n8n 2.43.3 → 2.44.0

package/dist/modules/scim/database/scim-api-key.repository.d.ts

@@ -0,0 +1,11 @@
+import { ApiKey, BaseRepository, TransactionRunner, type OperationContext } from '@n8n/db';
+import { DataSource } from '@n8n/typeorm';
+export declare class ScimApiKeyRepository extends BaseRepository<ApiKey> {
+    private readonly audience;
+    private readonly label;
+    constructor(dataSource: DataSource, transactionRunner: TransactionRunner);
+    findByUserId(userId: string, ctx: OperationContext): Promise<ApiKey | null>;
+    findByKey(apiKey: string, ctx: OperationContext): Promise<ApiKey | null>;
+    replaceForUser(userId: string, apiKey: string, ctx: OperationContext): Promise<ApiKey>;
+    deleteAllForUser(userId: string, ctx: OperationContext): Promise<void>;
+}

package/dist/modules/scim/database/scim-api-key.repository.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScimApiKeyRepository = void 0;
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const typeorm_1 = require("@n8n/typeorm");
+const token_purposes_1 = require("../../../services/token-purposes");
+let ScimApiKeyRepository = class ScimApiKeyRepository extends db_1.BaseRepository {
+    constructor(dataSource, transactionRunner) {
+        super(db_1.ApiKey, dataSource.manager, transactionRunner);
+        this.audience = token_purposes_1.TOKEN_PURPOSES.scimApiKey;
+        this.label = 'SCIM Provisioning API Key';
+    }
+    async findByUserId(userId, ctx) {
+        return await this.managerFor(ctx).findOne(db_1.ApiKey, {
+            where: { userId, audience: this.audience },
+        });
+    }
+    async findByKey(apiKey, ctx) {
+        return await this.managerFor(ctx).findOne(db_1.ApiKey, {
+            where: { apiKey, audience: this.audience },
+            relations: ['user'],
+        });
+    }
+    async replaceForUser(userId, apiKey, ctx) {
+        const { audience, label } = this;
+        return await this.runInTransaction(ctx, async (tx) => {
+            await tx.delete(db_1.ApiKey, { userId, audience });
+            await tx.insert(db_1.ApiKey, this.create({ userId, apiKey, audience, scopes: [], label }));
+            return await tx.findOneByOrFail(db_1.ApiKey, { apiKey });
+        });
+    }
+    async deleteAllForUser(userId, ctx) {
+        await this.managerFor(ctx).delete(db_1.ApiKey, { userId, audience: this.audience });
+    }
+};
+exports.ScimApiKeyRepository = ScimApiKeyRepository;
+exports.ScimApiKeyRepository = ScimApiKeyRepository = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource, db_1.TransactionRunner])
+], ScimApiKeyRepository);
+//# sourceMappingURL=scim-api-key.repository.js.map

package/dist/modules/scim/database/scim-api-key.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-api-key.repository.js","sourceRoot":"","sources":["../../../../src/modules/scim/database/scim-api-key.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAA2F;AAC3F,gCAAkC;AAClC,0CAA0C;AAE1C,8DAA2D;AAYpD,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,mBAAsB;IAc/D,YAAY,UAAsB,EAAE,iBAAoC;QACvE,KAAK,CAAC,WAAM,EAAE,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAdrC,aAAQ,GAAG,+BAAc,CAAC,UAAU,CAAC;QAWrC,UAAK,GAAG,2BAA2B,CAAC;IAIrD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,GAAqB;QACvD,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAM,EAAE;YACjD,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;SAC1C,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,GAAqB;QACpD,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAM,EAAE;YACjD,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;YAC1C,SAAS,EAAE,CAAC,MAAM,CAAC;SACnB,CAAC,CAAC;IACJ,CAAC;IAYD,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,GAAqB;QACzE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAEjC,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACpD,MAAM,EAAE,CAAC,MAAM,CAAC,WAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9C,MAAM,EAAE,CAAC,MAAM,CAAC,WAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAEtF,OAAO,MAAM,EAAE,CAAC,eAAe,CAAC,WAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,GAAqB;QAC3D,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChF,CAAC;CACD,CAAA;;+BAvDY,oBAAoB;IADhC,IAAA,YAAO,GAAE;qCAee,oBAAU,EAAqB,sBAAiB;GAd5D,oBAAoB,CAuDhC"}

package/dist/modules/scim/scim-auth.middleware.d.ts

@@ -0,0 +1,14 @@
+import { Logger } from '@n8n/backend-common';
+import type { AuthenticatedRequest } from '@n8n/db';
+import type { NextFunction, RequestHandler, Response } from 'express';
+import { ScimSettingsService } from './scim-settings.service';
+import { ScimTokenService } from './scim-token.service';
+export declare class ScimAuthMiddleware {
+    private readonly logger;
+    private readonly scimTokenService;
+    private readonly scimSettingsService;
+    constructor(logger: Logger, scimTokenService: ScimTokenService, scimSettingsService: ScimSettingsService);
+    getAuthMiddleware(): RequestHandler;
+    authenticate(req: AuthenticatedRequest, res: Response, next: NextFunction): Promise<void | Response<any, Record<string, any>>>;
+    private unauthorized;
+}

package/dist/modules/scim/scim-auth.middleware.js

@@ -0,0 +1,80 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScimAuthMiddleware = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const di_1 = require("@n8n/di");
+const scim_settings_service_1 = require("./scim-settings.service");
+const scim_token_service_1 = require("./scim-token.service");
+let ScimAuthMiddleware = class ScimAuthMiddleware {
+    constructor(logger, scimTokenService, scimSettingsService) {
+        this.logger = logger;
+        this.scimTokenService = scimTokenService;
+        this.scimSettingsService = scimSettingsService;
+    }
+    getAuthMiddleware() {
+        return this.authenticate.bind(this);
+    }
+    async authenticate(req, res, next) {
+        try {
+            if (!(await this.scimSettingsService.isEnabled())) {
+                return res
+                    .status(403)
+                    .header('Content-Type', 'application/scim+json')
+                    .json({
+                    schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'],
+                    status: '403',
+                    detail: 'SCIM provisioning is disabled',
+                });
+            }
+            const bearer = /^Bearer[ \t]+(.+)$/i.exec(req.headers.authorization ?? '');
+            if (!bearer) {
+                this.logger.warn('SCIM: Missing or invalid Authorization header');
+                return this.unauthorized(res, 'Authorization header with Bearer token required');
+            }
+            const token = bearer[1].trim();
+            const isValid = await this.scimTokenService.verifyApiKey(token);
+            if (!isValid) {
+                this.logger.warn('SCIM: Invalid API key provided');
+                return this.unauthorized(res, 'Invalid SCIM API key');
+            }
+            return next();
+        }
+        catch (error) {
+            this.logger.error('SCIM: Error during authentication', { error });
+            return res
+                .status(500)
+                .header('Content-Type', 'application/scim+json')
+                .json({
+                schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'],
+                status: '500',
+                detail: 'Internal server error',
+            });
+        }
+    }
+    unauthorized(res, detail) {
+        return res
+            .status(401)
+            .header('WWW-Authenticate', 'Bearer realm="n8n SCIM"')
+            .header('Content-Type', 'application/scim+json')
+            .json({
+            schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'],
+            status: '401',
+            detail,
+        });
+    }
+};
+exports.ScimAuthMiddleware = ScimAuthMiddleware;
+exports.ScimAuthMiddleware = ScimAuthMiddleware = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger, scim_token_service_1.ScimTokenService, scim_settings_service_1.ScimSettingsService])
+], ScimAuthMiddleware);
+//# sourceMappingURL=scim-auth.middleware.js.map

package/dist/modules/scim/scim-auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-auth.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAE7C,gCAAkC;AAGlC,mEAA8D;AAC9D,6DAAwD;AAMjD,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC9B,YACkB,MAAc,EACd,gBAAkC,EAClC,mBAAwC;sBAFxC,MAAM;gCACN,gBAAgB;mCAChB,mBAAmB;IAClC,CAAC;IAEJ,iBAAiB;QAChB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAmB,CAAC;IACvD,CAAC;IAKD,KAAK,CAAC,YAAY,CAAC,GAAyB,EAAE,GAAa,EAAE,IAAkB;QAC9E,IAAI,CAAC;YACJ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;gBACnD,OAAO,GAAG;qBACR,MAAM,CAAC,GAAG,CAAC;qBACX,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC;qBAC/C,IAAI,CAAC;oBACL,OAAO,EAAE,CAAC,6CAA6C,CAAC;oBACxD,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,+BAA+B;iBACvC,CAAC,CAAC;YACL,CAAC;YAID,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YAE3E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;gBAClE,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,iDAAiD,CAAC,CAAC;YAClF,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAEhE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBACnD,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YACvD,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,OAAO,GAAG;iBACR,MAAM,CAAC,GAAG,CAAC;iBACX,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC;iBAC/C,IAAI,CAAC;gBACL,OAAO,EAAE,CAAC,6CAA6C,CAAC;gBACxD,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,uBAAuB;aAC/B,CAAC,CAAC;QACL,CAAC;IACF,CAAC;IAEO,YAAY,CAAC,GAAa,EAAE,MAAc;QACjD,OAAO,GAAG;aACR,MAAM,CAAC,GAAG,CAAC;aACX,MAAM,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;aACrD,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC;aAC/C,IAAI,CAAC;YACL,OAAO,EAAE,CAAC,6CAA6C,CAAC;YACxD,MAAM,EAAE,KAAK;YACb,MAAM;SACN,CAAC,CAAC;IACL,CAAC;CACD,CAAA;;6BAtEY,kBAAkB;IAD9B,IAAA,YAAO,GAAE;qCAGiB,uBAAM,EACI,qCAAgB,EACb,2CAAmB;GAJ9C,kBAAkB,CAsE9B"}

package/dist/modules/scim/scim-discovery.controller.d.ts

@@ -0,0 +1,7 @@
+import type { AuthenticatedRequest } from '@n8n/db';
+import type { Response } from 'express';
+export declare class ScimDiscoveryController {
+    getServiceProviderConfig(_req: AuthenticatedRequest, res: Response): Response<any, Record<string, any>>;
+    getResourceTypes(_req: AuthenticatedRequest, res: Response): Response<any, Record<string, any>>;
+    getSchemas(_req: AuthenticatedRequest, res: Response): Response<any, Record<string, any>>;
+}

package/dist/modules/scim/scim-discovery.controller.js

@@ -0,0 +1,90 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScimDiscoveryController = void 0;
+const decorators_1 = require("@n8n/decorators");
+const scim_route_1 = require("./scim-route");
+let ScimDiscoveryController = class ScimDiscoveryController {
+    getServiceProviderConfig(_req, res) {
+        return res.header('Content-Type', 'application/scim+json').json({
+            schemas: ['urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig'],
+            documentationUri: 'https://docs.n8n.io/user-management/scim/',
+            patch: {
+                supported: false,
+            },
+            bulk: {
+                supported: false,
+                maxOperations: 0,
+                maxPayloadSize: 0,
+            },
+            filter: {
+                supported: false,
+                maxResults: 0,
+            },
+            changePassword: {
+                supported: false,
+            },
+            sort: {
+                supported: false,
+            },
+            etag: {
+                supported: false,
+            },
+            authenticationSchemes: [
+                {
+                    type: 'oauthbearertoken',
+                    name: 'OAuth Bearer Token',
+                    description: 'Authentication scheme using the OAuth Bearer Token Standard',
+                    specUri: 'https://tools.ietf.org/html/rfc6750',
+                    documentationUri: 'https://docs.n8n.io/user-management/scim/',
+                    primary: true,
+                },
+            ],
+        });
+    }
+    getResourceTypes(_req, res) {
+        return res.header('Content-Type', 'application/scim+json').json({
+            schemas: ['urn:ietf:params:scim:api:messages:2.0:ListResponse'],
+            totalResults: 0,
+            Resources: [],
+        });
+    }
+    getSchemas(_req, res) {
+        return res.header('Content-Type', 'application/scim+json').json({
+            schemas: ['urn:ietf:params:scim:api:messages:2.0:ListResponse'],
+            totalResults: 0,
+            Resources: [],
+        });
+    }
+};
+exports.ScimDiscoveryController = ScimDiscoveryController;
+__decorate([
+    (0, decorators_1.Get)('/ServiceProviderConfig', scim_route_1.scimRoute),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", void 0)
+], ScimDiscoveryController.prototype, "getServiceProviderConfig", null);
+__decorate([
+    (0, decorators_1.Get)('/ResourceTypes', scim_route_1.scimRoute),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", void 0)
+], ScimDiscoveryController.prototype, "getResourceTypes", null);
+__decorate([
+    (0, decorators_1.Get)('/Schemas', scim_route_1.scimRoute),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", void 0)
+], ScimDiscoveryController.prototype, "getSchemas", null);
+exports.ScimDiscoveryController = ScimDiscoveryController = __decorate([
+    (0, decorators_1.RootLevelController)('/scim/v2')
+], ScimDiscoveryController);
+//# sourceMappingURL=scim-discovery.controller.js.map

package/dist/modules/scim/scim-discovery.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-discovery.controller.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-discovery.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,gDAA2D;AAG3D,6CAAyC;AAclC,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAMnC,wBAAwB,CAAC,IAA0B,EAAE,GAAa;QACjE,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC;YAC/D,OAAO,EAAE,CAAC,6DAA6D,CAAC;YACxE,gBAAgB,EAAE,2CAA2C;YAC7D,KAAK,EAAE;gBACN,SAAS,EAAE,KAAK;aAChB;YACD,IAAI,EAAE;gBACL,SAAS,EAAE,KAAK;gBAChB,aAAa,EAAE,CAAC;gBAChB,cAAc,EAAE,CAAC;aACjB;YACD,MAAM,EAAE;gBACP,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,CAAC;aACb;YACD,cAAc,EAAE;gBACf,SAAS,EAAE,KAAK;aAChB;YACD,IAAI,EAAE;gBACL,SAAS,EAAE,KAAK;aAChB;YACD,IAAI,EAAE;gBACL,SAAS,EAAE,KAAK;aAChB;YACD,qBAAqB,EAAE;gBACtB;oBACC,IAAI,EAAE,kBAAkB;oBACxB,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,6DAA6D;oBAC1E,OAAO,EAAE,qCAAqC;oBAC9C,gBAAgB,EAAE,2CAA2C;oBAC7D,OAAO,EAAE,IAAI;iBACb;aACD;SACD,CAAC,CAAC;IACJ,CAAC;IAOD,gBAAgB,CAAC,IAA0B,EAAE,GAAa;QACzD,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC;YAC/D,OAAO,EAAE,CAAC,oDAAoD,CAAC;YAC/D,YAAY,EAAE,CAAC;YACf,SAAS,EAAE,EAAE;SACb,CAAC,CAAC;IACJ,CAAC;IAOD,UAAU,CAAC,IAA0B,EAAE,GAAa;QACnD,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC;YAC/D,OAAO,EAAE,CAAC,oDAAoD,CAAC;YAC/D,YAAY,EAAE,CAAC;YACf,SAAS,EAAE,EAAE;SACb,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;;AA/DA;IADC,IAAA,gBAAG,EAAC,wBAAwB,EAAE,sBAAS,CAAC;;;;uEAqCxC;AAOD;IADC,IAAA,gBAAG,EAAC,gBAAgB,EAAE,sBAAS,CAAC;;;;+DAOhC;AAOD;IADC,IAAA,gBAAG,EAAC,UAAU,EAAE,sBAAS,CAAC;;;;yDAO1B;kCApEW,uBAAuB;IADnC,IAAA,gCAAmB,EAAC,UAAU,CAAC;GACnB,uBAAuB,CAqEnC"}

package/dist/modules/scim/scim-route.d.ts

@@ -0,0 +1,9 @@
+import { createIpRateLimit } from '@n8n/decorators';
+import type { RequestHandler } from 'express';
+export declare const scimRoute: {
+    skipAuth: boolean;
+    usesTemplates: boolean;
+    allowBots: boolean;
+    middlewares: RequestHandler[];
+    ipRateLimit: ReturnType<typeof createIpRateLimit>;
+};

package/dist/modules/scim/scim-route.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scimRoute = void 0;
+const decorators_1 = require("@n8n/decorators");
+const di_1 = require("@n8n/di");
+const scim_auth_middleware_1 = require("./scim-auth.middleware");
+const scim_config_1 = require("./scim.config");
+const scimAuth = () => di_1.Container.get(scim_auth_middleware_1.ScimAuthMiddleware).getAuthMiddleware();
+const scimConfig = di_1.Container.get(scim_config_1.ScimConfig);
+exports.scimRoute = {
+    skipAuth: true,
+    usesTemplates: true,
+    allowBots: true,
+    middlewares: [scimAuth()],
+    ipRateLimit: (0, decorators_1.createIpRateLimit)(scimConfig.rateLimit),
+};
+//# sourceMappingURL=scim-route.js.map

package/dist/modules/scim/scim-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-route.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-route.ts"],"names":[],"mappings":";;;AAAA,gDAAoD;AACpD,gCAAoC;AAGpC,iEAA4D;AAC5D,+CAA2C;AAE3C,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,cAAS,CAAC,GAAG,CAAC,yCAAkB,CAAC,CAAC,iBAAiB,EAAE,CAAC;AAE7E,MAAM,UAAU,GAAG,cAAS,CAAC,GAAG,CAAC,wBAAU,CAAC,CAAC;AAOhC,QAAA,SAAS,GAMlB;IACH,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;IAGnB,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC;IACzB,WAAW,EAAE,IAAA,8BAAiB,EAAC,UAAU,CAAC,SAAS,CAAC;CACpD,CAAC"}

package/dist/modules/scim/scim-settings.service.d.ts

@@ -0,0 +1,9 @@
+import { SettingsRepository } from '@n8n/db';
+import { CacheService } from '@n8n/backend-services';
+export declare class ScimSettingsService {
+    private readonly settingsRepository;
+    private readonly cacheService;
+    constructor(settingsRepository: SettingsRepository, cacheService: CacheService);
+    isEnabled(): Promise<boolean>;
+    setEnabled(enabled: boolean): Promise<void>;
+}

package/dist/modules/scim/scim-settings.service.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScimSettingsService = void 0;
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const backend_services_1 = require("@n8n/backend-services");
+const ENABLED_KEY = 'scim.provisioning.enabled';
+let ScimSettingsService = class ScimSettingsService {
+    constructor(settingsRepository, cacheService) {
+        this.settingsRepository = settingsRepository;
+        this.cacheService = cacheService;
+    }
+    async isEnabled() {
+        const cached = await this.cacheService.get(ENABLED_KEY);
+        if (cached !== undefined)
+            return cached === 'true';
+        const row = await this.settingsRepository.findByKey(ENABLED_KEY);
+        const enabled = row?.value === 'true';
+        await this.cacheService.set(ENABLED_KEY, enabled.toString());
+        return enabled;
+    }
+    async setEnabled(enabled) {
+        await this.settingsRepository.upsert({ key: ENABLED_KEY, value: enabled.toString(), loadOnStartup: true }, ['key']);
+        await this.cacheService.set(ENABLED_KEY, enabled.toString());
+    }
+};
+exports.ScimSettingsService = ScimSettingsService;
+exports.ScimSettingsService = ScimSettingsService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [db_1.SettingsRepository, backend_services_1.CacheService])
+], ScimSettingsService);
+//# sourceMappingURL=scim-settings.service.js.map

package/dist/modules/scim/scim-settings.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-settings.service.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-settings.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAA6C;AAC7C,gCAAkC;AAElC,4DAAqD;AAErD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAQzC,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC/B,YACkB,kBAAsC,EACtC,YAA0B;kCAD1B,kBAAkB;4BAClB,YAAY;IAC3B,CAAC;IAEJ,KAAK,CAAC,SAAS;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,WAAW,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,KAAK,MAAM,CAAC;QAEnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,GAAG,EAAE,KAAK,KAAK,MAAM,CAAC;QAEtC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE7D,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAgB;QAChC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CACnC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EACpE,CAAC,KAAK,CAAC,CACP,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;CACD,CAAA;;8BA1BY,mBAAmB;IAD/B,IAAA,YAAO,GAAE;qCAG6B,uBAAkB,EACxB,+BAAY;GAHhC,mBAAmB,CA0B/B"}

package/dist/modules/scim/scim-token.controller.d.ts

@@ -0,0 +1,17 @@
+import { ScimConfigPatchDto } from '@n8n/api-types';
+import { Logger, ModuleRegistry } from '@n8n/backend-common';
+import type { AuthenticatedRequest } from '@n8n/db';
+import type { Response } from 'express';
+import { ScimSettingsService } from './scim-settings.service';
+import { ScimTokenService } from './scim-token.service';
+export declare class ScimTokenController {
+    private readonly logger;
+    private readonly scimTokenService;
+    private readonly scimSettingsService;
+    private readonly moduleRegistry;
+    constructor(logger: Logger, scimTokenService: ScimTokenService, scimSettingsService: ScimSettingsService, moduleRegistry: ModuleRegistry);
+    getConfig(req: AuthenticatedRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    updateConfig(_req: AuthenticatedRequest, res: Response, body: ScimConfigPatchDto): Promise<Response<any, Record<string, any>>>;
+    generateToken(req: AuthenticatedRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    deleteToken(req: AuthenticatedRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+}

package/dist/modules/scim/scim-token.controller.js

@@ -0,0 +1,115 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScimTokenController = void 0;
+const api_types_1 = require("@n8n/api-types");
+const backend_common_1 = require("@n8n/backend-common");
+const decorators_1 = require("@n8n/decorators");
+const scim_settings_service_1 = require("./scim-settings.service");
+const scim_token_service_1 = require("./scim-token.service");
+let ScimTokenController = class ScimTokenController {
+    constructor(logger, scimTokenService, scimSettingsService, moduleRegistry) {
+        this.logger = logger;
+        this.scimTokenService = scimTokenService;
+        this.scimSettingsService = scimSettingsService;
+        this.moduleRegistry = moduleRegistry;
+    }
+    async getConfig(req, res) {
+        try {
+            const [enabled, tokenInfo] = await Promise.all([
+                this.scimSettingsService.isEnabled(),
+                this.scimTokenService.getTokenInfoForUser(req.user),
+            ]);
+            return res.status(200).json({
+                data: {
+                    enabled,
+                    hasToken: tokenInfo.hasToken,
+                    tokenHint: tokenInfo.lastFour,
+                    baseUrl: this.scimTokenService.getScimBaseUrl(),
+                },
+            });
+        }
+        catch (error) {
+            this.logger.error('Error getting SCIM config', { error });
+            return res.status(500).json({ message: 'Internal server error' });
+        }
+    }
+    async updateConfig(_req, res, body) {
+        try {
+            await this.scimSettingsService.setEnabled(body.enabled);
+            await this.moduleRegistry.refreshModuleSettings('scim');
+            return res.status(200).json({ data: { enabled: body.enabled } });
+        }
+        catch (error) {
+            this.logger.error('Error updating SCIM config', { error });
+            return res.status(500).json({ message: 'Internal server error' });
+        }
+    }
+    async generateToken(req, res) {
+        try {
+            const apiKey = await this.scimTokenService.rotateScimApiKey(req.user);
+            const baseUrl = this.scimTokenService.getScimBaseUrl();
+            return res.status(201).json({ data: { token: apiKey.apiKey, baseUrl } });
+        }
+        catch (error) {
+            this.logger.error('Error generating SCIM token', { error });
+            return res.status(500).json({ message: 'Internal server error' });
+        }
+    }
+    async deleteToken(req, res) {
+        try {
+            await this.scimTokenService.deleteAllScimApiKeysForUser(req.user);
+            return res.status(200).json({ data: { success: true } });
+        }
+        catch (error) {
+            this.logger.error('Error deleting SCIM token', { error });
+            return res.status(500).json({ message: 'Internal server error' });
+        }
+    }
+};
+exports.ScimTokenController = ScimTokenController;
+__decorate([
+    (0, decorators_1.Get)('/config'),
+    (0, decorators_1.GlobalScope)('scim:manage'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], ScimTokenController.prototype, "getConfig", null);
+__decorate([
+    (0, decorators_1.Patch)('/config'),
+    (0, decorators_1.GlobalScope)('scim:manage'),
+    __param(2, decorators_1.Body),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, api_types_1.ScimConfigPatchDto]),
+    __metadata("design:returntype", Promise)
+], ScimTokenController.prototype, "updateConfig", null);
+__decorate([
+    (0, decorators_1.Post)('/token'),
+    (0, decorators_1.GlobalScope)('scim:manage'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], ScimTokenController.prototype, "generateToken", null);
+__decorate([
+    (0, decorators_1.Delete)('/token'),
+    (0, decorators_1.GlobalScope)('scim:manage'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], ScimTokenController.prototype, "deleteToken", null);
+exports.ScimTokenController = ScimTokenController = __decorate([
+    (0, decorators_1.RestController)('/scim'),
+    __metadata("design:paramtypes", [backend_common_1.Logger, scim_token_service_1.ScimTokenService, scim_settings_service_1.ScimSettingsService, backend_common_1.ModuleRegistry])
+], ScimTokenController);
+//# sourceMappingURL=scim-token.controller.js.map

package/dist/modules/scim/scim-token.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-token.controller.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-token.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8CAAoD;AACpD,wDAA6D;AAE7D,gDAA8F;AAG9F,mEAA8D;AAC9D,6DAAwD;AAWjD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC/B,YACkB,MAAc,EACd,gBAAkC,EAClC,mBAAwC,EACxC,cAA8B;sBAH9B,MAAM;gCACN,gBAAgB;mCAChB,mBAAmB;8BACnB,cAAc;IAC7B,CAAC;IAQE,AAAN,KAAK,CAAC,SAAS,CAAC,GAAyB,EAAE,GAAa;QACvD,IAAI,CAAC;YACJ,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC9C,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE;gBACpC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;aACnD,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC3B,IAAI,EAAE;oBACL,OAAO;oBACP,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,SAAS,EAAE,SAAS,CAAC,QAAQ;oBAC7B,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE;iBAC/C;aACD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IASK,AAAN,KAAK,CAAC,YAAY,CAAC,IAA0B,EAAE,GAAa,EAAQ,IAAwB;QAC3F,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAGxD,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAExD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IASK,AAAN,KAAK,CAAC,aAAa,CAAC,GAAyB,EAAE,GAAa;QAC3D,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC;YAEvD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IAQK,AAAN,KAAK,CAAC,WAAW,CAAC,GAAyB,EAAE,GAAa;QACzD,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAElE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;CACD,CAAA;;AA7EM;IAFL,IAAA,gBAAG,EAAC,SAAS,CAAC;IACd,IAAA,wBAAW,EAAC,aAAa,CAAC;;;;oDAoB1B;AASK;IAFL,IAAA,kBAAK,EAAC,SAAS,CAAC;IAChB,IAAA,wBAAW,EAAC,aAAa,CAAC;IACoC,WAAA,iBAAI,CAAA;;qDAAO,8BAAkB;;uDAY3F;AASK;IAFL,IAAA,iBAAI,EAAC,QAAQ,CAAC;IACd,IAAA,wBAAW,EAAC,aAAa,CAAC;;;;wDAW1B;AAQK;IAFL,IAAA,mBAAM,EAAC,QAAQ,CAAC;IAChB,IAAA,wBAAW,EAAC,aAAa,CAAC;;;;sDAU1B;8BA1FW,mBAAmB;IAD/B,IAAA,2BAAc,EAAC,OAAO,CAAC;qCAGG,uBAAM,EACI,qCAAgB,EACb,2CAAmB,EACxB,+BAAc;GALpC,mBAAmB,CA2F/B"}

package/dist/modules/scim/scim-token.service.d.ts

@@ -0,0 +1,23 @@
+import { type OperationContext, type User } from '@n8n/db';
+import { JwtService } from '../../services/jwt.service';
+import { UrlService } from '@n8n/backend-services';
+import { ScimApiKeyRepository } from './database/scim-api-key.repository';
+export declare class ScimTokenService {
+    private readonly apiKeyRepository;
+    private readonly jwtService;
+    private readonly urlService;
+    constructor(apiKeyRepository: ScimApiKeyRepository, jwtService: JwtService, urlService: UrlService);
+    private signApiKey;
+    getTokenInfoForUser(user: User, ctx?: OperationContext): Promise<{
+        hasToken: boolean;
+        lastFour: string | null;
+    }>;
+    findScimApiKeyForUser(user: User, { redact }?: {
+        redact?: boolean | undefined;
+    }, ctx?: OperationContext): Promise<import("@n8n/db").ApiKey | null>;
+    verifyApiKey(apiKey: string, ctx?: OperationContext): Promise<boolean>;
+    deleteAllScimApiKeysForUser(user: User, ctx?: OperationContext): Promise<void>;
+    rotateScimApiKey(user: User, ctx?: OperationContext): Promise<import("@n8n/db").ApiKey>;
+    getScimBaseUrl(): string;
+    private redactApiKey;
+}

package/dist/modules/scim/scim-token.service.js

@@ -0,0 +1,83 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScimTokenService = void 0;
+const di_1 = require("@n8n/di");
+const crypto_1 = require("crypto");
+const jwt_service_1 = require("../../services/jwt.service");
+const backend_services_1 = require("@n8n/backend-services");
+const scim_api_key_repository_1 = require("./database/scim-api-key.repository");
+const API_KEY_PURPOSE = 'scimApiKey';
+const API_KEY_ISSUER = 'n8n';
+const REDACT_API_KEY_REVEAL_COUNT = 4;
+const REDACT_API_KEY_MAX_LENGTH = 10;
+const REDACT_API_KEY_MIN_HIDDEN_CHARS = 6;
+let ScimTokenService = class ScimTokenService {
+    constructor(apiKeyRepository, jwtService, urlService) {
+        this.apiKeyRepository = apiKeyRepository;
+        this.jwtService = jwtService;
+        this.urlService = urlService;
+    }
+    signApiKey(user) {
+        return this.jwtService.sign(API_KEY_PURPOSE, {
+            sub: user.id,
+            iss: API_KEY_ISSUER,
+            jti: (0, crypto_1.randomUUID)(),
+        });
+    }
+    async getTokenInfoForUser(user, ctx = {}) {
+        const apiKey = await this.apiKeyRepository.findByUserId(user.id, ctx);
+        return {
+            hasToken: !!apiKey,
+            lastFour: apiKey ? apiKey.apiKey.slice(-REDACT_API_KEY_REVEAL_COUNT) : null,
+        };
+    }
+    async findScimApiKeyForUser(user, { redact = true } = {}, ctx = {}) {
+        const apiKey = await this.apiKeyRepository.findByUserId(user.id, ctx);
+        if (apiKey && redact) {
+            apiKey.apiKey = this.redactApiKey(apiKey.apiKey);
+        }
+        return apiKey;
+    }
+    async verifyApiKey(apiKey, ctx = {}) {
+        try {
+            this.jwtService.verify(API_KEY_PURPOSE, apiKey, { issuer: API_KEY_ISSUER });
+        }
+        catch {
+            return false;
+        }
+        const key = await this.apiKeyRepository.findByKey(apiKey, ctx);
+        return !!key && !!key.user && !key.user.disabled;
+    }
+    async deleteAllScimApiKeysForUser(user, ctx = {}) {
+        await this.apiKeyRepository.deleteAllForUser(user.id, ctx);
+    }
+    async rotateScimApiKey(user, ctx = {}) {
+        return await this.apiKeyRepository.replaceForUser(user.id, this.signApiKey(user), ctx);
+    }
+    getScimBaseUrl() {
+        return `${this.urlService.getInstanceBaseUrl()}/scim/v2`;
+    }
+    redactApiKey(apiKey) {
+        if (REDACT_API_KEY_REVEAL_COUNT >= apiKey.length - REDACT_API_KEY_MIN_HIDDEN_CHARS) {
+            return '*'.repeat(apiKey.length);
+        }
+        const visiblePart = apiKey.slice(-REDACT_API_KEY_REVEAL_COUNT);
+        const redactedPart = '*'.repeat(Math.max(0, REDACT_API_KEY_MAX_LENGTH - REDACT_API_KEY_REVEAL_COUNT));
+        return redactedPart + visiblePart;
+    }
+};
+exports.ScimTokenService = ScimTokenService;
+exports.ScimTokenService = ScimTokenService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [scim_api_key_repository_1.ScimApiKeyRepository, jwt_service_1.JwtService, backend_services_1.UrlService])
+], ScimTokenService);
+//# sourceMappingURL=scim-token.service.js.map

package/dist/modules/scim/scim-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-token.service.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,gCAAkC;AAClC,mCAAoC;AAEpC,wDAAoD;AACpD,4DAAmD;AAEnD,gFAA0E;AAE1E,MAAM,eAAe,GAAG,YAAqB,CAAC;AAC9C,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,2BAA2B,GAAG,CAAC,CAAC;AACtC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAMnC,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC5B,YACkB,gBAAsC,EACtC,UAAsB,EACtB,UAAsB;gCAFtB,gBAAgB;0BAChB,UAAU;0BACV,UAAU;IACzB,CAAC;IAEI,UAAU,CAAC,IAAU;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,EAAE;YAC5C,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,IAAA,mBAAU,GAAE;SACjB,CAAC,CAAC;IACJ,CAAC;IAMD,KAAK,CAAC,mBAAmB,CACxB,IAAU,EACV,GAAG,GAAqB,EAAE;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAEtE,OAAO;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM;YAClB,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,IAAI;SAC3E,CAAC;IACH,CAAC;IAKD,KAAK,CAAC,qBAAqB,CAAC,IAAU,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,GAAqB,EAAE;QACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAEtE,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAMD,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,GAAG,GAAqB,EAAE;QAC5D,IAAI,CAAC;YACJ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YAER,OAAO,KAAK,CAAC;QACd,CAAC;QAKD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE/D,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;IAClD,CAAC;IAKD,KAAK,CAAC,2BAA2B,CAAC,IAAU,EAAE,GAAG,GAAqB,EAAE;QACvE,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAKD,KAAK,CAAC,gBAAgB,CAAC,IAAU,EAAE,GAAG,GAAqB,EAAE;QAC5D,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACxF,CAAC;IAKD,cAAc;QACb,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC;IAC1D,CAAC;IAKO,YAAY,CAAC,MAAc;QAClC,IAAI,2BAA2B,IAAI,MAAM,CAAC,MAAM,GAAG,+BAA+B,EAAE,CAAC;YACpF,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,GAAG,2BAA2B,CAAC,CACpE,CAAC;QAEF,OAAO,YAAY,GAAG,WAAW,CAAC;IACnC,CAAC;CACD,CAAA;;2BApGY,gBAAgB;IAD5B,IAAA,YAAO,GAAE;qCAG2B,8CAAoB,EAC1B,wBAAU,EACV,6BAAU;GAJ5B,gBAAgB,CAoG5B"}

package/dist/modules/scim/scim.config.d.ts

@@ -0,0 +1,3 @@
+export declare class ScimConfig {
+    rateLimit: number;
+}