permdock 0.3.1 → 0.5.0

package/dist/{scim-BFGBBAqR.js → scim-ClHtpyV3.js}

@@ -1,7 +1,12 @@
-import { n as isReadonlyArray, t as compact } from "./compact-y6vfu2_f.js";
+import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as sha256 } from "./sha256-BO0swRXL.js";
-import { a as memorySink, i as membershipEvent } from "./sink-Bd9PSyfq.js";
+import { i as readAppData } from "./app-data-MuyzVqX8.js";
+import { d as isoNow } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { n as sha256, r as sha256Digest } from "./sha256-D9ihqmvd.js";
+import { d as membershipEvent, f as memoryDecisionSink } from "./sink-BEZSlMS_.js";
+import { n as readBodyText, t as MAX_BODY_BYTES } from "./body-text-QcXok_SI.js";
+import { t as readClaim } from "./claims-map-7oQ3ue4X.js";
 //#region src/scim/auth.ts
 function hexToBytes(hex) {
 	if (hex.length % 2 !== 0) return;
@@ -33,9 +38,12 @@ async function matchStaticToken(tenant, token, options) {
 	}
 	return timingSafeEqual(actual, expected);
 }
-function tenantClaim(claims) {
-	if (typeof claims["tenant"] === "string" && claims["tenant"] !== "") return claims["tenant"];
-	if (typeof claims["tid"] === "string" && claims["tid"] !== "") return claims["tid"];
+/** The tenant a JWT names: `claims.tenant` when set, else `tenant`, then `tid`. */
+function tenantClaim(claims, path) {
+	for (const candidate of path === void 0 ? ["tenant", "tid"] : [path]) {
+		const value = readClaim(claims, candidate);
+		if (typeof value === "string" && value !== "") return value;
+	}
 }
 async function authenticateScim(input) {
 	const bearer = bearerToken(input.request);
@@ -58,7 +66,7 @@ async function authenticateScim(input) {
 		ok: false,
 		status: 401
 	};
-	if (tenantClaim(verified.claims) !== input.tenant) return {
+	if (tenantClaim(verified.claims, input.claims?.tenant) !== input.tenant) return {
 		ok: false,
 		status: 403
 	};
@@ -84,7 +92,10 @@ const GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
 const LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
 const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
 const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
-const ROLES_EXTENSION = "urn:permdock:scim:schemas:extension:roles:1.0";
+/** The RFC 7643 section 3.3 Group extension that carries PermDock roles. */
+const ROLES_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:Group";
+/** The extension that carries the application's own data (`x`) on a User or a Group. */
+const APP_DATA_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:AppData";
 var DirectoryUniquenessError = class extends Error {
 	name = "DirectoryUniquenessError";
 	code = "uniqueness";
@@ -99,11 +110,16 @@ var DirectoryNotFoundError = class extends Error {
 		super(message);
 	}
 };
+function isNamedError(error, name, code) {
+	return error instanceof Error && error.name === name && Reflect.get(error, "code") === code;
+}
+/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
 function isDirectoryUniquenessError(error) {
-	return error instanceof DirectoryUniquenessError;
+	return isNamedError(error, "DirectoryUniquenessError", "uniqueness");
 }
+/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
 function isDirectoryNotFoundError(error) {
-	return error instanceof DirectoryNotFoundError;
+	return isNamedError(error, "DirectoryNotFoundError", "not-found");
 }
 //#endregion
 //#region src/scim/discovery.ts
@@ -123,7 +139,7 @@ function serviceProviderConfig() {
 		},
 		changePassword: { supported: false },
 		sort: { supported: false },
-		etag: { supported: false },
+		etag: { supported: true },
 		pagination: {
 			cursor: true,
 			index: true
@@ -144,7 +160,10 @@ function resourceTypes() {
 		name: "User",
 		endpoint: "/Users",
 		schema: USER_SCHEMA,
-		schemaExtensions: []
+		schemaExtensions: [{
+			schema: APP_DATA_EXTENSION,
+			required: false
+		}]
 	}, {
 		schemas: ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
 		id: "Group",
@@ -154,6 +173,9 @@ function resourceTypes() {
 		schemaExtensions: [{
 			schema: ROLES_EXTENSION,
 			required: false
+		}, {
+			schema: APP_DATA_EXTENSION,
+			required: false
 		}]
 	}];
 }
@@ -208,6 +230,12 @@ function schemas() {
 			id: ROLES_EXTENSION,
 			name: "PermDockRoles",
 			attributes: [attribute("roles", "string", { multiValued: true })]
+		},
+		{
+			schemas: [SCHEMA_SCHEMA],
+			id: APP_DATA_EXTENSION,
+			name: "PermDockAppData",
+			attributes: [attribute("x", "complex")]
 		}
 	];
 }
@@ -445,13 +473,21 @@ function filterSupported(filter) {
 }
 //#endregion
 //#region src/scim/body.ts
-function isRecord$1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
+/** The parsed body; `undefined` for an empty or unreadable one. Invalid JSON throws a `SyntaxError`. */
 async function readJson(request) {
-	const text = await request.text();
-	if (text === "") return;
-	return JSON.parse(text);
+	const read = await readBodyText(request);
+	if (!read.ok) return read.cause === "too-large" ? { tooLarge: true } : {
+		tooLarge: false,
+		body: void 0
+	};
+	if (read.text === "") return {
+		tooLarge: false,
+		body: void 0
+	};
+	return {
+		tooLarge: false,
+		body: JSON.parse(read.text)
+	};
 }
 function schemasOk(body, required) {
 	const listed = body["schemas"];
@@ -460,13 +496,18 @@ function schemasOk(body, required) {
 }
 function readRoles(body) {
 	const extension = body[ROLES_EXTENSION];
-	if (!isRecord$1(extension) || !Array.isArray(extension["roles"])) return;
+	if (!isRecord(extension) || !Array.isArray(extension["roles"])) return;
 	return extension["roles"].filter((item) => typeof item === "string");
 }
+/** `x` from the `AppData` extension; a value that is not a plain JSON object is dropped. */
+function readX(body) {
+	const extension = body[APP_DATA_EXTENSION];
+	return isRecord(extension) && extension["x"] !== void 0 ? readAppData(void 0, extension["x"]) : void 0;
+}
 function userFromBody(body, id) {
 	if (typeof body["userName"] !== "string" || body["userName"] === "") return;
 	const emails = Array.isArray(body["emails"]) ? body["emails"].flatMap((item) => {
-		if (!isRecord$1(item) || typeof item["value"] !== "string") return [];
+		if (!isRecord(item) || typeof item["value"] !== "string") return [];
 		return [compact({
 			value: item["value"],
 			primary: typeof item["primary"] === "boolean" ? item["primary"] : void 0,
@@ -480,6 +521,7 @@ function userFromBody(body, id) {
 		externalId: typeof body["externalId"] === "string" ? body["externalId"] : void 0,
 		active,
 		emails,
+		x: readX(body),
 		meta: {
 			created: "",
 			lastModified: ""
@@ -489,7 +531,7 @@ function userFromBody(body, id) {
 function groupFromBody(body, id, fallbackRoles) {
 	if (typeof body["displayName"] !== "string" || body["displayName"] === "") return;
 	const members = Array.isArray(body["members"]) ? body["members"].flatMap((item) => {
-		if (!isRecord$1(item) || typeof item["value"] !== "string") return [];
+		if (!isRecord(item) || typeof item["value"] !== "string") return [];
 		return [{ value: item["value"] }];
 	}) : [];
 	return compact({
@@ -498,6 +540,7 @@ function groupFromBody(body, id, fallbackRoles) {
 		externalId: typeof body["externalId"] === "string" ? body["externalId"] : void 0,
 		members,
 		roles: readRoles(body) ?? fallbackRoles,
+		x: readX(body),
 		meta: {
 			created: "",
 			lastModified: ""
@@ -550,7 +593,7 @@ function membershipEventsForGroup(input) {
 }
 async function emitDirectory(options, event, userIds, extra = [], known = []) {
 	const kind = event.resource.type === "User" && event.active === false ? "session-revoked" : "changed";
-	const sink = options.sink ?? memorySink();
+	const sink = options.sink ?? memoryDecisionSink();
 	try {
 		await sink.write([event, ...extra]);
 	} catch {}
@@ -570,7 +613,7 @@ async function principalIds(options, tenant, userIds, known) {
 		const hit = known.find((user) => user.id === id);
 		if (hit !== void 0) return hit;
 		try {
-			return await options.store.getUser(tenant, id);
+			return await options.directory.getUser(tenant, id);
 		} catch {
 			return null;
 		}
@@ -599,7 +642,7 @@ async function publish(options, kind, tenant, userIds, known) {
 function directoryEvent(input) {
 	return compact({
 		type: "directory",
-		at: (/* @__PURE__ */ new Date()).toISOString(),
+		at: isoNow(),
 		source: "scim",
 		operation: input.operation,
 		tenant: input.tenant,
@@ -620,9 +663,6 @@ function groupRolesFor(groupRoles, id) {
 //#endregion
 //#region src/scim/patch.ts
 const FILTER_PATH = /^(?<attribute>[A-Za-z0-9._]+)\[(?<field>[A-Za-z0-9._]+)\s+eq\s+"(?<value>[^"]+)"\](?<rest>\.[A-Za-z0-9._]+)?$/u;
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function coerceActive(value) {
 	if (typeof value === "boolean") return value;
 	if (typeof value === "string") {
@@ -632,7 +672,7 @@ function coerceActive(value) {
 	}
 }
 function rolesPath(path) {
-	return path === "roles" || path === `urn:permdock:scim:schemas:extension:roles:1.0:roles` || path === `urn:permdock:scim:schemas:extension:roles:1.0.roles`;
+	return path === "roles" || path === `urn:ietf:params:scim:schemas:extension:permdock:2.0:Group:roles` || path === `urn:ietf:params:scim:schemas:extension:permdock:2.0:Group.roles`;
 }
 function opName(value) {
 	if (typeof value !== "string") return;
@@ -655,7 +695,7 @@ function normalizePatchOps(ops) {
 				continue;
 			}
 			for (const [key, value] of Object.entries(raw["value"])) {
-				if (key === "urn:permdock:scim:schemas:extension:roles:1.0" && isRecord(value)) {
+				if (key === "urn:ietf:params:scim:schemas:extension:permdock:2.0:Group" && isRecord(value)) {
 					next.push({
 						op,
 						path: "roles",
@@ -742,25 +782,63 @@ function scimResponse(status, body, extra) {
 		}
 	});
 }
-function scimError(status, scimType, detail) {
-	return scimResponse(status, {
+/** RFC 7644 section 3.12: `scimType` is defined for `400` and `409` only, so other statuses omit it. */
+function scimError(status, scimType, detail, extra) {
+	return scimResponse(status, compact({
 		schemas: [ERROR_SCHEMA],
 		status: String(status),
-		scimType,
+		scimType: status === 400 || status === 409 ? scimType : void 0,
 		detail
-	});
+	}), extra);
 }
 function unauthorized() {
-	return new Response(null, {
-		status: 401,
-		headers: { "www-authenticate": "Bearer" }
-	});
+	return scimError(401, "", "authentication required", { "www-authenticate": "Bearer" });
 }
 function forbidden() {
-	return new Response(null, {
-		status: 403,
-		headers: { "www-authenticate": "Bearer" }
-	});
+	return scimError(403, "", "the credential may not provision this tenant", { "www-authenticate": "Bearer error=\"insufficient_scope\"" });
+}
+/**
+* RFC 7644 section 3.14 `meta.version`: a weak entity tag over the
+* resource as rendered, `meta.location` excluded so every URL agrees.
+*/
+function withVersion(resource, meta) {
+	const { location: _location, ...stable } = meta;
+	const version = `W/"${sha256Digest(canonicalJson({
+		...resource,
+		meta: stable
+	}))}"`;
+	return {
+		...resource,
+		meta: {
+			...meta,
+			version
+		}
+	};
+}
+/** The `meta.version` a rendered resource carries, for `ETag`. */
+function versionOf(rendered) {
+	const meta = rendered["meta"];
+	return isRecord(meta) && typeof meta["version"] === "string" ? meta["version"] : "";
+}
+function entityTags(field) {
+	return field.split(",").map((tag) => tag.trim().replace(/^W\//u, "")).filter((tag) => tag !== "");
+}
+/** RFC 9110 section 13.1.1 `If-Match` against a weak `meta.version`: `true` when the request may proceed. */
+function ifMatchHolds(request, version) {
+	const field = request.headers.get("if-match");
+	if (field === null) return true;
+	const tags = entityTags(field);
+	return tags.includes("*") || tags.includes(version.replace(/^W\//u, ""));
+}
+/** RFC 9110 section 13.1.2 `If-None-Match`: `true` when the client holds `version`. */
+function ifNoneMatchHolds(request, version) {
+	const field = request.headers.get("if-none-match");
+	if (field === null) return false;
+	const tags = entityTags(field);
+	return tags.includes("*") || tags.includes(version.replace(/^W\//u, ""));
+}
+function preconditionFailed() {
+	return scimError(412, "", "the resource changed since meta.version");
 }
 function mapStoreError(error) {
 	if (isDirectoryUniquenessError(error)) return scimError(409, "uniqueness", error.message);
@@ -777,37 +855,53 @@ function listBody(result, render) {
 		Resources: result.Resources.map(render)
 	});
 }
+/** The `AppData` extension for `x`, and the schema URN it adds. */
+function appData(x) {
+	return x === void 0 ? {
+		schemas: [],
+		body: {}
+	} : {
+		schemas: [APP_DATA_EXTENSION],
+		body: { [APP_DATA_EXTENSION]: { x } }
+	};
+}
 function renderUser(user, location) {
-	return compact({
-		schemas: [USER_SCHEMA],
+	const data = appData(user.x);
+	return withVersion(compact({
+		schemas: [USER_SCHEMA, ...data.schemas],
 		id: user.id,
 		externalId: user.externalId,
 		userName: user.userName,
 		active: user.active,
 		emails: user.emails,
-		meta: {
-			resourceType: "User",
-			created: user.meta.created,
-			lastModified: user.meta.lastModified,
-			location
-		}
+		...data.body
+	}), {
+		resourceType: "User",
+		created: user.meta.created,
+		lastModified: user.meta.lastModified,
+		location
 	});
 }
 function renderGroup(group, location) {
 	const extension = group.roles === void 0 ? void 0 : { [ROLES_EXTENSION]: { roles: group.roles } };
-	return compact({
-		schemas: group.roles === void 0 ? [GROUP_SCHEMA] : [GROUP_SCHEMA, ROLES_EXTENSION],
+	const data = appData(group.x);
+	return withVersion(compact({
+		schemas: [
+			GROUP_SCHEMA,
+			...group.roles === void 0 ? [] : [ROLES_EXTENSION],
+			...data.schemas
+		],
 		id: group.id,
 		externalId: group.externalId,
 		displayName: group.displayName,
 		members: group.members,
 		...extension,
-		meta: {
-			resourceType: "Group",
-			created: group.meta.created,
-			lastModified: group.meta.lastModified,
-			location
-		}
+		...data.body
+	}), {
+		resourceType: "Group",
+		created: group.meta.created,
+		lastModified: group.meta.lastModified,
+		location
 	});
 }
 //#endregion
@@ -885,6 +979,20 @@ function pageFrom(url) {
 }
 //#endregion
 //#region src/scim/handler.ts
+/** One resource with its `meta.version` as the `ETag`. */
+function resourceResponse(status, rendered, location) {
+	return scimResponse(status, rendered, compact({
+		ETag: versionOf(rendered),
+		location
+	}));
+}
+function renderedOf(request, resource) {
+	return "userName" in resource ? renderUser(resource, locationOf(request, "Users", resource.id)) : renderGroup(resource, locationOf(request, "Groups", resource.id));
+}
+/** `false` when `If-Match` names a version other than `current`'s; a missing resource passes to the store. */
+function matches(request, current) {
+	return current === null || ifMatchHolds(request, versionOf(renderedOf(request, current)));
+}
 function scimHandler(options) {
 	if (options.token === void 0 && options.verifier === void 0) throw new Error("scimHandler requires token or verifier");
 	if (options.verifier !== void 0 && options.audience === void 0) throw new Error("scimHandler requires audience with a verifier");
@@ -904,7 +1012,8 @@ function scimHandler(options) {
 			tenant,
 			audience: options.audience,
 			token: options.token,
-			verifier: options.verifier
+			verifier: options.verifier,
+			claims: options.claims
 		}));
 		if (!auth.ok) return auth.status === 403 ? forbidden() : unauthorized();
 		try {
@@ -918,23 +1027,24 @@ function scimHandler(options) {
 				if (rawFilter !== null && rawFilter !== "" && filter === void 0) return scimError(400, "invalidFilter", "unsupported filter");
 				if (filter !== void 0 && !filterSupported(filter)) return scimError(400, "invalidFilter", "unsupported filter");
 				const page = pageFrom(url);
-				if (route.kind === "Users") return scimResponse(200, listBody(await options.store.findUsers(tenant, filter, page), (user) => renderUser(user, locationOf(request, "Users", user.id))));
-				return scimResponse(200, listBody(await options.store.findGroups(tenant, filter, page), (group) => renderGroup(group, locationOf(request, "Groups", group.id))));
+				if (route.kind === "Users") return scimResponse(200, listBody(await options.directory.findUsers(tenant, filter, page), (user) => renderUser(user, locationOf(request, "Users", user.id))));
+				return scimResponse(200, listBody(await options.directory.findGroups(tenant, filter, page), (group) => renderGroup(group, locationOf(request, "Groups", group.id))));
 			}
 			if (request.method === "GET" && route.id !== void 0) {
 				if (route.kind === "Users") {
-					const user = await options.store.getUser(tenant, route.id);
+					const user = await options.directory.getUser(tenant, route.id);
 					if (user === null) return scimError(404, "invalidValue", "resource not found");
-					return scimResponse(200, renderUser(user, locationOf(request, "Users", user.id)));
+					return readResponse(request, renderedOf(request, user));
 				}
-				const group = await options.store.getGroup(tenant, route.id);
+				const group = await options.directory.getGroup(tenant, route.id);
 				if (group === null) return scimError(404, "invalidValue", "resource not found");
-				return scimResponse(200, renderGroup(group, locationOf(request, "Groups", group.id)));
+				return readResponse(request, renderedOf(request, group));
 			}
 			if (request.method === "DELETE" && route.id !== void 0) {
 				if (route.kind === "Users") {
-					const existing = await options.store.getUser(tenant, route.id);
-					await options.store.deleteUser(tenant, route.id);
+					const existing = await options.directory.getUser(tenant, route.id);
+					if (!matches(request, existing)) return preconditionFailed();
+					await options.directory.deleteUser(tenant, route.id);
 					await emitDirectory(options, directoryEvent({
 						operation: "delete",
 						tenant,
@@ -945,8 +1055,9 @@ function scimHandler(options) {
 					}), existing === null ? [] : [existing.id], [], existing === null ? [] : [existing]);
 					return new Response(null, { status: 204 });
 				}
-				const existing = await options.store.getGroup(tenant, route.id);
-				await options.store.deleteGroup(tenant, route.id);
+				const existing = await options.directory.getGroup(tenant, route.id);
+				if (!matches(request, existing)) return preconditionFailed();
+				await options.directory.deleteGroup(tenant, route.id);
 				await emitDirectory(options, directoryEvent({
 					operation: "delete",
 					tenant,
@@ -962,14 +1073,16 @@ function scimHandler(options) {
 				}));
 				return new Response(null, { status: 204 });
 			}
-			const body = await readJson(request);
-			if (!isRecord$1(body)) return scimError(400, "invalidSyntax", "malformed body");
+			const read = await readJson(request);
+			if (read.tooLarge) return scimError(413, "", `request body exceeds ${String(MAX_BODY_BYTES)} bytes`);
+			const { body } = read;
+			if (!isRecord(body)) return scimError(400, "invalidSyntax", "malformed body");
 			if (request.method === "POST" && route.id === void 0) {
 				if (route.kind === "Users") {
 					if (!schemasOk(body, "urn:ietf:params:scim:schemas:core:2.0:User")) return scimError(400, "invalidSyntax", "unsupported schema");
 					const parsed = userFromBody(body, "");
 					if (parsed === void 0) return scimError(400, "invalidValue", "userName is required");
-					const stored = await options.store.putUser(tenant, parsed);
+					const stored = await options.directory.putUser(tenant, parsed);
 					const location = locationOf(request, "Users", stored.id);
 					await emitDirectory(options, directoryEvent({
 						operation: "create",
@@ -979,13 +1092,13 @@ function scimHandler(options) {
 						credential: auth.credential,
 						active: stored.active
 					}), [stored.id]);
-					return scimResponse(201, renderUser(stored, location), { location });
+					return resourceResponse(201, renderUser(stored, location), location);
 				}
 				if (!schemasOk(body, "urn:ietf:params:scim:schemas:core:2.0:Group")) return scimError(400, "invalidSyntax", "unsupported schema");
 				const parsed = groupFromBody(body, "", groupRolesFor(options.groupRoles, body["id"]));
 				if (parsed === void 0) return scimError(400, "invalidValue", "displayName is required");
 				reportUnknownRoles(parsed.roles, options);
-				const stored = await options.store.putGroup(tenant, parsed);
+				const stored = await options.directory.putGroup(tenant, parsed);
 				const location = locationOf(request, "Groups", stored.id);
 				await emitDirectory(options, directoryEvent({
 					operation: "create",
@@ -1000,15 +1113,17 @@ function scimHandler(options) {
 					previous: null,
 					next: stored
 				}));
-				return scimResponse(201, renderGroup(stored, location), { location });
+				return resourceResponse(201, renderGroup(stored, location), location);
 			}
 			if (request.method === "PUT" && route.id !== void 0) {
 				if (route.kind === "Users") {
 					if (!schemasOk(body, "urn:ietf:params:scim:schemas:core:2.0:User")) return scimError(400, "invalidSyntax", "unsupported schema");
-					if (await options.store.getUser(tenant, route.id) === null) return scimError(404, "invalidValue", "resource not found");
+					const existing = await options.directory.getUser(tenant, route.id);
+					if (existing === null) return scimError(404, "invalidValue", "resource not found");
+					if (!matches(request, existing)) return preconditionFailed();
 					const parsed = userFromBody(body, route.id);
 					if (parsed === void 0) return scimError(400, "invalidValue", "userName is required");
-					const stored = await options.store.putUser(tenant, parsed);
+					const stored = await options.directory.putUser(tenant, parsed);
 					const location = locationOf(request, "Users", stored.id);
 					await emitDirectory(options, directoryEvent({
 						operation: "replace",
@@ -1018,15 +1133,16 @@ function scimHandler(options) {
 						credential: auth.credential,
 						active: stored.active
 					}), [stored.id]);
-					return scimResponse(200, renderUser(stored, location), { location });
+					return resourceResponse(200, renderUser(stored, location), location);
 				}
 				if (!schemasOk(body, "urn:ietf:params:scim:schemas:core:2.0:Group")) return scimError(400, "invalidSyntax", "unsupported schema");
-				const existing = await options.store.getGroup(tenant, route.id);
+				const existing = await options.directory.getGroup(tenant, route.id);
 				if (existing === null) return scimError(404, "invalidValue", "resource not found");
+				if (!matches(request, existing)) return preconditionFailed();
 				const parsed = groupFromBody(body, route.id, groupRolesFor(options.groupRoles, route.id));
 				if (parsed === void 0) return scimError(400, "invalidValue", "displayName is required");
 				reportUnknownRoles(parsed.roles, options);
-				const stored = await options.store.putGroup(tenant, parsed);
+				const stored = await options.directory.putGroup(tenant, parsed);
 				const location = locationOf(request, "Groups", stored.id);
 				await emitDirectory(options, directoryEvent({
 					operation: "replace",
@@ -1041,7 +1157,7 @@ function scimHandler(options) {
 					previous: existing,
 					next: stored
 				}));
-				return scimResponse(200, renderGroup(stored, location), { location });
+				return resourceResponse(200, renderGroup(stored, location), location);
 			}
 			if (request.method === "PATCH" && route.id !== void 0) {
 				const operations = readPatchOperations(body);
@@ -1049,7 +1165,8 @@ function scimHandler(options) {
 				const normalized = normalizePatchOps(operations);
 				if (normalized === void 0) return scimError(400, "invalidSyntax", "invalid patch");
 				if (route.kind === "Users") {
-					const stored = await options.store.patchUser(tenant, route.id, normalized);
+					if (!matches(request, await options.directory.getUser(tenant, route.id))) return preconditionFailed();
+					const stored = await options.directory.patchUser(tenant, route.id, normalized);
 					const location = locationOf(request, "Users", stored.id);
 					await emitDirectory(options, directoryEvent({
 						operation: "patch",
@@ -1059,10 +1176,11 @@ function scimHandler(options) {
 						credential: auth.credential,
 						active: stored.active
 					}), [stored.id]);
-					return scimResponse(200, renderUser(stored, location), { location });
+					return resourceResponse(200, renderUser(stored, location), location);
 				}
-				const existing = await options.store.getGroup(tenant, route.id);
-				const stored = await options.store.patchGroup(tenant, route.id, normalized);
+				const existing = await options.directory.getGroup(tenant, route.id);
+				if (!matches(request, existing)) return preconditionFailed();
+				const stored = await options.directory.patchGroup(tenant, route.id, normalized);
 				reportUnknownRoles(stored.roles, options);
 				const location = locationOf(request, "Groups", stored.id);
 				await emitDirectory(options, directoryEvent({
@@ -1078,7 +1196,7 @@ function scimHandler(options) {
 					previous: existing,
 					next: stored
 				}));
-				return scimResponse(200, renderGroup(stored, location), { location });
+				return resourceResponse(200, renderGroup(stored, location), location);
 			}
 			return scimError(405, "invalidValue", "method not allowed");
 		} catch (error) {
@@ -1087,6 +1205,14 @@ function scimHandler(options) {
 		}
 	};
 }
+function readResponse(request, rendered) {
+	const version = versionOf(rendered);
+	if (ifNoneMatchHolds(request, version)) return new Response(null, {
+		status: 304,
+		headers: { ETag: version }
+	});
+	return resourceResponse(200, rendered);
+}
 function discoveryResponse(request, route) {
 	if (route.kind === "ServiceProviderConfig") return scimResponse(200, {
 		...serviceProviderConfig(),
@@ -1180,7 +1306,7 @@ function directoryMembershipSource(store, options = {}) {
 //#region src/scim/store.ts
 const DEFAULT_COUNT = 100;
 function now() {
-	return (/* @__PURE__ */ new Date()).toISOString();
+	return isoNow();
 }
 function createdAt(at, ...candidates) {
 	return candidates.find((value) => value !== void 0 && value !== "") ?? at;
@@ -1442,4 +1568,4 @@ function memoryDirectoryStore() {
 	};
 }
 //#endregion
-export { sha256Hex as S, PATCH_SCHEMA as _, normalizePatchOps as a, USER_SCHEMA as b, parseScimFilter as c, serviceProviderConfig as d, DirectoryNotFoundError as f, LIST_SCHEMA as g, GROUP_SCHEMA as h, tenantFromPath as i, resourceTypes as l, ERROR_SCHEMA as m, directoryMembershipSource as n, filterSupported as o, DirectoryUniquenessError as p, scimHandler as r, matchFilter as s, memoryDirectoryStore as t, schemas as u, ROLES_EXTENSION as v, authenticateScim as x, SCIM_CONTENT_TYPE as y };
+export { isDirectoryUniquenessError as C, isDirectoryNotFoundError as S, sha256Hex as T, LIST_SCHEMA as _, normalizePatchOps as a, SCIM_CONTENT_TYPE as b, parseScimFilter as c, serviceProviderConfig as d, APP_DATA_EXTENSION as f, GROUP_SCHEMA as g, ERROR_SCHEMA as h, tenantFromPath as i, resourceTypes as l, DirectoryUniquenessError as m, directoryMembershipSource as n, filterSupported as o, DirectoryNotFoundError as p, scimHandler as r, matchFilter as s, memoryDirectoryStore as t, schemas as u, PATCH_SCHEMA as v, authenticateScim as w, USER_SCHEMA as x, ROLES_EXTENSION as y };