n8n 2.45.4 → 2.46.0

package/dist/modules/scim/database/scim-token.repository.js

@@ -0,0 +1,95 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScimTokenRepository = exports.SCIM_TOKEN_SETTINGS_KEY = void 0;
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const typeorm_1 = require("@n8n/typeorm");
+const n8n_workflow_1 = require("n8n-workflow");
+const zod_1 = require("zod");
+const scim_errors_1 = require("../scim.errors");
+exports.SCIM_TOKEN_SETTINGS_KEY = 'scim.provisioning.token';
+const isoDate = zod_1.z
+    .string()
+    .datetime()
+    .transform((value) => new Date(value));
+const storedTokenSchema = zod_1.z.object({
+    tokenHash: zod_1.z.string().regex(/^[0-9a-f]{64}$/),
+    tokenHint: zod_1.z.string(),
+    createdById: zod_1.z.string(),
+    createdAt: isoDate,
+});
+const tokenStateSchema = zod_1.z.object({ current: storedTokenSchema.nullable() });
+const NO_TOKEN = { current: null };
+const parseState = (value) => {
+    const result = tokenStateSchema.safeParse((0, n8n_workflow_1.jsonParse)(value, { fallbackValue: null }));
+    return result.success ? result.data : NO_TOKEN;
+};
+class SettingsTable extends db_1.BaseRepository {
+    constructor(dataSource, transactionRunner) {
+        super(db_1.Settings, dataSource.manager, transactionRunner);
+    }
+}
+let ScimTokenRepository = class ScimTokenRepository {
+    constructor(dataSource, transactionRunner) {
+        this.table = new SettingsTable(dataSource, transactionRunner);
+    }
+    async findInstanceToken(ctx) {
+        const row = await this.table
+            .managerFor(ctx)
+            .findOneBy(db_1.Settings, { key: exports.SCIM_TOKEN_SETTINGS_KEY });
+        return row ? parseState(row.value).current : null;
+    }
+    async replace(expectedTokenHash, token, ctx) {
+        await this.table.runInTransaction(ctx, async (tx) => {
+            const state = await this.lockState(tx);
+            if ((state.current?.tokenHash ?? null) !== expectedTokenHash) {
+                throw new scim_errors_1.ScimTokenConflictError();
+            }
+            await this.write(tx, { ...state, current: token });
+        });
+    }
+    async revokeInstanceToken(ctx) {
+        await this.table.runInTransaction(ctx, async (tx) => {
+            const state = await this.lockState(tx);
+            if (!state.current)
+                return;
+            await this.write(tx, { ...state, current: null });
+        });
+    }
+    async lockState(tx) {
+        await tx
+            .createQueryBuilder()
+            .insert()
+            .into(db_1.Settings)
+            .values({
+            key: exports.SCIM_TOKEN_SETTINGS_KEY,
+            value: JSON.stringify(NO_TOKEN),
+            loadOnStartup: false,
+        })
+            .orIgnore()
+            .execute();
+        const row = await tx.findOneOrFail(db_1.Settings, {
+            where: { key: exports.SCIM_TOKEN_SETTINGS_KEY },
+            lock: tx.connection.options.type === 'postgres' ? { mode: 'pessimistic_write' } : undefined,
+        });
+        return parseState(row.value);
+    }
+    async write(tx, state) {
+        await tx.update(db_1.Settings, { key: exports.SCIM_TOKEN_SETTINGS_KEY }, { value: JSON.stringify(state) });
+    }
+};
+exports.ScimTokenRepository = ScimTokenRepository;
+exports.ScimTokenRepository = ScimTokenRepository = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource, db_1.TransactionRunner])
+], ScimTokenRepository);
+//# sourceMappingURL=scim-token.repository.js.map

package/dist/modules/scim/database/scim-token.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-token.repository.js","sourceRoot":"","sources":["../../../../src/modules/scim/database/scim-token.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAA6F;AAC7F,gCAAkC;AAClC,0CAA8D;AAC9D,+CAAyC;AACzC,6BAAwB;AAExB,gDAAwD;AAG3C,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE,MAAM,OAAO,GAAG,OAAC;KACf,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAExC,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IAElC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAE7C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE;IAErB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,OAAO;CAClB,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAO7E,MAAM,QAAQ,GAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAMnD,MAAM,UAAU,GAAG,CAAC,KAAa,EAAkB,EAAE;IACpD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAA,wBAAS,EAAU,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9F,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,aAAc,SAAQ,mBAAwB;IACnD,YAAY,UAAsB,EAAE,iBAAoC;QACvE,KAAK,CAAC,aAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACxD,CAAC;CACD;AAQM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAG/B,YAAY,UAAsB,EAAE,iBAAoC;QACvE,IAAI,CAAC,KAAK,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAqB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK;aAC1B,UAAU,CAAC,GAAG,CAAC;aACf,SAAS,CAAC,aAAQ,EAAE,EAAE,GAAG,EAAE,QAAA,uBAAuB,EAAE,CAAC,CAAC;QAExD,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAUD,KAAK,CAAC,OAAO,CACZ,iBAAgC,EAChC,KAAmB,EACnB,GAAqB;QAErB,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAEvC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,KAAK,iBAAiB,EAAE,CAAC;gBAC9D,MAAM,IAAI,oCAAsB,EAAE,CAAC;YACpC,CAAC;YAED,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACJ,CAAC;IAGD,KAAK,CAAC,mBAAmB,CAAC,GAAqB;QAC9C,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO;YAE3B,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACJ,CAAC;IAOO,KAAK,CAAC,SAAS,CAAC,EAAiB;QACxC,MAAM,EAAE;aACN,kBAAkB,EAAE;aACpB,MAAM,EAAE;aACR,IAAI,CAAC,aAAQ,CAAC;aACd,MAAM,CAAC;YACP,GAAG,EAAE,QAAA,uBAAuB;YAC5B,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC/B,aAAa,EAAE,KAAK;SACpB,CAAC;aACD,QAAQ,EAAE;aACV,OAAO,EAAE,CAAC;QAEZ,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,aAAQ,EAAE;YAC5C,KAAK,EAAE,EAAE,GAAG,EAAE,QAAA,uBAAuB,EAAE;YACvC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3F,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,EAAiB,EAAE,KAAqB;QAC3D,MAAM,EAAE,CAAC,MAAM,CAAC,aAAQ,EAAE,EAAE,GAAG,EAAE,QAAA,uBAAuB,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;CACD,CAAA;;8BA9EY,mBAAmB;IAD/B,IAAA,YAAO,GAAE;qCAIe,oBAAU,EAAqB,sBAAiB;GAH5D,mBAAmB,CA8E/B"}

package/dist/modules/scim/database/scim-user.repository.js

@@ -22,7 +22,6 @@ let ScimUserRepository = class ScimUserRepository extends db_1.BaseRepository {
         const qb = this.managerFor(ctx)
             .createQueryBuilder(db_1.User, 'user')
             .leftJoinAndSelect('user.authIdentities', 'authIdentity')
-            .leftJoinAndSelect('user.role', 'role')
             .orderBy('user.createdAt', 'ASC')
             .addOrderBy('user.id', 'ASC');
         if (filter?.attribute === 'userName') {
@@ -32,7 +31,7 @@ let ScimUserRepository = class ScimUserRepository extends db_1.BaseRepository {
             qb.where('authIdentity.providerId = :externalId AND authIdentity.providerType IN (:...providerTypes)', { externalId: filter.value, providerTypes: filter.providerTypes });
         }
         const total = await qb.getCount();
-        const users = await qb.skip(skip).take(take).getMany();
+        const users = take > 0 ? await qb.skip(skip).take(take).getMany() : [];
         return [users, total];
     }
     async createProvisioned(user, identity, ctx) {

package/dist/modules/scim/database/scim-user.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-user.repository.js","sourceRoot":"","sources":["../../../../src/modules/scim/database/scim-user.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAQiB;AACjB,gCAAkC;AAClC,0CAA4D;AAYrD,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,mBAAoB;IAC3D,YACC,UAAsB,EACtB,iBAAoC,EACnB,cAA8B;QAE/C,KAAK,CAAC,SAAI,EAAE,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;8BAFlC,cAAc;IAGhC,CAAC;IAGD,KAAK,CAAC,QAAQ,CACb,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAA2D,EAC/E,GAAqB;QAErB,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;aAC7B,kBAAkB,CAAC,SAAI,EAAE,MAAM,CAAC;aAChC,iBAAiB,CAAC,qBAAqB,EAAE,cAAc,CAAC;aACxD,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC;aACtC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC;aAChC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAE/B,IAAI,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,CAAC;YACtC,EAAE,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACxE,CAAC;aAAM,IAAI,MAAM,EAAE,SAAS,KAAK,YAAY,EAAE,CAAC;YAC/C,EAAE,CAAC,KAAK,CACP,4FAA4F,EAC5F,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CACjE,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAEvD,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IAOD,KAAK,CAAC,iBAAiB,CACtB,IAAuB,EACvB,QAA4E,EAC5E,GAAqB;QAErB,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACpD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAEpF,IAAI,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,iBAAY,EAAE,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7E,CAAC;YAED,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;;6BAxDY,kBAAkB;IAD9B,IAAA,YAAO,GAAE;qCAGI,oBAAU,EACH,sBAAiB,EACH,mBAAc;GAJpC,kBAAkB,CAwD9B"}
+{"version":3,"file":"scim-user.repository.js","sourceRoot":"","sources":["../../../../src/modules/scim/database/scim-user.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAQiB;AACjB,gCAAkC;AAClC,0CAA4D;AAYrD,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,mBAAoB;IAC3D,YACC,UAAsB,EACtB,iBAAoC,EACnB,cAA8B;QAE/C,KAAK,CAAC,SAAI,EAAE,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;8BAFlC,cAAc;IAGhC,CAAC;IAGD,KAAK,CAAC,QAAQ,CACb,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAA2D,EAC/E,GAAqB;QAErB,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;aAC7B,kBAAkB,CAAC,SAAI,EAAE,MAAM,CAAC;aAChC,iBAAiB,CAAC,qBAAqB,EAAE,cAAc,CAAC;aACxD,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC;aAChC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAE/B,IAAI,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,CAAC;YACtC,EAAE,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACxE,CAAC;aAAM,IAAI,MAAM,EAAE,SAAS,KAAK,YAAY,EAAE,CAAC;YAC/C,EAAE,CAAC,KAAK,CACP,4FAA4F,EAC5F,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CACjE,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QAGlC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAEvE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IAOD,KAAK,CAAC,iBAAiB,CACtB,IAAuB,EACvB,QAA4E,EAC5E,GAAqB;QAErB,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACpD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAEpF,IAAI,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,iBAAY,EAAE,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7E,CAAC;YAED,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;;6BAzDY,kBAAkB;IAD9B,IAAA,YAAO,GAAE;qCAGI,oBAAU,EACH,sBAAiB,EACH,mBAAc;GAJpC,kBAAkB,CAyD9B"}

package/dist/modules/scim/scim-auth.middleware.d.ts

@@ -2,13 +2,16 @@ import { Logger } from '@n8n/backend-common';
 import type { AuthenticatedRequest } from '@n8n/db';
 import type { NextFunction, RequestHandler, Response } from 'express';
 import { ScimSettingsService } from './scim-settings.service';
+import { ScimSsoService } from './scim-sso.service';
 import { ScimTokenService } from './scim-token.service';
 export declare class ScimAuthMiddleware {
     private readonly logger;
     private readonly scimTokenService;
     private readonly scimSettingsService;
-    constructor(logger: Logger, scimTokenService: ScimTokenService, scimSettingsService: ScimSettingsService);
+    private readonly scimSsoService;
+    constructor(logger: Logger, scimTokenService: ScimTokenService, scimSettingsService: ScimSettingsService, scimSsoService: ScimSsoService);
     getAuthMiddleware(): RequestHandler;
     authenticate(req: AuthenticatedRequest, res: Response, next: NextFunction): Promise<void | Response<any, Record<string, any>>>;
+    private forbidden;
     private unauthorized;
 }

package/dist/modules/scim/scim-auth.middleware.js

@@ -13,12 +13,14 @@ exports.ScimAuthMiddleware = void 0;
 const backend_common_1 = require("@n8n/backend-common");
 const di_1 = require("@n8n/di");
 const scim_settings_service_1 = require("./scim-settings.service");
+const scim_sso_service_1 = require("./scim-sso.service");
 const scim_token_service_1 = require("./scim-token.service");
 let ScimAuthMiddleware = class ScimAuthMiddleware {
-    constructor(logger, scimTokenService, scimSettingsService) {
+    constructor(logger, scimTokenService, scimSettingsService, scimSsoService) {
         this.logger = logger;
         this.scimTokenService = scimTokenService;
         this.scimSettingsService = scimSettingsService;
+        this.scimSsoService = scimSsoService;
     }
     getAuthMiddleware() {
         return this.authenticate.bind(this);
@@ -26,14 +28,10 @@ let ScimAuthMiddleware = class ScimAuthMiddleware {
     async authenticate(req, res, next) {
         try {
             if (!(await this.scimSettingsService.isEnabled())) {
-                return res
-                    .status(403)
-                    .header('Content-Type', 'application/scim+json')
-                    .json({
-                    schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'],
-                    status: '403',
-                    detail: 'SCIM provisioning is disabled',
-                });
+                return this.forbidden(res, 'SCIM provisioning is disabled');
+            }
+            if (!this.scimSsoService.isSsoEnabled()) {
+                return this.forbidden(res, 'SCIM provisioning requires SAML or OIDC single sign-on');
             }
             const bearer = /^Bearer[ \t]+(.+)$/i.exec(req.headers.authorization ?? '');
             if (!bearer) {
@@ -60,6 +58,16 @@ let ScimAuthMiddleware = class ScimAuthMiddleware {
             });
         }
     }
+    forbidden(res, detail) {
+        return res
+            .status(403)
+            .header('Content-Type', 'application/scim+json')
+            .json({
+            schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'],
+            status: '403',
+            detail,
+        });
+    }
     unauthorized(res, detail) {
         return res
             .status(401)
@@ -75,6 +83,6 @@ let ScimAuthMiddleware = class ScimAuthMiddleware {
 exports.ScimAuthMiddleware = ScimAuthMiddleware;
 exports.ScimAuthMiddleware = ScimAuthMiddleware = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [backend_common_1.Logger, scim_token_service_1.ScimTokenService, scim_settings_service_1.ScimSettingsService])
+    __metadata("design:paramtypes", [backend_common_1.Logger, scim_token_service_1.ScimTokenService, scim_settings_service_1.ScimSettingsService, scim_sso_service_1.ScimSsoService])
 ], ScimAuthMiddleware);
 //# sourceMappingURL=scim-auth.middleware.js.map

package/dist/modules/scim/scim-auth.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-auth.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAE7C,gCAAkC;AAGlC,mEAA8D;AAC9D,6DAAwD;AAMjD,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC9B,YACkB,MAAc,EACd,gBAAkC,EAClC,mBAAwC;sBAFxC,MAAM;gCACN,gBAAgB;mCAChB,mBAAmB;IAClC,CAAC;IAEJ,iBAAiB;QAChB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAmB,CAAC;IACvD,CAAC;IAKD,KAAK,CAAC,YAAY,CAAC,GAAyB,EAAE,GAAa,EAAE,IAAkB;QAC9E,IAAI,CAAC;YACJ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;gBACnD,OAAO,GAAG;qBACR,MAAM,CAAC,GAAG,CAAC;qBACX,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC;qBAC/C,IAAI,CAAC;oBACL,OAAO,EAAE,CAAC,6CAA6C,CAAC;oBACxD,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,+BAA+B;iBACvC,CAAC,CAAC;YACL,CAAC;YAID,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YAE3E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;gBAClE,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,iDAAiD,CAAC,CAAC;YAClF,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAEhE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBACnD,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YACvD,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,OAAO,GAAG;iBACR,MAAM,CAAC,GAAG,CAAC;iBACX,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC;iBAC/C,IAAI,CAAC;gBACL,OAAO,EAAE,CAAC,6CAA6C,CAAC;gBACxD,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,uBAAuB;aAC/B,CAAC,CAAC;QACL,CAAC;IACF,CAAC;IAEO,YAAY,CAAC,GAAa,EAAE,MAAc;QACjD,OAAO,GAAG;aACR,MAAM,CAAC,GAAG,CAAC;aACX,MAAM,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;aACrD,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC;aAC/C,IAAI,CAAC;YACL,OAAO,EAAE,CAAC,6CAA6C,CAAC;YACxD,MAAM,EAAE,KAAK;YACb,MAAM;SACN,CAAC,CAAC;IACL,CAAC;CACD,CAAA;;6BAtEY,kBAAkB;IAD9B,IAAA,YAAO,GAAE;qCAGiB,uBAAM,EACI,qCAAgB,EACb,2CAAmB;GAJ9C,kBAAkB,CAsE9B"}
+{"version":3,"file":"scim-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-auth.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6C;AAE7C,gCAAkC;AAGlC,mEAA8D;AAC9D,yDAAoD;AACpD,6DAAwD;AAMjD,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC9B,YACkB,MAAc,EACd,gBAAkC,EAClC,mBAAwC,EACxC,cAA8B;sBAH9B,MAAM;gCACN,gBAAgB;mCAChB,mBAAmB;8BACnB,cAAc;IAC7B,CAAC;IAEJ,iBAAiB;QAChB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAmB,CAAC;IACvD,CAAC;IAKD,KAAK,CAAC,YAAY,CAAC,GAAyB,EAAE,GAAa,EAAE,IAAkB;QAC9E,IAAI,CAAC;YACJ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;YAC7D,CAAC;YAID,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,CAAC;gBACzC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,wDAAwD,CAAC,CAAC;YACtF,CAAC;YAID,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YAE3E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;gBAClE,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,iDAAiD,CAAC,CAAC;YAClF,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAEhE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBACnD,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YACvD,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,OAAO,GAAG;iBACR,MAAM,CAAC,GAAG,CAAC;iBACX,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC;iBAC/C,IAAI,CAAC;gBACL,OAAO,EAAE,CAAC,6CAA6C,CAAC;gBACxD,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,uBAAuB;aAC/B,CAAC,CAAC;QACL,CAAC;IACF,CAAC;IAEO,SAAS,CAAC,GAAa,EAAE,MAAc;QAC9C,OAAO,GAAG;aACR,MAAM,CAAC,GAAG,CAAC;aACX,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC;aAC/C,IAAI,CAAC;YACL,OAAO,EAAE,CAAC,6CAA6C,CAAC;YACxD,MAAM,EAAE,KAAK;YACb,MAAM;SACN,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAAC,GAAa,EAAE,MAAc;QACjD,OAAO,GAAG;aACR,MAAM,CAAC,GAAG,CAAC;aACX,MAAM,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;aACrD,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC;aAC/C,IAAI,CAAC;YACL,OAAO,EAAE,CAAC,6CAA6C,CAAC;YACxD,MAAM,EAAE,KAAK;YACb,MAAM;SACN,CAAC,CAAC;IACL,CAAC;CACD,CAAA;;6BAjFY,kBAAkB;IAD9B,IAAA,YAAO,GAAE;qCAGiB,uBAAM,EACI,qCAAgB,EACb,2CAAmB,EACxB,iCAAc;GALpC,kBAAkB,CAiF9B"}

package/dist/modules/scim/scim-discovery.controller.js

@@ -72,6 +72,7 @@ let ScimDiscoveryController = class ScimDiscoveryController {
             totalResults: 1,
             Resources: [
                 {
+                    schemas: ['urn:ietf:params:scim:schemas:core:2.0:Schema'],
                     id: 'urn:ietf:params:scim:schemas:core:2.0:User',
                     name: 'User',
                     description: 'User Account',
@@ -128,14 +129,6 @@ let ScimDiscoveryController = class ScimDiscoveryController {
                             mutability: 'readWrite',
                             returned: 'default',
                         },
-                        {
-                            name: 'roles',
-                            type: 'complex',
-                            multiValued: true,
-                            required: false,
-                            mutability: 'readWrite',
-                            returned: 'default',
-                        },
                     ],
                 },
             ],

package/dist/modules/scim/scim-discovery.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-discovery.controller.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-discovery.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,gDAA2D;AAG3D,6CAAyC;AAclC,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAMnC,wBAAwB,CAAC,IAA0B,EAAE,GAAa;QACjE,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC;YAC/D,OAAO,EAAE,CAAC,6DAA6D,CAAC;YACxE,gBAAgB,EAAE,2CAA2C;YAC7D,KAAK,EAAE;gBACN,SAAS,EAAE,IAAI;aACf;YACD,IAAI,EAAE;gBACL,SAAS,EAAE,KAAK;gBAChB,aAAa,EAAE,CAAC;gBAChB,cAAc,EAAE,CAAC;aACjB;YACD,MAAM,EAAE;gBACP,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;aAChB;YACD,cAAc,EAAE;gBACf,SAAS,EAAE,KAAK;aAChB;YACD,IAAI,EAAE;gBACL,SAAS,EAAE,KAAK;aAChB;YACD,IAAI,EAAE;gBACL,SAAS,EAAE,KAAK;aAChB;YACD,qBAAqB,EAAE;gBACtB;oBACC,IAAI,EAAE,kBAAkB;oBACxB,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,6DAA6D;oBAC1E,OAAO,EAAE,qCAAqC;oBAC9C,gBAAgB,EAAE,2CAA2C;oBAC7D,OAAO,EAAE,IAAI;iBACb;aACD;SACD,CAAC,CAAC;IACJ,CAAC;IAOD,gBAAgB,CAAC,IAA0B,EAAE,GAAa;QACzD,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC;YAC/D,OAAO,EAAE,CAAC,oDAAoD,CAAC;YAC/D,YAAY,EAAE,CAAC;YACf,SAAS,EAAE;gBACV;oBACC,OAAO,EAAE,CAAC,oDAAoD,CAAC;oBAC/D,EAAE,EAAE,MAAM;oBACV,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,cAAc;oBAC3B,MAAM,EAAE,4CAA4C;iBACpD;aACD;SACD,CAAC,CAAC;IACJ,CAAC;IAOD,UAAU,CAAC,IAA0B,EAAE,GAAa;QACnD,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC;YAC/D,OAAO,EAAE,CAAC,oDAAoD,CAAC;YAC/D,YAAY,EAAE,CAAC;YACf,SAAS,EAAE;gBACV;oBACC,EAAE,EAAE,4CAA4C;oBAChD,IAAI,EAAE,MAAM;oBACZ,WAAW,EAAE,cAAc;oBAC3B,UAAU,EAAE;wBACX;4BACC,IAAI,EAAE,UAAU;4BAChB,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,KAAK;4BAClB,QAAQ,EAAE,IAAI;4BACd,SAAS,EAAE,KAAK;4BAChB,UAAU,EAAE,WAAW;4BACvB,QAAQ,EAAE,SAAS;4BACnB,UAAU,EAAE,QAAQ;yBACpB;wBACD;4BACC,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,SAAS;4BACf,WAAW,EAAE,KAAK;4BAClB,QAAQ,EAAE,KAAK;4BACf,UAAU,EAAE,WAAW;4BACvB,QAAQ,EAAE,SAAS;4BACnB,aAAa,EAAE;gCACd;oCACC,IAAI,EAAE,WAAW;oCACjB,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,KAAK;oCAClB,QAAQ,EAAE,KAAK;oCACf,UAAU,EAAE,WAAW;oCACvB,QAAQ,EAAE,SAAS;iCACnB;gCACD;oCACC,IAAI,EAAE,YAAY;oCAClB,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,KAAK;oCAClB,QAAQ,EAAE,KAAK;oCACf,UAAU,EAAE,WAAW;oCACvB,QAAQ,EAAE,SAAS;iCACnB;6BACD;yBACD;wBACD;4BACC,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,SAAS;4BACf,WAAW,EAAE,IAAI;4BACjB,QAAQ,EAAE,KAAK;4BACf,UAAU,EAAE,WAAW;4BACvB,QAAQ,EAAE,SAAS;yBACnB;wBACD;4BACC,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,SAAS;4BACf,WAAW,EAAE,KAAK;4BAClB,QAAQ,EAAE,KAAK;4BACf,UAAU,EAAE,WAAW;4BACvB,QAAQ,EAAE,SAAS;yBACnB;wBACD;4BACC,IAAI,EAAE,OAAO;4BACb,IAAI,EAAE,SAAS;4BACf,WAAW,EAAE,IAAI;4BACjB,QAAQ,EAAE,KAAK;4BACf,UAAU,EAAE,WAAW;4BACvB,QAAQ,EAAE,SAAS;yBACnB;qBACD;iBACD;aACD;SACD,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;;AA5IA;IADC,IAAA,gBAAG,EAAC,wBAAwB,EAAE,sBAAS,CAAC;;;;uEAqCxC;AAOD;IADC,IAAA,gBAAG,EAAC,gBAAgB,EAAE,sBAAS,CAAC;;;;+DAgBhC;AAOD;IADC,IAAA,gBAAG,EAAC,UAAU,EAAE,sBAAS,CAAC;;;;yDA2E1B;kCAjJW,uBAAuB;IADnC,IAAA,gCAAmB,EAAC,UAAU,CAAC;GACnB,uBAAuB,CAkJnC"}
+{"version":3,"file":"scim-discovery.controller.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-discovery.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,gDAA2D;AAG3D,6CAAyC;AAclC,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAMnC,wBAAwB,CAAC,IAA0B,EAAE,GAAa;QACjE,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC;YAC/D,OAAO,EAAE,CAAC,6DAA6D,CAAC;YACxE,gBAAgB,EAAE,2CAA2C;YAC7D,KAAK,EAAE;gBACN,SAAS,EAAE,IAAI;aACf;YACD,IAAI,EAAE;gBACL,SAAS,EAAE,KAAK;gBAChB,aAAa,EAAE,CAAC;gBAChB,cAAc,EAAE,CAAC;aACjB;YACD,MAAM,EAAE;gBACP,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;aAChB;YACD,cAAc,EAAE;gBACf,SAAS,EAAE,KAAK;aAChB;YACD,IAAI,EAAE;gBACL,SAAS,EAAE,KAAK;aAChB;YACD,IAAI,EAAE;gBACL,SAAS,EAAE,KAAK;aAChB;YACD,qBAAqB,EAAE;gBACtB;oBACC,IAAI,EAAE,kBAAkB;oBACxB,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,6DAA6D;oBAC1E,OAAO,EAAE,qCAAqC;oBAC9C,gBAAgB,EAAE,2CAA2C;oBAC7D,OAAO,EAAE,IAAI;iBACb;aACD;SACD,CAAC,CAAC;IACJ,CAAC;IAOD,gBAAgB,CAAC,IAA0B,EAAE,GAAa;QACzD,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC;YAC/D,OAAO,EAAE,CAAC,oDAAoD,CAAC;YAC/D,YAAY,EAAE,CAAC;YACf,SAAS,EAAE;gBACV;oBACC,OAAO,EAAE,CAAC,oDAAoD,CAAC;oBAC/D,EAAE,EAAE,MAAM;oBACV,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,cAAc;oBAC3B,MAAM,EAAE,4CAA4C;iBACpD;aACD;SACD,CAAC,CAAC;IACJ,CAAC;IAQD,UAAU,CAAC,IAA0B,EAAE,GAAa;QACnD,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC;YAC/D,OAAO,EAAE,CAAC,oDAAoD,CAAC;YAC/D,YAAY,EAAE,CAAC;YACf,SAAS,EAAE;gBACV;oBACC,OAAO,EAAE,CAAC,8CAA8C,CAAC;oBACzD,EAAE,EAAE,4CAA4C;oBAChD,IAAI,EAAE,MAAM;oBACZ,WAAW,EAAE,cAAc;oBAC3B,UAAU,EAAE;wBACX;4BACC,IAAI,EAAE,UAAU;4BAChB,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,KAAK;4BAClB,QAAQ,EAAE,IAAI;4BACd,SAAS,EAAE,KAAK;4BAChB,UAAU,EAAE,WAAW;4BACvB,QAAQ,EAAE,SAAS;4BACnB,UAAU,EAAE,QAAQ;yBACpB;wBACD;4BACC,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,SAAS;4BACf,WAAW,EAAE,KAAK;4BAClB,QAAQ,EAAE,KAAK;4BACf,UAAU,EAAE,WAAW;4BACvB,QAAQ,EAAE,SAAS;4BACnB,aAAa,EAAE;gCACd;oCACC,IAAI,EAAE,WAAW;oCACjB,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,KAAK;oCAClB,QAAQ,EAAE,KAAK;oCACf,UAAU,EAAE,WAAW;oCACvB,QAAQ,EAAE,SAAS;iCACnB;gCACD;oCACC,IAAI,EAAE,YAAY;oCAClB,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,KAAK;oCAClB,QAAQ,EAAE,KAAK;oCACf,UAAU,EAAE,WAAW;oCACvB,QAAQ,EAAE,SAAS;iCACnB;6BACD;yBACD;wBACD;4BACC,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,SAAS;4BACf,WAAW,EAAE,IAAI;4BACjB,QAAQ,EAAE,KAAK;4BACf,UAAU,EAAE,WAAW;4BACvB,QAAQ,EAAE,SAAS;yBACnB;wBACD;4BACC,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,SAAS;4BACf,WAAW,EAAE,KAAK;4BAClB,QAAQ,EAAE,KAAK;4BACf,UAAU,EAAE,WAAW;4BACvB,QAAQ,EAAE,SAAS;yBACnB;qBACD;iBACD;aACD;SACD,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;;AAtIA;IADC,IAAA,gBAAG,EAAC,wBAAwB,EAAE,sBAAS,CAAC;;;;uEAqCxC;AAOD;IADC,IAAA,gBAAG,EAAC,gBAAgB,EAAE,sBAAS,CAAC;;;;+DAgBhC;AAQD;IADC,IAAA,gBAAG,EAAC,UAAU,EAAE,sBAAS,CAAC;;;;yDAoE1B;kCA3IW,uBAAuB;IADnC,IAAA,gCAAmB,EAAC,UAAU,CAAC;GACnB,uBAAuB,CA4InC"}

package/dist/modules/scim/scim-settings.service.d.ts

@@ -1,9 +1,22 @@
-import { SettingsRepository } from '@n8n/db';
+import { SettingsRepository, TransactionRunner, type OperationContext } from '@n8n/db';
 import { CacheService } from '@n8n/backend-services';
+export interface ScimSettingsChange {
+    enabled: boolean;
+    assertCanEnable?: (ctx: OperationContext) => Promise<void>;
+}
+export interface ScimSettingsChangeResult {
+    wasEnabled: boolean;
+    enabled: boolean;
+}
 export declare class ScimSettingsService {
     private readonly settingsRepository;
     private readonly cacheService;
-    constructor(settingsRepository: SettingsRepository, cacheService: CacheService);
+    private readonly transactionRunner;
+    constructor(settingsRepository: SettingsRepository, cacheService: CacheService, transactionRunner: TransactionRunner);
     isEnabled(): Promise<boolean>;
     setEnabled(enabled: boolean): Promise<void>;
+    isSavedEnabled(): Promise<boolean>;
+    turnOff(): Promise<boolean>;
+    update({ enabled, assertCanEnable, }: ScimSettingsChange): Promise<ScimSettingsChangeResult>;
+    private lockSwitch;
 }

package/dist/modules/scim/scim-settings.service.js

@@ -13,11 +13,13 @@ exports.ScimSettingsService = void 0;
 const db_1 = require("@n8n/db");
 const di_1 = require("@n8n/di");
 const backend_services_1 = require("@n8n/backend-services");
-const ENABLED_KEY = 'scim.provisioning.enabled';
+const scim_switch_reader_1 = require("../../sso.ee/scim-switch-reader");
+const ENABLED_KEY = scim_switch_reader_1.SCIM_PROVISIONING_ENABLED_KEY;
 let ScimSettingsService = class ScimSettingsService {
-    constructor(settingsRepository, cacheService) {
+    constructor(settingsRepository, cacheService, transactionRunner) {
         this.settingsRepository = settingsRepository;
         this.cacheService = cacheService;
+        this.transactionRunner = transactionRunner;
     }
     async isEnabled() {
         const cached = await this.cacheService.get(ENABLED_KEY);
@@ -32,10 +34,41 @@ let ScimSettingsService = class ScimSettingsService {
         await this.settingsRepository.upsert({ key: ENABLED_KEY, value: enabled.toString(), loadOnStartup: true }, ['key']);
         await this.cacheService.set(ENABLED_KEY, enabled.toString());
     }
+    async isSavedEnabled() {
+        return await this.transactionRunner.run({}, async (ctx) => {
+            const row = await this.settingsRepository.getOrCreateWithReadLock(ENABLED_KEY, 'false', true, ctx);
+            return row.value === 'true';
+        });
+    }
+    async turnOff() {
+        const wasEnabled = await this.transactionRunner.run({}, async (ctx) => {
+            const row = await this.lockSwitch(ctx);
+            if (row.value !== 'true')
+                return false;
+            await this.settingsRepository.upsertByKey(ENABLED_KEY, 'false', true, ctx);
+            return true;
+        });
+        await this.cacheService.set(ENABLED_KEY, 'false');
+        return wasEnabled;
+    }
+    async update({ enabled, assertCanEnable, }) {
+        const result = await this.transactionRunner.run({}, async (ctx) => {
+            const wasEnabled = (await this.lockSwitch(ctx)).value === 'true';
+            if (enabled)
+                await assertCanEnable?.(ctx);
+            await this.settingsRepository.upsertByKey(ENABLED_KEY, enabled.toString(), true, ctx);
+            return { wasEnabled, enabled };
+        });
+        await this.cacheService.set(ENABLED_KEY, enabled.toString());
+        return result;
+    }
+    async lockSwitch(ctx) {
+        return await this.settingsRepository.getOrCreateWithWriteLock(ENABLED_KEY, 'false', true, ctx);
+    }
 };
 exports.ScimSettingsService = ScimSettingsService;
 exports.ScimSettingsService = ScimSettingsService = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [db_1.SettingsRepository, backend_services_1.CacheService])
+    __metadata("design:paramtypes", [db_1.SettingsRepository, backend_services_1.CacheService, db_1.TransactionRunner])
 ], ScimSettingsService);
 //# sourceMappingURL=scim-settings.service.js.map

package/dist/modules/scim/scim-settings.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-settings.service.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-settings.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAA6C;AAC7C,gCAAkC;AAElC,4DAAqD;AAErD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAQzC,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC/B,YACkB,kBAAsC,EACtC,YAA0B;kCAD1B,kBAAkB;4BAClB,YAAY;IAC3B,CAAC;IAEJ,KAAK,CAAC,SAAS;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,WAAW,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,KAAK,MAAM,CAAC;QAEnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,GAAG,EAAE,KAAK,KAAK,MAAM,CAAC;QAEtC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE7D,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAgB;QAChC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CACnC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EACpE,CAAC,KAAK,CAAC,CACP,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;CACD,CAAA;;8BA1BY,mBAAmB;IAD/B,IAAA,YAAO,GAAE;qCAG6B,uBAAkB,EACxB,+BAAY;GAHhC,mBAAmB,CA0B/B"}
+{"version":3,"file":"scim-settings.service.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-settings.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAAuF;AACvF,gCAAkC;AAElC,4DAAqD;AAErD,oEAA4E;AAE5E,MAAM,WAAW,GAAG,kDAA6B,CAAC;AAuB3C,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC/B,YACkB,kBAAsC,EACtC,YAA0B,EAC1B,iBAAoC;kCAFpC,kBAAkB;4BAClB,YAAY;iCACZ,iBAAiB;IAChC,CAAC;IAEJ,KAAK,CAAC,SAAS;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,WAAW,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,KAAK,MAAM,CAAC;QAEnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,GAAG,EAAE,KAAK,KAAK,MAAM,CAAC;QAEtC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE7D,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAgB;QAChC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CACnC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EACpE,CAAC,KAAK,CAAC,CACP,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IAOD,KAAK,CAAC,cAAc;QACnB,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,uBAAuB,CAChE,WAAW,EACX,OAAO,EACP,IAAI,EACJ,GAAG,CACH,CAAC;YACF,OAAO,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC;QAC7B,CAAC,CAAC,CAAC;IACJ,CAAC;IAOD,KAAK,CAAC,OAAO;QACZ,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAC;YAEvC,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAElD,OAAO,UAAU,CAAC;IACnB,CAAC;IAQD,KAAK,CAAC,MAAM,CAAC,EACZ,OAAO,EACP,eAAe,GACK;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC;YACjE,IAAI,OAAO;gBAAE,MAAM,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAEtF,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QAGH,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE7D,OAAO,MAAM,CAAC;IACf,CAAC;IAGO,KAAK,CAAC,UAAU,CAAC,GAAqB;QAC7C,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAChG,CAAC;CACD,CAAA;;8BA5FY,mBAAmB;IAD/B,IAAA,YAAO,GAAE;qCAG6B,uBAAkB,EACxB,+BAAY,EACP,sBAAiB;GAJ1C,mBAAmB,CA4F/B"}

package/dist/modules/scim/scim-sso.service.d.ts

@@ -0,0 +1,16 @@
+import { Logger, ModuleRegistry } from '@n8n/backend-common';
+import { SettingsRepository, type OperationContext } from '@n8n/db';
+import { ScimSwitchReader } from '../../sso.ee/scim-switch-reader';
+import { ScimSettingsService } from './scim-settings.service';
+export declare class ScimSsoService {
+    private readonly logger;
+    private readonly scimSettingsService;
+    private readonly moduleRegistry;
+    private readonly scimSwitchReader;
+    private readonly settingsRepository;
+    constructor(logger: Logger, scimSettingsService: ScimSettingsService, moduleRegistry: ModuleRegistry, scimSwitchReader: ScimSwitchReader, settingsRepository: SettingsRepository);
+    isSsoEnabled(): boolean;
+    isSsoEnabledInTransaction(ctx: OperationContext): Promise<boolean>;
+    init(): Promise<void>;
+    private turnOffScim;
+}

package/dist/modules/scim/scim-sso.service.js

@@ -0,0 +1,72 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScimSsoService = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const errors_1 = require("@n8n/errors");
+const scim_switch_reader_1 = require("../../sso.ee/scim-switch-reader");
+const sso_helpers_1 = require("../../sso.ee/sso-helpers");
+const scim_settings_service_1 = require("./scim-settings.service");
+let ScimSsoService = class ScimSsoService {
+    constructor(logger, scimSettingsService, moduleRegistry, scimSwitchReader, settingsRepository) {
+        this.logger = logger;
+        this.scimSettingsService = scimSettingsService;
+        this.moduleRegistry = moduleRegistry;
+        this.scimSwitchReader = scimSwitchReader;
+        this.settingsRepository = settingsRepository;
+    }
+    isSsoEnabled() {
+        return (0, sso_helpers_1.isSamlOrOidcLoginEnabled)();
+    }
+    async isSsoEnabledInTransaction(ctx) {
+        if (!this.isSsoEnabled())
+            return false;
+        const saved = await this.settingsRepository.findByKeyInContext('userManagement.authenticationMethod', ctx);
+        return !saved || saved.value === 'saml' || saved.value === 'oidc';
+    }
+    async init() {
+        this.scimSwitchReader.register(async () => await this.scimSettingsService.isSavedEnabled(), async (protocol) => await this.turnOffScim(`${protocol.toUpperCase()} single sign-on turned off`));
+        if (this.isSsoEnabled())
+            return;
+        try {
+            await this.turnOffScim('single sign-on is off at startup');
+        }
+        catch {
+        }
+    }
+    async turnOffScim(reason) {
+        try {
+            if (!(await this.scimSettingsService.turnOff()))
+                return;
+        }
+        catch (error) {
+            this.logger.error('SCIM: Failed to turn off SCIM provisioning without single sign-on', {
+                error,
+            });
+            throw new errors_1.InternalServerError('SCIM provisioning did not turn off, so single sign-on did not turn off fully. Turn off SCIM provisioning in the SCIM settings. Then turn off single sign-on again.', error);
+        }
+        this.logger.info(`SCIM provisioning turned off, because ${reason}. The SCIM token and the SCIM settings are kept.`);
+        try {
+            await this.moduleRegistry.refreshModuleSettings('scim');
+        }
+        catch (error) {
+            this.logger.warn('SCIM: Failed to refresh the module settings', { error });
+        }
+    }
+};
+exports.ScimSsoService = ScimSsoService;
+exports.ScimSsoService = ScimSsoService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger, scim_settings_service_1.ScimSettingsService, backend_common_1.ModuleRegistry, scim_switch_reader_1.ScimSwitchReader, db_1.SettingsRepository])
+], ScimSsoService);
+//# sourceMappingURL=scim-sso.service.js.map

package/dist/modules/scim/scim-sso.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-sso.service.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-sso.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA6D;AAC7D,gCAAoE;AACpE,gCAAkC;AAClC,wCAAkD;AAElD,oEAA+D;AAC/D,sDAAgE;AAEhE,mEAA8D;AAYvD,IAAM,cAAc,GAApB,MAAM,cAAc;IAC1B,YACkB,MAAc,EACd,mBAAwC,EACxC,cAA8B,EAC9B,gBAAkC,EAClC,kBAAsC;sBAJtC,MAAM;mCACN,mBAAmB;8BACnB,cAAc;gCACd,gBAAgB;kCAChB,kBAAkB;IACjC,CAAC;IAEJ,YAAY;QACX,OAAO,IAAA,sCAAwB,GAAE,CAAC;IACnC,CAAC;IAQD,KAAK,CAAC,yBAAyB,CAAC,GAAqB;QACpD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAC7D,qCAAqC,EACrC,GAAG,CACH,CAAC;QAEF,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC;IACnE,CAAC;IAaD,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAC7B,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,EAAE,EAC3D,KAAK,EAAE,QAAQ,EAAE,EAAE,CAClB,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAC9E,CAAC;QAEF,IAAI,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO;QAEhC,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;QAGT,CAAC;IACF,CAAC;IASO,KAAK,CAAC,WAAW,CAAC,MAAc;QACvC,IAAI,CAAC;YACJ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,CAAC;gBAAE,OAAO;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mEAAmE,EAAE;gBACtF,KAAK;aACL,CAAC,CAAC;YACH,MAAM,IAAI,4BAAmB,CAC5B,oKAAoK,EACpK,KAAK,CACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,yCAAyC,MAAM,kDAAkD,CACjG,CAAC;QAEF,IAAI,CAAC;YAEJ,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;IACF,CAAC;CACD,CAAA;;yBAzFY,cAAc;IAD1B,IAAA,YAAO,GAAE;qCAGiB,uBAAM,EACO,2CAAmB,EACxB,+BAAc,EACZ,qCAAgB,EACd,uBAAkB;GAN5C,cAAc,CAyF1B"}

package/dist/modules/scim/scim-token.controller.d.ts

@@ -3,15 +3,19 @@ import { Logger, ModuleRegistry } from '@n8n/backend-common';
 import type { AuthenticatedRequest } from '@n8n/db';
 import type { Response } from 'express';
 import { ScimSettingsService } from './scim-settings.service';
+import { ScimSsoService } from './scim-sso.service';
 import { ScimTokenService } from './scim-token.service';
 export declare class ScimTokenController {
     private readonly logger;
     private readonly scimTokenService;
     private readonly scimSettingsService;
     private readonly moduleRegistry;
-    constructor(logger: Logger, scimTokenService: ScimTokenService, scimSettingsService: ScimSettingsService, moduleRegistry: ModuleRegistry);
-    getConfig(req: AuthenticatedRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    private readonly scimSsoService;
+    constructor(logger: Logger, scimTokenService: ScimTokenService, scimSettingsService: ScimSettingsService, moduleRegistry: ModuleRegistry, scimSsoService: ScimSsoService);
+    getConfig(_req: AuthenticatedRequest, res: Response): Promise<Response<any, Record<string, any>>>;
     updateConfig(_req: AuthenticatedRequest, res: Response, body: ScimConfigPatchDto): Promise<Response<any, Record<string, any>>>;
     generateToken(req: AuthenticatedRequest, res: Response): Promise<Response<any, Record<string, any>>>;
-    deleteToken(req: AuthenticatedRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    deleteToken(_req: AuthenticatedRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    private assertSsoEnabled;
+    private refreshModuleSettings;
 }

package/dist/modules/scim/scim-token.controller.js

@@ -17,19 +17,22 @@ const api_types_1 = require("@n8n/api-types");
 const backend_common_1 = require("@n8n/backend-common");
 const decorators_1 = require("@n8n/decorators");
 const scim_settings_service_1 = require("./scim-settings.service");
+const scim_sso_service_1 = require("./scim-sso.service");
 const scim_token_service_1 = require("./scim-token.service");
+const scim_errors_1 = require("./scim.errors");
 let ScimTokenController = class ScimTokenController {
-    constructor(logger, scimTokenService, scimSettingsService, moduleRegistry) {
+    constructor(logger, scimTokenService, scimSettingsService, moduleRegistry, scimSsoService) {
         this.logger = logger;
         this.scimTokenService = scimTokenService;
         this.scimSettingsService = scimSettingsService;
         this.moduleRegistry = moduleRegistry;
+        this.scimSsoService = scimSsoService;
     }
-    async getConfig(req, res) {
+    async getConfig(_req, res) {
         try {
             const [enabled, tokenInfo] = await Promise.all([
                 this.scimSettingsService.isEnabled(),
-                this.scimTokenService.getTokenInfoForUser(req.user),
+                this.scimTokenService.getTokenInfo(),
             ]);
             return res.status(200).json({
                 data: {
@@ -46,30 +49,48 @@ let ScimTokenController = class ScimTokenController {
         }
     }
     async updateConfig(_req, res, body) {
+        const { enabled } = body;
         try {
-            await this.scimSettingsService.setEnabled(body.enabled);
+            if (enabled)
+                this.assertSsoEnabled();
+            const saved = await this.scimSettingsService.update({
+                enabled,
+                assertCanEnable: async (ctx) => {
+                    if (!(await this.scimSsoService.isSsoEnabledInTransaction(ctx))) {
+                        throw new scim_errors_1.ScimSsoRequiredError();
+                    }
+                },
+            });
             await this.moduleRegistry.refreshModuleSettings('scim');
-            return res.status(200).json({ data: { enabled: body.enabled } });
+            return res.status(200).json({ data: { enabled: saved.enabled } });
         }
         catch (error) {
+            if (error instanceof scim_errors_1.ScimSsoRequiredError) {
+                return res.status(400).json({ message: error.message });
+            }
             this.logger.error('Error updating SCIM config', { error });
             return res.status(500).json({ message: 'Internal server error' });
         }
     }
     async generateToken(req, res) {
         try {
-            const apiKey = await this.scimTokenService.rotateScimApiKey(req.user);
+            const token = await this.scimTokenService.rotateToken(req.user);
             const baseUrl = this.scimTokenService.getScimBaseUrl();
-            return res.status(201).json({ data: { token: apiKey.apiKey, baseUrl } });
+            await this.refreshModuleSettings();
+            return res.status(201).json({ data: { token, baseUrl } });
         }
         catch (error) {
+            if (error instanceof scim_errors_1.ScimTokenConflictError) {
+                return res.status(409).json({ message: error.message });
+            }
             this.logger.error('Error generating SCIM token', { error });
             return res.status(500).json({ message: 'Internal server error' });
         }
     }
-    async deleteToken(req, res) {
+    async deleteToken(_req, res) {
         try {
-            await this.scimTokenService.deleteAllScimApiKeysForUser(req.user);
+            await this.scimTokenService.revokeToken();
+            await this.refreshModuleSettings();
             return res.status(200).json({ data: { success: true } });
         }
         catch (error) {
@@ -77,6 +98,18 @@ let ScimTokenController = class ScimTokenController {
             return res.status(500).json({ message: 'Internal server error' });
         }
     }
+    assertSsoEnabled() {
+        if (!this.scimSsoService.isSsoEnabled())
+            throw new scim_errors_1.ScimSsoRequiredError();
+    }
+    async refreshModuleSettings() {
+        try {
+            await this.moduleRegistry.refreshModuleSettings('scim');
+        }
+        catch (error) {
+            this.logger.warn('SCIM: Failed to refresh the module settings', { error });
+        }
+    }
 };
 exports.ScimTokenController = ScimTokenController;
 __decorate([
@@ -110,6 +143,6 @@ __decorate([
 ], ScimTokenController.prototype, "deleteToken", null);
 exports.ScimTokenController = ScimTokenController = __decorate([
     (0, decorators_1.RestController)('/scim'),
-    __metadata("design:paramtypes", [backend_common_1.Logger, scim_token_service_1.ScimTokenService, scim_settings_service_1.ScimSettingsService, backend_common_1.ModuleRegistry])
+    __metadata("design:paramtypes", [backend_common_1.Logger, scim_token_service_1.ScimTokenService, scim_settings_service_1.ScimSettingsService, backend_common_1.ModuleRegistry, scim_sso_service_1.ScimSsoService])
 ], ScimTokenController);
 //# sourceMappingURL=scim-token.controller.js.map

package/dist/modules/scim/scim-token.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-token.controller.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-token.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8CAAoD;AACpD,wDAA6D;AAE7D,gDAA8F;AAG9F,mEAA8D;AAC9D,6DAAwD;AAWjD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC/B,YACkB,MAAc,EACd,gBAAkC,EAClC,mBAAwC,EACxC,cAA8B;sBAH9B,MAAM;gCACN,gBAAgB;mCAChB,mBAAmB;8BACnB,cAAc;IAC7B,CAAC;IAQE,AAAN,KAAK,CAAC,SAAS,CAAC,GAAyB,EAAE,GAAa;QACvD,IAAI,CAAC;YACJ,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC9C,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE;gBACpC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;aACnD,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC3B,IAAI,EAAE;oBACL,OAAO;oBACP,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,SAAS,EAAE,SAAS,CAAC,QAAQ;oBAC7B,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE;iBAC/C;aACD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IASK,AAAN,KAAK,CAAC,YAAY,CAAC,IAA0B,EAAE,GAAa,EAAQ,IAAwB;QAC3F,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAGxD,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAExD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IASK,AAAN,KAAK,CAAC,aAAa,CAAC,GAAyB,EAAE,GAAa;QAC3D,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC;YAEvD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IAQK,AAAN,KAAK,CAAC,WAAW,CAAC,GAAyB,EAAE,GAAa;QACzD,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAElE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;CACD,CAAA;;AA7EM;IAFL,IAAA,gBAAG,EAAC,SAAS,CAAC;IACd,IAAA,wBAAW,EAAC,aAAa,CAAC;;;;oDAoB1B;AASK;IAFL,IAAA,kBAAK,EAAC,SAAS,CAAC;IAChB,IAAA,wBAAW,EAAC,aAAa,CAAC;IACoC,WAAA,iBAAI,CAAA;;qDAAO,8BAAkB;;uDAY3F;AASK;IAFL,IAAA,iBAAI,EAAC,QAAQ,CAAC;IACd,IAAA,wBAAW,EAAC,aAAa,CAAC;;;;wDAW1B;AAQK;IAFL,IAAA,mBAAM,EAAC,QAAQ,CAAC;IAChB,IAAA,wBAAW,EAAC,aAAa,CAAC;;;;sDAU1B;8BA1FW,mBAAmB;IAD/B,IAAA,2BAAc,EAAC,OAAO,CAAC;qCAGG,uBAAM,EACI,qCAAgB,EACb,2CAAmB,EACxB,+BAAc;GALpC,mBAAmB,CA2F/B"}
+{"version":3,"file":"scim-token.controller.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-token.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8CAAoD;AACpD,wDAA6D;AAE7D,gDAA8F;AAG9F,mEAA8D;AAC9D,yDAAoD;AACpD,6DAAwD;AACxD,+CAA6E;AActE,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC/B,YACkB,MAAc,EACd,gBAAkC,EAClC,mBAAwC,EACxC,cAA8B,EAC9B,cAA8B;sBAJ9B,MAAM;gCACN,gBAAgB;mCAChB,mBAAmB;8BACnB,cAAc;8BACd,cAAc;IAC7B,CAAC;IAQE,AAAN,KAAK,CAAC,SAAS,CAAC,IAA0B,EAAE,GAAa;QACxD,IAAI,CAAC;YACJ,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC9C,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE;gBACpC,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE;aACpC,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC3B,IAAI,EAAE;oBACL,OAAO;oBACP,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,SAAS,EAAE,SAAS,CAAC,QAAQ;oBAC7B,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE;iBAC/C;aACD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IAWK,AAAN,KAAK,CAAC,YAAY,CAAC,IAA0B,EAAE,GAAa,EAAQ,IAAwB;QAC3F,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAEzB,IAAI,CAAC;YACJ,IAAI,OAAO;gBAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAErC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;gBACnD,OAAO;gBAKP,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBAC9B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;wBACjE,MAAM,IAAI,kCAAoB,EAAE,CAAC;oBAClC,CAAC;gBACF,CAAC;aACD,CAAC,CAAC;YAIH,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAExD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,kCAAoB,EAAE,CAAC;gBAC3C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IAUK,AAAN,KAAK,CAAC,aAAa,CAAC,GAAyB,EAAE,GAAa;QAC3D,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChE,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEnC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,oCAAsB,EAAE,CAAC;gBAC7C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IAQK,AAAN,KAAK,CAAC,WAAW,CAAC,IAA0B,EAAE,GAAa;QAC1D,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEnC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IAGO,gBAAgB;QACvB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE;YAAE,MAAM,IAAI,kCAAoB,EAAE,CAAC;IAC3E,CAAC;IAQO,KAAK,CAAC,qBAAqB;QAClC,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;IACF,CAAC;CACD,CAAA;;AA7HM;IAFL,IAAA,gBAAG,EAAC,SAAS,CAAC;IACd,IAAA,wBAAW,EAAC,aAAa,CAAC;;;;oDAoB1B;AAWK;IAFL,IAAA,kBAAK,EAAC,SAAS,CAAC;IAChB,IAAA,wBAAW,EAAC,aAAa,CAAC;IACoC,WAAA,iBAAI,CAAA;;qDAAO,8BAAkB;;uDAgC3F;AAUK;IAFL,IAAA,iBAAI,EAAC,QAAQ,CAAC;IACd,IAAA,wBAAW,EAAC,aAAa,CAAC;;;;wDAgB1B;AAQK;IAFL,IAAA,mBAAM,EAAC,QAAQ,CAAC;IAChB,IAAA,wBAAW,EAAC,aAAa,CAAC;;;;sDAW1B;8BAxHW,mBAAmB;IAD/B,IAAA,2BAAc,EAAC,OAAO,CAAC;qCAGG,uBAAM,EACI,qCAAgB,EACb,2CAAmB,EACxB,+BAAc,EACd,iCAAc;GANpC,mBAAmB,CA4I/B"}