scimgateway 6.1.7 → 6.1.9

package/README.md

@@ -1303,6 +1303,18 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 ## Change log
 
+### v6.1.9
+
+[Improved]
+
+- Some improvements to createUser/createGroup regarding the response object, which should contain the newly generated ID
+
+### v6.1.8
+
+[Fixed]
+
+- Incorrect masking of secrets in the final info log message for requests
+
 ### v6.1.7
 
 [Fixed]

package/lib/logger.ts

@@ -297,7 +297,13 @@ export class Logger {
   private async log(level: 'debug' | 'info' | 'warn' | 'error', message: string, obj?: Record<string, any>) {
     const time = new Date().toISOString()
     message = this.maskSecret(message)
-    if (typeof obj === 'object' && !Array.isArray(obj)) obj = JSON.parse(this.maskSecret(JSON.stringify(obj)))
+
+    if (typeof obj === 'object' && !Array.isArray(obj)) {
+      obj = JSON.parse(JSON.stringify(obj, (_k, v) => {
+        if (typeof v === 'string') return this.maskSecret(v)
+        return v
+      }))
+    }
     const msgObj: Record<string, any> = {
       time,
       level,

package/lib/plugin-entra-id.ts

@@ -57,8 +57,6 @@
 // Members                                    members                             members
 // =====================================================================================================================
 
-import querystring from 'querystring'
-
 // start - mandatory plugin initialization
 import { ScimGateway, HelperRest } from 'scimgateway'
 const scimgateway = new ScimGateway()
@@ -143,6 +141,7 @@ scimgateway.getUsers = async (baseEntity, getObj, attributes, ctx) => {
   let options: Record<string, any> = {}
   let isExpandManager = true
 
+  if (Object.hasOwn(getObj, 'value')) getObj.value = encodeURIComponent(getObj.value)
   if (!Object.hasOwn(getObj, 'count')) getObj.count = 200
   if (getObj.count > 500) getObj.count = 500 // Entra ID max 999
 
@@ -266,7 +265,7 @@ scimgateway.createUser = async (baseEntity, userObj, ctx) => {
       const id = res?.body?.id || userObj.userName
       await scimgateway.modifyUser(baseEntity, id, addonObj, ctx) // manager, proxyAddresses, servicePlan
     }
-    return null
+    return res?.body
   } catch (err: any) {
     const newErr = new Error(`${action} error: ${err.message}`)
     if (err.message.includes('userPrincipalName already exists')) newErr.name += '#409' // customErrCode
@@ -402,6 +401,7 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
     totalResults: null,
   }
 
+  if (Object.hasOwn(getObj, 'value')) getObj.value = encodeURIComponent(getObj.value)
   if (attributes.length === 0) attributes = groupAttributes
   let includeMembers = false
   if (attributes.includes('members.value') || attributes.includes('members')) {
@@ -525,7 +525,7 @@ scimgateway.createGroup = async (baseEntity, groupObj, ctx) => {
   scimgateway.logDebug(baseEntity, `handling ${action} groupObj=${JSON.stringify(groupObj)} passThrough=${ctx ? 'true' : 'false'}`)
 
   const body: any = { displayName: groupObj.displayName }
-  body.mailNickName = groupObj.displayName
+  body.mailNickName = groupObj.displayName?.replace(/[^a-zA-Z0-9]/g, '')
   body.mailEnabled = false
   body.securityEnabled = true
   const method = 'POST'
@@ -536,8 +536,8 @@ scimgateway.createGroup = async (baseEntity, groupObj, ctx) => {
     if (res && res.Resources && res.Resources.length > 0) {
       throw new Error(`group ${groupObj.displayName} already exist`)
     }
-    await helper.doRequest(baseEntity, method, path, body, ctx)
-    return null
+    const response = await helper.doRequest(baseEntity, method, path, body, ctx)
+    return response?.body
   } catch (err: any) {
     const newErr = new Error(`${action} error: ${err.message}`)
     if (err.message.includes('already exist')) newErr.name += '#409' // customErrCode
@@ -743,7 +743,7 @@ const getUser = async (baseEntity: string, uid: string, attributes: string[], ct
 
     const userPromise = (async () => {
       const method = 'GET'
-      const path = `/users/${querystring.escape(uid)}?$expand=manager($select=userPrincipalName)`
+      const path = `/users/${uid}?$expand=manager($select=userPrincipalName)`
       const body = null
       const response = await helper.doRequest(baseEntity, method, path, body, ctx)
       const userObj = response.body
@@ -761,7 +761,7 @@ const getUser = async (baseEntity: string, uid: string, attributes: string[], ct
     const licensePromise = (async () => {
       if (!attributes.includes('servicePlans.value')) return null // licenses not requested
       const method = 'GET'
-      const path = `/users/${querystring.escape(uid)}/licenseDetails`
+      const path = `/users/${uid}/licenseDetails`
       const body = null
       const retObj: Record<string, any> = { servicePlan: [] }
       try {

package/lib/scimgateway.ts

@@ -548,7 +548,7 @@ export class ScimGateway {
         status: ctx.response.status,
         method: ctx.request.method,
         url: ctx.request.url,
-        requestBody: ctx.request.body,
+        requestBody: JSON.stringify(ctx.request.body),
         responseBody: outbound,
       }
       let msg = utils.statusText(logEvent.status)
@@ -1707,33 +1707,45 @@ export class ScimGateway {
           }
         }
         logger.debug(`${gwName} calling ${handle.createMethod}`, { baseEntity: ctx?.routeObj?.baseEntity })
-        const res = await (this as any)[handle.createMethod](baseEntity, scimdata, ctx.passThrough)
-        for (const key in res) { // merge any result e.g: {'id': 'xxxx'}
-          jsonBody[key] = res[key]
-        }
+        const response = await (this as any)[handle.createMethod](baseEntity, scimdata, ctx.passThrough)
 
-        if (!jsonBody.id) { // retrieve all attributes including id
-          let res: any
-          let obj: any
-          try {
-            if (handle.createMethod === 'createUser') {
-              const attributes: string[] = []
-              if (jsonBody.userName) obj = { attribute: 'userName', operator: 'eq', value: jsonBody.userName }
-              else if (jsonBody.externalId) obj = { attribute: 'externalId', operator: 'eq', value: jsonBody.externalId }
-              res = await (this as any)[handle.getMethod](baseEntity, obj, attributes, ctx.passThrough)
-            } else if (handle.createMethod === 'createGroup') {
-              const attributes: string[] = []
-              if (jsonBody.externalId) obj = { attribute: 'externalId', operator: 'eq', value: jsonBody.externalId }
-              else if (jsonBody.displayName) obj = { attribute: 'displayName', operator: 'eq', value: jsonBody.displayName }
+        // lookup user/group created, id should be included in response
+        let res: any
+        let obj: any
+        try {
+          if (handle.createMethod === 'createUser') {
+            const attributes: string[] = []
+            if (response?.id) obj = { attribute: 'id', operator: 'eq', value: response.id }
+            else if (jsonBody.userName) obj = { attribute: 'userName', operator: 'eq', value: jsonBody.userName }
+            else if (jsonBody.externalId) obj = { attribute: 'externalId', operator: 'eq', value: jsonBody.externalId }
+            res = await (this as any)[handle.getMethod](baseEntity, obj, attributes, ctx.passThrough)
+          } else if (handle.createMethod === 'createGroup') {
+            const attributes: string[] = []
+            if (response?.id) obj = { attribute: 'id', operator: 'eq', value: response.id }
+            else if (jsonBody.displayName) obj = { attribute: 'displayName', operator: 'eq', value: jsonBody.displayName }
+            else if (jsonBody.externalId) obj = { attribute: 'externalId', operator: 'eq', value: jsonBody.externalId }
+            if (response?.id && response['@odata.context']?.includes('graph.microsoft.com')) {
+              // Entra ID may experience some latency before a newly created group can be looked up
+              let counter = 0
+              const maxCounter = 20
+              while (true) {
+                counter++
+                if (counter > maxCounter) break
+                res = await (this as any)[handle.getMethod](baseEntity, obj, attributes, ctx.passThrough)
+                if (res?.Resources && Array.isArray(res.Resources) && res.Resources.length === 1) break
+                await new Promise(resolve => setTimeout(resolve, 1000))
+              }
+            } else {
               res = await (this as any)[handle.getMethod](baseEntity, obj, attributes, ctx.passThrough)
             }
-          } catch (err: any) {
-            logger.warn(`${gwName} ${handle.createMethod} succeeded, but corresponding ${handle.getMethod} ${obj?.value} failed with error: ${err.message}`, { baseEntity: ctx?.routeObj?.baseEntity })
-          }
-          if (res?.Resources && Array.isArray(res.Resources) && res.Resources.length === 1) {
-            if (res.Resources[0]?.id) jsonBody = res.Resources[0] // id found, using returned object
           }
+        } catch (err: any) {
+          logger.warn(`${gwName} ${handle.createMethod} succeeded, but corresponding ${handle.getMethod} ${obj?.value} failed with error: ${err.message}`, { baseEntity: ctx?.routeObj?.baseEntity })
+        }
+        if (res?.Resources && Array.isArray(res.Resources) && res.Resources.length === 1) {
+          jsonBody = res.Resources[0]
         }
+        delete jsonBody.password
 
         const eTag = utils.getEtag(jsonBody)
         if (addGrps.length > 0 && handle.createMethod === 'createUser') { // add group membership
@@ -2090,7 +2102,7 @@ export class ScimGateway {
         }
       }
 
-      const activeExists = Object.prototype.hasOwnProperty.call(obj, 'active')
+      const activeExists = Object.hasOwn(obj, 'active')
       let objGroups: any
       if (obj.groups) {
         if (!this.config.scimgateway.scim.groupMemberOfUser) {

package/lib/utils-scim.ts

@@ -329,7 +329,7 @@ export function convertedScim20(obj: any, multiValueTypes: string[]): any {
                   scimdata.meta.attributes.push(`${key}:${_k}`)
                   delete value[_k]
                 } else if (typeof value[_k] === 'object') { // manager.value
-                  if (Object.prototype.hasOwnProperty.call(value[_k], 'value') && (value[_k].value === undefined || value[_k].value === null)) {
+                  if (Object.hasOwn(value[_k], 'value') && (value[_k].value === undefined || value[_k].value === null)) {
                     scimdata.meta.attributes.push(`${key}:${_k}.value`)
                     delete value[_k].value
                   }

package/lib/utils.ts

@@ -170,7 +170,7 @@ export const JSONStringify = function (object: any) {
 }
 
 const objProp = function (obj: Record<string, any>, prop: string, val: any) { // return obj value based on json dot notation formatted prop
-  if (Object.prototype.hasOwnProperty.call(obj, prop)) return obj[prop]
+  if (Object.hasOwn(obj, prop)) return obj[prop]
   const props = prop.split('.') // scimgateway.auth.basic[0].password
   const final = props.pop() as string
   for (let i = 0; i < props.length; i++) {
@@ -210,7 +210,7 @@ const _extendObj = (obj: Record<any, any>, src: Record<any, any>) => {
           for (let i = 0; i < src[key].length; i++) {
             const val = src[key][i]
             if (typeof val === 'object') {
-              if (Object.prototype.hasOwnProperty.call(val, 'type')) {
+              if (Object.hasOwn(val, 'type')) {
                 if (!obj[key]) obj[key] = [val]
                 else {
                   for (let j = 0; j < obj[key].length; j++) {
@@ -223,7 +223,7 @@ const _extendObj = (obj: Record<any, any>, src: Record<any, any>) => {
                   }
                   obj[key].push(val)
                 }
-              } else if (Object.prototype.hasOwnProperty.call(val, 'value')) {
+              } else if (Object.hasOwn(val, 'value')) {
                 if (!obj[key]) obj[key] = [val]
                 else {
                   for (let j = 0; j < obj[key].length; j++) {
@@ -258,7 +258,7 @@ export const extendObjClear = (obj: Record<string, any>, src: Record<string, any
   Object.keys(src).forEach((key) => {
     if (src[key] === null) return
     if (typeof src[key] !== 'object') { // last key
-      if (Object.prototype.hasOwnProperty.call(obj, key)) return
+      if (Object.hasOwn(obj, key)) return
       if (isSoftSync) obj[key] = src[key]
       else {
         switch (typeof src[key]) {
@@ -288,7 +288,7 @@ export const extendObjClear = (obj: Record<string, any>, src: Record<string, any
         if (typeof val !== 'object') {
           if (!obj[key].includes(val)) obj[key].push(val) // e.g. ["value1", "value2"]
         } else {
-          if (Object.prototype.hasOwnProperty.call(val, 'type') && key !== 'members' && key !== 'groups') {
+          if (Object.hasOwn(val, 'type') && key !== 'members' && key !== 'groups') {
             if (obj[key].length < 1) {
               const v: any = copyObj(val)
               if (!isSoftSync) v.operation = 'delete'
@@ -301,7 +301,7 @@ export const extendObjClear = (obj: Record<string, any>, src: Record<string, any
                   found = true
                   for (const kv in val) {
                     if (kv === 'type' || kv === 'value' || isSoftSync) continue // don't clear type/value
-                    if (Object.prototype.hasOwnProperty.call(el, kv)) continue
+                    if (Object.hasOwn(el, kv)) continue
                     switch (typeof val[kv]) {
                       case 'string':
                         el[kv] = ''
@@ -324,7 +324,7 @@ export const extendObjClear = (obj: Record<string, any>, src: Record<string, any
                 obj[key].push(v)
               }
             }
-          } else if (Object.prototype.hasOwnProperty.call(val, 'value')) { // no type
+          } else if (Object.hasOwn(val, 'value')) { // no type
             if (obj[key].length < 1) {
               const v: any = copyObj(val)
               if (!isSoftSync) v.operation = 'delete'
@@ -370,7 +370,7 @@ export const deltaObj = (obj: Record<string, any>, src: Record<string, any>) =>
         const el = arr[i]
         if (el.operation) continue // keep operation
         if (el.type) {
-          if (Object.prototype.hasOwnProperty.call(el, 'value')) {
+          if (Object.hasOwn(el, 'value')) {
             const a = src[key].filter(o => o.type === el.type && o.value === el.value)
             if (a.length === 1) {
               arr.splice(i, 1)
@@ -388,7 +388,7 @@ export const deltaObj = (obj: Record<string, any>, src: Record<string, any>) =>
               i -= 1
             }
           }
-        } else if (Object.prototype.hasOwnProperty.call(el, 'value')) {
+        } else if (Object.hasOwn(el, 'value')) {
           const a = src[key].filter(o => o.value === el.value)
           if (a.length === 1) {
             arr.splice(i, 1)
@@ -441,9 +441,9 @@ export const stripObj = (obj: Record<string, any>, attributes?: string, excluded
       const ret: Record<string, any> = {}
       for (let i = 0; i < arrAttr.length; i++) {
         const attr = arrAttr[i].split('.') // title / name.familyName / emails.value
-        if (Object.prototype.hasOwnProperty.call(obj, attr[0])) {
+        if (Object.hasOwn(obj, attr[0])) {
           if (attr.length === 1) ret[attr[0]] = obj[attr[0]]
-          else if (Object.prototype.hasOwnProperty.call(obj[attr[0]], attr[1])) { // name.familyName
+          else if (Object.hasOwn(obj[attr[0]], attr[1])) { // name.familyName
             if (!ret[attr[0]]) ret[attr[0]] = {}
             ret[attr[0]][attr[1]] = obj[attr[0]][attr[1]]
           } else if (Array.isArray(obj[attr[0]])) { // emails.value / phoneNumbers.type
@@ -452,7 +452,7 @@ export const stripObj = (obj: Record<string, any>, attributes?: string, excluded
             for (let j = 0; j < arr.length; j++) {
               if (typeof arr[j] !== 'object') {
                 ret[attr[0]].push(arr[j])
-              } else if (Object.prototype.hasOwnProperty.call(arr[j], attr[1])) {
+              } else if (Object.hasOwn(arr[j], attr[1])) {
                 if (ret[attr[0]].length !== arr.length) { // initiate
                   for (let i = 0; i < arr.length; i++) ret[attr[0]].push({}) // need arrCheckEmpty
                 }
@@ -481,14 +481,14 @@ export const stripObj = (obj: Record<string, any>, attributes?: string, excluded
       const ret: any = copyObj(obj)
       for (let i = 0; i < arrAttr.length; i++) {
         const attr = arrAttr[i].split('.') // title / name.familyName / emails.value
-        if (Object.prototype.hasOwnProperty.call(ret, attr[0])) {
+        if (Object.hasOwn(ret, attr[0])) {
           if (attr.length === 1) delete ret[attr[0]]
-          else if (Object.prototype.hasOwnProperty.call(ret[attr[0]], attr[1])) delete ret[attr[0]][attr[1]] // name.familyName
+          else if (Object.hasOwn(ret[attr[0]], attr[1])) delete ret[attr[0]][attr[1]] // name.familyName
           else if (Array.isArray(ret[attr[0]])) { // emails.value / phoneNumbers.type
             const arr = ret[attr[0]]
             for (let j = 0; j < arr.length; j++) {
-              if (Object.prototype.hasOwnProperty.call(arr[j], attr[1])) {
-                const index = arr.findIndex((el: Record<string, any>) => ((Object.prototype.hasOwnProperty.call(el, attr[1]))))
+              if (Object.hasOwn(arr[j], attr[1])) {
+                const index = arr.findIndex((el: Record<string, any>) => ((Object.hasOwn(el, attr[1]))))
                 if (index > -1) {
                   delete arr[index][attr[1]]
                   try {
@@ -516,7 +516,7 @@ export const sortByKey = (key: string, order: string = 'ascending') => {
     const val: any = [undefined, undefined]
     const arrIter = [a, b]
     const levels = key.split('.')
-    if (!Object.prototype.hasOwnProperty.call(a, levels[0]) || !Object.prototype.hasOwnProperty.call(b, levels[0])) return 0
+    if (!Object.hasOwn(a, levels[0]) || !Object.hasOwn(b, levels[0])) return 0
     arrIter.forEach((el, index) => {
       let parent = el
       for (let i = 0; i < levels.length; i++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "6.1.7",
+  "version": "6.1.9",
   "type": "module",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",