Complete preliminary SCIM fns, add permissioning to SCIM, add docs for SCIM

backend/src/ee/routes/v1/scim-router.ts

@@ -1,195 +1,19 @@
-import jwt from "jsonwebtoken";
 import { z } from "zod";
+
 import { ScimTokensSchema } from "@app/db/schemas";
-
-import { getConfig } from "@app/lib/config/env";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode, AuthTokenType } from "@app/services/auth/auth-type";
-
-
+import { AuthMode } from "@app/services/auth/auth-type";
 
 export const registerScimRouter = async (server: FastifyZodProvider) => {
-  server.route({
-    url: "/",
-    method: "GET",
-    schema: {
-      params: z.object({}),
-      response: {
-        200: z.object({})
-      }
-    },
-    // onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async () => {
-      return {
-        hello: "world"
-      };
-    }
-  });
+  server.addContentTypeParser("application/scim+json", { parseAs: "string" }, function (req, body, done) {
+    try {
+      const strBody = body instanceof Buffer ? body.toString() : body;
 
-  server.route({
-    url: "/Users",
-    method: "GET",
-    schema: {
-      querystring: z.object({
-        startIndex: z.coerce.number().default(1),
-        count: z.coerce.number().default(20),
-        filter: z.string().trim().optional()
-      }),
-      response: {
-        200: z.object({ // TODO: audit the response
-          Resources: z.array(z.object({
-            id: z.string().trim(),
-            userName: z.string().trim(),
-            name: z.object({
-              familyName: z.string().trim(),
-              givenName: z.string().trim()
-            }),
-            emails: z.array(z.object({
-              primary: z.boolean(),
-              value: z.string().email(),
-              type: z.string().trim()
-            })),
-            displayName: z.string().trim(),
-            active: z.boolean()
-          })),
-          itemsPerPage: z.number(),
-          schemas: z.array(z.string()),
-          startIndex: z.number(),
-          totalResults: z.number(),
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
-    handler: async (req) => {
-      const res = await req.server.services.scim.listUsers({
-        offset: req.query.startIndex,
-        limit: req.query.count,
-        filter: req.query.filter
-      });
-      return res;
-    }
-  });
-
-  server.route({
-    url: "/Users/:userId",
-    method: "GET",
-    schema: {
-      params: z.object({
-        userId: z.string().trim()
-      }),
-      response: {
-        201: z.object({
-          schemas: z.array(z.string()),
-          id: z.string().trim(),
-          userName: z.string().trim(),
-          name: z.object({
-            familyName: z.string().trim(),
-            givenName: z.string().trim()
-          }),
-          emails: z.array(z.object({
-            primary: z.boolean(),
-            value: z.string().email(),
-            type: z.string().trim()
-          })),
-          displayName: z.string().trim(),
-          active: z.boolean()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
-    handler: async (req) => {
-      const res = await req.server.services.scim.getUser(req.params.userId);
-      return res;
-    }
-  });
-
-  server.route({
-    url: "/Users",
-    method: "POST",
-    schema: {
-      body: z.object({
-        schemas: z.array(z.string()),
-        userName: z.string().trim(),
-        name: z.object({
-          familyName: z.string().trim(),
-          givenName: z.string().trim()
-        }),
-        emails: z.array(z.object({
-          primary: z.boolean(),
-          value: z.string().email(),
-          type: z.string().trim()
-        })),
-        displayName: z.string().trim(),
-        // locale: z.string().trim(),
-        // externalId: z.string().trim(),
-        // groups: z.array(z.object({
-        //   value: z.string().trim()
-        // })),
-        // password: z.string().trim(),
-        active: z.boolean()
-      }),
-      response: {
-        200: z.object({
-          schemas: z.array(z.string()),
-          id: z.string().trim(),
-          userName: z.string().trim(),
-          name: z.object({
-            familyName: z.string().trim(),
-            givenName: z.string().trim()
-          }),
-          emails: z.array(z.object({
-            primary: z.boolean(),
-            value: z.string().email(),
-            type: z.string().trim()
-          })),
-          displayName: z.string().trim(),
-          active: z.boolean()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
-    handler: async (req, reply) => {
-      const user = await req.server.services.scim.createUser({
-        email: req.body.emails[0].value,
-        firstName: req.body.name.givenName,
-        lastName: req.body.name.familyName,
-        orgId: req.permission.orgId as string
-      });
-
-      reply.code(201);
-      return user;
-    }
-  });
-
-  server.route({
-    url: "/Users/:userId",
-    method: "PATCH",
-    schema: {
-      body: z.object({}),
-      response: {
-        200: z.object({})
-      }
-    },
-    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
-    handler: async (req) => {
-      // TODO: update a user's attr
-      return {};
-    }
-  });
-
-  server.route({
-    url: "/Users/:userId",
-    method: "PUT",
-    schema: {
-      body: z.object({}),
-      response: {
-        200: z.object({})
-      }
-    },
-    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
-    handler: async (req) => {
-      // TODO: update a user's profile
-      return {};
+      const json: unknown = JSON.parse(strBody); // TODO: update
+      done(null, json);
+    } catch (err) {
+      const error = err as Error;
+      done(error, undefined);
     }
   });
 
@@ -201,7 +25,7 @@ export const registerScimRouter = async (server: FastifyZodProvider) => {
       body: z.object({
         organizationId: z.string().trim(),
         description: z.string().trim().default(""),
-        ttl: z.number().min(0).default(0)
+        ttlDays: z.number().min(0).default(0)
       }),
       response: {
         200: z.object({
@@ -211,9 +35,12 @@ export const registerScimRouter = async (server: FastifyZodProvider) => {
     },
     handler: async (req) => {
       const { scimToken } = await server.services.scim.createScimToken({
-        organizationId: req.body.organizationId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        orgId: req.body.organizationId,
         description: req.body.description,
-        ttl: req.body.ttl
+        ttlDays: req.body.ttlDays
       });
 
       return { scimToken };
@@ -235,7 +62,13 @@ export const registerScimRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const scimTokens = await server.services.scim.getScimTokens(req.query.organizationId);
+      const scimTokens = await server.services.scim.listScimTokens({
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        orgId: req.query.organizationId
+      });
+
       return { scimTokens };
     }
   });
@@ -255,8 +88,267 @@ export const registerScimRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const scimToken = await server.services.scim.deleteScimToken(req.params.scimTokenId);
+      const scimToken = await server.services.scim.deleteScimToken({
+        scimTokenId: req.params.scimTokenId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId
+      });
+
       return { scimToken };
     }
   });
+
+  // SCIM server endpoints
+  server.route({
+    url: "/Users",
+    method: "GET",
+    schema: {
+      querystring: z.object({
+        startIndex: z.coerce.number().default(1),
+        count: z.coerce.number().default(20),
+        filter: z.string().trim().optional()
+      }),
+      response: {
+        200: z.object({
+          Resources: z.array(
+            z.object({
+              id: z.string().trim(),
+              userName: z.string().trim(),
+              name: z.object({
+                familyName: z.string().trim(),
+                givenName: z.string().trim()
+              }),
+              emails: z.array(
+                z.object({
+                  primary: z.boolean(),
+                  value: z.string().email(),
+                  type: z.string().trim()
+                })
+              ),
+              displayName: z.string().trim(),
+              active: z.boolean()
+            })
+          ),
+          itemsPerPage: z.number(),
+          schemas: z.array(z.string()),
+          startIndex: z.number(),
+          totalResults: z.number()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
+    handler: async (req) => {
+      const users = await req.server.services.scim.listScimUsers({
+        offset: req.query.startIndex,
+        limit: req.query.count,
+        filter: req.query.filter,
+        orgId: req.permission.orgId as string
+      });
+      return users;
+    }
+  });
+
+  server.route({
+    url: "/Users/:userId",
+    method: "GET",
+    schema: {
+      params: z.object({
+        userId: z.string().trim()
+      }),
+      response: {
+        201: z.object({
+          schemas: z.array(z.string()),
+          id: z.string().trim(),
+          userName: z.string().trim(),
+          name: z.object({
+            familyName: z.string().trim(),
+            givenName: z.string().trim()
+          }),
+          emails: z.array(
+            z.object({
+              primary: z.boolean(),
+              value: z.string().email(),
+              type: z.string().trim()
+            })
+          ),
+          displayName: z.string().trim(),
+          active: z.boolean()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
+    handler: async (req) => {
+      const user = await req.server.services.scim.getScimUser({
+        userId: req.params.userId,
+        orgId: req.permission.orgId as string
+      });
+      return user;
+    }
+  });
+
+  server.route({
+    url: "/Users",
+    method: "POST",
+    schema: {
+      body: z.object({
+        schemas: z.array(z.string()),
+        userName: z.string().trim().email(),
+        name: z.object({
+          familyName: z.string().trim(),
+          givenName: z.string().trim()
+        }),
+        // emails: z.array( // optional?
+        //   z.object({
+        //     primary: z.boolean(),
+        //     value: z.string().email(),
+        //     type: z.string().trim()
+        //   })
+        // ),
+        // displayName: z.string().trim(),
+        active: z.boolean()
+      }),
+      response: {
+        200: z.object({
+          schemas: z.array(z.string()),
+          id: z.string().trim(),
+          userName: z.string().trim().email(),
+          name: z.object({
+            familyName: z.string().trim(),
+            givenName: z.string().trim()
+          }),
+          emails: z.array(
+            z.object({
+              primary: z.boolean(),
+              value: z.string().email(),
+              type: z.string().trim()
+            })
+          ),
+          displayName: z.string().trim(),
+          active: z.boolean()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
+    handler: async (req) => {
+      const user = await req.server.services.scim.createScimUser({
+        email: req.body.userName,
+        firstName: req.body.name.givenName,
+        lastName: req.body.name.familyName,
+        orgId: req.permission.orgId as string
+      });
+
+      return user;
+    }
+  });
+
+  server.route({
+    url: "/Users/:userId",
+    method: "PATCH",
+    schema: {
+      params: z.object({
+        userId: z.string().trim()
+      }),
+      body: z.object({
+        schemas: z.array(z.string()),
+        Operations: z.array(
+          z.object({
+            op: z.string().trim(),
+            path: z.string().trim().optional(),
+            value: z.union([
+              z.object({
+                active: z.boolean()
+              }),
+              z.string().trim()
+            ])
+          })
+        )
+      }),
+      response: {
+        200: z.object({})
+      }
+    },
+    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
+    handler: async (req) => {
+      const user = await req.server.services.scim.updateScimUser({
+        userId: req.params.userId,
+        orgId: req.permission.orgId as string,
+        operations: req.body.Operations
+      });
+      return user;
+    }
+  });
+
+  server.route({
+    url: "/Users/:userId",
+    method: "PUT",
+    schema: {
+      params: z.object({
+        userId: z.string().trim()
+      }),
+      body: z.object({
+        schemas: z.array(z.string()),
+        id: z.string().trim(),
+        userName: z.string().trim(),
+        name: z.object({
+          familyName: z.string().trim(),
+          givenName: z.string().trim()
+        }),
+        // emails: z.array(
+        //   z.object({
+        //     primary: z.boolean(),
+        //     value: z.string().email(),
+        //     type: z.string().trim()
+        //   })
+        // ),
+        displayName: z.string().trim(),
+        active: z.boolean()
+      }),
+      response: {
+        200: z.object({
+          schemas: z.array(z.string()),
+          id: z.string().trim(),
+          userName: z.string().trim(),
+          name: z.object({
+            familyName: z.string().trim(),
+            givenName: z.string().trim()
+          }),
+          emails: z.array(
+            z.object({
+              primary: z.boolean(),
+              value: z.string().email(),
+              type: z.string().trim()
+            })
+          ),
+          displayName: z.string().trim(),
+          active: z.boolean()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
+    handler: async (req) => {
+      const user = await req.server.services.scim.replaceScimUser({
+        userId: req.params.userId,
+        orgId: req.permission.orgId as string,
+        active: req.body.active
+      });
+      return user;
+    }
+  });
+
+  // server.route({
+  //   url: "/Users/:userId",
+  //   method: "DELETE",
+  //   schema: {
+  //     body: z.object({}),
+  //     response: {
+  //       200: z.object({})
+  //     }
+  //   },
+  //   onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
+  //   handler: () => {
+  //     // TODO: update a user's profile
+  //     return {};
+  //   }
+  // });
 };

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -15,7 +15,7 @@ export type TListProjectAuditLogDTO = {
 
 export type TCreateAuditLogDTO = {
   event: Event;
-  actor: UserActor | IdentityActor | ServiceActor | ScimIdpActor;
+  actor: UserActor | IdentityActor | ServiceActor;
   orgId?: string;
   projectId?: string;
 } & BaseAuthData;

backend/src/ee/services/license/licence-fns.ts

@@ -23,8 +23,8 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   customAlerts: false,
   auditLogs: false,
   auditLogsRetentionDays: 0,
-  samlSSO: true,
-  scim: true,
+  samlSSO: false,
+  scim: false,
   status: null,
   trial_end: null,
   has_used_trial: true,

backend/src/ee/services/license/license-types.ts

@@ -24,8 +24,8 @@ export type TFeatureSet = {
   customAlerts: false;
   auditLogs: false;
   auditLogsRetentionDays: 0;
-  samlSSO: true;
-  scim: true;
+  samlSSO: false;
+  scim: false;
   status: null;
   trial_end: null;
   has_used_trial: true;

backend/src/ee/services/permission/org-permission.ts

@@ -16,6 +16,7 @@ export enum OrgPermissionSubjects {
   Settings = "settings",
   IncidentAccount = "incident-contact",
   Sso = "sso",
+  Scim = "scim",
   Billing = "billing",
   SecretScanning = "secret-scanning",
   Identity = "identity"
@@ -29,6 +30,7 @@ export type OrgPermissionSet =
   | [OrgPermissionActions, OrgPermissionSubjects.Settings]
   | [OrgPermissionActions, OrgPermissionSubjects.IncidentAccount]
   | [OrgPermissionActions, OrgPermissionSubjects.Sso]
+  | [OrgPermissionActions, OrgPermissionSubjects.Scim]
   | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning]
   | [OrgPermissionActions, OrgPermissionSubjects.Billing]
   | [OrgPermissionActions, OrgPermissionSubjects.Identity];
@@ -69,6 +71,11 @@ const buildAdminPermission = () => {
   can(OrgPermissionActions.Edit, OrgPermissionSubjects.Sso);
   can(OrgPermissionActions.Delete, OrgPermissionSubjects.Sso);
 
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Scim);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Scim);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Scim);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Scim);
+
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
   can(OrgPermissionActions.Create, OrgPermissionSubjects.Billing);
   can(OrgPermissionActions.Edit, OrgPermissionSubjects.Billing);

backend/src/ee/services/saml-config/saml-config-service.ts

@@ -195,7 +195,7 @@ export const samlConfigServiceFactory = ({
       updateQuery.certTag = certTag;
     }
     const [ssoConfig] = await samlConfigDAL.update({ orgId }, updateQuery);
-    await orgDAL.updateById(orgId, { authEnforced: false });
+    await orgDAL.updateById(orgId, { authEnforced: false, scimEnabled: false });
 
     return ssoConfig;
   };

backend/src/ee/services/scim/scim-fns.ts

@@ -0,0 +1,58 @@
+import { TListScimUsers, TScimUser } from "./scim-types";
+
+export const buildScimUserList = ({
+  scimUsers,
+  offset,
+  limit
+}: {
+  scimUsers: TScimUser[];
+  offset: number;
+  limit: number;
+}): TListScimUsers => {
+  return {
+    Resources: scimUsers,
+    itemsPerPage: limit,
+    schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+    startIndex: offset,
+    totalResults: scimUsers.length
+  };
+};
+
+export const buildScimUser = ({
+  userId,
+  firstName,
+  lastName,
+  email,
+  active
+}: {
+  userId: string;
+  firstName: string;
+  lastName: string;
+  email: string;
+  active: boolean;
+}): TScimUser => {
+  return {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"],
+    id: userId,
+    userName: email,
+    displayName: `${firstName} ${lastName}`,
+    name: {
+      givenName: firstName,
+      middleName: null,
+      familyName: lastName
+    },
+    emails: [
+      {
+        primary: true,
+        value: email,
+        type: "work"
+      }
+    ],
+    active,
+    groups: [],
+    meta: {
+      resourceType: "User",
+      location: null
+    }
+  };
+};

backend/src/ee/services/scim/scim-service.ts

@@ -1,61 +1,71 @@
+import { ForbiddenError } from "@casl/ability";
 import jwt from "jsonwebtoken";
 
-import {
-  OrgMembershipRole,
-  OrgMembershipStatus
-} from "@app/db/schemas";
+import { OrgMembershipRole, OrgMembershipStatus } from "@app/db/schemas";
 import { TScimDALFactory } from "@app/ee/services/scim/scim-dal";
-import { TUserDALFactory } from "@app/services/user/user-dal";        
-import { TOrgDALFactory } from "@app/services/org/org-dal";
-import { TPermissionServiceFactory } from "../permission/permission-service";
-import { TLicenseServiceFactory } from "../license/license-service";
 import { getConfig } from "@app/lib/config/env";
+import { BadRequestError, ScimRequestError, UnauthorizedError } from "@app/lib/errors";
+import { TOrgPermission } from "@app/lib/types";
 import { AuthMethod, AuthTokenType } from "@app/services/auth/auth-type";
+import { TOrgDALFactory } from "@app/services/org/org-dal";
+import { deleteOrgMembership } from "@app/services/org/org-fns";
+import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
+import { TUserDALFactory } from "@app/services/user/user-dal";
+
+import { TLicenseServiceFactory } from "../license/license-service";
+import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
+import { TPermissionServiceFactory } from "../permission/permission-service";
+import { buildScimUser, buildScimUserList } from "./scim-fns";
 import {
   TCreateScimTokenDTO,
-  TListScimUsersDTO,
-  TListScimUsersRes,
   TCreateScimUserDTO,
-  TScimTokenJwtPayload
+  TDeleteScimTokenDTO,
+  TGetScimUserDTO,
+  TListScimUsers,
+  TListScimUsersDTO,
+  TReplaceScimUserDTO,
+  TScimTokenJwtPayload,
+  TUpdateScimUserDTO
 } from "./scim-types";
-import { 
-  createScimUser,
-  TScimUser,
-} from "@app/lib/scim";
-import { UnauthorizedError, ScimRequestError } from "@app/lib/errors";
 
 type TScimServiceFactoryDep = {
-  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  // TODO: pick types
   scimDAL: TScimDALFactory; // TODO: pick
   userDAL: TUserDALFactory; // TODO: pick
   orgDAL: TOrgDALFactory; // TODO: pick
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
+  permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
+  smtpService: TSmtpService;
 };
 
 export type TScimServiceFactory = ReturnType<typeof scimServiceFactory>;
 
-export const scimServiceFactory = ({ 
+export const scimServiceFactory = ({
   licenseService,
   scimDAL,
   userDAL,
   orgDAL,
-  permissionService
+  permissionService,
+  smtpService
 }: TScimServiceFactoryDep) => {
-  const createScimToken = async ({
-    organizationId,
-    description,
-    ttl
-  }: TCreateScimTokenDTO) => {
+  const createScimToken = async ({ actor, actorId, actorOrgId, orgId, description, ttlDays }: TCreateScimTokenDTO) => {
+    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorOrgId);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Scim);
+
+    const plan = await licenseService.getPlan(orgId);
+    if (!plan.scim)
+      throw new BadRequestError({
+        message: "Failed to create a SCIM token due to plan restriction. Upgrade plan to create a SCIM token."
+      });
+
     const appCfg = getConfig();
-    
-    // TODO: permission stuff
 
     const scimTokenData = await scimDAL.create({
-      orgId: organizationId,
+      orgId,
       description,
-      ttl
+      ttlDays
     });
-    
+
     const scimToken = jwt.sign(
       {
         scimTokenId: scimTokenData.id,
@@ -63,167 +73,346 @@ export const scimServiceFactory = ({
       },
       appCfg.AUTH_SECRET
     );
-    
-    return { scimToken }
-  }
 
-  const getScimTokens = async (organizationId: string) => {
-    const scimTokens = await scimDAL.find({ orgId: organizationId });
+    return { scimToken };
+  };
+
+  const listScimTokens = async ({ actor, actorId, actorOrgId, orgId }: TOrgPermission) => {
+    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorOrgId);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Scim);
+
+    const plan = await licenseService.getPlan(orgId);
+    if (!plan.scim)
+      throw new BadRequestError({
+        message: "Failed to get SCIM tokens due to plan restriction. Upgrade plan to get SCIM tokens."
+      });
+
+    const scimTokens = await scimDAL.find({ orgId });
     return scimTokens;
-  }
-  
-  const deleteScimToken = async (scimTokenId: string) => {
-    const scimToken = await scimDAL.deleteById(scimTokenId);
+  };
+
+  const deleteScimToken = async ({ scimTokenId, actor, actorId, actorOrgId }: TDeleteScimTokenDTO) => {
+    let scimToken = await scimDAL.findById(scimTokenId);
+    if (!scimToken) throw new BadRequestError({ message: "Failed to find SCIM token to delete" });
+
+    const { permission } = await permissionService.getOrgPermission(actor, actorId, scimToken.orgId, actorOrgId);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Delete, OrgPermissionSubjects.Scim);
+
+    const plan = await licenseService.getPlan(scimToken.orgId);
+    if (!plan.scim)
+      throw new BadRequestError({
+        message: "Failed to delete the SCIM token due to plan restriction. Upgrade plan to delete the SCIM token."
+      });
+
+    scimToken = await scimDAL.deleteById(scimTokenId);
+
     return scimToken;
-  }
-  
-  // scim server endpoints
+  };
+
+  // SCIM server endpoints
+  const listScimUsers = async ({ offset, limit, filter, orgId }: TListScimUsersDTO): Promise<TListScimUsers> => {
+    const org = await orgDAL.findById(orgId);
+
+    if (!org.scimEnabled)
+      throw new ScimRequestError({
+        detail: "SCIM is disabled for the organization",
+        status: 403
+      });
+
+    const parseFilter = (filterToParse: string | undefined) => {
+      if (!filterToParse) return {};
+      const [parsedName, parsedValue] = filterToParse.split("eq").map((s) => s.trim());
 
-  const listUsers = async ({
-    offset,
-    limit,
-    filter
-  }: TListScimUsersDTO): Promise<TListScimUsersRes> => {
-    
-    const parseFilter = (filter: string | undefined) => {
-      if (!filter) return {};
-      const [parsedName, parsedValue] = filter.split("eq").map(s => s.trim());
-      
       let attributeName = parsedName;
-      if (parsedName === "userName") { // note
+      if (parsedName === "userName") {
         attributeName = "email";
       }
-      
+
       return { [attributeName]: parsedValue };
     };
-    
+
     const findOpts = {
       ...(offset && { offset }),
-      ...(limit && { limit }),
+      ...(limit && { limit })
     };
-    
-    const users = await userDAL.find(parseFilter(filter), findOpts);
-    
-    let resources: TScimUser[] = [];
-    
-    let scimResource: TListScimUsersRes = { // note: type
-      Resources: [],
-      itemsPerPage: limit,
-      schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
-      startIndex: offset,
-      totalResults: users.length
-    };
-    
-    users.forEach((user) => {
-      let scimUser = createScimUser({
-        userId: user.id,
-        firstName: user.firstName as string,
-        lastName: user.lastName as string,
-        email: user.email
-      });
-      resources.push(scimUser);
+
+    const users = await orgDAL.findMembership(
+      {
+        orgId,
+        ...parseFilter(filter)
+      },
+      findOpts
+    );
+
+    const scimUsers = users.map(({ userId, firstName, lastName, email }) =>
+      buildScimUser({
+        userId: userId ?? "",
+        firstName: firstName ?? "",
+        lastName: lastName ?? "",
+        email,
+        active: true
+      })
+    );
+
+    return buildScimUserList({
+      scimUsers,
+      offset,
+      limit
     });
+  };
 
-    scimResource.Resources = resources;
-    
-    return scimResource;
-  }
-  
-  const getUser = async (userId: string) => {
-    // TODO: check out SCIM-specific errors
-    
-    let user;
-    try {
-      user = await userDAL.findById(userId);
-    } catch (error) {
+  const getScimUser = async ({ userId, orgId }: TGetScimUserDTO) => {
+    const [membership] = await orgDAL
+      .findMembership({
+        userId,
+        orgId
+      })
+      .catch(() => {
+        throw new ScimRequestError({
+          detail: "User not found",
+          status: 404
+        });
+      });
 
-      interface PostgresError extends Error {
-        error: {
-          code: string;
-        }
-      }
-      
-      const dbError = error as PostgresError;
-      
-      if (dbError.error.code === "22P02") throw new ScimRequestError({
+    if (!membership)
+      throw new ScimRequestError({
         detail: "User not found",
         status: 404
       });
-      
-      throw error;
-    }
-    
-    if (!user) throw new ScimRequestError({
-      detail: "User not found",
-      status: 404
+
+    if (!membership.scimEnabled)
+      throw new ScimRequestError({
+        detail: "SCIM is disabled for the organization",
+        status: 403
+      });
+
+    return buildScimUser({
+      userId: membership.userId as string,
+      firstName: membership.firstName as string,
+      lastName: membership.lastName as string,
+      email: membership.email,
+      active: true
     });
-    
-    return createScimUser({
-      userId: user.id,
-      firstName: user.firstName as string,
-      lastName: user.lastName as string,
-      email: user.email
-    });
-  }
-  
-  const createUser = async ({
-    firstName,
-    lastName,
-    email,
-    orgId
-  }: TCreateScimUserDTO) => {
+  };
+
+  const createScimUser = async ({ firstName, lastName, email, orgId }: TCreateScimUserDTO) => {
+    const org = await orgDAL.findById(orgId);
+
+    if (!org)
+      throw new ScimRequestError({
+        detail: "Organization not found",
+        status: 404
+      });
+
+    if (!org.scimEnabled)
+      throw new ScimRequestError({
+        detail: "SCIM is disabled for the organization",
+        status: 403
+      });
+
     let user = await userDAL.findOne({
       email
     });
-    
-    if (user) throw new ScimRequestError({
-      detail: "User already exists in the database",
-      status: 409
+
+    if (user) {
+      await userDAL.transaction(async (tx) => {
+        const [orgMembership] = await orgDAL.findMembership({ userId: user.id, orgId }, { tx });
+        if (orgMembership)
+          throw new ScimRequestError({
+            detail: "User already exists in the database",
+            status: 409
+          });
+
+        if (!orgMembership) {
+          await orgDAL.createMembership(
+            {
+              userId: user.id,
+              orgId,
+              inviteEmail: email,
+              role: OrgMembershipRole.Member,
+              status: OrgMembershipStatus.Invited
+            },
+            tx
+          );
+        }
+      });
+    } else {
+      user = await userDAL.transaction(async (tx) => {
+        const newUser = await userDAL.create(
+          {
+            email,
+            firstName,
+            lastName,
+            authMethods: [AuthMethod.EMAIL]
+          },
+          tx
+        );
+
+        await orgDAL.createMembership(
+          {
+            inviteEmail: email,
+            orgId,
+            userId: newUser.id,
+            role: OrgMembershipRole.Member,
+            status: OrgMembershipStatus.Invited
+          },
+          tx
+        );
+        return newUser;
+      });
+    }
+
+    const appCfg = getConfig();
+    await smtpService.sendMail({
+      template: SmtpTemplates.ScimUserProvisioned,
+      subjectLine: "Infisical organization invitation",
+      recipients: [email],
+      substitutions: {
+        organizationName: org.name,
+        callback_url: `${appCfg.SITE_URL}/api/v1/sso/redirect/saml2/organizations/${org.slug}`
+      }
     });
 
-    user = await userDAL.transaction(async (tx) => {
-      const newUser = await userDAL.create(
-        {
-          email,
-          firstName,
-          lastName,
-          authMethods: [AuthMethod.EMAIL]
-        },
-        tx
-      );
-      await orgDAL.createMembership({
-        inviteEmail: email,
-        orgId,
-        role: OrgMembershipRole.Member,
-        status: OrgMembershipStatus.Invited
-      });
-      return newUser;
-    });
-    
-    return createScimUser({
+    return buildScimUser({
       userId: user.id,
       firstName: user.firstName as string,
       lastName: user.lastName as string,
-      email: user.email
+      email: user.email,
+      active: true
     });
-  }
-  
+  };
+
+  const updateScimUser = async ({ userId, orgId, operations }: TUpdateScimUserDTO) => {
+    const [membership] = await orgDAL
+      .findMembership({
+        userId,
+        orgId
+      })
+      .catch(() => {
+        throw new ScimRequestError({
+          detail: "User not found",
+          status: 404
+        });
+      });
+
+    if (!membership)
+      throw new ScimRequestError({
+        detail: "User not found",
+        status: 404
+      });
+
+    if (!membership.scimEnabled)
+      throw new ScimRequestError({
+        detail: "SCIM is disabled for the organization",
+        status: 403
+      });
+
+    let active = true;
+
+    operations.forEach((operation) => {
+      if (operation.op.toLowerCase() === "replace") {
+        if (operation.path === "active" && operation.value === "False") {
+          // azure scim op format
+          active = false;
+        } else if (typeof operation.value === "object" && operation.value.active === false) {
+          // okta scim op format
+          active = false;
+        }
+      }
+    });
+
+    if (!active) {
+      await deleteOrgMembership({
+        orgMembershipId: membership.id,
+        orgId: membership.orgId,
+        orgDAL
+      });
+    }
+
+    return buildScimUser({
+      userId: membership.userId as string,
+      firstName: membership.firstName as string,
+      lastName: membership.lastName as string,
+      email: membership.email,
+      active
+    });
+  };
+
+  const replaceScimUser = async ({ userId, active, orgId }: TReplaceScimUserDTO) => {
+    const [membership] = await orgDAL
+      .findMembership({
+        userId,
+        orgId
+      })
+      .catch(() => {
+        throw new ScimRequestError({
+          detail: "User not found",
+          status: 404
+        });
+      });
+
+    if (!membership)
+      throw new ScimRequestError({
+        detail: "User not found",
+        status: 404
+      });
+
+    if (!membership.scimEnabled)
+      throw new ScimRequestError({
+        detail: "SCIM is disabled for the organization",
+        status: 403
+      });
+
+    if (!active) {
+      // tx
+      await deleteOrgMembership({
+        orgMembershipId: membership.id,
+        orgId: membership.orgId,
+        orgDAL
+      });
+    }
+
+    return buildScimUser({
+      userId: membership.userId as string,
+      firstName: membership.firstName as string,
+      lastName: membership.lastName as string,
+      email: membership.email,
+      active
+    });
+  };
+
   const fnValidateScimToken = async (token: TScimTokenJwtPayload) => {
-    // TODO: check expiry
-    
     const scimToken = await scimDAL.findById(token.scimTokenId);
     if (!scimToken) throw new UnauthorizedError();
-    
+
+    const { ttlDays, createdAt } = scimToken;
+
+    // ttl check
+    if (Number(ttlDays) > 0) {
+      const currentDate = new Date();
+      const scimTokenCreatedAt = new Date(createdAt);
+      const ttlInMilliseconds = Number(scimToken.ttlDays) * 86400;
+      const expirationDate = new Date(scimTokenCreatedAt.getTime() + ttlInMilliseconds);
+
+      if (currentDate > expirationDate)
+        throw new ScimRequestError({
+          detail: "The access token expired",
+          status: 401
+        });
+    }
+
     return { scimTokenId: scimToken.id, orgId: scimToken.orgId };
-  }
-  
-  return { 
+  };
+
+  return {
     createScimToken,
-    getScimTokens,
+    listScimTokens,
     deleteScimToken,
-    listUsers,
-    getUser,
-    createUser,
+    listScimUsers,
+    getScimUser,
+    createScimUser,
+    updateScimUser,
+    replaceScimUser,
     fnValidateScimToken
   };
 };

backend/src/ee/services/scim/scim-types.ts

@@ -1,41 +1,87 @@
 import { TOrgPermission } from "@app/lib/types";
-import { TScimUser } from "@app/lib/scim";
 
 export type TCreateScimTokenDTO = {
-    organizationId: string;
-    description: string;
-    ttl: number;
-} 
+  description: string;
+  ttlDays: number;
+} & TOrgPermission;
 
-// TODO: add org permissions
-// & Omit<TOrgPermission, "orgId">;
+export type TDeleteScimTokenDTO = {
+  scimTokenId: string;
+} & Omit<TOrgPermission, "orgId">;
+
+// SCIM server endpoint types
 
 export type TListScimUsersDTO = {
-    offset: number;
-    limit: number;
-    filter?: string;
-}
+  offset: number;
+  limit: number;
+  filter?: string;
+  orgId: string;
+};
 
-export type TListScimUsersRes = { // check naming here
-    schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"];
-    totalResults: number;
-    Resources: TScimUser[];
-    itemsPerPage: number;
-    startIndex: number;
-}
+export type TListScimUsers = {
+  schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"];
+  totalResults: number;
+  Resources: TScimUser[];
+  itemsPerPage: number;
+  startIndex: number;
+};
+
+export type TGetScimUserDTO = {
+  userId: string;
+  orgId: string;
+};
 
 export type TCreateScimUserDTO = {
-    email: string;
-    firstName: string;
-    lastName: string;
-    orgId: string;
-}
+  email: string;
+  firstName: string;
+  lastName: string;
+  orgId: string;
+};
 
-export type TCreateScimUserRes = {
-    schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"]
-}
+export type TUpdateScimUserDTO = {
+  userId: string;
+  orgId: string;
+  operations: {
+    op: string;
+    path?: string;
+    value?:
+      | string
+      | {
+          active: boolean;
+        };
+  }[];
+};
+
+export type TReplaceScimUserDTO = {
+  userId: string;
+  active: boolean;
+  orgId: string;
+};
 
 export type TScimTokenJwtPayload = {
-    scimTokenId: string;
-    authTokenType: string;
-};
+  scimTokenId: string;
+  authTokenType: string;
+};
+
+export type TScimUser = {
+  schemas: string[];
+  id: string;
+  userName: string;
+  displayName: string;
+  name: {
+    givenName: string;
+    middleName: null;
+    familyName: string;
+  };
+  emails: {
+    primary: boolean;
+    value: string;
+    type: string;
+  }[];
+  active: boolean;
+  groups: string[];
+  meta: {
+    resourceType: string;
+    location: null;
+  };
+};