feat(scim): store a per-provider SCIM token hash

Author: xlgmokha

internal/api/scim/core/core.go

@@ -0,0 +1,8 @@
+// Package core implements the SCIM 2.0 core schema defined in RFC 7643.
+package core
+
+// SchemaURI identifies a SCIM schema
+type SchemaURI string
+
+// ResourceTypeName names a resource type
+type ResourceTypeName string

internal/api/scim/core/endpoints.go

@@ -0,0 +1,6 @@
+package core
+
+// The resource endpoints of RFC 7644, Section 3.2, relative to the base URL
+const (
+	EndpointServiceProviderConfig = "/ServiceProviderConfig"
+)

internal/api/scim/core/meta.go

@@ -0,0 +1,14 @@
+package core
+
+// Meta is the resource metadata common attribute defined in RFC 7643, Section 3.1.
+type Meta struct {
+	ResourceType ResourceTypeName `json:"resourceType"`
+	Location     string           `json:"location,omitempty"`
+}
+
+func NewMeta(baseURL string, resourceType ResourceTypeName, endpoint string) Meta {
+	return Meta{
+		ResourceType: resourceType,
+		Location:     baseURL + endpoint,
+	}
+}

internal/api/scim/core/meta_test.go

@@ -0,0 +1,39 @@
+package core
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewMeta(t *testing.T) {
+	t.Run("locates the resource at its endpoint", func(t *testing.T) {
+		meta := NewMeta("http://localhost:9999/scim/v2", ResourceTypeServiceProviderConfig, EndpointServiceProviderConfig)
+
+		require.Equal(t, ResourceTypeServiceProviderConfig, meta.ResourceType)
+		require.Equal(t, "http://localhost:9999/scim/v2/ServiceProviderConfig", meta.Location)
+	})
+}
+
+func TestMeta(t *testing.T) {
+	t.Run("serializes to JSON correctly", func(t *testing.T) {
+		body, err := json.Marshal(Meta{
+			ResourceType: ResourceTypeServiceProviderConfig,
+			Location:     "http://localhost:9999/scim/v2/ServiceProviderConfig",
+		})
+
+		require.NoError(t, err)
+		require.JSONEq(t, `{
+			"resourceType": "ServiceProviderConfig",
+			"location": "http://localhost:9999/scim/v2/ServiceProviderConfig"
+		}`, string(body))
+	})
+
+	t.Run("omits the location when it is empty", func(t *testing.T) {
+		body, err := json.Marshal(Meta{ResourceType: ResourceTypeServiceProviderConfig})
+
+		require.NoError(t, err)
+		require.JSONEq(t, `{"resourceType": "ServiceProviderConfig"}`, string(body))
+	})
+}

internal/api/scim/core/schemas.go

@@ -0,0 +1,13 @@
+package core
+
+// The schema URIs of RFC 7643
+const (
+	schemaRoot = "urn:ietf:params:scim:schemas"
+	schemaCore = schemaRoot + ":core:2.0"
+
+	SchemaServiceProviderConfig SchemaURI = schemaCore + ":ServiceProviderConfig"
+)
+
+const (
+	ResourceTypeServiceProviderConfig ResourceTypeName = "ServiceProviderConfig"
+)

internal/api/scim/core/service_provider_config.go

@@ -0,0 +1,70 @@
+package core
+
+type SupportedFeature struct {
+	Supported bool `json:"supported"`
+}
+
+type BulkFeature struct {
+	Supported      bool `json:"supported"`
+	MaxOperations  int  `json:"maxOperations"`
+	MaxPayloadSize int  `json:"maxPayloadSize"`
+}
+
+type FilterFeature struct {
+	Supported  bool `json:"supported"`
+	MaxResults int  `json:"maxResults"`
+}
+
+type AuthenticationSchemeType string
+
+const (
+	AuthenticationSchemeOAuthBearerToken AuthenticationSchemeType = "oauthbearertoken"
+)
+
+// AuthenticationScheme is the authentication scheme of RFC 7643, Section 5.
+type AuthenticationScheme struct {
+	Type        AuthenticationSchemeType `json:"type"`
+	Name        string                   `json:"name"`
+	Description string                   `json:"description"`
+	SpecURI     string                   `json:"specUri,omitempty"`
+	Primary     bool                     `json:"primary"`
+}
+
+func NewOAuthBearerToken() *AuthenticationScheme {
+	return &AuthenticationScheme{
+		Type:        AuthenticationSchemeOAuthBearerToken,
+		Name:        "OAuth Bearer Token",
+		Description: "Authentication scheme using the OAuth Bearer Token Standard",
+		SpecURI:     "http://www.rfc-editor.org/info/rfc6750",
+	}
+}
+
+func (scheme *AuthenticationScheme) AsPrimary() *AuthenticationScheme {
+	scheme.Primary = true
+	return scheme
+}
+
+// ServiceProviderConfig is the schema defined in RFC 7643, Section 5.
+type ServiceProviderConfig struct {
+	Schemas               []SchemaURI             `json:"schemas"`
+	Patch                 SupportedFeature        `json:"patch"`
+	Bulk                  BulkFeature             `json:"bulk"`
+	Filter                FilterFeature           `json:"filter"`
+	ChangePassword        SupportedFeature        `json:"changePassword"`
+	Sort                  SupportedFeature        `json:"sort"`
+	ETag                  SupportedFeature        `json:"etag"`
+	AuthenticationSchemes []*AuthenticationScheme `json:"authenticationSchemes"`
+	Meta                  Meta                    `json:"meta"`
+}
+
+func NewServiceProviderConfig(baseURL string, schemes ...*AuthenticationScheme) *ServiceProviderConfig {
+	if schemes == nil {
+		schemes = []*AuthenticationScheme{}
+	}
+
+	return &ServiceProviderConfig{
+		Schemas:               []SchemaURI{SchemaServiceProviderConfig},
+		AuthenticationSchemes: schemes,
+		Meta:                  NewMeta(baseURL, ResourceTypeServiceProviderConfig, EndpointServiceProviderConfig),
+	}
+}

internal/api/scim/core/service_provider_config_test.go

@@ -0,0 +1,66 @@
+package core
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewServiceProviderConfig(t *testing.T) {
+	t.Run("advertises the schemes the caller declares", func(t *testing.T) {
+		scheme := NewOAuthBearerToken().AsPrimary()
+
+		config := NewServiceProviderConfig("", scheme)
+
+		require.Equal(t, []SchemaURI{SchemaServiceProviderConfig}, config.Schemas)
+		require.Equal(t, []*AuthenticationScheme{scheme}, config.AuthenticationSchemes)
+	})
+
+	t.Run("identifies itself with resource metadata", func(t *testing.T) {
+		baseURL := "http://localhost:9999/scim/v2"
+
+		config := NewServiceProviderConfig(baseURL)
+
+		require.Equal(t, ResourceTypeServiceProviderConfig, config.Meta.ResourceType)
+		require.Equal(t, baseURL+EndpointServiceProviderConfig, config.Meta.Location)
+	})
+
+	t.Run("supports none of the optional protocol features", func(t *testing.T) {
+		config := NewServiceProviderConfig("")
+
+		assert.False(t, config.Patch.Supported)
+		assert.False(t, config.Bulk.Supported)
+		assert.False(t, config.Filter.Supported)
+		assert.False(t, config.ChangePassword.Supported)
+		assert.False(t, config.Sort.Supported)
+		assert.False(t, config.ETag.Supported)
+	})
+
+	t.Run("serializes authenticationSchemes as an array", func(t *testing.T) {
+		body, err := json.Marshal(NewServiceProviderConfig(""))
+
+		require.NoError(t, err)
+		require.Contains(t, string(body), `"authenticationSchemes":[]`)
+	})
+}
+
+func TestAuthenticationScheme(t *testing.T) {
+	t.Run("NewOAuthBearerToken", func(t *testing.T) {
+		scheme := NewOAuthBearerToken()
+
+		assert.Equal(t, AuthenticationSchemeOAuthBearerToken, scheme.Type)
+		assert.Equal(t, "OAuth Bearer Token", scheme.Name)
+		assert.Equal(t, "Authentication scheme using the OAuth Bearer Token Standard", scheme.Description)
+		assert.Equal(t, "http://www.rfc-editor.org/info/rfc6750", scheme.SpecURI)
+		assert.False(t, scheme.Primary)
+	})
+
+	t.Run("AsPrimary marks the scheme primary", func(t *testing.T) {
+		scheme := NewOAuthBearerToken()
+
+		require.Same(t, scheme, scheme.AsPrimary())
+		assert.True(t, scheme.Primary)
+	})
+}

internal/api/scim/protocol/error_test.go

@@ -9,18 +9,18 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+const notFoundError = `{
+	"schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
+	"status": "404",
+	"detail": "Endpoint or resource does not exist"
+}`
+
 func TestNewError(t *testing.T) {
 	t.Run("serializes to JSON correctly", func(t *testing.T) {
 		body, err := json.Marshal(NewError(http.StatusNotFound, "", "Endpoint or resource does not exist"))
 
 		require.NoError(t, err)
-		assert.JSONEq(t, `{
-			"schemas": [
-				"urn:ietf:params:scim:api:messages:2.0:Error"
-			],
-			"status": "404",
-			"detail": "Endpoint or resource does not exist"
-		}`, string(body))
+		assert.JSONEq(t, notFoundError, string(body))
 	})
 
 	t.Run("includes the scimType when one is given", func(t *testing.T) {

internal/api/scim/protocol/list_response.go

@@ -0,0 +1,25 @@
+package protocol
+
+const SchemaListResponse = "urn:ietf:params:scim:api:messages:2.0:ListResponse"
+
+type ListResponse[T any] struct {
+	Schemas      []string `json:"schemas"`
+	TotalResults int      `json:"totalResults"`
+	StartIndex   int      `json:"startIndex"`
+	ItemsPerPage int      `json:"itemsPerPage"`
+	Resources    []T      `json:"Resources"`
+}
+
+func NewListResponse[T any](resources []T) *ListResponse[T] {
+	if resources == nil {
+		resources = []T{}
+	}
+	n := len(resources)
+	return &ListResponse[T]{
+		Schemas:      []string{SchemaListResponse},
+		TotalResults: n,
+		StartIndex:   1,
+		ItemsPerPage: n,
+		Resources:    resources,
+	}
+}

internal/api/scim/protocol/list_response_test.go

@@ -0,0 +1,53 @@
+package protocol
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+const emptyListResponse = `{
+	"schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+	"totalResults": 0,
+	"startIndex": 1,
+	"itemsPerPage": 0,
+	"Resources": []
+}`
+
+func TestNewListResponse(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		resources []string
+		expected  string
+	}{
+		{
+			name:      "nil resources marshal to an empty array",
+			resources: nil,
+			expected:  emptyListResponse,
+		},
+		{
+			name:      "empty resources marshal to an empty array",
+			resources: []string{},
+			expected:  emptyListResponse,
+		},
+		{
+			name:      "populated resources are counted",
+			resources: []string{"a", "b"},
+			expected: `{
+				"schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+				"totalResults": 2,
+				"startIndex": 1,
+				"itemsPerPage": 2,
+				"Resources": ["a", "b"]
+			}`,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			body, err := json.Marshal(NewListResponse(tc.resources))
+
+			require.NoError(t, err)
+			require.JSONEq(t, tc.expected, string(body))
+		})
+	}
+}