@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/security/scim/utils/scim-filter-parser.js

@@ -0,0 +1,232 @@
+/**
+ * SCIM Filter Parser — Step 20
+ *
+ * Parses SCIM 2.0 filter expressions (RFC 7644 §3.4.2.2) and translates them
+ * into MongoDB-compatible query filters using the SCIM attribute map.
+ *
+ * Supports: eq, ne, co (contains), sw (starts with), ew (ends with), pr (present),
+ *           gt, ge, lt, le, and, or, not
+ * Does NOT support: complex multi-valued attribute sub-filters (these require SCIM 2.0 conformance suite — Step 21)
+ */
+import { SCIM_USER_ATTRIBUTE_MAP } from '../../../security/scim/models/scim-protocol.backend.schemas.js';
+/**
+ * Parse a SCIM filter expression and translate it to a MongoDB-compatible query filter.
+ *
+ * Examples:
+ *   parseSCIMFilter('userName eq "john@acme.com"') → { email: "john@acme.com" }
+ *   parseSCIMFilter('active eq true') → special handling for user status
+ *   parseSCIMFilter('name.familyName co "Smith"') → { lastName: { $regex: "Smith", $options: "i" } }
+ *   parseSCIMFilter('userName sw "john" and active eq true') → { $and: [...] }
+ *
+ * @param filter - SCIM filter expression string
+ * @param attributeMap - Optional custom attribute map (defaults to SCIM_USER_ATTRIBUTE_MAP)
+ */
+export function parseSCIMFilter(filter, attributeMap = SCIM_USER_ATTRIBUTE_MAP) {
+    if (!filter || filter.trim().length === 0) {
+        return {};
+    }
+    const trimmed = filter.trim();
+    const ast = _parseExpression(trimmed);
+    return _astToMongoFilter(ast, attributeMap);
+}
+const SCIM_OPERATORS = new Set(['eq', 'ne', 'co', 'sw', 'ew', 'gt', 'ge', 'lt', 'le', 'pr']);
+const LOGICAL_OPERATORS = new Set(['and', 'or', 'not']);
+function _tokenize(input) {
+    const tokens = [];
+    let i = 0;
+    while (i < input.length) {
+        // Skip whitespace
+        if (input[i] === ' ' || input[i] === '\t') {
+            i++;
+            continue;
+        }
+        // Parentheses
+        if (input[i] === '(') {
+            tokens.push({ type: 'lparen', value: '(' });
+            i++;
+            continue;
+        }
+        if (input[i] === ')') {
+            tokens.push({ type: 'rparen', value: ')' });
+            i++;
+            continue;
+        }
+        // Quoted string value
+        if (input[i] === '"') {
+            i++;
+            let value = '';
+            while (i < input.length && input[i] !== '"') {
+                if (input[i] === '\\' && i + 1 < input.length) {
+                    value += input[i + 1];
+                    i += 2;
+                }
+                else {
+                    value += input[i];
+                    i++;
+                }
+            }
+            i++; // skip closing quote
+            tokens.push({ type: 'value', value });
+            continue;
+        }
+        // Words: attribute names, operators, logical operators, unquoted values
+        let word = '';
+        while (i < input.length && input[i] !== ' ' && input[i] !== '\t' && input[i] !== '(' && input[i] !== ')' && input[i] !== '"') {
+            word += input[i];
+            i++;
+        }
+        if (word.length === 0)
+            continue;
+        const lowerWord = word.toLowerCase();
+        if (SCIM_OPERATORS.has(lowerWord)) {
+            tokens.push({ type: 'operator', value: lowerWord });
+        }
+        else if (LOGICAL_OPERATORS.has(lowerWord)) {
+            tokens.push({ type: 'logical', value: lowerWord });
+        }
+        else if (lowerWord === 'true' || lowerWord === 'false' || lowerWord === 'null') {
+            tokens.push({ type: 'value', value: lowerWord });
+        }
+        else {
+            // Check if it looks like an attribute path (contains dots or is a known attribute)
+            tokens.push({ type: 'attribute', value: word });
+        }
+    }
+    return tokens;
+}
+// ═══════════════════════════════════════════════════════════════
+// Parser (recursive descent)
+// ═══════════════════════════════════════════════════════════════
+function _parseExpression(input) {
+    const tokens = _tokenize(input);
+    let pos = 0;
+    function parseOr() {
+        let left = parseAnd();
+        while (pos < tokens.length && tokens[pos]?.type === 'logical' && tokens[pos]?.value === 'or') {
+            pos++; // skip 'or'
+            const right = parseAnd();
+            left = { type: 'logical', logicalOp: 'or', children: [left, right] };
+        }
+        return left;
+    }
+    function parseAnd() {
+        let left = parsePrimary();
+        while (pos < tokens.length && tokens[pos]?.type === 'logical' && tokens[pos]?.value === 'and') {
+            pos++; // skip 'and'
+            const right = parsePrimary();
+            left = { type: 'logical', logicalOp: 'and', children: [left, right] };
+        }
+        return left;
+    }
+    function parsePrimary() {
+        // `not` prefix: RFC 7644 §3.4.2.2 — `not (expression)`
+        if (pos < tokens.length && tokens[pos]?.type === 'logical' && tokens[pos]?.value === 'not') {
+            pos++; // skip 'not'
+            const inner = parsePrimary();
+            return { type: 'logical', logicalOp: 'not', children: [inner] };
+        }
+        if (pos < tokens.length && tokens[pos]?.type === 'lparen') {
+            pos++; // skip '('
+            const node = parseOr();
+            if (pos < tokens.length && tokens[pos]?.type === 'rparen') {
+                pos++; // skip ')'
+            }
+            return node;
+        }
+        // Comparison: attribute operator [value]
+        const attributeToken = tokens[pos];
+        if (!attributeToken || attributeToken.type !== 'attribute') {
+            return { type: 'comparison', attribute: '', operator: 'eq', value: '' };
+        }
+        pos++;
+        const operatorToken = tokens[pos];
+        if (!operatorToken || operatorToken.type !== 'operator') {
+            return { type: 'comparison', attribute: attributeToken.value, operator: 'eq', value: '' };
+        }
+        pos++;
+        // 'pr' (present) operator has no value
+        if (operatorToken.value === 'pr') {
+            return { type: 'comparison', attribute: attributeToken.value, operator: 'pr' };
+        }
+        const valueToken = tokens[pos];
+        const value = valueToken ? valueToken.value : '';
+        if (valueToken)
+            pos++;
+        return { type: 'comparison', attribute: attributeToken.value, operator: operatorToken.value, value };
+    }
+    return parseOr();
+}
+// ═══════════════════════════════════════════════════════════════
+// AST to MongoDB Filter
+// ═══════════════════════════════════════════════════════════════
+function _astToMongoFilter(node, attributeMap) {
+    if (node.type === 'logical' && node.children) {
+        if (node.logicalOp === 'not') {
+            return { $nor: [_astToMongoFilter(node.children[0], attributeMap)] };
+        }
+        const childFilters = node.children.map(c => _astToMongoFilter(c, attributeMap));
+        if (node.logicalOp === 'or') {
+            return { $or: childFilters };
+        }
+        return { $and: childFilters };
+    }
+    // Comparison node
+    const scimAttr = node.attribute || '';
+    const dbField = attributeMap[scimAttr] || scimAttr;
+    const op = node.operator || 'eq';
+    const rawValue = node.value;
+    // Special handling for 'active' attribute → maps to user status field
+    if (dbField === '_active') {
+        const isActive = rawValue === 'true';
+        if (op === 'eq') {
+            return { status: isActive ? 'active' : 'inactive' };
+        }
+        if (op === 'ne') {
+            return { status: isActive ? 'inactive' : 'active' };
+        }
+        return {};
+    }
+    // Parse value type
+    const parsedValue = _parseValue(rawValue);
+    switch (op) {
+        case 'eq':
+            if (typeof parsedValue === 'string') {
+                // Case-insensitive exact match for strings (SCIM spec: userName is case-insensitive)
+                return { [dbField]: { $regex: `^${_escapeRegex(parsedValue)}$`, $options: 'i' } };
+            }
+            return { [dbField]: parsedValue };
+        case 'ne':
+            return { [dbField]: { $ne: parsedValue } };
+        case 'co':
+            return { [dbField]: { $regex: _escapeRegex(String(parsedValue)), $options: 'i' } };
+        case 'sw':
+            return { [dbField]: { $regex: `^${_escapeRegex(String(parsedValue))}`, $options: 'i' } };
+        case 'ew':
+            return { [dbField]: { $regex: `${_escapeRegex(String(parsedValue))}$`, $options: 'i' } };
+        case 'pr':
+            return { [dbField]: { $exists: true, $ne: null } };
+        case 'gt':
+            return { [dbField]: { $gt: parsedValue } };
+        case 'ge':
+            return { [dbField]: { $gte: parsedValue } };
+        case 'lt':
+            return { [dbField]: { $lt: parsedValue } };
+        case 'le':
+            return { [dbField]: { $lte: parsedValue } };
+        default:
+            return {};
+    }
+}
+function _parseValue(raw) {
+    if (raw === undefined || raw === 'null')
+        return null;
+    if (raw === 'true')
+        return true;
+    if (raw === 'false')
+        return false;
+    return raw;
+}
+function _escapeRegex(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+//# sourceMappingURL=scim-filter-parser.js.map

package/dist/esm/security/scim/utils/scim-filter-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-filter-parser.js","sourceRoot":"","sources":["../../../../../src/security/scim/utils/scim-filter-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,uEAAuE,CAAC;AAehH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA0B,EAC1B,eAAuC,uBAA4D;IAEnG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,iBAAiB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AAC9C,CAAC;AAWD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7F,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAExD,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,kBAAkB;QAClB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,cAAc;QACd,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,sBAAsB;QACtB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,CAAC,EAAE,CAAC;YACJ,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC9C,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBACtB,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;qBAAM,CAAC;oBACN,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;oBAClB,CAAC,EAAE,CAAC;gBACN,CAAC;YACH,CAAC;YACD,CAAC,EAAE,CAAC,CAAC,qBAAqB;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QAED,wEAAwE;QACxE,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7H,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC,EAAE,CAAC;QACN,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEhC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;YACjF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,mFAAmF;YACnF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,SAAS,OAAO;QACd,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;QACtB,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;YAC7F,GAAG,EAAE,CAAC,CAAC,YAAY;YACnB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,QAAQ;QACf,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;QAC1B,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;YAC9F,GAAG,EAAE,CAAC,CAAC,aAAa;YACpB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;YAC7B,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,YAAY;QACnB,uDAAuD;QACvD,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;YAC3F,GAAG,EAAE,CAAC,CAAC,aAAa;YACpB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;YAC7B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,CAAC;QAED,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1D,GAAG,EAAE,CAAC,CAAC,WAAW;YAClB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1D,GAAG,EAAE,CAAC,CAAC,WAAW;YACpB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yCAAyC;QACzC,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC1E,CAAC;QACD,GAAG,EAAE,CAAC;QAEN,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACxD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,GAAG,EAAE,CAAC;QAEN,uCAAuC;QACvC,IAAI,aAAa,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACjC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACjF,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,UAAU;YAAE,GAAG,EAAE,CAAC;QAEtB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;IACvG,CAAC;IAED,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,kEAAkE;AAClE,wBAAwB;AACxB,kEAAkE;AAElE,SAAS,iBAAiB,CAAC,IAAoB,EAAE,YAAoC;IACnF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB;IAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC;IACnD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;IAE5B,sEAAsE;IACtE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,QAAQ,KAAK,MAAM,CAAC;QACrC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,mBAAmB;IACnB,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAE1C,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,IAAI;YACP,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACpC,qFAAqF;gBACrF,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC;YACpF,CAAC;YACD,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;QAEpC,KAAK,IAAI;YACP,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC;QAE7C,KAAK,IAAI;YACP,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC;QAErF,KAAK,IAAI;YACP,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC;QAE3F,KAAK,IAAI;YACP,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC;QAE3F,KAAK,IAAI;YACP,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;QAErD,KAAK,IAAI;YACP,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC;QAE7C,KAAK,IAAI;YACP,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;QAE9C,KAAK,IAAI;YACP,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC;QAE7C,KAAK,IAAI;YACP,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;QAE9C;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAuB;IAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}

package/dist/esm/security/scim/utils/scim-response-formatter.d.ts

@@ -0,0 +1,42 @@
+/**
+ * SCIM Response Formatter — Step 20
+ *
+ * Formats internal user data as SCIM 2.0 compliant responses.
+ * Wraps users in the SCIM User schema envelope with proper metadata.
+ */
+import { type User } from '@wildo-ai/saas-models';
+import { type SCIMUserResource, type SCIMListResponse, type SCIMErrorResponse, type SCIMErrorType } from '../../../security/scim/models/scim-protocol.backend.schemas.js';
+interface UserProfile {
+    firstName?: string;
+    lastName?: string;
+    displayName?: string;
+    avatarUrl?: string;
+}
+/**
+ * Format a single user as a SCIM 2.0 User resource.
+ *
+ * @param user - The internal User object
+ * @param profile - The user's profile (firstName, lastName, etc.)
+ * @param baseUrl - Base URL for SCIM resource locations (e.g., "https://api.wildo.ai/scim/v2")
+ * @param externalId - Optional external ID from the IdP
+ */
+export declare function formatUserAsSCIM(user: User, profile: UserProfile | null, baseUrl: string, externalId?: string): SCIMUserResource;
+/**
+ * Format a list of users as a SCIM 2.0 ListResponse.
+ *
+ * @param users - Array of { user, profile, externalId } objects
+ * @param totalCount - Total number of matching users (for pagination)
+ * @param startIndex - 1-based start index for pagination
+ * @param baseUrl - Base URL for SCIM resource locations
+ */
+export declare function formatListAsSCIM(users: Array<{
+    user: User;
+    profile: UserProfile | null;
+    externalId?: string;
+}>, totalCount: number, startIndex: number, baseUrl: string): SCIMListResponse;
+/**
+ * Format a SCIM 2.0 error response.
+ */
+export declare function formatSCIMError(status: number, detail: string, scimType?: SCIMErrorType): SCIMErrorResponse;
+export {};
+//# sourceMappingURL=scim-response-formatter.d.ts.map

package/dist/esm/security/scim/utils/scim-response-formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-response-formatter.d.ts","sourceRoot":"","sources":["../../../../../src/security/scim/utils/scim-response-formatter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,IAAI,EAAc,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EACnB,MAAM,uEAAuE,CAAC;AAE/E,UAAU,WAAW;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,WAAW,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,GAClB,gBAAgB,CA6BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9E,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,gBAAgB,CAUlB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,aAAa,GACvB,iBAAiB,CAOnB"}

package/dist/esm/security/scim/utils/scim-response-formatter.js

@@ -0,0 +1,89 @@
+/**
+ * SCIM Response Formatter — Step 20
+ *
+ * Formats internal user data as SCIM 2.0 compliant responses.
+ * Wraps users in the SCIM User schema envelope with proper metadata.
+ */
+import { UserStatus } from '@wildo-ai/saas-models';
+import { SCIM_SCHEMAS, } from '../../../security/scim/models/scim-protocol.backend.schemas.js';
+/**
+ * Format a single user as a SCIM 2.0 User resource.
+ *
+ * @param user - The internal User object
+ * @param profile - The user's profile (firstName, lastName, etc.)
+ * @param baseUrl - Base URL for SCIM resource locations (e.g., "https://api.wildo.ai/scim/v2")
+ * @param externalId - Optional external ID from the IdP
+ */
+export function formatUserAsSCIM(user, profile, baseUrl, externalId) {
+    const isActive = user.status === UserStatus.ACTIVE;
+    const createdAt = user.createdAt;
+    const updatedAt = user.updatedAt;
+    return {
+        schemas: [SCIM_SCHEMAS.USER],
+        id: user._id,
+        externalId: externalId || undefined,
+        userName: user.email,
+        name: {
+            givenName: profile?.firstName || undefined,
+            familyName: profile?.lastName || undefined,
+            formatted: _formatFullName(profile?.firstName, profile?.lastName),
+        },
+        displayName: profile?.displayName || _formatFullName(profile?.firstName, profile?.lastName) || user.email,
+        active: isActive,
+        emails: [{
+                value: user.email,
+                type: 'work',
+                primary: true,
+            }],
+        meta: {
+            resourceType: 'User',
+            created: _toISO(createdAt),
+            lastModified: _toISO(updatedAt),
+            location: `${baseUrl}/Users/${user._id}`,
+        },
+    };
+}
+/**
+ * Format a list of users as a SCIM 2.0 ListResponse.
+ *
+ * @param users - Array of { user, profile, externalId } objects
+ * @param totalCount - Total number of matching users (for pagination)
+ * @param startIndex - 1-based start index for pagination
+ * @param baseUrl - Base URL for SCIM resource locations
+ */
+export function formatListAsSCIM(users, totalCount, startIndex, baseUrl) {
+    return {
+        schemas: [SCIM_SCHEMAS.LIST_RESPONSE],
+        totalResults: totalCount,
+        startIndex: startIndex,
+        itemsPerPage: users.length,
+        Resources: users.map(({ user, profile, externalId }) => formatUserAsSCIM(user, profile, baseUrl, externalId)),
+    };
+}
+/**
+ * Format a SCIM 2.0 error response.
+ */
+export function formatSCIMError(status, detail, scimType) {
+    return {
+        schemas: [SCIM_SCHEMAS.ERROR],
+        status: String(status),
+        detail,
+        scimType,
+    };
+}
+// ═══════════════════════════════════════════════════════════════
+// Helpers
+// ═══════════════════════════════════════════════════════════════
+function _formatFullName(firstName, lastName) {
+    if (firstName && lastName)
+        return `${firstName} ${lastName}`;
+    return firstName || lastName || undefined;
+}
+function _toISO(value) {
+    if (value instanceof Date)
+        return value.toISOString();
+    if (typeof value === 'string')
+        return value;
+    return new Date().toISOString();
+}
+//# sourceMappingURL=scim-response-formatter.js.map

package/dist/esm/security/scim/utils/scim-response-formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-response-formatter.js","sourceRoot":"","sources":["../../../../../src/security/scim/utils/scim-response-formatter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EACL,YAAY,GAKb,MAAM,uEAAuE,CAAC;AAS/E;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAU,EACV,OAA2B,EAC3B,OAAe,EACf,UAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;IACnD,MAAM,SAAS,GAAI,IAAgC,CAAC,SAAS,CAAC;IAC9D,MAAM,SAAS,GAAI,IAAgC,CAAC,SAAS,CAAC;IAE9D,OAAO;QACL,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;QAC5B,EAAE,EAAE,IAAI,CAAC,GAAG;QACZ,UAAU,EAAE,UAAU,IAAI,SAAS;QACnC,QAAQ,EAAE,IAAI,CAAC,KAAK;QACpB,IAAI,EAAE;YACJ,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,SAAS;YAC1C,UAAU,EAAE,OAAO,EAAE,QAAQ,IAAI,SAAS;YAC1C,SAAS,EAAE,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC;SAClE;QACD,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK;QACzG,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,CAAC;gBACP,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,IAAI;aACd,CAAC;QACF,IAAI,EAAE;YACJ,YAAY,EAAE,MAAM;YACpB,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC;YAC1B,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC;YAC/B,QAAQ,EAAE,GAAG,OAAO,UAAU,IAAI,CAAC,GAAG,EAAE;SACzC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA8E,EAC9E,UAAkB,EAClB,UAAkB,EAClB,OAAe;IAEf,OAAO;QACL,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;QACrC,YAAY,EAAE,UAAU;QACxB,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CACrD,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CACrD;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,MAAc,EACd,QAAwB;IAExB,OAAO;QACL,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,UAAU;AACV,kEAAkE;AAElE,SAAS,eAAe,CAAC,SAAkB,EAAE,QAAiB;IAC5D,IAAI,SAAS,IAAI,QAAQ;QAAE,OAAO,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;IAC7D,OAAO,SAAS,IAAI,QAAQ,IAAI,SAAS,CAAC;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC"}

package/dist/esm/testing.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Public testing surface for @wildo-ai/saas-backend-lib.
+ * Import from `@wildo-ai/saas-backend-lib/testing` — not from the main package entry.
+ */
+export * from './billing/testing/mock-billing-provider.js';
+export * from './billing/testing/billing-test-fixtures.js';
+export * from './compliance/audit-trails/services/__tests__/mock-audit-logs.service.js';
+export * from './base-classes/services/repositories/__tests__/mock-repositories-registry-handler.service.js';
+export * from './base-classes/services/services/__tests__/mock-services-registry-handler.service.js';
+export * from './databases/services/__tests__/mock-mongodb.service.js';
+export * from './databases/services/__tests__/mock-redis.service.js';
+export * from './errors/services/__tests__/mock-error-builder.service.js';
+export * from './external-providers/services/__tests__/mock-external-providers-registry.service.js';
+export * from './external-providers/services/__tests__/mock-lazy-provider-registry.service.js';
+export * from './features/services/__tests__/mock-feature-definition-registry.service.js';
+export * from './features/services/__tests__/mock-capability-bindings.service.js';
+export * from './features/services/__tests__/mock-feature-resolution.service.js';
+export * from './features/testing/feature-test-utils.js';
+export * from './files/services/__tests__/mock-file-field-detection.service.js';
+export * from './files/services/__tests__/mock-file-operation-handler.service.js';
+export * from './files/services/__tests__/mock-file-repository.service.js';
+export * from './resources/services/__tests__/mock-resources-registry.service.js';
+export * from './runtime/testing/execution-context-test-fixtures.js';
+export * from './runtime/testing/mock-execution-context-creator.service.js';
+export * from './security/authentications/services/__tests__/mock-auth-execution-context-factory.service.js';
+export * from './security/authentications/services/__tests__/mock-auth-token-issuer.service.js';
+export * from './security/authentications/services/admin-config/__tests__/mock-domain-to-org-lookup.service.js';
+export * from './security/authentications/services/admin-config/__tests__/mock-enterprise-user-provisioning.service.js';
+export * from './security/authentications/services/utils/__tests__/mock-auth-user-lookup.service.js';
+export * from './security/consumable-tokens/services/__tests__/mock-consumable-token.service.js';
+//# sourceMappingURL=testing.d.ts.map

package/dist/esm/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,yCAAyC,CAAC;AACxD,cAAc,yCAAyC,CAAC;AACxD,cAAc,sEAAsE,CAAC;AACrF,cAAc,2FAA2F,CAAC;AAC1G,cAAc,mFAAmF,CAAC;AAClG,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,wDAAwD,CAAC;AACvE,cAAc,kFAAkF,CAAC;AACjG,cAAc,6EAA6E,CAAC;AAC5F,cAAc,wEAAwE,CAAC;AACvF,cAAc,gEAAgE,CAAC;AAC/E,cAAc,+DAA+D,CAAC;AAC9E,cAAc,uCAAuC,CAAC;AACtD,cAAc,8DAA8D,CAAC;AAC7E,cAAc,gEAAgE,CAAC;AAC/E,cAAc,yDAAyD,CAAC;AACxE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,mDAAmD,CAAC;AAClE,cAAc,0DAA0D,CAAC;AACzE,cAAc,2FAA2F,CAAC;AAC1G,cAAc,8EAA8E,CAAC;AAC7F,cAAc,8FAA8F,CAAC;AAC7G,cAAc,sGAAsG,CAAC;AACrH,cAAc,mFAAmF,CAAC;AAClG,cAAc,+EAA+E,CAAC"}

package/dist/esm/testing.js

@@ -0,0 +1,31 @@
+/**
+ * Public testing surface for @wildo-ai/saas-backend-lib.
+ * Import from `@wildo-ai/saas-backend-lib/testing` — not from the main package entry.
+ */
+export * from './billing/testing/mock-billing-provider.js';
+export * from './billing/testing/billing-test-fixtures.js';
+export * from './compliance/audit-trails/services/__tests__/mock-audit-logs.service.js';
+export * from './base-classes/services/repositories/__tests__/mock-repositories-registry-handler.service.js';
+export * from './base-classes/services/services/__tests__/mock-services-registry-handler.service.js';
+export * from './databases/services/__tests__/mock-mongodb.service.js';
+export * from './databases/services/__tests__/mock-redis.service.js';
+export * from './errors/services/__tests__/mock-error-builder.service.js';
+export * from './external-providers/services/__tests__/mock-external-providers-registry.service.js';
+export * from './external-providers/services/__tests__/mock-lazy-provider-registry.service.js';
+export * from './features/services/__tests__/mock-feature-definition-registry.service.js';
+export * from './features/services/__tests__/mock-capability-bindings.service.js';
+export * from './features/services/__tests__/mock-feature-resolution.service.js';
+export * from './features/testing/feature-test-utils.js';
+export * from './files/services/__tests__/mock-file-field-detection.service.js';
+export * from './files/services/__tests__/mock-file-operation-handler.service.js';
+export * from './files/services/__tests__/mock-file-repository.service.js';
+export * from './resources/services/__tests__/mock-resources-registry.service.js';
+export * from './runtime/testing/execution-context-test-fixtures.js';
+export * from './runtime/testing/mock-execution-context-creator.service.js';
+export * from './security/authentications/services/__tests__/mock-auth-execution-context-factory.service.js';
+export * from './security/authentications/services/__tests__/mock-auth-token-issuer.service.js';
+export * from './security/authentications/services/admin-config/__tests__/mock-domain-to-org-lookup.service.js';
+export * from './security/authentications/services/admin-config/__tests__/mock-enterprise-user-provisioning.service.js';
+export * from './security/authentications/services/utils/__tests__/mock-auth-user-lookup.service.js';
+export * from './security/consumable-tokens/services/__tests__/mock-consumable-token.service.js';
+//# sourceMappingURL=testing.js.map

package/dist/esm/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,yCAAyC,CAAC;AACxD,cAAc,yCAAyC,CAAC;AACxD,cAAc,sEAAsE,CAAC;AACrF,cAAc,2FAA2F,CAAC;AAC1G,cAAc,mFAAmF,CAAC;AAClG,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,wDAAwD,CAAC;AACvE,cAAc,kFAAkF,CAAC;AACjG,cAAc,6EAA6E,CAAC;AAC5F,cAAc,wEAAwE,CAAC;AACvF,cAAc,gEAAgE,CAAC;AAC/E,cAAc,+DAA+D,CAAC;AAC9E,cAAc,uCAAuC,CAAC;AACtD,cAAc,8DAA8D,CAAC;AAC7E,cAAc,gEAAgE,CAAC;AAC/E,cAAc,yDAAyD,CAAC;AACxE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,mDAAmD,CAAC;AAClE,cAAc,0DAA0D,CAAC;AACzE,cAAc,2FAA2F,CAAC;AAC1G,cAAc,8EAA8E,CAAC;AAC7F,cAAc,8FAA8F,CAAC;AAC7G,cAAc,sGAAsG,CAAC;AACrH,cAAc,mFAAmF,CAAC;AAClG,cAAc,+EAA+E,CAAC"}

package/dist/esm/users/services/user-self-custom-implementations.backend.d.ts

@@ -0,0 +1,9 @@
+/**
+ * User Custom Service Implementations
+ *
+ * SEC-W5.13-FIX-6: Validates userTypes on Users.UPDATE to prevent assigning
+ * non-existent user types via admin CRUD.
+ */
+import { type ResourceCustomServiceImplementationFactory } from '../../base-classes/services/services/resource-operation-custom-implementation.factory.backend.js';
+export declare const userSelfCustomImplementations: ResourceCustomServiceImplementationFactory[];
+//# sourceMappingURL=user-self-custom-implementations.backend.d.ts.map

package/dist/esm/users/services/user-self-custom-implementations.backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-self-custom-implementations.backend.d.ts","sourceRoot":"","sources":["../../../../src/users/services/user-self-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA0CpH,eAAO,MAAM,6BAA6B,EAAE,0CAA0C,EAErF,CAAC"}

package/dist/esm/users/services/user-self-custom-implementations.backend.js

@@ -0,0 +1,48 @@
+/**
+ * User Custom Service Implementations
+ *
+ * SEC-W5.13-FIX-6: Validates userTypes on Users.UPDATE to prevent assigning
+ * non-existent user types via admin CRUD.
+ */
+import { CoreResourceOperation, CoreResourceType, ErrorType, ErrorCustomMessageReference, ResourceOperationVariantType, } from '@wildo-ai/saas-models';
+import { createResourceCustomServiceImplementation, } from '../../base-classes/services/services/resource-operation-custom-implementation.factory.backend.js';
+function createUsersUpdateFactory() {
+    return (resourcesRegistryService) => {
+        return createResourceCustomServiceImplementation({
+            operationPath: {
+                resourceIdentifier: CoreResourceType.USERS,
+                operationIdentifier: CoreResourceOperation.UPDATE,
+                variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                isOperationDefault: true,
+            },
+            handlers: {
+                prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {
+                    const patch = input;
+                    const userTypes = patch?.userTypes;
+                    if (!userTypes || userTypes.length === 0)
+                        return input;
+                    const userTypesConfig = resourcesRegistryService.getUserTypesConfig();
+                    if (!userTypesConfig)
+                        return input;
+                    const validTypes = Object.keys(userTypesConfig);
+                    const invalidTypes = userTypes.filter(t => !validTypes.includes(t));
+                    if (invalidTypes.length > 0) {
+                        throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+                            customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,
+                            context: {
+                                reason: 'invalid_user_types',
+                                invalidTypes,
+                                validTypes,
+                            },
+                        });
+                    }
+                    return input;
+                },
+            },
+        });
+    };
+}
+export const userSelfCustomImplementations = [
+    createUsersUpdateFactory(),
+];
+//# sourceMappingURL=user-self-custom-implementations.backend.js.map

package/dist/esm/users/services/user-self-custom-implementations.backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-self-custom-implementations.backend.js","sourceRoot":"","sources":["../../../../src/users/services/user-self-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,SAAS,EACT,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAGpH,SAAS,wBAAwB;IAC/B,OAAO,CAAC,wBAAyD,EAAE,EAAE;QACnE,OAAO,yCAAyC,CAAC;YAC/C,aAAa,EAAE;gBACb,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;gBAC1C,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;gBACjD,WAAW,EAAE,4BAA4B,CAAC,eAAe;gBACzD,kBAAkB,EAAE,IAAI;aACzB;YACD,QAAQ,EAAE;gBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;oBAClF,MAAM,KAAK,GAAG,KAAiC,CAAC;oBAChD,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,CAAC;oBACnC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;wBAAE,OAAO,KAAK,CAAC;oBAEvD,MAAM,eAAe,GAAG,wBAAwB,CAAC,kBAAkB,EAAE,CAAC;oBACtE,IAAI,CAAC,eAAe;wBAAE,OAAO,KAAK,CAAC;oBAEnC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBAChD,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;oBAEpE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC5B,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;4BAC1E,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;4BACtF,OAAO,EAAE;gCACP,MAAM,EAAE,oBAAoB;gCAC5B,YAAY;gCACZ,UAAU;6BACX;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,OAAO,KAAK,CAAC;gBACf,CAAC;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAiD;IACzF,wBAAwB,EAAE;CAC3B,CAAC"}