n8n 2.45.6 → 2.46.1

package/dist/modules/scim/scim-token.service.d.ts

@@ -1,22 +1,17 @@
 import { type OperationContext, type User } from '@n8n/db';
-import { JwtService, UrlService } from '@n8n/backend-services';
-import { ScimApiKeyRepository } from './database/scim-api-key.repository';
+import { UrlService } from '@n8n/backend-services';
+import { ScimTokenRepository } from './database/scim-token.repository';
+export declare const hashScimToken: (token: string) => string;
 export declare class ScimTokenService {
-    private readonly apiKeyRepository;
-    private readonly jwtService;
+    private readonly scimTokenRepository;
     private readonly urlService;
-    constructor(apiKeyRepository: ScimApiKeyRepository, jwtService: JwtService, urlService: UrlService);
-    private signApiKey;
-    getTokenInfoForUser(user: User, ctx?: OperationContext): Promise<{
+    constructor(scimTokenRepository: ScimTokenRepository, urlService: UrlService);
+    getTokenInfo(ctx?: OperationContext): Promise<{
         hasToken: boolean;
         lastFour: string | null;
     }>;
-    findScimApiKeyForUser(user: User, { redact }?: {
-        redact?: boolean | undefined;
-    }, ctx?: OperationContext): Promise<import("@n8n/db").ApiKey | null>;
     verifyApiKey(apiKey: string, ctx?: OperationContext): Promise<boolean>;
-    deleteAllScimApiKeysForUser(user: User, ctx?: OperationContext): Promise<void>;
-    rotateScimApiKey(user: User, ctx?: OperationContext): Promise<import("@n8n/db").ApiKey>;
+    rotateToken(user: User, ctx?: OperationContext): Promise<string>;
+    revokeToken(ctx?: OperationContext): Promise<void>;
     getScimBaseUrl(): string;
-    private redactApiKey;
 }

package/dist/modules/scim/scim-token.service.js

@@ -9,74 +9,61 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ScimTokenService = void 0;
+exports.ScimTokenService = exports.hashScimToken = void 0;
 const di_1 = require("@n8n/di");
 const crypto_1 = require("crypto");
 const backend_services_1 = require("@n8n/backend-services");
-const scim_api_key_repository_1 = require("./database/scim-api-key.repository");
-const API_KEY_PURPOSE = 'scimApiKey';
-const API_KEY_ISSUER = 'n8n';
-const REDACT_API_KEY_REVEAL_COUNT = 4;
-const REDACT_API_KEY_MAX_LENGTH = 10;
-const REDACT_API_KEY_MIN_HIDDEN_CHARS = 6;
+const scim_token_repository_1 = require("./database/scim-token.repository");
+const TOKEN_PREFIX = 'n8n_scim_';
+const TOKEN_RANDOM_BYTES = 32;
+const TOKEN_FORMAT = /^n8n_scim_[\w-]{43}$/;
+const TOKEN_HINT_LENGTH = 4;
+const hashScimToken = (token) => (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+exports.hashScimToken = hashScimToken;
+const hashesMatch = (a, b) => {
+    const left = Buffer.from(a, 'hex');
+    const right = Buffer.from(b, 'hex');
+    return left.length === right.length && (0, crypto_1.timingSafeEqual)(left, right);
+};
 let ScimTokenService = class ScimTokenService {
-    constructor(apiKeyRepository, jwtService, urlService) {
-        this.apiKeyRepository = apiKeyRepository;
-        this.jwtService = jwtService;
+    constructor(scimTokenRepository, urlService) {
+        this.scimTokenRepository = scimTokenRepository;
         this.urlService = urlService;
     }
-    signApiKey(user) {
-        return this.jwtService.sign(API_KEY_PURPOSE, {
-            sub: user.id,
-            iss: API_KEY_ISSUER,
-            jti: (0, crypto_1.randomUUID)(),
-        });
-    }
-    async getTokenInfoForUser(user, ctx = {}) {
-        const apiKey = await this.apiKeyRepository.findByUserId(user.id, ctx);
+    async getTokenInfo(ctx = {}) {
+        const token = await this.scimTokenRepository.findInstanceToken(ctx);
         return {
-            hasToken: !!apiKey,
-            lastFour: apiKey ? apiKey.apiKey.slice(-REDACT_API_KEY_REVEAL_COUNT) : null,
+            hasToken: !!token,
+            lastFour: token ? token.tokenHint : null,
         };
     }
-    async findScimApiKeyForUser(user, { redact = true } = {}, ctx = {}) {
-        const apiKey = await this.apiKeyRepository.findByUserId(user.id, ctx);
-        if (apiKey && redact) {
-            apiKey.apiKey = this.redactApiKey(apiKey.apiKey);
-        }
-        return apiKey;
-    }
     async verifyApiKey(apiKey, ctx = {}) {
-        try {
-            this.jwtService.verify(API_KEY_PURPOSE, apiKey, { issuer: API_KEY_ISSUER });
-        }
-        catch {
+        if (!TOKEN_FORMAT.test(apiKey))
             return false;
-        }
-        const key = await this.apiKeyRepository.findByKey(apiKey, ctx);
-        return !!key && !!key.user && !key.user.disabled;
+        const current = await this.scimTokenRepository.findInstanceToken(ctx);
+        return !!current && hashesMatch(current.tokenHash, (0, exports.hashScimToken)(apiKey));
     }
-    async deleteAllScimApiKeysForUser(user, ctx = {}) {
-        await this.apiKeyRepository.deleteAllForUser(user.id, ctx);
+    async rotateToken(user, ctx = {}) {
+        const current = await this.scimTokenRepository.findInstanceToken(ctx);
+        const token = TOKEN_PREFIX + (0, crypto_1.randomBytes)(TOKEN_RANDOM_BYTES).toString('base64url');
+        await this.scimTokenRepository.replace(current?.tokenHash ?? null, {
+            tokenHash: (0, exports.hashScimToken)(token),
+            tokenHint: token.slice(-TOKEN_HINT_LENGTH),
+            createdById: user.id,
+            createdAt: new Date(),
+        }, ctx);
+        return token;
     }
-    async rotateScimApiKey(user, ctx = {}) {
-        return await this.apiKeyRepository.replaceForUser(user.id, this.signApiKey(user), ctx);
+    async revokeToken(ctx = {}) {
+        await this.scimTokenRepository.revokeInstanceToken(ctx);
     }
     getScimBaseUrl() {
         return `${this.urlService.getInstanceBaseUrl()}/scim/v2`;
     }
-    redactApiKey(apiKey) {
-        if (REDACT_API_KEY_REVEAL_COUNT >= apiKey.length - REDACT_API_KEY_MIN_HIDDEN_CHARS) {
-            return '*'.repeat(apiKey.length);
-        }
-        const visiblePart = apiKey.slice(-REDACT_API_KEY_REVEAL_COUNT);
-        const redactedPart = '*'.repeat(Math.max(0, REDACT_API_KEY_MAX_LENGTH - REDACT_API_KEY_REVEAL_COUNT));
-        return redactedPart + visiblePart;
-    }
 };
 exports.ScimTokenService = ScimTokenService;
 exports.ScimTokenService = ScimTokenService = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [scim_api_key_repository_1.ScimApiKeyRepository, backend_services_1.JwtService, backend_services_1.UrlService])
+    __metadata("design:paramtypes", [scim_token_repository_1.ScimTokenRepository, backend_services_1.UrlService])
 ], ScimTokenService);
 //# sourceMappingURL=scim-token.service.js.map

package/dist/modules/scim/scim-token.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-token.service.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,gCAAkC;AAClC,mCAAoC;AAEpC,4DAA+D;AAE/D,gFAA0E;AAE1E,MAAM,eAAe,GAAG,YAAqB,CAAC;AAC9C,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,2BAA2B,GAAG,CAAC,CAAC;AACtC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAMnC,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC5B,YACkB,gBAAsC,EACtC,UAAsB,EACtB,UAAsB;gCAFtB,gBAAgB;0BAChB,UAAU;0BACV,UAAU;IACzB,CAAC;IAEI,UAAU,CAAC,IAAU;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,EAAE;YAC5C,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,IAAA,mBAAU,GAAE;SACjB,CAAC,CAAC;IACJ,CAAC;IAMD,KAAK,CAAC,mBAAmB,CACxB,IAAU,EACV,GAAG,GAAqB,EAAE;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAEtE,OAAO;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM;YAClB,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,IAAI;SAC3E,CAAC;IACH,CAAC;IAKD,KAAK,CAAC,qBAAqB,CAAC,IAAU,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,GAAqB,EAAE;QACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAEtE,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAMD,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,GAAG,GAAqB,EAAE;QAC5D,IAAI,CAAC;YACJ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YAER,OAAO,KAAK,CAAC;QACd,CAAC;QAKD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE/D,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;IAClD,CAAC;IAKD,KAAK,CAAC,2BAA2B,CAAC,IAAU,EAAE,GAAG,GAAqB,EAAE;QACvE,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAKD,KAAK,CAAC,gBAAgB,CAAC,IAAU,EAAE,GAAG,GAAqB,EAAE;QAC5D,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACxF,CAAC;IAKD,cAAc;QACb,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC;IAC1D,CAAC;IAKO,YAAY,CAAC,MAAc;QAClC,IAAI,2BAA2B,IAAI,MAAM,CAAC,MAAM,GAAG,+BAA+B,EAAE,CAAC;YACpF,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,GAAG,2BAA2B,CAAC,CACpE,CAAC;QAEF,OAAO,YAAY,GAAG,WAAW,CAAC;IACnC,CAAC;CACD,CAAA;;2BApGY,gBAAgB;IAD5B,IAAA,YAAO,GAAE;qCAG2B,8CAAoB,EAC1B,6BAAU,EACV,6BAAU;GAJ5B,gBAAgB,CAoG5B"}
+{"version":3,"file":"scim-token.service.js","sourceRoot":"","sources":["../../../src/modules/scim/scim-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,gCAAkC;AAClC,mCAAkE;AAElE,4DAAmD;AAEnD,4EAAuE;AAGvE,MAAM,YAAY,GAAG,WAAW,CAAC;AAEjC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAC5C,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAMrB,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAApF,QAAA,aAAa,GAAb,aAAa,CAAuE;AAGjG,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAA,wBAAe,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC,CAAC;AASK,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC5B,YACkB,mBAAwC,EACxC,UAAsB;mCADtB,mBAAmB;0BACnB,UAAU;IACzB,CAAC;IAMJ,KAAK,CAAC,YAAY,CACjB,GAAG,GAAqB,EAAE;QAE1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEpE,OAAO;YACN,QAAQ,EAAE,CAAC,CAAC,KAAK;YACjB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;SACxC,CAAC;IACH,CAAC;IAMD,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,GAAG,GAAqB,EAAE;QAE5D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAK7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEtE,OAAO,CAAC,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,IAAA,QAAA,aAAa,EAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IAUD,KAAK,CAAC,WAAW,CAAC,IAAU,EAAE,GAAG,GAAqB,EAAE;QACvD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,YAAY,GAAG,IAAA,oBAAW,EAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAEnF,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CACrC,OAAO,EAAE,SAAS,IAAI,IAAI,EAC1B;YACC,SAAS,EAAE,IAAA,QAAA,aAAa,EAAC,KAAK,CAAC;YAC/B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC;YAC1C,WAAW,EAAE,IAAI,CAAC,EAAE;YACpB,SAAS,EAAE,IAAI,IAAI,EAAE;SACrB,EACD,GAAG,CACH,CAAC;QAEF,OAAO,KAAK,CAAC;IACd,CAAC;IAGD,KAAK,CAAC,WAAW,CAAC,GAAG,GAAqB,EAAE;QAC3C,MAAM,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IAKD,cAAc;QACb,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC;IAC1D,CAAC;CACD,CAAA;;2BA1EY,gBAAgB;IAD5B,IAAA,YAAO,GAAE;qCAG8B,2CAAmB,EAC5B,6BAAU;GAH5B,gBAAgB,CA0E5B"}

package/dist/modules/scim/scim.controller.js

@@ -40,6 +40,9 @@ let ScimController = class ScimController {
         if (error instanceof scim_errors_1.ScimConflictError) {
             return this.scimError(res, 409, error.message, 'uniqueness');
         }
+        if (error instanceof scim_errors_1.ScimForbiddenError) {
+            return this.scimError(res, 403, error.message);
+        }
         if (error instanceof scim_errors_1.ScimInvalidFilterError) {
             return this.scimError(res, 400, error.message, 'invalidFilter');
         }
@@ -77,6 +80,8 @@ let ScimController = class ScimController {
     async createUser(_req, res, body) {
         try {
             const createdUser = await this.scimService.createUser(body);
+            if (createdUser.meta?.location)
+                res.header('Location', createdUser.meta.location);
             return res.status(201).header('Content-Type', 'application/scim+json').json(createdUser);
         }
         catch (error) {

package/dist/modules/scim/scim.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim.controller.js","sourceRoot":"","sources":["../../../src/modules/scim/scim.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AACA,8CAAsF;AACtF,wDAA6C;AAE7C,gDAUyB;AAGzB,6CAAyC;AACzC,+CAKuB;AACvB,iDAA6C;AAOtC,IAAM,cAAc,GAApB,MAAM,cAAc;IAC1B,YACkB,MAAc,EACd,WAAwB;sBADxB,MAAM;2BACN,WAAW;IAC1B,CAAC;IAKI,SAAS,CAAC,GAAa,EAAE,MAAc,EAAE,MAAc,EAAE,QAAiB;QACjF,MAAM,KAAK,GAAc;YACxB,OAAO,EAAE,CAAC,6CAA6C,CAAC;YACxD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,MAAM;YACN,QAAQ;SACR,CAAC;QACF,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvF,CAAC;IAKO,WAAW,CAAC,GAAa,EAAE,KAAc,EAAE,SAAiB;QACnE,IAAI,KAAK,YAAY,uCAAyB,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,KAAK,YAAY,+BAAiB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,KAAK,YAAY,oCAAsB,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,KAAK,YAAY,mCAAqB,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC1D,CAAC;IAOK,AAAN,KAAK,CAAC,SAAS,CACd,IAA0B,EAC1B,GAAa,EACN,KAAmB;QAE1B,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;gBAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACpB,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;IACF,CAAC;IAOK,AAAN,KAAK,CAAC,OAAO,CACZ,IAA0B,EAC1B,GAAa,EACA,MAAc;QAE3B,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAExD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,MAAM,YAAY,CAAC,CAAC;YACjE,CAAC;YAED,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;IAOK,AAAN,KAAK,CAAC,UAAU,CACf,IAA0B,EAC1B,GAAa,EACP,IAAuB;QAE7B,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAE5D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;IAOK,AAAN,KAAK,CAAC,WAAW,CAChB,IAA0B,EAC1B,GAAa,EACA,MAAc,EACrB,IAAuB;QAE7B,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAEpE,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QACrD,CAAC;IACF,CAAC;IAOK,AAAN,KAAK,CAAC,SAAS,CACd,IAA0B,EAC1B,GAAa,EACA,MAAc,EACrB,IAAyB;QAE/B,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAEnE,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;IACF,CAAC;IAOK,AAAN,KAAK,CAAC,UAAU,CACf,IAA0B,EAC1B,GAAa,EACA,MAAc;QAE3B,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE1C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;CACD,CAAA;;AAtHM;IADL,IAAA,gBAAG,EAAC,QAAQ,EAAE,sBAAS,CAAC;IAIvB,WAAA,kBAAK,CAAA;;qDAAQ,wBAAY;;+CAa1B;AAOK;IADL,IAAA,gBAAG,EAAC,YAAY,EAAE,sBAAS,CAAC;IAI3B,WAAA,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAA;;;;6CAaZ;AAOK;IADL,IAAA,iBAAI,EAAC,QAAQ,EAAE,sBAAS,CAAC;IAIxB,WAAA,iBAAI,CAAA;;qDAAO,6BAAiB;;gDAS7B;AAOK;IADL,IAAA,gBAAG,EAAC,YAAY,EAAE,sBAAS,CAAC;IAI3B,WAAA,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,iBAAI,CAAA;;6DAAO,6BAAiB;;iDAS7B;AAOK;IADL,IAAA,kBAAK,EAAC,YAAY,EAAE,sBAAS,CAAC;IAI7B,WAAA,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,iBAAI,CAAA;;6DAAO,+BAAmB;;+CAS/B;AAOK;IADL,IAAA,mBAAM,EAAC,YAAY,EAAE,sBAAS,CAAC;IAI9B,WAAA,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAA;;;;gDASZ;yBAlKW,cAAc;IAD1B,IAAA,gCAAmB,EAAC,UAAU,CAAC;qCAGL,uBAAM,EACD,0BAAW;GAH9B,cAAc,CAmK1B"}
+{"version":3,"file":"scim.controller.js","sourceRoot":"","sources":["../../../src/modules/scim/scim.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AACA,8CAAsF;AACtF,wDAA6C;AAE7C,gDAUyB;AAGzB,6CAAyC;AACzC,+CAMuB;AACvB,iDAA6C;AAOtC,IAAM,cAAc,GAApB,MAAM,cAAc;IAC1B,YACkB,MAAc,EACd,WAAwB;sBADxB,MAAM;2BACN,WAAW;IAC1B,CAAC;IAKI,SAAS,CAAC,GAAa,EAAE,MAAc,EAAE,MAAc,EAAE,QAAiB;QACjF,MAAM,KAAK,GAAc;YACxB,OAAO,EAAE,CAAC,6CAA6C,CAAC;YACxD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,MAAM;YACN,QAAQ;SACR,CAAC;QACF,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvF,CAAC;IAKO,WAAW,CAAC,GAAa,EAAE,KAAc,EAAE,SAAiB;QACnE,IAAI,KAAK,YAAY,uCAAyB,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,KAAK,YAAY,+BAAiB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,KAAK,YAAY,gCAAkB,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,KAAK,YAAY,oCAAsB,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,KAAK,YAAY,mCAAqB,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC1D,CAAC;IAOK,AAAN,KAAK,CAAC,SAAS,CACd,IAA0B,EAC1B,GAAa,EACN,KAAmB;QAE1B,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;gBAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACpB,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;IACF,CAAC;IAOK,AAAN,KAAK,CAAC,OAAO,CACZ,IAA0B,EAC1B,GAAa,EACA,MAAc;QAE3B,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAExD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,MAAM,YAAY,CAAC,CAAC;YACjE,CAAC;YAED,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;IAOK,AAAN,KAAK,CAAC,UAAU,CACf,IAA0B,EAC1B,GAAa,EACP,IAAuB;QAE7B,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAG5D,IAAI,WAAW,CAAC,IAAI,EAAE,QAAQ;gBAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAElF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;IAOK,AAAN,KAAK,CAAC,WAAW,CAChB,IAA0B,EAC1B,GAAa,EACA,MAAc,EACrB,IAAuB;QAE7B,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAEpE,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QACrD,CAAC;IACF,CAAC;IAOK,AAAN,KAAK,CAAC,SAAS,CACd,IAA0B,EAC1B,GAAa,EACA,MAAc,EACrB,IAAyB;QAE/B,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAEnE,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;IACF,CAAC;IAOK,AAAN,KAAK,CAAC,UAAU,CACf,IAA0B,EAC1B,GAAa,EACA,MAAc;QAE3B,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE1C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;CACD,CAAA;;AAzHM;IADL,IAAA,gBAAG,EAAC,QAAQ,EAAE,sBAAS,CAAC;IAIvB,WAAA,kBAAK,CAAA;;qDAAQ,wBAAY;;+CAa1B;AAOK;IADL,IAAA,gBAAG,EAAC,YAAY,EAAE,sBAAS,CAAC;IAI3B,WAAA,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAA;;;;6CAaZ;AAOK;IADL,IAAA,iBAAI,EAAC,QAAQ,EAAE,sBAAS,CAAC;IAIxB,WAAA,iBAAI,CAAA;;qDAAO,6BAAiB;;gDAY7B;AAOK;IADL,IAAA,gBAAG,EAAC,YAAY,EAAE,sBAAS,CAAC;IAI3B,WAAA,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,iBAAI,CAAA;;6DAAO,6BAAiB;;iDAS7B;AAOK;IADL,IAAA,kBAAK,EAAC,YAAY,EAAE,sBAAS,CAAC;IAI7B,WAAA,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,iBAAI,CAAA;;6DAAO,+BAAmB;;+CAS/B;AAOK;IADL,IAAA,mBAAM,EAAC,YAAY,EAAE,sBAAS,CAAC;IAI9B,WAAA,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAA;;;;gDASZ;yBAxKW,cAAc;IAD1B,IAAA,gCAAmB,EAAC,UAAU,CAAC;qCAGL,uBAAM,EACD,0BAAW;GAH9B,cAAc,CAyK1B"}

package/dist/modules/scim/scim.errors.d.ts

@@ -5,9 +5,18 @@ export declare class ScimResourceNotFoundError extends UserError {
 export declare class ScimConflictError extends UserError {
     constructor(detail: string);
 }
+export declare class ScimForbiddenError extends UserError {
+    constructor(detail: string);
+}
 export declare class ScimInvalidFilterError extends UserError {
     constructor(filter: string);
 }
 export declare class ScimInvalidValueError extends UserError {
     constructor(detail: string);
 }
+export declare class ScimTokenConflictError extends UserError {
+    constructor();
+}
+export declare class ScimSsoRequiredError extends UserError {
+    constructor();
+}

package/dist/modules/scim/scim.errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ScimInvalidValueError = exports.ScimInvalidFilterError = exports.ScimConflictError = exports.ScimResourceNotFoundError = void 0;
+exports.ScimSsoRequiredError = exports.ScimTokenConflictError = exports.ScimInvalidValueError = exports.ScimInvalidFilterError = exports.ScimForbiddenError = exports.ScimConflictError = exports.ScimResourceNotFoundError = void 0;
 const n8n_workflow_1 = require("n8n-workflow");
 class ScimResourceNotFoundError extends n8n_workflow_1.UserError {
     constructor(resourceId) {
@@ -14,6 +14,12 @@ class ScimConflictError extends n8n_workflow_1.UserError {
     }
 }
 exports.ScimConflictError = ScimConflictError;
+class ScimForbiddenError extends n8n_workflow_1.UserError {
+    constructor(detail) {
+        super(detail);
+    }
+}
+exports.ScimForbiddenError = ScimForbiddenError;
 class ScimInvalidFilterError extends n8n_workflow_1.UserError {
     constructor(filter) {
         super(`Unsupported filter expression: ${filter}`);
@@ -26,4 +32,16 @@ class ScimInvalidValueError extends n8n_workflow_1.UserError {
     }
 }
 exports.ScimInvalidValueError = ScimInvalidValueError;
+class ScimTokenConflictError extends n8n_workflow_1.UserError {
+    constructor() {
+        super('The SCIM token changed during this request. Load the token state again and retry.');
+    }
+}
+exports.ScimTokenConflictError = ScimTokenConflictError;
+class ScimSsoRequiredError extends n8n_workflow_1.UserError {
+    constructor() {
+        super('Turn on SAML or OIDC single sign-on before you enable SCIM provisioning.');
+    }
+}
+exports.ScimSsoRequiredError = ScimSsoRequiredError;
 //# sourceMappingURL=scim.errors.js.map

package/dist/modules/scim/scim.errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim.errors.js","sourceRoot":"","sources":["../../../src/modules/scim/scim.errors.ts"],"names":[],"mappings":";;;AAAA,+CAAyC;AAGzC,+BAAuC,SAAQ,wBAAS;IACvD,YAAY,UAAkB;QAC7B,KAAK,CAAC,YAAY,UAAU,YAAY,CAAC,CAAC;IAC3C,CAAC;CACD;;AAGD,uBAA+B,SAAQ,wBAAS;IAC/C,YAAY,MAAc;QACzB,KAAK,CAAC,MAAM,CAAC,CAAC;IACf,CAAC;CACD;;AAGD,4BAAoC,SAAQ,wBAAS;IACpD,YAAY,MAAc;QACzB,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;CACD;;AAGD,2BAAmC,SAAQ,wBAAS;IACnD,YAAY,MAAc;QACzB,KAAK,CAAC,MAAM,CAAC,CAAC;IACf,CAAC;CACD"}
+{"version":3,"file":"scim.errors.js","sourceRoot":"","sources":["../../../src/modules/scim/scim.errors.ts"],"names":[],"mappings":";;;AAAA,+CAAyC;AAGzC,+BAAuC,SAAQ,wBAAS;IACvD,YAAY,UAAkB;QAC7B,KAAK,CAAC,YAAY,UAAU,YAAY,CAAC,CAAC;IAC3C,CAAC;CACD;;AAGD,uBAA+B,SAAQ,wBAAS;IAC/C,YAAY,MAAc;QACzB,KAAK,CAAC,MAAM,CAAC,CAAC;IACf,CAAC;CACD;;AAGD,wBAAgC,SAAQ,wBAAS;IAChD,YAAY,MAAc;QACzB,KAAK,CAAC,MAAM,CAAC,CAAC;IACf,CAAC;CACD;;AAGD,4BAAoC,SAAQ,wBAAS;IACpD,YAAY,MAAc;QACzB,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;CACD;;AAGD,2BAAmC,SAAQ,wBAAS;IACnD,YAAY,MAAc;QACzB,KAAK,CAAC,MAAM,CAAC,CAAC;IACf,CAAC;CACD;;AAMD,4BAAoC,SAAQ,wBAAS;IACpD;QACC,KAAK,CAAC,mFAAmF,CAAC,CAAC;IAC5F,CAAC;CACD;;AAMD,0BAAkC,SAAQ,wBAAS;IAClD;QACC,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACnF,CAAC;CACD"}

package/dist/modules/scim/scim.module.js

@@ -17,6 +17,8 @@ let ScimModule = class ScimModule {
         await import('./scim.controller.js');
         await import('./scim-discovery.controller.js');
         await import('./scim-token.controller.js');
+        const { ScimSsoService } = await import('./scim-sso.service.js');
+        await di_1.Container.get(ScimSsoService).init();
     }
     async settings() {
         const { ScimSettingsService } = await import('./scim-settings.service.js');

package/dist/modules/scim/scim.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim.module.js","sourceRoot":"","sources":["../../../src/modules/scim/scim.module.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,gDAA4D;AAC5D,gCAAoC;AAQ7B,IAAM,UAAU,GAAhB,MAAM,UAAU;IACtB,KAAK,CAAC,IAAI;QAET,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;IAMD,KAAK,CAAC,QAAQ;QACb,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAE3E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;IAC9E,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,KAAI,CAAC;CACnB,CAAA;;AADM;IADL,IAAA,uBAAU,GAAE;;;;0CACM;qBAnBP,UAAU;IADtB,IAAA,0BAAa,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;GACtE,UAAU,CAoBtB"}
+{"version":3,"file":"scim.module.js","sourceRoot":"","sources":["../../../src/modules/scim/scim.module.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,gDAA4D;AAC5D,gCAAoC;AAW7B,IAAM,UAAU,GAAhB,MAAM,UAAU;IACtB,KAAK,CAAC,IAAI;QAET,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAI3C,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACjE,MAAM,cAAS,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,CAAC;IAMD,KAAK,CAAC,QAAQ;QACb,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAE3E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;IAC9E,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,KAAI,CAAC;CACnB,CAAA;;AADM;IADL,IAAA,uBAAU,GAAE;;;;0CACM;qBAxBP,UAAU;IADtB,IAAA,0BAAa,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;GACtE,UAAU,CAyBtB"}

package/dist/modules/scim/scim.service.d.ts

@@ -1,7 +1,7 @@
-import type { ScimUser, ScimUserCreate, ScimListResponse, ScimPatchRequestDto } from '@n8n/api-types';
+import type { ScimUser, ScimUserCreateDto, ScimListResponse, ScimPatchRequestDto } from '@n8n/api-types';
 import { Logger } from '@n8n/backend-common';
 import { GlobalConfig } from '@n8n/config';
-import { RoleRepository, UserRepository } from '@n8n/db';
+import { UserRepository } from '@n8n/db';
 import { EventService, UrlService } from '@n8n/backend-services';
 import { PasswordUtility } from '../../services/password.utility';
 import { ScimUserRepository } from './database/scim-user.repository';
@@ -9,12 +9,11 @@ export declare class ScimService {
     private readonly logger;
     private readonly userRepository;
     private readonly scimUserRepository;
-    private readonly roleRepository;
     private readonly urlService;
     private readonly globalConfig;
     private readonly passwordUtility;
     private readonly eventService;
-    constructor(logger: Logger, userRepository: UserRepository, scimUserRepository: ScimUserRepository, roleRepository: RoleRepository, urlService: UrlService, globalConfig: GlobalConfig, passwordUtility: PasswordUtility, eventService: EventService);
+    constructor(logger: Logger, userRepository: UserRepository, scimUserRepository: ScimUserRepository, urlService: UrlService, globalConfig: GlobalConfig, passwordUtility: PasswordUtility, eventService: EventService);
     private toScimUser;
     private parseFilter;
     getUsers(options: {
@@ -23,16 +22,17 @@ export declare class ScimService {
         filter?: string;
     }): Promise<ScimListResponse>;
     getUserById(id: string): Promise<ScimUser | null>;
-    private resolveRequestedRole;
     private resolveEmail;
-    createUser(scimUser: ScimUserCreate): Promise<ScimUser>;
+    createUser(scimUser: ScimUserCreateDto): Promise<ScimUser>;
     patchUser(id: string, patchRequest: ScimPatchRequestDto): Promise<ScimUser>;
     private applyPathOperation;
-    updateUser(id: string, scimUser: ScimUserCreate): Promise<ScimUser>;
+    private setField;
+    updateUser(id: string, scimUser: ScimUserCreateDto): Promise<ScimUser>;
     deleteUser(id: string): Promise<void>;
     private getUserEntity;
-    private toScimRoles;
-    private applyRoleChange;
+    private isOwner;
+    private snapshot;
+    private assertOwnerUnchanged;
     private saveUser;
     private getSsoProviderType;
 }

package/dist/modules/scim/scim.service.js

@@ -14,20 +14,18 @@ const backend_common_1 = require("@n8n/backend-common");
 const config_1 = require("@n8n/config");
 const db_1 = require("@n8n/db");
 const di_1 = require("@n8n/di");
+const permissions_1 = require("@n8n/permissions");
 const n8n_workflow_1 = require("n8n-workflow");
 const backend_services_1 = require("@n8n/backend-services");
 const password_utility_1 = require("../../services/password.utility");
 const scim_user_repository_1 = require("./database/scim-user.repository");
 const scim_errors_1 = require("./scim.errors");
 const SSO_PROVIDER_TYPES = ['saml', 'oidc'];
-const DEFAULT_ROLE_SLUG = 'global:member';
-const OWNER_ROLE_SLUG = 'global:owner';
 let ScimService = class ScimService {
-    constructor(logger, userRepository, scimUserRepository, roleRepository, urlService, globalConfig, passwordUtility, eventService) {
+    constructor(logger, userRepository, scimUserRepository, urlService, globalConfig, passwordUtility, eventService) {
         this.logger = logger;
         this.userRepository = userRepository;
         this.scimUserRepository = scimUserRepository;
-        this.roleRepository = roleRepository;
         this.urlService = urlService;
         this.globalConfig = globalConfig;
         this.passwordUtility = passwordUtility;
@@ -54,7 +52,6 @@ let ScimService = class ScimService {
                     },
                 ]
                 : undefined,
-            roles: user.role ? [{ value: user.role.slug, primary: true }] : undefined,
             active: !user.disabled,
             meta: {
                 resourceType: 'User',
@@ -102,28 +99,12 @@ let ScimService = class ScimService {
     async getUserById(id) {
         const user = await this.userRepository.findOne({
             where: { id },
-            relations: ['authIdentities', 'role'],
+            relations: ['authIdentities'],
         });
         if (!user)
             return null;
         return this.toScimUser(user);
     }
-    async resolveRequestedRole(roles) {
-        if (!roles?.length)
-            return null;
-        if (roles.length > 1) {
-            throw new scim_errors_1.ScimInvalidValueError('n8n users have a single global role; the roles attribute must contain exactly one entry');
-        }
-        const slug = roles[0].value;
-        if (slug === OWNER_ROLE_SLUG) {
-            throw new scim_errors_1.ScimInvalidValueError('The owner role cannot be assigned via SCIM');
-        }
-        const role = await this.roleRepository.findOne({ where: { slug, roleType: 'global' } });
-        if (!role) {
-            throw new scim_errors_1.ScimInvalidValueError(`Unknown role: ${slug}`);
-        }
-        return role;
-    }
     resolveEmail(scimUser) {
         const emails = scimUser.emails ?? [];
         const candidate = emails.find((entry) => entry.primary)?.value ?? emails[0]?.value ?? scimUser.userName;
@@ -143,12 +124,11 @@ let ScimService = class ScimService {
             throw new scim_errors_1.ScimConflictError('User with this userName already exists');
         }
         const providerType = this.getSsoProviderType();
-        const requestedRole = await this.resolveRequestedRole(scimUser.roles);
         const createdUser = await this.scimUserRepository.createProvisioned({
             email,
             firstName,
             lastName,
-            role: { slug: requestedRole?.slug ?? DEFAULT_ROLE_SLUG },
+            role: { slug: permissions_1.GLOBAL_MEMBER_ROLE_SLUG },
             password: await this.passwordUtility.hash((0, n8n_workflow_1.randomString)(18)),
             disabled: !active,
         }, providerType && externalId ? { providerId: externalId, providerType } : undefined, {});
@@ -165,22 +145,22 @@ let ScimService = class ScimService {
     }
     async patchUser(id, patchRequest) {
         const user = await this.getUserEntity(id);
+        const before = this.snapshot(user);
         const changes = new Set();
-        const pending = {};
         for (const operation of patchRequest.Operations) {
             const { op, path, value } = operation;
             if (op !== 'add' && op !== 'replace')
                 continue;
             if (path) {
-                this.applyPathOperation(user, path, value, changes, pending);
+                this.applyPathOperation(user, path, value, changes);
             }
             else if (typeof value === 'object' && value !== null) {
                 for (const [attribute, attributeValue] of Object.entries(value)) {
-                    this.applyPathOperation(user, attribute, attributeValue, changes, pending);
+                    this.applyPathOperation(user, attribute, attributeValue, changes);
                 }
             }
         }
-        await this.applyRoleChange(user, this.toScimRoles(pending.roles), changes);
+        this.assertOwnerUnchanged(user, before);
         if (changes.size > 0) {
             await this.saveUser(user);
             this.eventService.emit('user-updated', { user, fieldsChanged: [...changes] });
@@ -190,66 +170,59 @@ let ScimService = class ScimService {
             throw new scim_errors_1.ScimResourceNotFoundError(user.id);
         return patched;
     }
-    applyPathOperation(user, path, value, changes, pending) {
+    applyPathOperation(user, path, value, changes) {
         switch (path) {
             case 'roles':
-                pending.roles = value;
                 return;
             case 'active':
-                if (typeof value === 'boolean') {
-                    user.disabled = !value;
-                    changes.add('disabled');
-                }
+                if (typeof value === 'boolean')
+                    this.setField(user, 'disabled', !value, changes);
                 return;
             case 'userName':
-                if (typeof value === 'string') {
-                    user.email = value.toLowerCase();
-                    changes.add('email');
-                }
+                if (typeof value === 'string')
+                    this.setField(user, 'email', value.toLowerCase(), changes);
                 return;
             case 'name.givenName':
-                if (typeof value === 'string') {
-                    user.firstName = value;
-                    changes.add('firstName');
-                }
+                if (typeof value === 'string')
+                    this.setField(user, 'firstName', value, changes);
                 return;
             case 'name.familyName':
-                if (typeof value === 'string') {
-                    user.lastName = value;
-                    changes.add('lastName');
-                }
+                if (typeof value === 'string')
+                    this.setField(user, 'lastName', value, changes);
                 return;
             case 'name':
                 if (typeof value === 'object' && value !== null) {
                     const name = value;
                     if (typeof name.givenName === 'string') {
-                        user.firstName = name.givenName;
-                        changes.add('firstName');
+                        this.setField(user, 'firstName', name.givenName, changes);
                     }
                     if (typeof name.familyName === 'string') {
-                        user.lastName = name.familyName;
-                        changes.add('lastName');
+                        this.setField(user, 'lastName', name.familyName, changes);
                     }
                 }
                 return;
             case 'emails':
                 if (Array.isArray(value)) {
                     const primary = value.find((email) => email?.primary && typeof email.value === 'string');
-                    if (primary) {
-                        user.email = primary.value.toLowerCase();
-                        changes.add('email');
-                    }
+                    if (primary)
+                        this.setField(user, 'email', primary.value.toLowerCase(), changes);
                 }
                 return;
             default:
                 if (/^emails\[.*\]\.value$/.test(path) && typeof value === 'string') {
-                    user.email = value.toLowerCase();
-                    changes.add('email');
+                    this.setField(user, 'email', value.toLowerCase(), changes);
                 }
         }
     }
+    setField(user, field, value, changes) {
+        if (user[field] === value)
+            return;
+        user[field] = value;
+        changes.add(field);
+    }
     async updateUser(id, scimUser) {
         const user = await this.getUserEntity(id);
+        const before = this.snapshot(user);
         const changes = new Set();
         const email = this.resolveEmail(scimUser);
         if (email !== user.email) {
@@ -268,7 +241,7 @@ let ScimService = class ScimService {
             user.disabled = !scimUser.active;
             changes.add('disabled');
         }
-        await this.applyRoleChange(user, scimUser.roles, changes);
+        this.assertOwnerUnchanged(user, before);
         if (changes.size > 0) {
             await this.saveUser(user);
             this.eventService.emit('user-updated', { user, fieldsChanged: [...changes] });
@@ -280,6 +253,9 @@ let ScimService = class ScimService {
     }
     async deleteUser(id) {
         const user = await this.getUserEntity(id);
+        if (this.isOwner(user)) {
+            throw new scim_errors_1.ScimForbiddenError('The instance owner cannot be deleted via SCIM');
+        }
         user.disabled = true;
         await this.userRepository.save(user);
         this.eventService.emit('user-updated', { user, fieldsChanged: ['disabled'] });
@@ -291,20 +267,21 @@ let ScimService = class ScimService {
             throw new scim_errors_1.ScimResourceNotFoundError(id);
         return user;
     }
-    toScimRoles(value) {
-        if (!Array.isArray(value))
-            return undefined;
-        return value.filter((role) => typeof role === 'object' && role !== null && typeof role.value === 'string');
+    isOwner(user) {
+        return user.role?.slug === permissions_1.GLOBAL_OWNER_ROLE_SLUG;
+    }
+    snapshot(user) {
+        return { email: user.email, disabled: user.disabled };
     }
-    async applyRoleChange(user, roles, changes) {
-        const requestedRole = await this.resolveRequestedRole(roles);
-        if (!requestedRole || requestedRole.slug === user.role?.slug)
+    assertOwnerUnchanged(user, before) {
+        if (!this.isOwner(user))
             return;
-        if (user.role?.slug === OWNER_ROLE_SLUG) {
-            throw new scim_errors_1.ScimInvalidValueError('The role of the instance owner cannot be changed via SCIM');
+        if (user.email.toLowerCase() !== before.email.toLowerCase()) {
+            throw new scim_errors_1.ScimForbiddenError('The email of the instance owner cannot be changed via SCIM');
+        }
+        if (user.disabled && !before.disabled) {
+            throw new scim_errors_1.ScimForbiddenError('The instance owner cannot be deactivated via SCIM');
         }
-        user.role = requestedRole;
-        changes.add('role');
     }
     async saveUser(user) {
         const conflictingUser = await this.userRepository.findOne({ where: { email: user.email } });
@@ -324,6 +301,6 @@ let ScimService = class ScimService {
 exports.ScimService = ScimService;
 exports.ScimService = ScimService = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [backend_common_1.Logger, db_1.UserRepository, scim_user_repository_1.ScimUserRepository, db_1.RoleRepository, backend_services_1.UrlService, config_1.GlobalConfig, password_utility_1.PasswordUtility, backend_services_1.EventService])
+    __metadata("design:paramtypes", [backend_common_1.Logger, db_1.UserRepository, scim_user_repository_1.ScimUserRepository, backend_services_1.UrlService, config_1.GlobalConfig, password_utility_1.PasswordUtility, backend_services_1.EventService])
 ], ScimService);
 //# sourceMappingURL=scim.service.js.map