scimgateway 6.1.8 → 6.1.10

package/README.md

@@ -1303,6 +1303,19 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 ## Change log
 
+### v6.1.10
+
+[Fixed]
+
+- plugin-entra-id: user group membership now includes nested (transitive) groups (`direct` and `indirect`)
+- Docker example files `config/docker/.dockerignore` and `docker-compose-mssql.yml` were missing
+
+### v6.1.9
+
+[Improved]
+
+- Some improvements to createUser/createGroup regarding the response object, which should contain the newly generated ID
+
 ### v6.1.8
 
 [Fixed]

package/lib/helper-rest.ts

@@ -34,8 +34,8 @@ export class HelperRest {
     this.scimgateway = scimgateway
     this.idleTimeout = (scimgateway as any)?.config?.scimgateway.idleTimeout || 120
     this.idleTimeout = this.idleTimeout - 1
-    if (optionalEntities && optionalEntities.entity) this.config_entity = utils.copyObj(optionalEntities.entity) ?? {}
-    else this.config_entity = utils.copyObj(scimgateway.getConfig())?.entity ?? {}
+    if (optionalEntities && optionalEntities.entity) this.config_entity = structuredClone(optionalEntities.entity) ?? {}
+    else this.config_entity = structuredClone(scimgateway.getConfig())?.entity ?? {}
 
     for (const baseEntity in this.config_entity) {
       const connectionObj = this.config_entity[baseEntity]?.connection
@@ -387,7 +387,7 @@ export class HelperRest {
       const method = 'POST'
       let connOpt: any = {}
       if (connectionObj.options && typeof connectionObj.options === 'object') {
-        connOpt = utils.copyObj(connectionObj.options)
+        connOpt = structuredClone(connectionObj.options)
       }
       if (!connOpt.headers) connOpt.headers = {}
       connOpt.headers['Content-Type'] = 'application/x-www-form-urlencoded' // body must be query string formatted (no JSON)
@@ -494,7 +494,7 @@ export class HelperRest {
         let orgConnection: any
         if (opt?.connection) { // allow overriding/extending configuration connection by caller argument opt.connection
           let org = connectionObj
-          orgConnection = utils.copyObj(org)
+          orgConnection = structuredClone(org)
           if (!org) org = {}
           org = utils.extendObj(org, opt.connection)
         }
@@ -533,7 +533,7 @@ export class HelperRest {
         }
 
         if (connectionObj.options) { // http connect options
-          const connOpt: any = utils.copyObj(connectionObj.options)
+          const connOpt: any = structuredClone(connectionObj.options)
           try {
             // using fs.readFileSync().toString() instead of Bun.file().text() for nodejs compability
             if (connOpt?.tls?.key) connOpt.tls.key = fs.readFileSync(connOpt.tls.key).toString()
@@ -565,7 +565,7 @@ export class HelperRest {
       if (ctx?.headers?.get) { // Auth PassThrough using ctx header
         this._serviceClient[baseEntity].options.headers['Authorization'] = ctx.headers.get('authorization')
       }
-      const cli: any = utils.copyObj(this._serviceClient[baseEntity]) // client ready
+      const cli: any = structuredClone(this._serviceClient[baseEntity]) // client ready
 
       // failover support
       path = this._serviceClient[baseEntity].baseUrl + path
@@ -611,7 +611,7 @@ export class HelperRest {
 
     // merge any argument options - basic auth header is supported through {auth:{type:"basic",options:{username:"username",password:"password"}}}
     if (opt) {
-      const o: any = utils.copyObj(opt)
+      const o: any = structuredClone(opt)
       if (o?.auth?.type === 'basic') {
         options.headers['Authorization'] = 'Basic ' + Buffer.from(`${o.auth?.options?.username}:${o.auth?.options?.password}`).toString('base64')
         delete o.auth

package/lib/plugin-entra-id.ts

@@ -57,8 +57,6 @@
 // Members                                    members                             members
 // =====================================================================================================================
 
-import querystring from 'querystring'
-
 // start - mandatory plugin initialization
 import { ScimGateway, HelperRest } from 'scimgateway'
 const scimgateway = new ScimGateway()
@@ -67,6 +65,8 @@ const config = scimgateway.getConfig()
 scimgateway.authPassThroughAllowed = false
 // end - mandatory plugin initialization
 
+const newHelper = new HelperRest(scimgateway)
+
 if (config.map) { // having licensDetails map here instead of config file
   config.map.licenseDetails = {
     servicePlanId: {
@@ -143,6 +143,7 @@ scimgateway.getUsers = async (baseEntity, getObj, attributes, ctx) => {
   let options: Record<string, any> = {}
   let isExpandManager = true
 
+  if (Object.hasOwn(getObj, 'value')) getObj.value = encodeURIComponent(getObj.value)
   if (!Object.hasOwn(getObj, 'count')) getObj.count = 200
   if (getObj.count > 500) getObj.count = 500 // Entra ID max 999
 
@@ -266,7 +267,7 @@ scimgateway.createUser = async (baseEntity, userObj, ctx) => {
       const id = res?.body?.id || userObj.userName
       await scimgateway.modifyUser(baseEntity, id, addonObj, ctx) // manager, proxyAddresses, servicePlan
     }
-    return null
+    return res?.body
   } catch (err: any) {
     const newErr = new Error(`${action} error: ${err.message}`)
     if (err.message.includes('userPrincipalName already exists')) newErr.name += '#409' // customErrCode
@@ -402,6 +403,7 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
     totalResults: null,
   }
 
+  if (Object.hasOwn(getObj, 'value')) getObj.value = encodeURIComponent(getObj.value)
   if (attributes.length === 0) attributes = groupAttributes
   let includeMembers = false
   if (attributes.includes('members.value') || attributes.includes('members')) {
@@ -413,6 +415,7 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
   const body = null
   let path
   let options: Record<string, any> = {}
+  let isUserMemberOf = getObj?.operator === 'eq' && getObj?.attribute === 'members.value'
 
   if (!Object.hasOwn(getObj, 'count')) getObj.count = 500
   if (getObj.count > 500) getObj.count = 500 // Entra ID max 999
@@ -428,10 +431,10 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
         if (includeMembers) path = `/groups?$filter=${getObj.attribute} eq '${getObj.value}'&$select=${attrs.join()}&$expand=members($select=id,displayName)`
         else path = `/groups?$filter=${getObj.attribute} eq '${getObj.value}'&$select=${attrs.join()}`
       }
-    } else if (getObj.operator === 'eq' && getObj.attribute === 'members.value') {
+    } else if (isUserMemberOf) {
       // mandatory - return all groups the user 'id' (getObj.value) is member of - correspond to getGroupMembers() in versions < 4.x.x
       // Resources = [{ id: <id-group>> , displayName: <displayName-group>, members [{value: <id-user>}] }]
-      path = `/users/${getObj.value}/memberOf/microsoft.graph.group?$top=${getObj.count}&$count=true&select=id,displayName`
+      path = `/users/${getObj.value}/transitiveMemberOf/microsoft.graph.group?$top=${getObj.count}&$count=true&select=id,displayName`
     } else {
       // optional - simpel filtering
       if (getObj.attribute) {
@@ -471,8 +474,69 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
   if (!ctx) ctx = { paging }
   else ctx.paging = paging
 
+  const newCtx = { ...ctx }
+  newCtx.paging = { startIndex: 1 }
+
   try {
-    let response = await helper.doRequest(baseEntity, method, path, body, ctx, options)
+    let response: any
+    let responseMemberOf: any
+    if (!isUserMemberOf) response = await helper.doRequest(baseEntity, method, path, body, ctx, options)
+    else {
+      // request both the default transitiveMemberOf (includes nested groups) and memberOf because we want to distinguish SCIM type=direct/indirect
+      const pathMemberOf = `/users/${getObj.value}/memberOf/microsoft.graph.group?$top=${getObj.count}&$count=true&select=id,displayName`
+      const allErrors: string[] = []
+      const results = await Promise.allSettled([
+        helper.doRequest(baseEntity, method, path, body, ctx, options),
+        newHelper.doRequest(baseEntity, method, pathMemberOf, body, newCtx, options), // using newHelper to avoid shared internal helperRest paging 
+      ])
+      const errors = results
+        .filter(r => r.status === 'rejected')
+        .map(r => (r as PromiseRejectedResult).reason.message)
+        .filter(msg => !msg.includes('already exist'))
+      allErrors.push(...errors)
+
+      if (allErrors.length > 0) {
+        throw new Error(allErrors.join(', '))
+      }
+
+      response = (results[0] as PromiseFulfilledResult<any>).value // includes all groups (also nested)
+      responseMemberOf = (results[1] as PromiseFulfilledResult<any>).value // do not include nested groups
+
+      let nextStartIndex = scimgateway.getNextStartIndex(responseMemberOf.body.value.length * 2, newCtx.paging.startIndex, responseMemberOf.body.value.length)
+      if (nextStartIndex > newCtx.paging.startIndex && responseMemberOf && responseMemberOf.body.value && Array.isArray(responseMemberOf.body.value)) {
+        // use paging to ensure responseMemberOf is complete 
+        let totalResults = responseMemberOf.body.value.length
+        let startIndex = 1
+        let res: any
+        do {
+          try {
+            startIndex = nextStartIndex
+            newCtx.paging.startIndex = startIndex
+            res = await newHelper.doRequest(baseEntity, method, pathMemberOf, body, newCtx, options)
+          } catch (err) { void 0 }
+          if (res?.body && res.body.value && Array.isArray(res.body.value) && res.body.value.length > 0) {
+            const count = res.body.value.length
+            totalResults += count
+            nextStartIndex = scimgateway.getNextStartIndex(totalResults + count, startIndex, count)
+            for (let i = 0; i < res.body.value.length; i++) {
+              if (!res.body.value[i].id) continue
+              responseMemberOf.body.value.push(res.body.value[i])
+            }
+          }
+        } while (nextStartIndex > startIndex)
+      }
+
+      if (response.body && response.body.value && Array.isArray(response.body.value)) {
+        const directIds = new Set()
+        if (responseMemberOf.body && responseMemberOf.body.value && Array.isArray(responseMemberOf.body.value)) {
+          responseMemberOf.body.value.forEach((el: any) => directIds.add(el.id))
+        }
+        response.body.value.forEach((el: any) => {
+          if (directIds.has(el.id)) el.type = 'direct'
+          else el.type = 'indirect'
+        })
+      }
+    }
     if (!response.body) {
       throw new Error(`invalid response: ${JSON.stringify(response)}`)
     }
@@ -494,6 +558,7 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
       } else if (getObj.operator === 'eq' && getObj.attribute === 'members.value') { // Not using expand-members. Only includes current user as member, but should have requested all...
         members = [{
           value: getObj.value,
+          type: response.body.value[i].type || 'direct',
         }]
       }
 
@@ -525,7 +590,7 @@ scimgateway.createGroup = async (baseEntity, groupObj, ctx) => {
   scimgateway.logDebug(baseEntity, `handling ${action} groupObj=${JSON.stringify(groupObj)} passThrough=${ctx ? 'true' : 'false'}`)
 
   const body: any = { displayName: groupObj.displayName }
-  body.mailNickName = groupObj.displayName
+  body.mailNickName = groupObj.displayName?.replace(/[^a-zA-Z0-9]/g, '')
   body.mailEnabled = false
   body.securityEnabled = true
   const method = 'POST'
@@ -536,8 +601,8 @@ scimgateway.createGroup = async (baseEntity, groupObj, ctx) => {
     if (res && res.Resources && res.Resources.length > 0) {
       throw new Error(`group ${groupObj.displayName} already exist`)
     }
-    await helper.doRequest(baseEntity, method, path, body, ctx)
-    return null
+    const response = await helper.doRequest(baseEntity, method, path, body, ctx)
+    return response?.body
   } catch (err: any) {
     const newErr = new Error(`${action} error: ${err.message}`)
     if (err.message.includes('already exist')) newErr.name += '#409' // customErrCode
@@ -743,7 +808,7 @@ const getUser = async (baseEntity: string, uid: string, attributes: string[], ct
 
     const userPromise = (async () => {
       const method = 'GET'
-      const path = `/users/${querystring.escape(uid)}?$expand=manager($select=userPrincipalName)`
+      const path = `/users/${uid}?$expand=manager($select=userPrincipalName)`
       const body = null
       const response = await helper.doRequest(baseEntity, method, path, body, ctx)
       const userObj = response.body
@@ -761,7 +826,7 @@ const getUser = async (baseEntity: string, uid: string, attributes: string[], ct
     const licensePromise = (async () => {
       if (!attributes.includes('servicePlans.value')) return null // licenses not requested
       const method = 'GET'
-      const path = `/users/${querystring.escape(uid)}/licenseDetails`
+      const path = `/users/${uid}/licenseDetails`
       const body = null
       const retObj: Record<string, any> = { servicePlan: [] }
       try {

package/lib/postinstall.ts

@@ -53,10 +53,12 @@ if (!fsExistsSync('../../config/wsdls/UserService.wsdl')) {
   fs.writeFileSync('../../config/wsdls/UserService.wsdl', fs.readFileSync('./config/wsdls/UserService.wsdl'))
 }
 
-fs.writeFileSync('../../config/docker/docker-compose.yml', fs.readFileSync('./config/docker/docker-compose.yml'))
-fs.writeFileSync('../../config/docker/Dockerfile', fs.readFileSync('./config/docker/Dockerfile'))
+fs.writeFileSync('../../config/docker/.dockerignore', fs.readFileSync('./config/docker/.dockerignore'))
 fs.writeFileSync('../../config/docker/DataDockerfile', fs.readFileSync('./config/docker/DataDockerfile'))
 fs.writeFileSync('../../config/docker/docker-compose-debug.yml', fs.readFileSync('./config/docker/docker-compose-debug.yml'))
+fs.writeFileSync('../../config/docker/docker-compose-mssql.yml', fs.readFileSync('./config/docker/docker-compose-mssql.yml'))
+fs.writeFileSync('../../config/docker/docker-compose.yml', fs.readFileSync('./config/docker/docker-compose.yml'))
+fs.writeFileSync('../../config/docker/Dockerfile', fs.readFileSync('./config/docker/Dockerfile'))
 
 fs.writeFileSync('../../LICENSE', fs.readFileSync('./LICENSE'))
 if (!fsExistsSync('../../index.ts')) fs.writeFileSync('../../index.ts', fs.readFileSync('./index.ts'))

package/lib/scimgateway.ts

@@ -757,7 +757,7 @@ export class ScimGateway {
             }
             if (utils.getEncrypted(authToken, arr[i].clientSecret) === arr[i].clientSecret) {
               arr[i].isTokenRequested = true // flagged as true to not allow repeated resolvements because token will also be cleared when expired
-              const baseEntities = utils.copyObj(arr[i].baseEntities)
+              const baseEntities = structuredClone(arr[i].baseEntities)
               let expires
               let readOnly = false
               if (arr[i].readOnly && arr[i].readOnly === true) readOnly = true
@@ -857,7 +857,7 @@ export class ScimGateway {
     }
 
     const getHandlerSchemas = async (ctx: Context) => {
-      let tx = utils.copyObj(this.scimDef.Schemas)
+      let tx = structuredClone(this.scimDef.Schemas)
       if (this.config.endpoint?.map) {
         // endpointMapper being used
         // Schemas returned should instead reflect what is defined in the plugin config file
@@ -891,7 +891,7 @@ export class ScimGateway {
                 uniqueness: (item.mapTo === 'userName') ? 'server' : 'none',
               }
               if (item['x-agent-schema']) {
-                const agentSchema = utils.copyObj(item['x-agent-schema'])
+                const agentSchema = structuredClone(item['x-agent-schema'])
                 if (agentSchema.description) {
                   attr.description = agentSchema.description
                   delete agentSchema.description
@@ -909,7 +909,7 @@ export class ScimGateway {
               if (names.length > 1) {
                 const userNameFound = attr.name.includes('userName')
                 for (let i = 0; i < names.length; i++) {
-                  let attrCopy = utils.copyObj(attr)
+                  let attrCopy = structuredClone(attr)
                   const name = names[i].trim()
                   attrCopy.name = name
                   if (name === 'id') continue
@@ -959,7 +959,7 @@ export class ScimGateway {
                   delete subAttr.uniqueness
                 }
                 if (item['x-agent-schema']) {
-                  const hints = utils.copyObj(item['x-agent-schema'])
+                  const hints = structuredClone(item['x-agent-schema'])
                   if (hints.description) {
                     subAttr.description = hints.description
                     delete hints.description
@@ -1147,7 +1147,7 @@ export class ScimGateway {
           ctx.request.body = body // now json - ensure final info log will be masked
           jsonBody = body
         }
-        jsonBody = utils.copyObj(jsonBody) // no changes to original
+        jsonBody = structuredClone(jsonBody) // no changes to original
       } catch (err: any) {
         logger.error(`${gwName} [oauth] token request error: ${err.message}`)
         ctx.response.status = 401
@@ -1184,7 +1184,7 @@ export class ScimGateway {
               if (!arr[i].baseEntities.includes(baseEntity)) continue
             }
             token = utils.getEncrypted(jsonBody.client_secret, jsonBody.client_secret)
-            baseEntities = utils.copyObj(arr[i].baseEntities)
+            baseEntities = structuredClone(arr[i].baseEntities)
             if (arr[i].readOnly && arr[i].readOnly === true) readOnly = true
             if (arr[i].expires_in && !isNaN(arr[i].expires_in)) expires = arr[i].expires_in
             else expires = oAuthTokenExpire
@@ -1291,7 +1291,7 @@ export class ScimGateway {
       logger.debug(`${gwName} [Get ${handle.description}] ${getObj.attribute}=${getObj.value}`, { baseEntity: ctx?.routeObj?.baseEntity })
 
       try {
-        const ob = utils.copyObj(getObj)
+        const ob = structuredClone(getObj)
         const attributes: string[] = ctx.query.attributes ? ctx.query.attributes.split(',').map((item: string) => item.trim()) : []
         if (attributes.length > 0 && !attributes.includes('id')) attributes.push('id')
         logger.debug(`${gwName} calling ${handle.getMethod}`, { baseEntity: ctx?.routeObj?.baseEntity })
@@ -1523,7 +1523,7 @@ export class ScimGateway {
         getObj.count = ctx.query.count ? parseInt(ctx.query.count, 10) : 200 // defaults to 200 (plugin may override)
 
         let res: any
-        const obj: any = utils.copyObj(getObj)
+        const obj: any = structuredClone(getObj)
         const attributes: string[] = ctx.query.attributes ? ctx.query.attributes.split(',').map((item: string) => item.trim()) : []
         if (attributes.length > 0 && !attributes.includes('id')) attributes.push('id') // id is mandatory
 
@@ -1659,7 +1659,7 @@ export class ScimGateway {
       try {
         if (!jsonBody) throw new Error('missing body')
         if (typeof jsonBody !== 'object' || jsonBody === null) throw new Error('body is not JSON')
-        jsonBody = utils.copyObj(jsonBody) // no changes to original
+        jsonBody = structuredClone(jsonBody) // no changes to original
       } catch (err: any) {
         const [e, statusCode] = utilsScim.jsonErr(this.config.scimgateway.scim.version, pluginName, 500, err)
         ctx.response.status = statusCode
@@ -1707,33 +1707,45 @@ export class ScimGateway {
           }
         }
         logger.debug(`${gwName} calling ${handle.createMethod}`, { baseEntity: ctx?.routeObj?.baseEntity })
-        const res = await (this as any)[handle.createMethod](baseEntity, scimdata, ctx.passThrough)
-        for (const key in res) { // merge any result e.g: {'id': 'xxxx'}
-          jsonBody[key] = res[key]
-        }
+        const response = await (this as any)[handle.createMethod](baseEntity, scimdata, ctx.passThrough)
 
-        if (!jsonBody.id) { // retrieve all attributes including id
-          let res: any
-          let obj: any
-          try {
-            if (handle.createMethod === 'createUser') {
-              const attributes: string[] = []
-              if (jsonBody.userName) obj = { attribute: 'userName', operator: 'eq', value: jsonBody.userName }
-              else if (jsonBody.externalId) obj = { attribute: 'externalId', operator: 'eq', value: jsonBody.externalId }
-              res = await (this as any)[handle.getMethod](baseEntity, obj, attributes, ctx.passThrough)
-            } else if (handle.createMethod === 'createGroup') {
-              const attributes: string[] = []
-              if (jsonBody.externalId) obj = { attribute: 'externalId', operator: 'eq', value: jsonBody.externalId }
-              else if (jsonBody.displayName) obj = { attribute: 'displayName', operator: 'eq', value: jsonBody.displayName }
+        // lookup user/group created, id should be included in response
+        let res: any
+        let obj: any
+        try {
+          if (handle.createMethod === 'createUser') {
+            const attributes: string[] = []
+            if (response?.id) obj = { attribute: 'id', operator: 'eq', value: response.id }
+            else if (jsonBody.userName) obj = { attribute: 'userName', operator: 'eq', value: jsonBody.userName }
+            else if (jsonBody.externalId) obj = { attribute: 'externalId', operator: 'eq', value: jsonBody.externalId }
+            res = await (this as any)[handle.getMethod](baseEntity, obj, attributes, ctx.passThrough)
+          } else if (handle.createMethod === 'createGroup') {
+            const attributes: string[] = []
+            if (response?.id) obj = { attribute: 'id', operator: 'eq', value: response.id }
+            else if (jsonBody.displayName) obj = { attribute: 'displayName', operator: 'eq', value: jsonBody.displayName }
+            else if (jsonBody.externalId) obj = { attribute: 'externalId', operator: 'eq', value: jsonBody.externalId }
+            if (response?.id && response['@odata.context']?.includes('graph.microsoft.com')) {
+              // Entra ID may experience some latency before a newly created group can be looked up
+              let counter = 0
+              const maxCounter = 20
+              while (true) {
+                counter++
+                if (counter > maxCounter) break
+                res = await (this as any)[handle.getMethod](baseEntity, obj, attributes, ctx.passThrough)
+                if (res?.Resources && Array.isArray(res.Resources) && res.Resources.length === 1) break
+                await new Promise(resolve => setTimeout(resolve, 1000))
+              }
+            } else {
               res = await (this as any)[handle.getMethod](baseEntity, obj, attributes, ctx.passThrough)
             }
-          } catch (err: any) {
-            logger.warn(`${gwName} ${handle.createMethod} succeeded, but corresponding ${handle.getMethod} ${obj?.value} failed with error: ${err.message}`, { baseEntity: ctx?.routeObj?.baseEntity })
-          }
-          if (res?.Resources && Array.isArray(res.Resources) && res.Resources.length === 1) {
-            if (res.Resources[0]?.id) jsonBody = res.Resources[0] // id found, using returned object
           }
+        } catch (err: any) {
+          logger.warn(`${gwName} ${handle.createMethod} succeeded, but corresponding ${handle.getMethod} ${obj?.value} failed with error: ${err.message}`, { baseEntity: ctx?.routeObj?.baseEntity })
+        }
+        if (res?.Resources && Array.isArray(res.Resources) && res.Resources.length === 1) {
+          jsonBody = res.Resources[0]
         }
+        delete jsonBody.password
 
         const eTag = utils.getEtag(jsonBody)
         if (addGrps.length > 0 && handle.createMethod === 'createUser') { // add group membership
@@ -1966,7 +1978,7 @@ export class ScimGateway {
         if (!this.config.scimgateway.scim.groupMemberOfUser) {
           for (let i = 0; i < scimdata.groups.length; i++) {
             if (!scimdata.groups[i].value) continue
-            const obj: any = utils.copyObj(scimdata.groups[i])
+            const obj: any = structuredClone(scimdata.groups[i])
             obj.value = decodeURIComponent(obj.value)
             groups.push(obj)
           }
@@ -1979,7 +1991,7 @@ export class ScimGateway {
           res = await replaceUsrGrp(ctx.routeObj.handle, baseEntity, id, scimdata, this.config.scimgateway.scim.usePutSoftSync, ctx.passThrough, undefined)
         } else {
           logger.debug(`${gwName} calling ${handle.modifyMethod}`, { baseEntity: ctx?.routeObj?.baseEntity })
-          finalScimdata = utils.copyObj(scimdata)
+          finalScimdata = structuredClone(scimdata)
           res = await (this as any)[handle.modifyMethod](baseEntity, id, scimdata, ctx.passThrough)
         }
 
@@ -2090,11 +2102,11 @@ export class ScimGateway {
         }
       }
 
-      const activeExists = Object.prototype.hasOwnProperty.call(obj, 'active')
+      const activeExists = Object.hasOwn(obj, 'active')
       let objGroups: any
       if (obj.groups) {
         if (!this.config.scimgateway.scim.groupMemberOfUser) {
-          objGroups = utils.copyObj(obj.groups)
+          objGroups = structuredClone(obj.groups)
           delete obj.groups
         }
       }
@@ -2270,7 +2282,7 @@ export class ScimGateway {
     const postBulkHandler = async (ctx: Context) => {
       const baseEntity = ctx.routeObj.baseEntity
       logger.debug(`${gwName} [Bulk Operations]`, { baseEntity: ctx?.routeObj?.baseEntity })
-      const bulkBody: SCIMBulkRequest = utils.copyObj(ctx.request.body)
+      const bulkBody: SCIMBulkRequest = structuredClone(ctx.request.body)
       try {
         if (!bulkBody) throw new Error('missing body')
         if (typeof bulkBody !== 'object') throw new Error('body is not JSON')
@@ -2746,9 +2758,11 @@ export class ScimGateway {
               if (!res.Resources[i].id) continue
               const el: any = {}
               el.value = res.Resources[i].id
+              const type = (Array.isArray(res.Resources[i].members) && res.Resources[i].members[0]?.type === 'indirect') ? 'indirect' : 'direct'
+              el.type = { value: type }
               if (res.Resources[i].displayName) el.display = res.Resources[i].displayName
-              if (isScimv2) el.type = 'direct'
-              else el.type = { value: 'direct' }
+              if (isScimv2) el.type = type
+              else el.type = { value: type }
               groups.push(el) // { "value": "Admins", "display": "Admins", "type": "direct"}
             }
             nextStartIndex = utilsScim.getNextStartIndex(res.totalResults, startIndex, res.Resources.length)
@@ -3617,7 +3631,7 @@ export class ScimGateway {
       logger.info(`${gwName} starting SCIM Stream subscribers...`)
       const sub: any = new stream.Subscriber(this, funcHandler)
       for (const baseEntity in this.config.scimgateway.stream.subscriber.entity) {
-        const cfgSub: any = utils.copyObj(this.config.scimgateway.stream.subscriber.entity[baseEntity])
+        const cfgSub: any = structuredClone(this.config.scimgateway.stream.subscriber.entity[baseEntity])
         cfgSub.baseUrls = this.config.scimgateway.stream.baseUrls
         cfgSub.certificate = this.config.scimgateway.stream.certificate
         cfgSub.usePutSoftSync = this.config.scimgateway.scim.usePutSoftSync
@@ -3631,7 +3645,7 @@ export class ScimGateway {
       logger.info(`${gwName} starting SCIM Stream publishers...`)
       const pub: any = new stream.Publisher(this)
       for (const baseEntity in this.config.scimgateway.stream.publisher.entity) {
-        const cfgPub: any = utils.copyObj(this.config.scimgateway.stream.publisher.entity[baseEntity])
+        const cfgPub: any = structuredClone(this.config.scimgateway.stream.publisher.entity[baseEntity])
         cfgPub.baseUrls = this.config.scimgateway.stream.baseUrls
         cfgPub.certificate = this.config.scimgateway.stream.certificate
         pub.add(baseEntity, cfgPub)
@@ -3783,6 +3797,7 @@ export class ScimGateway {
 
   /**
   * copyObj returns a copy of the object
+  * Note: prefer using structuredClone(obj)
   * @param obj object to be copied
   * @returns copy of object
   **/
@@ -3800,6 +3815,17 @@ export class ScimGateway {
     return utils.extendObj(obj, src)
   }
 
+  /**
+  * getNextStartIndex returns the next SCIM pagination startIndex based on current result set
+  * @param totalResults current totalResults
+  * @param startIndex: current startIndex
+  * @param count: current count
+  * @returns next startIndex
+  **/
+  getNextStartIndex(totalResults: number, startIndex: number, itemsPerPage: number): number {
+    return utilsScim.getNextStartIndex(totalResults, startIndex, itemsPerPage)
+  }
+
   /**
   * Lock for mutual exclusion
   * - const lock = new scimgateway.Lock()

package/lib/utils-scim.ts

@@ -26,7 +26,7 @@ type SCIMBulkOperation = {
 */
 export function convertedScim(obj: any, multiValueTypes: string[]): any {
   let err: any = null
-  const scimdata: any = utils.copyObj(obj)
+  const scimdata: any = structuredClone(obj)
   if (scimdata.schemas) delete scimdata.schemas
   const newMulti: Record<string, any> = {}
   if (!multiValueTypes) multiValueTypes = []
@@ -156,7 +156,7 @@ export function convertedScim(obj: any, multiValueTypes: string[]): any {
 export function convertedScim20(obj: any, multiValueTypes: string[]): any {
   if (!obj.Operations || !Array.isArray(obj.Operations)) return {}
   let scimdata: { [key: string]: any } = { meta: { attributes: [] } } // meta is used for deleted attributes
-  const o: any = utils.copyObj(obj)
+  const o: any = structuredClone(obj)
   const arrPrimaryDone: any = []
   const primaryOrgType: any = {}
 
@@ -199,7 +199,7 @@ export function convertedScim20(obj: any, multiValueTypes: string[]): any {
             typeElement = arrMatches[3] // streetAddress
 
             if (type === 'primary' && !arrPrimaryDone.includes(arrMatches[1])) { // make sure primary is included
-              const pObj: any = utils.copyObj(element)
+              const pObj: any = structuredClone(element)
               pObj.path = pObj.path.substring(0, pObj.path.lastIndexOf('.')) + '.primary'
               pObj.value = primaryValue
               o.Operations.push(pObj)
@@ -329,7 +329,7 @@ export function convertedScim20(obj: any, multiValueTypes: string[]): any {
                   scimdata.meta.attributes.push(`${key}:${_k}`)
                   delete value[_k]
                 } else if (typeof value[_k] === 'object') { // manager.value
-                  if (Object.prototype.hasOwnProperty.call(value[_k], 'value') && (value[_k].value === undefined || value[_k].value === null)) {
+                  if (Object.hasOwn(value[_k], 'value') && (value[_k].value === undefined || value[_k].value === null)) {
                     scimdata.meta.attributes.push(`${key}:${_k}.value`)
                     delete value[_k].value
                   }

package/lib/utils.ts

@@ -170,7 +170,7 @@ export const JSONStringify = function (object: any) {
 }
 
 const objProp = function (obj: Record<string, any>, prop: string, val: any) { // return obj value based on json dot notation formatted prop
-  if (Object.prototype.hasOwnProperty.call(obj, prop)) return obj[prop]
+  if (Object.hasOwn(obj, prop)) return obj[prop]
   const props = prop.split('.') // scimgateway.auth.basic[0].password
   const final = props.pop() as string
   for (let i = 0; i < props.length; i++) {
@@ -192,7 +192,8 @@ export const copyObj = (o: any): any => { // deep copy/clone faster than JSON.pa
     if (typeof v === 'object' && v !== null) {
       const objProp = Object.getPrototypeOf(v) // e.g. HttpsProxyAgent {}
       if (objProp !== null && objProp !== Object.getPrototypeOf({}) && objProp !== Object.getPrototypeOf([])) {
-        output[key] = Object.assign(Object.create(v), v) // e.g. { HttpsProxyAgent {...} }
+        const proto = Object.getPrototypeOf(v)
+        output[key] = Object.assign(Object.create(proto), v) // e.g. { HttpsProxyAgent {...} }
       } else output[key] = copyObj(v)
     } else output[key] = v
   }
@@ -210,7 +211,7 @@ const _extendObj = (obj: Record<any, any>, src: Record<any, any>) => {
           for (let i = 0; i < src[key].length; i++) {
             const val = src[key][i]
             if (typeof val === 'object') {
-              if (Object.prototype.hasOwnProperty.call(val, 'type')) {
+              if (Object.hasOwn(val, 'type')) {
                 if (!obj[key]) obj[key] = [val]
                 else {
                   for (let j = 0; j < obj[key].length; j++) {
@@ -223,7 +224,7 @@ const _extendObj = (obj: Record<any, any>, src: Record<any, any>) => {
                   }
                   obj[key].push(val)
                 }
-              } else if (Object.prototype.hasOwnProperty.call(val, 'value')) {
+              } else if (Object.hasOwn(val, 'value')) {
                 if (!obj[key]) obj[key] = [val]
                 else {
                   for (let j = 0; j < obj[key].length; j++) {
@@ -258,7 +259,7 @@ export const extendObjClear = (obj: Record<string, any>, src: Record<string, any
   Object.keys(src).forEach((key) => {
     if (src[key] === null) return
     if (typeof src[key] !== 'object') { // last key
-      if (Object.prototype.hasOwnProperty.call(obj, key)) return
+      if (Object.hasOwn(obj, key)) return
       if (isSoftSync) obj[key] = src[key]
       else {
         switch (typeof src[key]) {
@@ -288,7 +289,7 @@ export const extendObjClear = (obj: Record<string, any>, src: Record<string, any
         if (typeof val !== 'object') {
           if (!obj[key].includes(val)) obj[key].push(val) // e.g. ["value1", "value2"]
         } else {
-          if (Object.prototype.hasOwnProperty.call(val, 'type') && key !== 'members' && key !== 'groups') {
+          if (Object.hasOwn(val, 'type') && key !== 'members' && key !== 'groups') {
             if (obj[key].length < 1) {
               const v: any = copyObj(val)
               if (!isSoftSync) v.operation = 'delete'
@@ -301,7 +302,7 @@ export const extendObjClear = (obj: Record<string, any>, src: Record<string, any
                   found = true
                   for (const kv in val) {
                     if (kv === 'type' || kv === 'value' || isSoftSync) continue // don't clear type/value
-                    if (Object.prototype.hasOwnProperty.call(el, kv)) continue
+                    if (Object.hasOwn(el, kv)) continue
                     switch (typeof val[kv]) {
                       case 'string':
                         el[kv] = ''
@@ -324,7 +325,7 @@ export const extendObjClear = (obj: Record<string, any>, src: Record<string, any
                 obj[key].push(v)
               }
             }
-          } else if (Object.prototype.hasOwnProperty.call(val, 'value')) { // no type
+          } else if (Object.hasOwn(val, 'value')) { // no type
             if (obj[key].length < 1) {
               const v: any = copyObj(val)
               if (!isSoftSync) v.operation = 'delete'
@@ -370,7 +371,7 @@ export const deltaObj = (obj: Record<string, any>, src: Record<string, any>) =>
         const el = arr[i]
         if (el.operation) continue // keep operation
         if (el.type) {
-          if (Object.prototype.hasOwnProperty.call(el, 'value')) {
+          if (Object.hasOwn(el, 'value')) {
             const a = src[key].filter(o => o.type === el.type && o.value === el.value)
             if (a.length === 1) {
               arr.splice(i, 1)
@@ -388,7 +389,7 @@ export const deltaObj = (obj: Record<string, any>, src: Record<string, any>) =>
               i -= 1
             }
           }
-        } else if (Object.prototype.hasOwnProperty.call(el, 'value')) {
+        } else if (Object.hasOwn(el, 'value')) {
           const a = src[key].filter(o => o.value === el.value)
           if (a.length === 1) {
             arr.splice(i, 1)
@@ -441,9 +442,9 @@ export const stripObj = (obj: Record<string, any>, attributes?: string, excluded
       const ret: Record<string, any> = {}
       for (let i = 0; i < arrAttr.length; i++) {
         const attr = arrAttr[i].split('.') // title / name.familyName / emails.value
-        if (Object.prototype.hasOwnProperty.call(obj, attr[0])) {
+        if (Object.hasOwn(obj, attr[0])) {
           if (attr.length === 1) ret[attr[0]] = obj[attr[0]]
-          else if (Object.prototype.hasOwnProperty.call(obj[attr[0]], attr[1])) { // name.familyName
+          else if (Object.hasOwn(obj[attr[0]], attr[1])) { // name.familyName
             if (!ret[attr[0]]) ret[attr[0]] = {}
             ret[attr[0]][attr[1]] = obj[attr[0]][attr[1]]
           } else if (Array.isArray(obj[attr[0]])) { // emails.value / phoneNumbers.type
@@ -452,7 +453,7 @@ export const stripObj = (obj: Record<string, any>, attributes?: string, excluded
             for (let j = 0; j < arr.length; j++) {
               if (typeof arr[j] !== 'object') {
                 ret[attr[0]].push(arr[j])
-              } else if (Object.prototype.hasOwnProperty.call(arr[j], attr[1])) {
+              } else if (Object.hasOwn(arr[j], attr[1])) {
                 if (ret[attr[0]].length !== arr.length) { // initiate
                   for (let i = 0; i < arr.length; i++) ret[attr[0]].push({}) // need arrCheckEmpty
                 }
@@ -481,14 +482,14 @@ export const stripObj = (obj: Record<string, any>, attributes?: string, excluded
       const ret: any = copyObj(obj)
       for (let i = 0; i < arrAttr.length; i++) {
         const attr = arrAttr[i].split('.') // title / name.familyName / emails.value
-        if (Object.prototype.hasOwnProperty.call(ret, attr[0])) {
+        if (Object.hasOwn(ret, attr[0])) {
           if (attr.length === 1) delete ret[attr[0]]
-          else if (Object.prototype.hasOwnProperty.call(ret[attr[0]], attr[1])) delete ret[attr[0]][attr[1]] // name.familyName
+          else if (Object.hasOwn(ret[attr[0]], attr[1])) delete ret[attr[0]][attr[1]] // name.familyName
           else if (Array.isArray(ret[attr[0]])) { // emails.value / phoneNumbers.type
             const arr = ret[attr[0]]
             for (let j = 0; j < arr.length; j++) {
-              if (Object.prototype.hasOwnProperty.call(arr[j], attr[1])) {
-                const index = arr.findIndex((el: Record<string, any>) => ((Object.prototype.hasOwnProperty.call(el, attr[1]))))
+              if (Object.hasOwn(arr[j], attr[1])) {
+                const index = arr.findIndex((el: Record<string, any>) => ((Object.hasOwn(el, attr[1]))))
                 if (index > -1) {
                   delete arr[index][attr[1]]
                   try {
@@ -516,7 +517,7 @@ export const sortByKey = (key: string, order: string = 'ascending') => {
     const val: any = [undefined, undefined]
     const arrIter = [a, b]
     const levels = key.split('.')
-    if (!Object.prototype.hasOwnProperty.call(a, levels[0]) || !Object.prototype.hasOwnProperty.call(b, levels[0])) return 0
+    if (!Object.hasOwn(a, levels[0]) || !Object.hasOwn(b, levels[0])) return 0
     arrIter.forEach((el, index) => {
       let parent = el
       for (let i = 0; i < levels.length; i++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "6.1.8",
+  "version": "6.1.10",
   "type": "module",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",