slotlock 0.9.0 → 0.10.0

package/workspace-roles.js

@@ -0,0 +1,304 @@
+// Who may do what in a workspace: six fixed roles, each a set of capabilities, and every dashboard
+// route named by the capability it needs. The dashboard reads a person's role from the database on
+// every request (workspaces.ts) and checks it here before any handler runs, so a role changed or a
+// membership ended applies at the next request, and a route missing from the table is refused.
+//
+// The roles follow what API products settled on (Stripe, Vercel): a Developer holds credentials but
+// not people or money; Billing and Viewer hold the least. Owner and Admin differ by money and by
+// the workspace itself. A capability marked fresh also needs a sign-in in the last 15 minutes.
+/** The roles, most powerful first. */
+export const SLOTLOCK_WORKSPACE_ROLES = Object.freeze([
+    'owner',
+    'admin',
+    'developer',
+    'member',
+    'viewer',
+    'billing',
+]);
+/** Each role as the dashboard names it. */
+export const SLOTLOCK_WORKSPACE_ROLE_NAMES = Object.freeze({
+    owner: 'Owner',
+    admin: 'Admin',
+    developer: 'Developer',
+    member: 'Member',
+    viewer: 'Viewer',
+    billing: 'Billing',
+});
+export const SLOTLOCK_WORKSPACE_CAPABILITIES = Object.freeze([
+    /** Switch workspace or environment, sign out, see one's own account. Every role. */
+    'account.use',
+    /** Read the workspace: overview, resources, bookings, contacts, history, key and webhook lists. */
+    'workspace.read',
+    /** The plan, its limits and this month's use. */
+    'usage.read',
+    /** Chat with the assistant; what it proposes still waits for a person to approve. */
+    'assistant.chat',
+    /** Run the booking desk: approvals, the waitlist, hours, closures and holiday calendars. */
+    'operations.run',
+    /** Resources, their booking rules, pools, locations and groups. */
+    'resources.manage',
+    /** The test environment's seed, reset and fast-forward. */
+    'sandbox.manage',
+    /** Read-only, read-write or resource-limited keys; rotate, revoke and limit one's own. */
+    'keys.manage_own',
+    /** Full-access keys (the admin scope: contacts, webhooks, history, erasure). Fresh. */
+    'keys.full',
+    /** Rotate, revoke or limit a key someone else created. */
+    'keys.manage_any',
+    /** Add, delete and enable webhooks, which stream every change to an outside address. Fresh. */
+    'webhooks.manage',
+    /** Forget a contact: an erasure request. */
+    'contacts.forget',
+    /** Connect, test or disconnect the assistant's model and its key. Fresh. */
+    'assistant.settings',
+    /** Invite, change roles and remove people, up to one's own powers. */
+    'members.manage',
+    /** Read the audit log. */
+    'audit.read',
+    /**
+     * Export the workspace's data, and find, export or erase what it keeps about one person (RFC 0004
+     * D3). Fresh.
+     */
+    'privacy.manage',
+    /** Change the plan and open billing. Fresh. */
+    'billing.manage',
+    /** Grant Owner or Billing, transfer, delete the workspace, link a GitHub organization. Fresh. */
+    'workspace.own',
+    /** The team's identity: its verified domains and who may join through them. Owner only. Fresh. */
+    'identity.manage',
+]);
+/** Capabilities that also need a sign-in in the last 15 minutes (as GitHub's sudo mode). */
+export const SLOTLOCK_FRESH_CAPABILITIES = new Set([
+    'keys.full',
+    'webhooks.manage',
+    'assistant.settings',
+    'billing.manage',
+    'workspace.own',
+    'privacy.manage',
+    'identity.manage',
+]);
+const everyCapability = SLOTLOCK_WORKSPACE_CAPABILITIES;
+const without = (...left) => everyCapability.filter((capability) => !left.includes(capability));
+/** What each role may do. */
+export const SLOTLOCK_ROLE_CAPABILITIES = Object.freeze({
+    owner: new Set(everyCapability),
+    admin: new Set(without('billing.manage', 'workspace.own', 'identity.manage')),
+    developer: new Set([
+        'account.use',
+        'workspace.read',
+        'usage.read',
+        'assistant.chat',
+        'operations.run',
+        'resources.manage',
+        'sandbox.manage',
+        'keys.manage_own',
+    ]),
+    member: new Set(['account.use', 'workspace.read', 'usage.read', 'assistant.chat', 'operations.run']),
+    viewer: new Set(['account.use', 'workspace.read', 'usage.read', 'assistant.chat']),
+    billing: new Set(['account.use', 'usage.read', 'billing.manage']),
+});
+export function isSlotlockWorkspaceRole(value) {
+    return typeof value === 'string' && SLOTLOCK_WORKSPACE_ROLES.includes(value);
+}
+/** Whether a role may use a capability. */
+export function slotlockRoleCan(role, capability) {
+    return role !== null && role !== undefined && SLOTLOCK_ROLE_CAPABILITIES[role].has(capability);
+}
+/**
+ * Whether `granter` may give `role` to someone: never a role with a capability the granter lacks,
+ * so an Admin invites up to Admin, never Owner or Billing, and only those who manage members grant
+ * at all.
+ */
+export function slotlockRoleMayGrant(granter, role) {
+    if (!slotlockRoleCan(granter, 'members.manage'))
+        return false;
+    for (const capability of SLOTLOCK_ROLE_CAPABILITIES[role]) {
+        if (!slotlockRoleCan(granter, capability))
+            return false;
+    }
+    return true;
+}
+/** The API key scopes a role may give a key it creates: admin only with `keys.full`. */
+export function slotlockRoleKeyScopes(role) {
+    if (slotlockRoleCan(role, 'keys.full'))
+        return ['read', 'write', 'admin'];
+    if (slotlockRoleCan(role, 'keys.manage_own'))
+        return ['read', 'write'];
+    return [];
+}
+/**
+ * Each dashboard POST route, by the capability it needs before its handler runs. A handler may ask
+ * for more where the form decides (a Full-access key asks `keys.full`; another person's key asks
+ * `keys.manage_any`). A route not listed is refused.
+ */
+export const SLOTLOCK_DASHBOARD_POST_CAPABILITIES = Object.freeze({
+    '/sign-out': 'account.use',
+    '/sign-out-everywhere': 'account.use',
+    '/sessions/end': 'account.use',
+    '/organization': 'account.use',
+    '/environment': 'account.use',
+    '/teams/enable': 'account.use',
+    '/teams/disable': 'account.use',
+    // Anyone signed in may create a team workspace, join one they were invited to, or leave one.
+    '/teams/create': 'account.use',
+    // Deleting a team, or keeping one being deleted: its Owners only.
+    '/teams/delete': 'workspace.own',
+    '/teams/restore': 'workspace.own',
+    '/invite/accept': 'account.use',
+    '/members/leave': 'account.use',
+    // Inviting or changing someone also needs the power the role given carries (dashboard.ts
+    // capabilitiesOf): an Owner `workspace.own`, a Billing manager `billing.manage`.
+    '/members/invite': 'members.manage',
+    '/members/resend': 'members.manage',
+    '/members/revoke': 'members.manage',
+    '/members/role': 'members.manage',
+    // Limiting a member to locations and groups (RFC 0004 D1), or giving them all of it again.
+    '/members/scope': 'members.manage',
+    '/members/remove': 'members.manage',
+    // Approving or declining a request to join through a verified domain.
+    '/members/requests': 'members.manage',
+    // Asking to join a team through a verified address: anyone signed in, for a team they are not in.
+    '/join/request': 'account.use',
+    // A team's domains, and holding invitations to them: its Owners only.
+    '/identity/domains': 'identity.manage',
+    '/identity/domains/verify': 'identity.manage',
+    '/identity/domains/remove': 'identity.manage',
+    '/identity/domains/policy': 'identity.manage',
+    '/identity/invites': 'identity.manage',
+    // A team's single sign-on: its Owners only.
+    '/identity/sso': 'identity.manage',
+    '/identity/sso/test': 'identity.manage',
+    '/identity/sso/status': 'identity.manage',
+    '/identity/sso/delete': 'identity.manage',
+    '/identity/sso/provisioning': 'identity.manage',
+    '/identity/sso/mapping': 'identity.manage',
+    '/identity/sso/require': 'identity.manage',
+    '/identity/scim/enable': 'identity.manage',
+    '/identity/scim/disable': 'identity.manage',
+    '/identity/scim/token': 'identity.manage',
+    '/identity/scim/token/revoke': 'identity.manage',
+    '/identity/scim/group': 'identity.manage',
+    // Signing in through one's team's provider (to link it or prove oneself), or an Owner's bypass:
+    // from wherever one is, for a team the handler and the database check one belongs to.
+    '/sso/proof': 'account.use',
+    '/sso/bypass': 'account.use',
+    '/keys': 'keys.manage_own',
+    '/keys/rotate': 'keys.manage_own',
+    '/keys/revoke': 'keys.manage_own',
+    '/keys/limits': 'keys.manage_own',
+    '/resources': 'resources.manage',
+    '/resources/rules': 'resources.manage',
+    '/resources/pool': 'resources.manage',
+    '/resources/profile': 'resources.manage',
+    '/resources/place': 'resources.manage',
+    '/resources/parent': 'resources.manage',
+    '/locations': 'resources.manage',
+    '/locations/delete': 'resources.manage',
+    '/groups': 'resources.manage',
+    '/groups/delete': 'resources.manage',
+    '/webhooks': 'webhooks.manage',
+    '/webhooks/delete': 'webhooks.manage',
+    '/webhooks/enable': 'webhooks.manage',
+    '/waitlist/leave': 'operations.run',
+    '/approvals/decide': 'operations.run',
+    '/hours': 'operations.run',
+    '/closures': 'operations.run',
+    '/closures/delete': 'operations.run',
+    '/closures/import': 'operations.run',
+    '/closures/calendars/delete': 'operations.run',
+    '/sandbox/seed': 'sandbox.manage',
+    '/sandbox/reset': 'sandbox.manage',
+    '/sandbox/fast-forward': 'sandbox.manage',
+    '/contacts/forget': 'contacts.forget',
+    '/assistant': 'assistant.chat',
+    '/assistant/stream': 'assistant.chat',
+    '/assistant/reset': 'assistant.chat',
+    '/assistant/rename': 'assistant.chat',
+    '/assistant/delete': 'assistant.chat',
+    // Approving runs the change the assistant proposed: as the desk would.
+    '/assistant/approve': 'operations.run',
+    '/assistant/dismiss': 'assistant.chat',
+    '/settings/assistant': 'assistant.settings',
+    '/settings/assistant/test': 'assistant.settings',
+    '/settings/assistant/models': 'assistant.settings',
+    '/settings/assistant/remove': 'assistant.settings',
+    '/plan/upgrade': 'billing.manage',
+    '/plan/manage': 'billing.manage',
+    '/settings/privacy/export': 'privacy.manage',
+    '/settings/privacy/export/delete': 'privacy.manage',
+    '/settings/privacy/person': 'privacy.manage',
+    '/settings/privacy/person/export': 'privacy.manage',
+    '/settings/privacy/person/erase': 'privacy.manage',
+});
+/** Each dashboard page (GET), by the capability it needs. A page not listed is refused. */
+export const SLOTLOCK_DASHBOARD_PAGE_CAPABILITIES = Object.freeze({
+    '/': 'workspace.read',
+    '/keys': 'workspace.read',
+    '/resources': 'workspace.read',
+    '/resources/:id': 'workspace.read',
+    '/webhooks': 'workspace.read',
+    '/waitlist': 'workspace.read',
+    '/approvals': 'workspace.read',
+    '/hours': 'workspace.read',
+    '/closures': 'workspace.read',
+    '/contacts': 'workspace.read',
+    '/locations': 'workspace.read',
+    '/assistant': 'assistant.chat',
+    '/assistant/chats': 'assistant.chat',
+    '/plan': 'usage.read',
+    '/teams': 'account.use',
+    '/settings': 'workspace.read',
+    '/settings/endpoints': 'workspace.read',
+    '/settings/hours': 'workspace.read',
+    '/settings/account': 'account.use',
+    '/settings/members': 'workspace.read',
+    '/settings/audit': 'audit.read',
+    '/settings/audit/export': 'audit.read',
+    '/settings/team': 'workspace.own',
+    '/settings/privacy': 'privacy.manage',
+    '/settings/privacy/download': 'privacy.manage',
+    '/settings/identity': 'identity.manage',
+});
+/**
+ * A member limited to some locations and groups (RFC 0004 D1) keeps at most these of their role's
+ * capabilities: they read and run the desk for those resources, and chat with an assistant that
+ * reaches only them. Nothing that reaches the whole workspace (keys, webhooks, people, money, its
+ * hours and closures, its data whole or a person's) is theirs.
+ */
+export const SLOTLOCK_SCOPED_CAPABILITIES = new Set([
+    'account.use',
+    'workspace.read',
+    'assistant.chat',
+    'operations.run',
+]);
+/**
+ * The pages a limited member reaches: what the store reads for them is held to their resources by
+ * the database (resource_scope_v1), and pages whose content is the whole workspace's (keys,
+ * webhooks, contacts, hours, closures, locations, usage, the audit log) are not among them.
+ */
+export const SLOTLOCK_SCOPED_DASHBOARD_PAGES = new Set([
+    '/',
+    '/resources',
+    '/resources/:id',
+    '/waitlist',
+    '/approvals',
+    '/assistant',
+    '/assistant/chats',
+    '/teams',
+    '/settings',
+    '/settings/account',
+    '/settings/members',
+]);
+/** The forms a limited member may send: their own account's, and the desk's for their resources. */
+export const SLOTLOCK_SCOPED_DASHBOARD_POSTS = new Set([
+    ...Object.entries(SLOTLOCK_DASHBOARD_POST_CAPABILITIES)
+        .filter(([, capability]) => capability === 'account.use' || capability === 'assistant.chat')
+        .map(([route]) => route),
+    '/waitlist/leave',
+    '/approvals/decide',
+    '/assistant/approve',
+]);
+/** Whether a role, limited (`scoped`) or not, may use a capability. */
+export function slotlockMemberCan(role, scoped, capability) {
+    return slotlockRoleCan(role, capability) && (!scoped || SLOTLOCK_SCOPED_CAPABILITIES.has(capability));
+}

package/workspace-scim.d.ts

@@ -0,0 +1,89 @@
+import type { SlotlockScimGroupAttributes, SlotlockScimUserAttributes } from './scim.js';
+import type { SlotlockSql } from './store.js';
+/** A SCIM token: `slk_scim_` and 256 random bits in hex. */
+export declare const SLOTLOCK_SCIM_TOKEN: RegExp;
+export type SlotlockScimRefusal = 'not_found' | 'not_allowed' | 'not_enabled' | 'no_verified_domain' | 'key_policy' | 'token_limit' | 'bad_token' | 'wrong_workspace' | 'domain_not_verified' | 'uniqueness' | 'owner_protected' | 'invalid_member' | 'owner_not_mappable' | 'role_not_allowed';
+/** A directory user as kept, with its id and times. */
+export interface SlotlockScimUser extends SlotlockScimUserAttributes {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface SlotlockScimGroup extends SlotlockScimGroupAttributes {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    /** The role an Owner mapped the group to (reserved names map themselves), or null. Not part of SCIM. */
+    role: string | null;
+}
+/** A filter as the endpoint passes it: one attribute (username, externalid, id, email / displayname). */
+export type SlotlockScimLookup = {
+    attribute: string;
+    value: string;
+} | null;
+export interface SlotlockWorkspaceScim {
+    enable(tenantRef: string, actor: string, keyPolicy: 'keep' | 'revoke'): Promise<SlotlockScimRefusal | null>;
+    disable(tenantRef: string, actor: string): Promise<SlotlockScimRefusal | null>;
+    /** A new token, shown once: the raw value, or why not. */
+    createToken(tenantRef: string, actor: string): Promise<{
+        token: string;
+        prefix: string;
+    } | {
+        refusal: SlotlockScimRefusal;
+    }>;
+    revokeToken(tenantRef: string, actor: string, id: string): Promise<SlotlockScimRefusal | null>;
+    state(tenantRef: string): Promise<{
+        enabled: boolean;
+        keyPolicy: 'keep' | 'revoke' | null;
+        tokens: {
+            id: string;
+            prefix: string;
+            createdAt: Date;
+            lastUsedAt: Date | null;
+        }[];
+    }>;
+    /** A request's token, for the team its address names. */
+    authenticate(token: string, teamId: string): Promise<{
+        tenantRef: string;
+        prefix: string;
+        keyPolicy: 'keep' | 'revoke';
+    } | {
+        refusal: 'bad_token' | 'wrong_workspace';
+        tenantRef?: string;
+        prefix?: string;
+    }>;
+    putUser(tenantRef: string, id: string | null, newId: string, user: SlotlockScimUserAttributes): Promise<{
+        id: string;
+        membership: 'none' | 'deactivated' | 'activated';
+        person: string | null;
+    } | {
+        refusal: SlotlockScimRefusal;
+        person?: string | null;
+    }>;
+    users(tenantRef: string, lookup: SlotlockScimLookup, startIndex: number, count: number, id?: string): Promise<{
+        users: SlotlockScimUser[];
+        total: number;
+    }>;
+    deleteUser(tenantRef: string, id: string): Promise<{
+        refusal: SlotlockScimRefusal | null;
+        person: string | null;
+    }>;
+    putGroup(tenantRef: string, id: string | null, newId: string, group: SlotlockScimGroupAttributes): Promise<{
+        id: string;
+    } | {
+        refusal: SlotlockScimRefusal;
+    }>;
+    groups(tenantRef: string, lookup: SlotlockScimLookup, startIndex: number, count: number, id?: string): Promise<{
+        groups: SlotlockScimGroup[];
+        total: number;
+    }>;
+    deleteGroup(tenantRef: string, id: string): Promise<SlotlockScimRefusal | null>;
+    mapGroup(tenantRef: string, actor: string, id: string, role: string | null): Promise<SlotlockScimRefusal | null>;
+    /**
+     * A sign-in holding addresses the domain vouches for: the directory users at them bind to the
+     * person. `freeCap` is the member cap of a team on the free plan, where plans apply, else null.
+     */
+    bind(person: string, emails: readonly string[], freeCap?: number | null): Promise<string[]>;
+}
+/** Through the functions of ddl-scim.ts. */
+export declare function createSlotlockWorkspaceScim(sql: SlotlockSql): SlotlockWorkspaceScim;

package/workspace-scim.js

@@ -0,0 +1,157 @@
+// A team's directory (SCIM 2.0) as the dashboard and its SCIM endpoint reach it (teams phase
+// 5.6–5.7): through the SECURITY DEFINER functions of ddl-scim.ts. Tokens are made here and shown
+// once; only their SHA-256 reaches the database.
+import { createHash, randomBytes } from 'node:crypto';
+const TEAM = /^team:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** A SCIM token: `slk_scim_` and 256 random bits in hex. */
+export const SLOTLOCK_SCIM_TOKEN = /^slk_scim_[0-9a-f]{64}$/;
+const digest = (token) => createHash('sha256').update(token, 'utf8').digest();
+const refusalOf = (value) => value === null || value === undefined ? null : value;
+/** Through the functions of ddl-scim.ts. */
+export function createSlotlockWorkspaceScim(sql) {
+    return {
+        async enable(tenantRef, actor, keyPolicy) {
+            const [row] = await sql `SELECT slotlock.enable_scim(${tenantRef}::text, ${actor}::text, ${keyPolicy}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async disable(tenantRef, actor) {
+            const [row] = await sql `SELECT slotlock.disable_scim(${tenantRef}::text, ${actor}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async createToken(tenantRef, actor) {
+            const token = `slk_scim_${randomBytes(32).toString('hex')}`;
+            const prefix = token.slice(0, 'slk_scim_'.length + 4);
+            const [row] = await sql `
+        SELECT slotlock.create_scim_token(${tenantRef}::text, ${actor}::text, ${digest(token)}::bytea, ${prefix}::text) AS refusal`;
+            return row?.refusal ? { refusal: refusalOf(row.refusal) ?? 'not_allowed' } : { token, prefix };
+        },
+        async revokeToken(tenantRef, actor, id) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `SELECT slotlock.revoke_scim_token(${tenantRef}::text, ${actor}::text, ${id}::uuid) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async state(tenantRef) {
+            const rows = await sql `
+        SELECT * FROM slotlock.scim_state(${tenantRef}::text)`;
+            return {
+                enabled: rows[0]?.enabled === true,
+                keyPolicy: rows[0]?.key_policy ?? null,
+                tokens: rows.flatMap((row) => row.token_id && row.prefix && row.created_at ? [{ id: row.token_id, prefix: row.prefix, createdAt: row.created_at, lastUsedAt: row.last_used_at }] : []),
+            };
+        },
+        async authenticate(token, teamId) {
+            if (!SLOTLOCK_SCIM_TOKEN.test(token) || !UUID.test(teamId))
+                return { refusal: 'bad_token' };
+            const [row] = await sql `
+        SELECT * FROM slotlock.scim_authenticate(${digest(token)}::bytea, ${`team:${teamId.toLowerCase()}`}::text)`;
+            if (!row || row.refusal === 'bad_token' || (row.refusal === null && (!row.team_ref || !row.key_policy)))
+                return { refusal: 'bad_token' };
+            if (row.refusal === 'wrong_workspace') {
+                return { refusal: 'wrong_workspace', ...(row.team_ref ? { tenantRef: row.team_ref } : {}), ...(row.token_prefix ? { prefix: row.token_prefix } : {}) };
+            }
+            return { tenantRef: row.team_ref, prefix: row.token_prefix, keyPolicy: row.key_policy };
+        },
+        async putUser(tenantRef, id, newId, user) {
+            if (!TEAM.test(tenantRef) || (id !== null && !UUID.test(id)) || !UUID.test(newId))
+                return { refusal: 'not_found' };
+            const [row] = await sql `
+        SELECT * FROM slotlock.scim_put_user(${tenantRef}::text, ${id}::uuid, ${newId}::uuid, ${user.userName}::text,
+          ${user.externalId}::text, ${user.active}::boolean, ${user.givenName}::text, ${user.familyName}::text,
+          ${user.displayName}::text, ${user.workEmail}::text)`;
+            if (!row || row.refusal)
+                return { refusal: refusalOf(row?.refusal) ?? 'not_found', person: row?.person ?? null };
+            return {
+                id: row.user_id,
+                membership: row.membership === 'deactivated' || row.membership === 'activated' ? row.membership : 'none',
+                person: row.person,
+            };
+        },
+        async users(tenantRef, lookup, startIndex, count, id) {
+            if (!TEAM.test(tenantRef) || (id !== undefined && !UUID.test(id)))
+                return { users: [], total: 0 };
+            const rows = await sql `SELECT * FROM slotlock.scim_users_list(${tenantRef}::text, ${lookup?.attribute ?? null}::text, ${lookup?.value ?? null}::text,
+          ${startIndex}::integer, ${count}::integer, ${id ?? null}::uuid)`;
+            // A page past the end (or count=0) has no rows to carry the total: one row from the start does.
+            const total = rows[0]?.total ??
+                (startIndex > 1 || count === 0
+                    ? ((await sql `SELECT total FROM slotlock.scim_users_list(${tenantRef}::text, ${lookup?.attribute ?? null}::text,
+                ${lookup?.value ?? null}::text, 1, 1, ${id ?? null}::uuid)`)[0]?.total ?? 0)
+                    : 0);
+            return {
+                total: Number(total),
+                users: rows.map((row) => ({
+                    id: row.user_id,
+                    userName: row.user_name,
+                    externalId: row.external_id,
+                    active: row.active,
+                    givenName: row.given_name,
+                    familyName: row.family_name,
+                    displayName: row.display_name,
+                    workEmail: row.work_email,
+                    createdAt: row.created_at,
+                    updatedAt: row.updated_at,
+                })),
+            };
+        },
+        async deleteUser(tenantRef, id) {
+            if (!UUID.test(id))
+                return { refusal: 'not_found', person: null };
+            const [row] = await sql `SELECT * FROM slotlock.scim_delete_user(${tenantRef}::text, ${id}::uuid)`;
+            return { refusal: refusalOf(row?.refusal), person: row?.person ?? null };
+        },
+        async putGroup(tenantRef, id, newId, group) {
+            if (!TEAM.test(tenantRef) || (id !== null && !UUID.test(id)) || !UUID.test(newId))
+                return { refusal: 'not_found' };
+            if (!group.members.every((member) => UUID.test(member)))
+                return { refusal: 'invalid_member' };
+            const [row] = await sql `
+        SELECT * FROM slotlock.scim_put_group(${tenantRef}::text, ${id}::uuid, ${newId}::uuid, ${group.displayName}::text,
+          ${group.externalId}::text, ${group.members}::uuid[])`;
+            return row?.group_id && !row.refusal ? { id: row.group_id } : { refusal: refusalOf(row?.refusal) ?? 'not_found' };
+        },
+        async groups(tenantRef, lookup, startIndex, count, id) {
+            if (!TEAM.test(tenantRef) || (id !== undefined && !UUID.test(id)))
+                return { groups: [], total: 0 };
+            const rows = await sql `SELECT * FROM slotlock.scim_groups_list(${tenantRef}::text, ${lookup?.attribute ?? null}::text, ${lookup?.value ?? null}::text,
+          ${startIndex}::integer, ${count}::integer, ${id ?? null}::uuid)`;
+            const total = rows[0]?.total ??
+                (startIndex > 1 || count === 0
+                    ? ((await sql `SELECT total FROM slotlock.scim_groups_list(${tenantRef}::text, ${lookup?.attribute ?? null}::text,
+                ${lookup?.value ?? null}::text, 1, 1, ${id ?? null}::uuid)`)[0]?.total ?? 0)
+                    : 0);
+            return {
+                total: Number(total),
+                groups: rows.map((row) => ({
+                    id: row.group_id,
+                    displayName: row.display_name,
+                    externalId: row.external_id,
+                    members: row.members,
+                    createdAt: row.created_at,
+                    updatedAt: row.updated_at,
+                    role: row.mapped_role,
+                })),
+            };
+        },
+        async deleteGroup(tenantRef, id) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `SELECT slotlock.scim_delete_group(${tenantRef}::text, ${id}::uuid) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async mapGroup(tenantRef, actor, id, role) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `
+        SELECT slotlock.map_scim_group_role(${tenantRef}::text, ${actor}::text, ${id}::uuid, ${role}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async bind(person, emails, freeCap) {
+            if (emails.length === 0)
+                return [];
+            const rows = await sql `SELECT team_ref FROM slotlock.scim_bind(${person}::text, ${[...emails].slice(0, 10)}::text[], ${freeCap ?? null}::integer)`;
+            return rows.map((row) => row.team_ref);
+        },
+    };
+}