Browse Source
Phase 1 of the SCIM v2 implementation - the deprovisioning core: - GET /scim/v2/<org>/Users with eq filters on userName/externalId (filter values are matched against the lowercased stored email, avoiding the Entra create-409-quarantine loop) plus startIndex/count pagination. - POST creates or links the user and invites: shell account for unknown emails, membership at Invited (Accepted when mail is off and the account already has credentials), invite mail with rollback on failure. Honors active:false on create by storing the membership pre-revoked. - PATCH handles Entra's active toggle in all observed shapes: op casing, string booleans, and the path-less value-object form. - PATCH active:false and DELETE both map to revoke, never delete: the row and akey survive so restore is lossless. Documented RFC deviation. - Last-confirmed-owner protection returns a SCIM 409 mutability error. - Restore re-runs the org policy check like restore_member_impl. - Unknown member ids and other orgs' member ids return identical 404s. - Audit events (invited/revoked/restored) recorded with a synthetic SCIM actor, following the admin panel's ACTING_ADMIN_USER precedent. - ScimJson data guard accepts application/scim+json bodies under the scim size limit; 413 catcher added. Tests: 24 new (unit: filter grammar, PatchOp quirks, status-offset table with the -126/-128 revocation encoding, regression canary on from_i32; integration: full lifecycle, duplicate 409s, last-owner 409, enumeration shape, born-disabled create). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>pull/7443/head
David Croft
4 days ago
8 changed files with 1254 additions and 12 deletions
@ -0,0 +1,93 @@ |
|||
//
|
|||
// Minimal SCIM filter parser, RFC 7644 section 3.4.2.2.
|
|||
//
|
|||
// Only the form Entra uses for existence checks is supported:
|
|||
// attribute eq "value"
|
|||
// Anything else (and/or, co, sw, grouping, valuePath) is rejected with
|
|||
// scimType invalidFilter. That is the correct signal for a partially
|
|||
// supported filter grammar; 501 would claim filtering is entirely absent.
|
|||
//
|
|||
use crate::api::scim::error::ScimError; |
|||
|
|||
#[derive(Debug, PartialEq, Eq)] |
|||
pub struct EqFilter { |
|||
// Lowercased: SCIM attribute names are case-insensitive (RFC 7643 s2.1).
|
|||
pub attribute: String, |
|||
pub value: String, |
|||
} |
|||
|
|||
pub fn parse_eq_filter(raw: &str) -> Result<EqFilter, ScimError> { |
|||
let unsupported = |
|||
|| ScimError::bad_request("invalidFilter", "Only filters of the form `attr eq \"value\"` are supported"); |
|||
|
|||
let trimmed = raw.trim(); |
|||
// Split "attr eq "value"" on whitespace, keeping the quoted tail intact.
|
|||
let (attribute, rest) = trimmed.split_once(char::is_whitespace).ok_or_else(unsupported)?; |
|||
let rest = rest.trim_start(); |
|||
let (operator, rest) = rest.split_once(char::is_whitespace).ok_or_else(unsupported)?; |
|||
if !operator.eq_ignore_ascii_case("eq") { |
|||
return Err(unsupported()); |
|||
} |
|||
|
|||
let quoted = rest.trim(); |
|||
let value = quoted.strip_prefix('"').and_then(|v| v.strip_suffix('"')).ok_or_else(unsupported)?; |
|||
if value.contains('"') || attribute.is_empty() || value.is_empty() { |
|||
return Err(unsupported()); |
|||
} |
|||
|
|||
Ok(EqFilter { |
|||
attribute: attribute.to_lowercase(), |
|||
value: value.to_owned(), |
|||
}) |
|||
} |
|||
|
|||
#[cfg(test)] |
|||
mod tests { |
|||
use super::*; |
|||
|
|||
fn parse(raw: &str) -> Result<EqFilter, ScimError> { |
|||
parse_eq_filter(raw) |
|||
} |
|||
|
|||
#[test] |
|||
fn parses_username_eq() { |
|||
let f = parse("userName eq \"john@example.com\"").expect("valid filter"); |
|||
assert_eq!(f.attribute, "username"); |
|||
assert_eq!(f.value, "john@example.com"); |
|||
} |
|||
|
|||
#[test] |
|||
fn parses_externalid_eq_case_insensitive_attr_and_op() { |
|||
let f = parse("ExternalId EQ \"abc-123\"").expect("valid filter"); |
|||
assert_eq!(f.attribute, "externalid"); |
|||
assert_eq!(f.value, "abc-123"); |
|||
} |
|||
|
|||
#[test] |
|||
fn value_may_contain_spaces() { |
|||
let f = parse("displayName eq \"Jane van Der Berg\"").expect("valid filter"); |
|||
assert_eq!(f.value, "Jane van Der Berg"); |
|||
} |
|||
|
|||
#[test] |
|||
fn rejects_unsupported_grammar() { |
|||
for raw in [ |
|||
"", |
|||
"userName", |
|||
"userName eq", |
|||
"userName eq unquoted", |
|||
"userName co \"x\"", |
|||
"userName sw \"x\"", |
|||
"userName eq \"a\" and active eq true", |
|||
"emails[type eq \"work\"].value eq \"x\"", |
|||
"userName eq \"broken", |
|||
"userName eq \"\"", |
|||
] { |
|||
let result = parse(raw); |
|||
match result { |
|||
Err(e) => assert_eq!(e.scim_type, Some("invalidFilter"), "wrong scimType for {raw:?}"), |
|||
Ok(f) => panic!("filter {raw:?} unexpectedly parsed to {f:?}"), |
|||
} |
|||
} |
|||
} |
|||
} |
|||
@ -0,0 +1,160 @@ |
|||
//
|
|||
// Serde models for SCIM request bodies, RFC 7643.
|
|||
//
|
|||
// Deliberately NOT #[serde(deny_unknown_fields)]: RFC 7643 section 2.1
|
|||
// requires service providers to ignore attributes they do not recognize, and
|
|||
// Entra sends several (addresses, phoneNumbers, preferredLanguage, ...).
|
|||
//
|
|||
use serde::Deserialize; |
|||
use serde_json::Value; |
|||
|
|||
// Entra sometimes sends booleans as strings ("True"/"False"), particularly in
|
|||
// PATCH values. Accept both without losing strictness for other types.
|
|||
#[derive(Clone, Copy, Debug, Deserialize)] |
|||
#[serde(try_from = "Value")] |
|||
pub struct ScimBool(pub bool); |
|||
|
|||
impl TryFrom<Value> for ScimBool { |
|||
type Error = String; |
|||
|
|||
fn try_from(value: Value) -> Result<Self, Self::Error> { |
|||
match value { |
|||
Value::Bool(b) => Ok(ScimBool(b)), |
|||
Value::String(s) => match s.to_lowercase().as_str() { |
|||
"true" => Ok(ScimBool(true)), |
|||
"false" => Ok(ScimBool(false)), |
|||
_ => Err(format!("not a boolean: {s:?}")), |
|||
}, |
|||
other => Err(format!("not a boolean: {other}")), |
|||
} |
|||
} |
|||
} |
|||
|
|||
#[derive(Debug, Default, Deserialize)] |
|||
#[serde(rename_all = "camelCase")] |
|||
pub struct ScimName { |
|||
pub given_name: Option<String>, |
|||
pub family_name: Option<String>, |
|||
pub formatted: Option<String>, |
|||
} |
|||
|
|||
#[derive(Debug, Deserialize)] |
|||
#[serde(rename_all = "camelCase")] |
|||
pub struct ScimEmail { |
|||
pub value: String, |
|||
#[serde(default)] |
|||
pub primary: bool, |
|||
} |
|||
|
|||
#[derive(Debug, Deserialize)] |
|||
#[serde(rename_all = "camelCase")] |
|||
pub struct ScimUserRequest { |
|||
pub user_name: Option<String>, |
|||
pub external_id: Option<String>, |
|||
pub display_name: Option<String>, |
|||
pub name: Option<ScimName>, |
|||
#[serde(default)] |
|||
pub emails: Vec<ScimEmail>, |
|||
pub active: Option<ScimBool>, |
|||
} |
|||
|
|||
impl ScimUserRequest { |
|||
// Entra maps userName to the login identifier; some tenants map the
|
|||
// routable address only into emails[]. Prefer userName when it looks like
|
|||
// an email, else fall back to the primary (or first) email value.
|
|||
pub fn email(&self) -> Option<&str> { |
|||
let user_name = self.user_name.as_deref().filter(|v| v.contains('@')); |
|||
let from_emails = |
|||
self.emails.iter().find(|e| e.primary).or_else(|| self.emails.first()).map(|e| e.value.as_str()); |
|||
user_name.or(from_emails) |
|||
} |
|||
|
|||
// Compose a display name the way the web vault shows members.
|
|||
pub fn display_name(&self) -> Option<String> { |
|||
if let Some(display_name) = &self.display_name { |
|||
return Some(display_name.clone()); |
|||
} |
|||
if let Some(name) = &self.name { |
|||
if let Some(formatted) = &name.formatted { |
|||
return Some(formatted.clone()); |
|||
} |
|||
let composed = match (&name.given_name, &name.family_name) { |
|||
(Some(given), Some(family)) => Some(format!("{given} {family}")), |
|||
(Some(given), None) => Some(given.clone()), |
|||
(None, Some(family)) => Some(family.clone()), |
|||
(None, None) => None, |
|||
}; |
|||
return composed; |
|||
} |
|||
None |
|||
} |
|||
} |
|||
|
|||
#[cfg(test)] |
|||
mod tests { |
|||
use super::*; |
|||
|
|||
#[test] |
|||
fn scim_bool_coerces_entra_strings() { |
|||
for (raw, expected) in [ |
|||
(json!(true), true), |
|||
(json!(false), false), |
|||
(json!("True"), true), |
|||
(json!("true"), true), |
|||
(json!("FALSE"), false), |
|||
(json!("false"), false), |
|||
] { |
|||
let b: ScimBool = serde_json::from_value(raw).expect("coercible"); |
|||
assert_eq!(b.0, expected); |
|||
} |
|||
for bad in [json!("yes"), json!(1), json!(null), json!({})] { |
|||
assert!(serde_json::from_value::<ScimBool>(bad).is_err()); |
|||
} |
|||
} |
|||
|
|||
#[test] |
|||
fn email_prefers_username_then_primary_email() { |
|||
let parsed: ScimUserRequest = serde_json::from_value(json!({ |
|||
"userName": "user@example.com", |
|||
"emails": [{"value": "other@example.com", "primary": true}], |
|||
})) |
|||
.expect("valid"); |
|||
assert_eq!(parsed.email(), Some("user@example.com")); |
|||
|
|||
// Non-email userName (a bare UPN-less identifier) falls back to emails.
|
|||
let parsed: ScimUserRequest = serde_json::from_value(json!({ |
|||
"userName": "just-an-id", |
|||
"emails": [{"value": "second@example.com"}, {"value": "first@example.com", "primary": true}], |
|||
})) |
|||
.expect("valid"); |
|||
assert_eq!(parsed.email(), Some("first@example.com")); |
|||
|
|||
let parsed: ScimUserRequest = serde_json::from_value(json!({})).expect("valid"); |
|||
assert_eq!(parsed.email(), None); |
|||
} |
|||
|
|||
#[test] |
|||
fn display_name_composition() { |
|||
let parsed: ScimUserRequest = serde_json::from_value(json!({ |
|||
"name": {"givenName": "Ada", "familyName": "Lovelace"}, |
|||
})) |
|||
.expect("valid"); |
|||
assert_eq!(parsed.display_name().as_deref(), Some("Ada Lovelace")); |
|||
|
|||
let parsed: ScimUserRequest = serde_json::from_value(json!({ |
|||
"displayName": "Display Wins", |
|||
"name": {"formatted": "Formatted Loses"}, |
|||
})) |
|||
.expect("valid"); |
|||
assert_eq!(parsed.display_name().as_deref(), Some("Display Wins")); |
|||
|
|||
// Unknown attributes are ignored per RFC 7643 section 2.1.
|
|||
let parsed: ScimUserRequest = serde_json::from_value(json!({ |
|||
"userName": "a@b.com", |
|||
"preferredLanguage": "en-US", |
|||
"addresses": [], |
|||
})) |
|||
.expect("unknown attrs must not fail"); |
|||
assert_eq!(parsed.email(), Some("a@b.com")); |
|||
} |
|||
} |
|||
@ -0,0 +1,159 @@ |
|||
//
|
|||
// SCIM PatchOp parsing, RFC 7644 section 3.5.2, restricted to what the User
|
|||
// endpoints support. Entra quirks handled here, all observed in real syncs:
|
|||
// - "op" arrives with any casing ("Replace", "Add").
|
|||
// - boolean values may arrive as strings ("True"/"False").
|
|||
// - an operation may have no "path", carrying a value object instead
|
|||
// ({"op":"replace","value":{"active":false}}).
|
|||
//
|
|||
use serde::Deserialize; |
|||
use serde_json::Value; |
|||
|
|||
use crate::api::scim::{error::ScimError, models::ScimBool}; |
|||
|
|||
pub const PATCH_OP_URN: &str = "urn:ietf:params:scim:api:messages:2.0:PatchOp"; |
|||
|
|||
#[derive(Debug, Deserialize)] |
|||
pub struct PatchOp { |
|||
#[serde(default)] |
|||
pub schemas: Vec<String>, |
|||
#[serde(rename = "Operations", default)] |
|||
pub operations: Vec<PatchOperation>, |
|||
} |
|||
|
|||
#[derive(Debug, Deserialize)] |
|||
pub struct PatchOperation { |
|||
pub op: String, |
|||
#[serde(default)] |
|||
pub path: Option<String>, |
|||
#[serde(default)] |
|||
pub value: Option<Value>, |
|||
} |
|||
|
|||
// What a User PATCH asked for, after normalization.
|
|||
#[derive(Debug, Default, PartialEq)] |
|||
pub struct UserPatch { |
|||
pub active: Option<bool>, |
|||
} |
|||
|
|||
pub fn parse_user_patch(patch: &PatchOp) -> Result<UserPatch, ScimError> { |
|||
if !patch.schemas.iter().any(|s| s == PATCH_OP_URN) { |
|||
return Err(ScimError::bad_request("invalidValue", "Missing PatchOp schema")); |
|||
} |
|||
if patch.operations.is_empty() { |
|||
return Err(ScimError::bad_request("invalidValue", "No operations provided")); |
|||
} |
|||
|
|||
let mut result = UserPatch::default(); |
|||
|
|||
for operation in &patch.operations { |
|||
let op = operation.op.to_lowercase(); |
|||
if op != "replace" && op != "add" { |
|||
return Err(ScimError::bad_request( |
|||
"invalidValue", |
|||
"Only add and replace operations are supported for Users", |
|||
)); |
|||
} |
|||
|
|||
match operation.path.as_deref() { |
|||
Some(op_path) if op_path.eq_ignore_ascii_case("active") => { |
|||
let value = operation.value.clone().unwrap_or(Value::Null); |
|||
result.active = Some(coerce_bool(value)?); |
|||
} |
|||
Some(_) => { |
|||
return Err(ScimError::bad_request("invalidPath", "Unsupported patch path")); |
|||
} |
|||
None => { |
|||
// Path-less form: the value is an object of attribute => value.
|
|||
let Some(Value::Object(map)) = operation.value.as_ref() else { |
|||
return Err(ScimError::bad_request( |
|||
"invalidValue", |
|||
"Operation without path must carry an object value", |
|||
)); |
|||
}; |
|||
for (attribute, value) in map { |
|||
if attribute.eq_ignore_ascii_case("active") { |
|||
result.active = Some(coerce_bool(value.clone())?); |
|||
} else { |
|||
return Err(ScimError::bad_request("invalidPath", "Unsupported patch attribute")); |
|||
} |
|||
} |
|||
} |
|||
} |
|||
} |
|||
|
|||
Ok(result) |
|||
} |
|||
|
|||
fn coerce_bool(value: Value) -> Result<bool, ScimError> { |
|||
serde_json::from_value::<ScimBool>(value) |
|||
.map(|b| b.0) |
|||
.map_err(|_| ScimError::bad_request("invalidValue", "Expected a boolean value for active")) |
|||
} |
|||
|
|||
#[cfg(test)] |
|||
mod tests { |
|||
use super::*; |
|||
|
|||
fn patch(payload: Value) -> Result<UserPatch, ScimError> { |
|||
let parsed: PatchOp = serde_json::from_value(payload).expect("valid PatchOp json"); |
|||
parse_user_patch(&parsed) |
|||
} |
|||
|
|||
fn ok_active(payload: Value) -> Option<bool> { |
|||
patch(payload).expect("expected parse to succeed").active |
|||
} |
|||
|
|||
#[test] |
|||
fn replace_active_with_path() { |
|||
let active = ok_active(json!({ |
|||
"schemas": [PATCH_OP_URN], |
|||
"Operations": [{"op": "replace", "path": "active", "value": false}], |
|||
})); |
|||
assert_eq!(active, Some(false)); |
|||
} |
|||
|
|||
#[test] |
|||
fn entra_casing_and_string_bool() { |
|||
let active = ok_active(json!({ |
|||
"schemas": [PATCH_OP_URN], |
|||
"Operations": [{"op": "Replace", "path": "active", "value": "False"}], |
|||
})); |
|||
assert_eq!(active, Some(false)); |
|||
} |
|||
|
|||
#[test] |
|||
fn pathless_value_object() { |
|||
let active = ok_active(json!({ |
|||
"schemas": [PATCH_OP_URN], |
|||
"Operations": [{"op": "replace", "value": {"active": "True"}}], |
|||
})); |
|||
assert_eq!(active, Some(true)); |
|||
} |
|||
|
|||
#[test] |
|||
fn rejects_bad_patches() { |
|||
for (payload, expected_type) in [ |
|||
( |
|||
json!({"schemas": [], "Operations": [{"op": "replace", "path": "active", "value": true}]}), |
|||
"invalidValue", |
|||
), |
|||
(json!({"schemas": [PATCH_OP_URN], "Operations": []}), "invalidValue"), |
|||
(json!({"schemas": [PATCH_OP_URN], "Operations": [{"op": "remove", "path": "active"}]}), "invalidValue"), |
|||
( |
|||
json!({"schemas": [PATCH_OP_URN], "Operations": [{"op": "replace", "path": "displayName", "value": "x"}]}), |
|||
"invalidPath", |
|||
), |
|||
( |
|||
json!({"schemas": [PATCH_OP_URN], "Operations": [{"op": "replace", "path": "active", "value": "maybe"}]}), |
|||
"invalidValue", |
|||
), |
|||
(json!({"schemas": [PATCH_OP_URN], "Operations": [{"op": "replace", "value": 3}]}), "invalidValue"), |
|||
] { |
|||
match patch(payload.clone()) { |
|||
Err(e) => assert_eq!(e.scim_type, Some(expected_type), "wrong scimType for {payload}"), |
|||
Ok(p) => panic!("patch {payload} unexpectedly parsed to {p:?}"), |
|||
} |
|||
} |
|||
} |
|||
} |
|||
@ -0,0 +1,373 @@ |
|||
//
|
|||
// SCIM /Users endpoints. The SCIM User id is the org-membership uuid
|
|||
// (MembershipId), not the global user uuid: SCIM is org-scoped and one person
|
|||
// can belong to several organizations.
|
|||
//
|
|||
// Deprovisioning maps to REVOKE, never delete: the membership row and its
|
|||
// akey survive, so restore is lossless and needs no re-confirmation. This is
|
|||
// a deliberate deviation from RFC 7644 DELETE semantics, matching the
|
|||
// existing Directory Connector import endpoint, and it means a compromised
|
|||
// SCIM token cannot destroy memberships.
|
|||
//
|
|||
// Provisioning creates at most Invited (or Accepted when mail is disabled
|
|||
// and the user already has credentials). Confirmed requires an admin client
|
|||
// to wrap the org key for the member; no server-side path can do that.
|
|||
//
|
|||
use rocket::Route; |
|||
use serde_json::Value; |
|||
|
|||
use crate::{ |
|||
CONFIG, |
|||
api::{ |
|||
EmptyResult, |
|||
core::log_event, |
|||
scim::{ |
|||
ScimJson, ScimResponse, |
|||
error::ScimError, |
|||
filter::parse_eq_filter, |
|||
guard::ScimToken, |
|||
models::ScimUserRequest, |
|||
patch::{PatchOp, parse_user_patch}, |
|||
}, |
|||
}, |
|||
db::{ |
|||
DbConn, |
|||
models::{ |
|||
EventType, Invitation, Membership, MembershipId, MembershipStatus, MembershipType, OrgPolicy, Organization, |
|||
User, |
|||
}, |
|||
}, |
|||
mail, |
|||
util::is_valid_email, |
|||
}; |
|||
|
|||
pub fn routes() -> Vec<Route> { |
|||
routes![list_users, get_user, post_user, patch_user, delete_user] |
|||
} |
|||
|
|||
// Synthetic acting user recorded in the org event log for SCIM-driven
|
|||
// changes, following the ACTING_ADMIN_USER precedent in the admin panel.
|
|||
const SCIM_ACTOR: &str = "vaultwarden-scim-00000-000000000000"; |
|||
// Device type recorded for SCIM events: 14 = UnknownBrowser, same as admin.
|
|||
const SCIM_DEVICE_TYPE: i32 = 14; |
|||
|
|||
// The single place the revocation encoding is interpreted: revoked statuses
|
|||
// are stored as status - 128 (ACTIVATE_REVOKE_DIFF), so every stored revoked
|
|||
// value is <= Revoked (-1). Never compare equality against Revoked.
|
|||
fn membership_active(member: &Membership) -> bool { |
|||
member.status > MembershipStatus::Revoked as i32 |
|||
} |
|||
|
|||
fn to_scim_user(member: &Membership, user: &User, token: &ScimToken) -> Value { |
|||
let location = format!("{}/scim/v2/{}/Users/{}", CONFIG.domain(), token.org_uuid, member.uuid); |
|||
json!({ |
|||
"schemas": [crate::api::scim::discovery::USER_SCHEMA_URN], |
|||
"id": member.uuid, |
|||
"externalId": member.external_id, |
|||
"userName": user.email, |
|||
"displayName": user.name, |
|||
"active": membership_active(member), |
|||
"emails": [{"value": user.email, "primary": true, "type": "work"}], |
|||
"meta": { |
|||
"resourceType": "User", |
|||
"location": location, |
|||
}, |
|||
}) |
|||
} |
|||
|
|||
async fn log_scim_event(event_type: EventType, member: &Membership, token: &ScimToken, conn: &DbConn) { |
|||
log_event( |
|||
event_type as i32, |
|||
&member.uuid, |
|||
&token.org_uuid, |
|||
&SCIM_ACTOR.into(), |
|||
SCIM_DEVICE_TYPE, |
|||
&token.ip.ip, |
|||
conn, |
|||
) |
|||
.await; |
|||
} |
|||
|
|||
fn list_response(total: usize, start_index: usize, resources: &[Value]) -> ScimResponse { |
|||
ScimResponse::ok(json!({ |
|||
"schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"], |
|||
"totalResults": total, |
|||
"itemsPerPage": resources.len(), |
|||
"startIndex": start_index, |
|||
"Resources": resources, |
|||
})) |
|||
} |
|||
|
|||
#[derive(FromForm)] |
|||
pub struct ListParams { |
|||
filter: Option<String>, |
|||
#[field(name = "startIndex")] |
|||
start_index: Option<i64>, |
|||
count: Option<i64>, |
|||
} |
|||
|
|||
#[get("/v2/<_>/Users?<params..>")] |
|||
async fn list_users(params: ListParams, token: ScimToken, conn: DbConn) -> Result<ScimResponse, ScimError> { |
|||
// Resolve the matching memberships first, then paginate.
|
|||
let members: Vec<Membership> = if let Some(raw_filter) = params.filter.as_deref() { |
|||
let eq = parse_eq_filter(raw_filter)?; |
|||
match eq.attribute.as_str() { |
|||
// find_by_mail lowercases internally, so a mixed-case userName
|
|||
// from Entra still matches the lowercased stored email.
|
|||
"username" | "emails.value" => match User::find_by_mail(&eq.value, &conn).await { |
|||
Some(user) => { |
|||
Membership::find_by_user_and_org(&user.uuid, &token.org_uuid, &conn).await.into_iter().collect() |
|||
} |
|||
None => Vec::new(), |
|||
}, |
|||
"externalid" => { |
|||
Membership::find_by_external_id_and_org(&eq.value, &token.org_uuid, &conn).await.into_iter().collect() |
|||
} |
|||
_ => { |
|||
return Err(ScimError::bad_request( |
|||
"invalidFilter", |
|||
"Filterable attributes are userName and externalId", |
|||
)); |
|||
} |
|||
} |
|||
} else { |
|||
Membership::find_by_org(&token.org_uuid, &conn).await |
|||
}; |
|||
|
|||
let total = members.len(); |
|||
let start_index = usize::try_from(params.start_index.unwrap_or(1)).unwrap_or(1).max(1); |
|||
let count = usize::try_from(params.count.unwrap_or(100)).unwrap_or(0).min(200); |
|||
|
|||
let mut resources = Vec::new(); |
|||
for member in members.into_iter().skip(start_index - 1).take(count) { |
|||
// A membership always references a user; a missing row would be a
|
|||
// dangling foreign key, so surface it as a 500 rather than skip.
|
|||
let Some(user) = User::find_by_uuid(&member.user_uuid, &conn).await else { |
|||
return Err(ScimError::internal()); |
|||
}; |
|||
resources.push(to_scim_user(&member, &user, &token)); |
|||
} |
|||
|
|||
Ok(list_response(total, start_index, &resources)) |
|||
} |
|||
|
|||
#[get("/v2/<_>/Users/<member_id>")] |
|||
async fn get_user(member_id: MembershipId, token: ScimToken, conn: DbConn) -> Result<ScimResponse, ScimError> { |
|||
let Some(member) = Membership::find_by_uuid_and_org(&member_id, &token.org_uuid, &conn).await else { |
|||
return Err(ScimError::not_found()); |
|||
}; |
|||
let Some(user) = User::find_by_uuid(&member.user_uuid, &conn).await else { |
|||
return Err(ScimError::internal()); |
|||
}; |
|||
Ok(ScimResponse::ok(to_scim_user(&member, &user, &token))) |
|||
} |
|||
|
|||
#[post("/v2/<_>/Users", data = "<data>")] |
|||
async fn post_user(data: ScimJson<ScimUserRequest>, token: ScimToken, conn: DbConn) -> Result<ScimResponse, ScimError> { |
|||
let request = data.0; |
|||
|
|||
let Some(email) = request.email() else { |
|||
return Err(ScimError::bad_request("invalidValue", "userName (or a primary email) must be an email address")); |
|||
}; |
|||
if !is_valid_email(email) { |
|||
return Err(ScimError::bad_request("invalidValue", "userName is not a valid email address")); |
|||
} |
|||
|
|||
// Uniqueness: by externalId and by email, both scoped to the org.
|
|||
if let Some(external_id) = request.external_id.as_deref() |
|||
&& Membership::find_by_external_id_and_org(external_id, &token.org_uuid, &conn).await.is_some() |
|||
{ |
|||
return Err(ScimError::conflict("uniqueness", "A member with this externalId already exists")); |
|||
} |
|||
if Membership::find_by_email_and_org(email, &token.org_uuid, &conn).await.is_some() { |
|||
return Err(ScimError::conflict("uniqueness", "A member with this userName already exists")); |
|||
} |
|||
|
|||
let Some(org) = Organization::find_by_uuid(&token.org_uuid, &conn).await else { |
|||
return Err(ScimError::internal()); |
|||
}; |
|||
|
|||
// Mirrors the Directory Connector import: link an existing account by
|
|||
// email, or create a shell account (no keypair yet) that the invite email
|
|||
// lets the person register.
|
|||
let mut user_created = false; |
|||
let user = if let Some(user) = User::find_by_mail(email, &conn).await { |
|||
user |
|||
} else { |
|||
let mut new_user = User::new(email, request.display_name()); |
|||
new_user.save(&conn).await.map_err(|_| ScimError::internal())?; |
|||
if !CONFIG.mail_enabled() { |
|||
Invitation::new(&new_user.email).save(&conn).await.map_err(|_| ScimError::internal())?; |
|||
} |
|||
user_created = true; |
|||
new_user |
|||
}; |
|||
|
|||
// Reaching Accepted directly is only possible when no invite mail will be
|
|||
// sent and the account already has credentials to log in with.
|
|||
let member_status = if CONFIG.mail_enabled() || user.password_hash.is_empty() { |
|||
MembershipStatus::Invited as i32 |
|||
} else { |
|||
MembershipStatus::Accepted as i32 |
|||
}; |
|||
|
|||
// RFC 7644 allows creating a resource already deactivated; store the
|
|||
// membership pre-revoked and send no invite mail in that case.
|
|||
let create_active = request.active.is_none_or(|b| b.0); |
|||
|
|||
let mut member = Membership::new(user.uuid.clone(), token.org_uuid.clone(), Some(org.billing_email.clone())); |
|||
member.set_external_id(request.external_id.clone()); |
|||
member.access_all = false; |
|||
member.atype = MembershipType::User as i32; |
|||
member.status = member_status; |
|||
if !create_active { |
|||
member.revoke(); |
|||
} |
|||
member.save(&conn).await.map_err(|_| ScimError::internal())?; |
|||
|
|||
if create_active |
|||
&& CONFIG.mail_enabled() |
|||
&& let Err(e) = mail::send_invite( |
|||
&user, |
|||
token.org_uuid.clone(), |
|||
member.uuid.clone(), |
|||
&org.name, |
|||
Some(org.billing_email.clone()), |
|||
) |
|||
.await |
|||
{ |
|||
error!("SCIM provisioning rollback, invite mail failed: {e:#?}"); |
|||
let rollback: EmptyResult = if user_created { |
|||
user.delete(&conn).await |
|||
} else { |
|||
member.delete(&conn).await |
|||
}; |
|||
drop(rollback); |
|||
return Err(ScimError::internal()); |
|||
} |
|||
|
|||
log_scim_event(EventType::OrganizationUserInvited, &member, &token, &conn).await; |
|||
if !create_active { |
|||
log_scim_event(EventType::OrganizationUserRevoked, &member, &token, &conn).await; |
|||
} |
|||
|
|||
let location = format!("{}/scim/v2/{}/Users/{}", CONFIG.domain(), token.org_uuid, member.uuid); |
|||
Ok(ScimResponse::created(location, to_scim_user(&member, &user, &token))) |
|||
} |
|||
|
|||
#[patch("/v2/<_>/Users/<member_id>", data = "<data>")] |
|||
async fn patch_user( |
|||
member_id: MembershipId, |
|||
data: ScimJson<PatchOp>, |
|||
token: ScimToken, |
|||
conn: DbConn, |
|||
) -> Result<ScimResponse, ScimError> { |
|||
let Some(mut member) = Membership::find_by_uuid_and_org(&member_id, &token.org_uuid, &conn).await else { |
|||
return Err(ScimError::not_found()); |
|||
}; |
|||
|
|||
let patch = parse_user_patch(&data.0)?; |
|||
let Some(desired_active) = patch.active else { |
|||
return Err(ScimError::bad_request("invalidValue", "No supported attributes in patch (supported: active)")); |
|||
}; |
|||
|
|||
if desired_active { |
|||
restore_member(&mut member, &token, &conn).await?; |
|||
} else { |
|||
revoke_member(&mut member, &token, &conn).await?; |
|||
} |
|||
|
|||
let Some(user) = User::find_by_uuid(&member.user_uuid, &conn).await else { |
|||
return Err(ScimError::internal()); |
|||
}; |
|||
Ok(ScimResponse::ok(to_scim_user(&member, &user, &token))) |
|||
} |
|||
|
|||
// DELETE deprovisions by revoking, identically to PATCH active:false. The
|
|||
// membership row is kept: see the module comment.
|
|||
#[delete("/v2/<_>/Users/<member_id>")] |
|||
async fn delete_user(member_id: MembershipId, token: ScimToken, conn: DbConn) -> Result<ScimResponse, ScimError> { |
|||
let Some(mut member) = Membership::find_by_uuid_and_org(&member_id, &token.org_uuid, &conn).await else { |
|||
return Err(ScimError::not_found()); |
|||
}; |
|||
revoke_member(&mut member, &token, &conn).await?; |
|||
Ok(ScimResponse::no_content()) |
|||
} |
|||
|
|||
async fn revoke_member(member: &mut Membership, token: &ScimToken, conn: &DbConn) -> Result<(), ScimError> { |
|||
if !membership_active(member) { |
|||
// Already revoked: deprovisioning is idempotent.
|
|||
return Ok(()); |
|||
} |
|||
|
|||
// Never leave an organization without a confirmed owner.
|
|||
if member.atype == MembershipType::Owner |
|||
&& member.status == MembershipStatus::Confirmed as i32 |
|||
&& Membership::count_confirmed_by_org_and_type(&token.org_uuid, MembershipType::Owner, conn).await <= 1 |
|||
{ |
|||
return Err(ScimError::conflict("mutability", "Cannot revoke the last confirmed owner of the organization")); |
|||
} |
|||
|
|||
member.revoke(); |
|||
member.save(conn).await.map_err(|_| ScimError::internal())?; |
|||
log_scim_event(EventType::OrganizationUserRevoked, member, token, conn).await; |
|||
Ok(()) |
|||
} |
|||
|
|||
async fn restore_member(member: &mut Membership, token: &ScimToken, conn: &DbConn) -> Result<(), ScimError> { |
|||
if membership_active(member) { |
|||
return Ok(()); |
|||
} |
|||
|
|||
member.restore(); |
|||
// Policy check runs on the restored status, mirroring restore_member_impl.
|
|||
if OrgPolicy::check_user_allowed(member, "restore", conn).await.is_err() { |
|||
return Err(ScimError::bad_request("invalidValue", "Restore is blocked by an organization policy")); |
|||
} |
|||
member.save(conn).await.map_err(|_| ScimError::internal())?; |
|||
log_scim_event(EventType::OrganizationUserRestored, member, token, conn).await; |
|||
Ok(()) |
|||
} |
|||
|
|||
#[cfg(test)] |
|||
mod tests { |
|||
use super::*; |
|||
|
|||
fn member_with_status(status: i32) -> Membership { |
|||
let mut member = Membership::new("test-user".to_owned().into(), "test-org".to_owned().into(), None); |
|||
member.status = status; |
|||
member |
|||
} |
|||
|
|||
#[test] |
|||
fn active_mapping_handles_revocation_offsets() { |
|||
// Stored revoked values are status - 128; Revoked (-1) itself is a
|
|||
// sentinel that never hits the database.
|
|||
for (status, expected_active) in [(2, true), (1, true), (0, true), (-126, false), (-127, false), (-128, false)] |
|||
{ |
|||
assert_eq!(membership_active(&member_with_status(status)), expected_active, "status {status}"); |
|||
} |
|||
} |
|||
|
|||
#[test] |
|||
fn revoke_restore_arithmetic_round_trips() { |
|||
for initial in [0, 1, 2] { |
|||
let mut member = member_with_status(initial); |
|||
assert!(member.revoke()); |
|||
assert_eq!(member.status, initial - 128); |
|||
assert!(!member.revoke(), "revoke must be idempotent"); |
|||
assert!(member.restore()); |
|||
assert_eq!(member.status, initial); |
|||
assert!(!member.restore(), "restore must be idempotent"); |
|||
} |
|||
} |
|||
|
|||
#[test] |
|||
fn from_i32_still_rejects_revoked_values() { |
|||
// Regression canary: OrgHeaders relies on revoked statuses mapping to
|
|||
// None. If upstream ever changes this, revisit membership_active().
|
|||
assert!(MembershipStatus::from_i32(-126).is_none()); |
|||
assert!(MembershipStatus::from_i32(-128).is_none()); |
|||
assert!(MembershipStatus::from_i32(-1).is_none()); |
|||
} |
|||
} |
|||
Loading…
Reference in new issue