const profile = this._mapSCIMBodyToProfile(body);
+            const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);
+            // Update profile attributes
+            await this.provisioningService.updateOrgUser(userId, {
+                firstName: profile.firstName,
+                lastName: profile.lastName,
+                displayName: profile.displayName,
+            }, orgConfig);
+            // Handle active status change
+            if (body.active === false && user.status !== UserStatus.INACTIVE) {
+                await this.provisioningService.deactivateOrgUser(userId, orgConfig);
+            }
+            else if (body.active === true && user.status !== UserStatus.ACTIVE) {
+                await this.servicesRegistryHandler.update(CoreResourceType.USERS, ec, userId, { status: UserStatus.ACTIVE });
+            }
+            const updatedUser = await this._findUserInOrg(ec, userId, ctx.organizationId);
+            const updatedProfile = await this._getUserProfile(ec, userId);
+            const identityLink = await this._getUserIdentityLink(ec, userId, ctx.organizationId);
+            const baseUrl = this._getBaseUrl(req);
+            const scimUser = formatUserAsSCIM(updatedUser || user, updatedProfile, baseUrl, identityLink?.providerUserId);
+            this._logSCIMOperation('user_replaced', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });
+            // H8: Audit SCIM user updated (replace)
+            this.auditLogsService.logSCIMUserUpdated({
+                organizationId: ctx.organizationId,
+                userId,
+                operation: 'replace',
+                updatedAttributes: ['profile', body.active !== undefined ? 'active' : undefined].filter(Boolean),
+            }).catch(() => { });
+            res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(scimUser);
+        }
+        catch (error) {
+            this._handleSCIMError(res, error, 'replace_user');
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // PATCH /scim/v2/Users/:id — Partial Update (RFC 7644 §3.5.2)
+    // ═══════════════════════════════════════════════════════════════
+    async _handlePatchUser(req, res) {
+        const ctx = this._getSCIMContext(req);
+        const userId = req.params.id;
+        const body = req.body;
+        this._logSCIMOperation('patch_user', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });
+        if (!body.Operations || !Array.isArray(body.Operations)) {
+            res.status(400).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(400, 'PATCH requires Operations array', 'invalidSyntax'));
+            return;
+        }
+        try {
+            const ec = req.scimEc;
+            const user = await this._findUserInOrg(ec, userId, ctx.organizationId);
+            if (!user) {
+                res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(404, `User ${userId} not found`));
+                return;
+            }
+            const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);
+            const profileUpdates = {};
+            let statusChange = null;
+            for (const op of body.Operations) {
+                const normalizedOp = op.op?.toLowerCase();
+                if (normalizedOp === 'add' || normalizedOp === 'replace') {
+                    if (op.path) {
+                        // Single attribute update
+                        this._applyPatchAttribute(op.path, op.value, profileUpdates, (s) => { statusChange = s; });
+                    }
+                    else if (op.value && typeof op.value === 'object') {
+                        // Bulk attribute update (no path — value is an object of attributes)
+                        const valueObj = op.value;
+                        for (const [key, val] of Object.entries(valueObj)) {
+                            this._applyPatchAttribute(key, val, profileUpdates, (s) => { statusChange = s; });
+                        }
+                    }
+                }
+                else if (normalizedOp === 'remove' && op.path) {
+                    const scimAttr = op.path;
+                    const dbField = SCIM_USER_ATTRIBUTE_MAP[scimAttr];
+                    if (dbField && dbField !== '_active' && dbField !== 'email') {
+                        profileUpdates[dbField] = '';
+                    }
+                }
+            }
+            // Apply profile updates
+            if (Object.keys(profileUpdates).length > 0) {
+                await this.provisioningService.updateOrgUser(userId, profileUpdates, orgConfig);
+            }
+            // Apply status change
+            if (statusChange === 'deactivate') {
+                await this.provisioningService.deactivateOrgUser(userId, orgConfig);
+            }
+            else if (statusChange === 'activate') {
+                await this.servicesRegistryHandler.update(CoreResourceType.USERS, ec, userId, { status: UserStatus.ACTIVE });
+            }
+            // Return updated user
+            const updatedUser = await this._findUserInOrg(ec, userId, ctx.organizationId);
+            const updatedProfile = await this._getUserProfile(ec, userId);
+            const identityLink = await this._getUserIdentityLink(ec, userId, ctx.organizationId);
+            const baseUrl = this._getBaseUrl(req);
+            const scimUser = formatUserAsSCIM(updatedUser || user, updatedProfile, baseUrl, identityLink?.providerUserId);
+            this._logSCIMOperation('user_patched', {
+                organizationId: ctx.organizationId,
+                scopeType: ctx.scopeType,
+                scopeId: ctx.scopeId,
+                userId,
+                operations: body.Operations.length,
+                tokenId: ctx.tokenId,
+            });
+            // H8: Audit SCIM user updated (patch)
+            const patchedAttrs = Object.keys(profileUpdates);
+            if (statusChange)
+                patchedAttrs.push('active');
+            this.auditLogsService.logSCIMUserUpdated({
+                organizationId: ctx.organizationId,
+                userId,
+                operation: 'patch',
+                updatedAttributes: patchedAttrs,
+            }).catch(() => { });
+            res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(scimUser);
+        }
+        catch (error) {
+            this._handleSCIMError(res, error, 'patch_user');
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // DELETE /scim/v2/Users/:id — Deactivate User
+    // ═══════════════════════════════════════════════════════════════
+    async _handleDeleteUser(req, res) {
+        const ctx = this._getSCIMContext(req);
+        const userId = req.params.id;
+        this._logSCIMOperation('delete_user', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });
+        try {
+            const ec = req.scimEc;
+            const user = await this._findUserInOrg(ec, userId, ctx.organizationId);
+            if (!user) {
+                res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(404, `User ${userId} not found`));
+                return;
+            }
+            const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);
+            await this.provisioningService.deactivateOrgUser(userId, orgConfig);
+            this._logSCIMOperation('user_deactivated', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });
+            // H8: Audit SCIM user deactivated
+            this.auditLogsService.logSCIMUserDeactivated({
+                organizationId: ctx.organizationId,
+                userId,
+                email: user.email,
+            }).catch(() => { });
+            res.status(204).end();
+        }
+        catch (error) {
+            this._handleSCIMError(res, error, 'delete_user');
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // POST /scim/v2/Bulk — Bulk Operations (Step 21)
+    // ═══════════════════════════════════════════════════════════════
+    async _handleBulk(req, res) {
+        const ctx = this._getSCIMContext(req);
+        const body = req.body;
+        if (!body.Operations || !Array.isArray(body.Operations)) {
+            res.status(400).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(400, 'Bulk request requires Operations array', 'invalidSyntax'));
+            return;
+        }
+        if (body.Operations.length > 100) {
+            res.status(413).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(413, 'Bulk request exceeds maximum of 100 operations', 'tooMany'));
+            return;
+        }
+        this._logSCIMOperation('bulk_start', {
+            organizationId: ctx.organizationId,
+            scopeType: ctx.scopeType,
+            scopeId: ctx.scopeId,
+            operationCount: body.Operations.length,
+            tokenId: ctx.tokenId,
+        });
+        const results = [];
+        let errorCount = 0;
+        const failOnErrors = body.failOnErrors || 0;
+        for (const op of body.Operations) {
+            if (failOnErrors > 0 && errorCount >= failOnErrors) {
+                results.push({
+                    method: op.method,
+                    bulkId: op.bulkId,
+                    status: '412',
+                    response: formatSCIMError(412, 'Processing stopped due to failOnErrors threshold'),
+                });
+                continue;
+            }
+            try {
+                const result = await this._executeBulkOperation(op, ctx, req);
+                results.push(result);
+                if (parseInt(result.status) >= 400) {
+                    errorCount++;
+                }
+            }
+            catch {
+                errorCount++;
+                results.push({
+                    method: op.method,
+                    bulkId: op.bulkId,
+                    status: '500',
+                    response: formatSCIMError(500, 'Internal error processing bulk operation'),
+                });
+            }
+        }
+        this._logSCIMOperation('bulk_complete', {
+            organizationId: ctx.organizationId,
+            scopeType: ctx.scopeType,
+            scopeId: ctx.scopeId,
+            totalOperations: body.Operations.length,
+            errors: errorCount,
+            tokenId: ctx.tokenId,
+        });
+        res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json({
+            schemas: [SCIM_SCHEMAS.BULK_RESPONSE],
+            Operations: results,
+        });
+    }
+    async _executeBulkOperation(op, ctx, req) {
+        const pathMatch = op.path?.match(/\/Users(?:\/(.+))?$/);
+        if (!pathMatch) {
+            return { method: op.method, bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'Invalid path') };
+        }
+        const userId = pathMatch[1];
+        const ec = req.scimEc;
+        const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);
+        const baseUrl = this._getBaseUrl(req);
+        switch (op.method) {
+            case 'POST': {
+                if (!op.data) {
+                    return { method: 'POST', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'Missing data for POST') };
+                }
+                const profile = this._mapSCIMBodyToProfile(op.data);
+                if (!profile.email) {
+                    return { method: 'POST', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'userName required') };
+                }
+                const connection = this._buildSCIMConnection(ctx);
+                const result = await this.provisioningService.createOrgUser(profile, connection, orgConfig);
+                // H8: Audit bulk SCIM user provisioned
+                this.auditLogsService.logSCIMUserProvisioned({
+                    organizationId: ctx.organizationId,
+                    userId: result.user._id,
+                    email: profile.email,
+                    isNewUser: result.isNew,
+                    provisionedVia: `scim:bulk:${ctx.tokenDisplayName}`,
+                    authSource: 'scim',
+                }).catch(() => { });
+                return {
+                    method: 'POST',
+                    bulkId: op.bulkId,
+                    location: `${baseUrl}/Users/${result.user._id}`,
+                    status: '201',
+                };
+            }
+            case 'PUT': {
+                if (!userId || !op.data) {
+                    return { method: 'PUT', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'User ID and data required') };
+                }
+                const user = await this._findUserInOrg(ec, userId, ctx.organizationId);
+                if (!user) {
+                    return { method: 'PUT', bulkId: op.bulkId, status: '404', response: formatSCIMError(404, `User ${userId} not found`) };
+                }
+                const putProfile = this._mapSCIMBodyToProfile(op.data);
+                await this.provisioningService.updateOrgUser(userId, {
+                    firstName: putProfile.firstName,
+                    lastName: putProfile.lastName,
+                    displayName: putProfile.displayName,
+                }, orgConfig);
+                // H8: Audit bulk SCIM user updated (replace)
+                this.auditLogsService.logSCIMUserUpdated({
+                    organizationId: ctx.organizationId,
+                    userId,
+                    operation: 'replace',
+                    updatedAttributes: ['profile'],
+                }).catch(() => { });
+                return { method: 'PUT', bulkId: op.bulkId, location: `${baseUrl}/Users/${userId}`, status: '200' };
+            }
+            case 'PATCH': {
+                if (!userId || !op.data) {
+                    return { method: 'PATCH', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'User ID and data required') };
+                }
+                const patchUser = await this._findUserInOrg(ec, userId, ctx.organizationId);
+                if (!patchUser) {
+                    return { method: 'PATCH', bulkId: op.bulkId, status: '404', response: formatSCIMError(404, `User ${userId} not found`) };
+                }
+                // Simplified: apply operations from data
+                const operations = op.data.Operations;
+                const bulkPatchedAttrs = [];
+                if (operations) {
+                    const patchProfileUpdates = {};
+                    let patchStatusChange = null;
+                    for (const patchOp of operations) {
+                        const normalizedOp = patchOp.op?.toLowerCase();
+                        if (normalizedOp === 'add' || normalizedOp === 'replace') {
+                            if (patchOp.path) {
+                                this._applyPatchAttribute(patchOp.path, patchOp.value, patchProfileUpdates, (s) => { patchStatusChange = s; });
+                            }
+                        }
+                    }
+                    if (Object.keys(patchProfileUpdates).length > 0) {
+                        await this.provisioningService.updateOrgUser(userId, patchProfileUpdates, orgConfig);
+                    }
+                    if (patchStatusChange === 'deactivate') {
+                        await this.provisioningService.deactivateOrgUser(userId, orgConfig);
+                    }
+                    bulkPatchedAttrs.push(...Object.keys(patchProfileUpdates));
+                    if (patchStatusChange)
+                        bulkPatchedAttrs.push('active');
+                }
+                // H8: Audit bulk SCIM user updated (patch)
+                this.auditLogsService.logSCIMUserUpdated({
+                    organizationId: ctx.organizationId,
+                    userId,
+                    operation: 'patch',
+                    updatedAttributes: bulkPatchedAttrs,
+                }).catch(() => { });
+                return { method: 'PATCH', bulkId: op.bulkId, location: `${baseUrl}/Users/${userId}`, status: '200' };
+            }
+            case 'DELETE': {
+                if (!userId) {
+                    return { method: 'DELETE', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'User ID required') };
+                }
+                const deleteUser = await this._findUserInOrg(ec, userId, ctx.organizationId);
+                if (!deleteUser) {
+                    return { method: 'DELETE', bulkId: op.bulkId, status: '404', response: formatSCIMError(404, `User ${userId} not found`) };
+                }
+                await this.provisioningService.deactivateOrgUser(userId, orgConfig);
+                // H8: Audit bulk SCIM user deactivated
+                this.auditLogsService.logSCIMUserDeactivated({
+                    organizationId: ctx.organizationId,
+                    userId,
+                    email: deleteUser.email,
+                }).catch(() => { });
+                return { method: 'DELETE', bulkId: op.bulkId, status: '204' };
+            }
+            default:
+                return { method: op.method, bulkId: op.bulkId, status: '400', response: formatSCIMError(400, `Unsupported method: ${op.method}`) };
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // PATCH Helpers
+    // ═══════════════════════════════════════════════════════════════
+    _applyPatchAttribute(path, value, profileUpdates, onStatusChange) {
+        const attrMap = SCIM_USER_ATTRIBUTE_MAP;
+        const dbField = attrMap[path];
+        if (path === 'active' || dbField === '_active') {
+            const isActive = value === true || value === 'true';
+            onStatusChange(isActive ? 'activate' : 'deactivate');
+            return;
+        }
+        if (dbField && dbField !== 'email') {
+            profileUpdates[dbField] = String(value ?? '');
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // SCIM Body → NormalizedUserProfile
+    // ═══════════════════════════════════════════════════════════════
+    _mapSCIMBodyToProfile(body) {
+        const userName = body.userName;
+        const name = body.name;
+        const emails = body.emails;
+        // Determine email: prefer userName, then primary email, then first email
+        let email = userName || '';
+        if (!email && emails?.length) {
+            const primary = emails.find(e => e.primary);
+            email = primary?.value || emails[0]?.value || '';
+        }
+        return {
+            providerUserId: body.externalId || '',
+            email: email.toLowerCase(),
+            emailVerified: true, // SCIM-provisioned users are trusted
+            firstName: name?.givenName,
+            lastName: name?.familyName,
+            displayName: body.displayName || undefined,
+            rawClaims: body,
+        };
+    }
+    _buildSCIMConnection(ctx) {
+        return {
+            source: 'scim',
+            providerRef: 'scim',
+            displayName: 'SCIM Directory Provisioning',
+            organization: {
+                organizationId: ctx.organizationId,
+                connectionId: `scim:${ctx.tokenId}`,
+                allowedDomains: [],
+                autoCreateUsers: true,
+                autoVerifyEmail: true,
+            },
+        };
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // User Lookup Helpers
+    // ═══════════════════════════════════════════════════════════════
+    async _findUserInOrg(ec, userId, organizationId) {
+        try {
+            // Verify user exists
+            const user = await this.servicesRegistryHandler.read(CoreResourceType.USERS, ec, { _id: userId });
+            if (!user)
+                return null;
+            const membership = await this.servicesRegistryHandler.read(CoreResourceType.ORGANIZATION_MEMBERS, ec, { userId, organizationId });
+            if (!membership)
+                return null;
+            return user;
+        }
+        catch {
+            return null;
+        }
+    }
+    async _getUserProfile(ec, userId) {
+        try {
+            const profile = await this.servicesRegistryHandler.read(CoreResourceType.USER_PROFILES, ec, { userId });
+            return profile;
+        }
+        catch {
+            return null;
+        }
+    }
+    async _getUserIdentityLink(ec, userId, organizationId) {
+        try {
+            const link = await this.servicesRegistryHandler.read(CoreResourceType.USER_IDENTITY_LINKS, ec, {
+                userId,
+                connectionType: 'enterprise',
+                organizationId,
+            });
+            return link;
+        }
+        catch {
+            return null;
+        }
+    }
+    async _getProvisioningConfig(ec, organizationId) {
+        let allowedDomains = [];
+        try {
+            const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, AuthScopeType.ORGANIZATION, organizationId);
+            if (ssoConfig) {
+                // Only include domains that have passed DNS verification (H4)
+                allowedDomains = ssoConfig.domains.verifiedDomains.filter(d => ssoConfig.domains.domainVerificationStatus[d] === 'verified');
+            }
+        }
+        catch {
+            this.logDebug('Failed to load org SSO config for SCIM provisioning (non-fatal)', { organizationId });
+        }
+        return {
+            organizationId,
+            autoCreateUsers: true,
+            autoVerifyEmail: true,
+            allowedDomains,
+        };
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Structured Logging (Step 21)
+    // ═══════════════════════════════════════════════════════════════
+    _logSCIMOperation(operation, context) {
+        this.logDebug(`SCIM: ${operation}`, {
+            scimOperation: operation,
+            ...context,
+        });
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Error Handling
+    // ═══════════════════════════════════════════════════════════════
+    _handleSCIMError(res, error, operation) {
+        this._logSCIMOperation(`${operation}_error`, { error: error instanceof Error ? error.message : String(error) });
+        if (isWildoBackendError(error)) {
+            const wildoError = error;
+            const status = wildoError.statusCode || 500;
+            // Map common errors to SCIM-specific responses
+            if (status === 409 || wildoError.type === 'uniqueness') {
+                res.status(409).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(409, 'User already exists', 'uniqueness'));
+                return;
+            }
+            if (status === 404) {
+                res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(404, wildoError.message || 'Resource not found'));
+                return;
+            }
+            res.status(status).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(status, wildoError.message || 'Server error'));
+            return;
+        }
+        res.status(500).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatSCIMError(500, 'Internal server error'));
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Utilities
+    // ═══════════════════════════════════════════════════════════════
+    _hashToken(plainToken) {
+        return createHash('sha256').update(plainToken).digest('hex');
+    }
+    async _isScimProvisioningEnabledForOrg(ec, organizationId) {
+        if (!this.appConfigService.isInitialized())
+            return true;
+        const organizationTypes = this.appConfigService.config?.organizationTypes;
+        try {
+            return await isScimProvisioningEnabledForOrg(ec, {
+                organizationId,
+                organizationTypes,
+                servicesRegistryHandler: this.servicesRegistryHandler,
+            });
+        }
+        catch {
+            return true;
+        }
+    }
+    _getSCIMContext(req) {
+        return req.scimContext;
+    }
+    _getBaseUrl(req) {
+        const proto = req.headers[WildoHeaderKeys.FORWARDED_PROTO];
+        const protocol = (Array.isArray(proto) ? proto[0] : proto) || req.protocol || 'https';
+        const h = req.headers[WildoHeaderKeys.FORWARDED_HOST] || req.headers.host;
+        const host = (Array.isArray(h) ? h[0] : h) || 'localhost';
+        return `${protocol}://${host}/api/v1/scim/v2`;
+    }
+    async _getInternalExecutionContext() {
+        return this.authEcFactory.createForSystemAuthOperation(this.authEcFactory.getUsersCreateOperationPath());
+    }
+};
+SCIMControllerBackendService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.ErrorBuilderService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.ErrorHandlerService)),
+    __param(3, inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService)),
+    __param(4, inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory)),
+    __param(5, inject(SAAS_SERVICE_TYPES.EnterpriseUserProvisioningService)),
+    __param(6, inject(SAAS_SERVICE_TYPES.AuditLogsService)),
+    __param(7, inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService)),
+    __param(8, inject(SAAS_SERVICE_TYPES.RateLimitBackendService)),
+    __param(9, inject(SAAS_SERVICE_TYPES.AppConfigService)),
+    __metadata("design:paramtypes", [LoggerService,
+        ErrorBuilderBackendService,
+        ErrorHandlerService, Function, AuthExecutionContextFactoryBackendService,
+        EnterpriseUserProvisioningBackendService,
+        AuditLogsBackendService,
+        AuthOrganizationConfigurationService,
+        RateLimitBackendService, Function])
+], SCIMControllerBackendService);
+export { SCIMControllerBackendService };
+//# sourceMappingURL=scim.backend.controller.js.map