feat(scim): SCIM /Users endpoints and bearer-token middleware

Author: xlgmokha

internal/api/api.go

@@ -138,7 +138,7 @@ func NewAPIWithVersion(globalConfig *conf.GlobalConfiguration, db *storage.Conne
 		api.oauthServer = oauthserver.NewServer(globalConfig, db, api.tokenService)
 	}
 
-	api.scim = scim.NewServer(globalConfig)
+	api.scim = scim.NewServer(db, globalConfig.API.ExternalURL)
 
 	if api.config.Password.HIBP.Enabled {
 		httpClient := &http.Client{
@@ -457,7 +457,16 @@ func NewAPIWithVersion(globalConfig *conf.GlobalConfiguration, db *storage.Conne
 
 			r.Get("/ServiceProviderConfig", api.scim.ServiceProviderConfig)
 			r.Get("/ResourceTypes", api.scim.ResourceTypes)
+			r.Get("/ResourceTypes/{id}", api.scim.ResourceTypeByID)
 			r.Get("/Schemas", api.scim.Schemas)
+			r.Get("/Schemas/{id}", api.scim.SchemaByID)
+
+			tenant := r.WithBypass(api.scim.Tenant)
+			tenant.Get("/Users", api.scim.Users)
+			tenant.Post("/Users", api.scim.CreateUser)
+			tenant.Get("/Users/{id}", api.scim.UserByID)
+			tenant.Put("/Users/{id}", api.scim.ReplaceUser)
+			tenant.Delete("/Users/{id}", api.scim.DeleteUser)
 		})
 	})
 

internal/api/scim/helpers_test.go

@@ -0,0 +1,107 @@
+package scim
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/gofrs/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/supabase/auth/internal/api/scim/core"
+	"github.com/supabase/auth/internal/conf/confload"
+	"github.com/supabase/auth/internal/storage"
+	"github.com/supabase/auth/internal/storage/test"
+)
+
+const scimTestConfig = "../../../hack/test.env"
+
+const testExternalURL = "http://localhost:9999"
+
+func newTestDB(t *testing.T) *storage.Connection {
+	t.Helper()
+
+	globalConfig, err := confload.LoadGlobal(scimTestConfig)
+	require.NoError(t, err)
+
+	conn, err := test.SetupDBConnection(globalConfig)
+	require.NoError(t, err)
+
+	return conn
+}
+
+func newTenant(t *testing.T, db *storage.Connection) string {
+	t.Helper()
+
+	id := uuid.Must(uuid.NewV4()).String()
+	require.NoError(t, db.RawQuery("INSERT INTO sso_providers (id, resource_id, created_at, updated_at) VALUES (?, ?, now(), now())", id, "scim-test-"+id).Exec())
+
+	t.Cleanup(func() {
+		_ = db.RawQuery("DELETE FROM sso_providers WHERE id = ?", id).Exec()
+	})
+
+	return id
+}
+
+func putUser(t *testing.T, db *storage.Connection, tenant string, user *core.User) {
+	t.Helper()
+
+	stored := *user
+	stored.ID, stored.Meta = "", core.Meta{}
+
+	document, err := json.Marshal(&stored)
+	require.NoError(t, err)
+
+	require.NoError(t, db.RawQuery(
+		"INSERT INTO scim_users (id, sso_provider_id, resource, created_at, updated_at)"+
+			" VALUES (?, ?, ?, ?, ?)",
+		user.ID, tenant, string(document), user.Meta.Created, user.Meta.LastModified,
+	).Exec())
+}
+
+func newStoredUser(t *testing.T, db *storage.Connection, tenant string, user *core.User) *core.User {
+	t.Helper()
+
+	if user.ID == "" {
+		user.ID = uuid.Must(uuid.NewV4()).String()
+	}
+	putUser(t, db, tenant, user)
+	return user
+}
+
+func newTestRepo(db *storage.Connection) *userRepository {
+	return &userRepository{db: db, baseURL: core.Join(testExternalURL, BasePath)}
+}
+
+func ctxFor(tenant string) context.Context {
+	return withTenant(context.Background(), tenant)
+}
+
+func seedPostgres(t *testing.T, users []*core.User) (Repository[*core.User], context.Context) {
+	db := newTestDB(t)
+	owner := newTenant(t, db)
+	for _, user := range users {
+		putUser(t, db, owner, user)
+	}
+	return newTestRepo(db), ctxFor(owner)
+}
+
+func grantToken(t *testing.T, db *storage.Connection, provider string) string {
+	t.Helper()
+
+	token, digest := NewToken()
+	require.NoError(t, db.RawQuery(
+		"INSERT INTO scim_tokens (sso_provider_id, token_hash, prefix) VALUES (?, ?, ?)",
+		provider, digest, token[:12],
+	).Exec())
+
+	return token
+}
+
+func userNamesOf(users []*core.User) []string {
+	names := make([]string, 0, len(users))
+	for _, user := range users {
+		names = append(names, user.UserName)
+	}
+	return names
+}

internal/api/scim/middleware.go

@@ -0,0 +1,84 @@
+package scim
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/supabase/auth/internal/api/scim/protocol"
+)
+
+const bearerScheme = "bearer "
+
+func (srv *Server) Tenant(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := srv.tenant(w, r)
+		if !ok {
+			return
+		}
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func (srv *Server) tenant(w http.ResponseWriter, r *http.Request) (context.Context, bool) {
+	ctx := r.Context()
+
+	tenant, err := srv.lookup(ctx, credential(r))
+	if err != nil {
+		if errors.Is(err, ErrNotFound) {
+			_ = srv.unauthorized(w)
+		} else {
+			_ = srv.internalError(w, r, err)
+		}
+		return nil, false
+	}
+
+	return withTenant(ctx, tenant), true
+}
+
+// unauthorized answers a request with no valid tenant, per RFC 7644, Section 3.12 and RFC 6750, Section 3.
+func (srv *Server) unauthorized(w http.ResponseWriter) error {
+	w.Header().Set("WWW-Authenticate", `Bearer realm="SCIM"`)
+	return protocol.WriteError(w, protocol.ErrUnauthorized("Bearer token is missing or invalid"))
+}
+
+// credential is the bearer token a SCIM client authenticates with, per RFC 7644,
+// Section 2 and RFC 6750, Section 2.1.
+func credential(r *http.Request) string {
+	header := r.Header.Get("Authorization")
+
+	if len(header) < len(bearerScheme) || !strings.EqualFold(header[:len(bearerScheme)], bearerScheme) {
+		return ""
+	}
+	return strings.TrimSpace(header[len(bearerScheme):])
+}
+
+func (srv *Server) lookup(ctx context.Context, credential string) (string, error) {
+	if !strings.HasPrefix(credential, TokenPrefix) {
+		return "", ErrNotFound
+	}
+
+	var rows []scimToken
+	tokenQuery := `
+		SELECT t.id, t.sso_provider_id
+		FROM scim_tokens t
+		INNER JOIN sso_providers p ON p.id = t.sso_provider_id
+		WHERE t.token_hash = ?
+			AND t.revoked_at IS NULL
+			AND (t.expires_at IS NULL OR t.expires_at > now())
+			AND (p.disabled IS NULL OR p.disabled = false)
+		`
+
+	err := srv.db.WithContext(ctx).RawQuery(tokenQuery, hashToken(credential)).All(&rows)
+	if err != nil {
+		return "", fmt.Errorf("scim: looking up token: %w", err)
+	}
+
+	if len(rows) == 0 {
+		return "", ErrNotFound
+	}
+
+	return rows[0].SSOProviderID, nil
+}

internal/api/scim/middleware_test.go

@@ -0,0 +1,31 @@
+package scim
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCredential(t *testing.T) {
+	for _, tc := range []struct{ name, header, expected string }{
+		{"a bearer token", "Bearer scim_abc", "scim_abc"},
+		{"a lowercase scheme, per RFC 7235", "bearer scim_abc", "scim_abc"},
+		{"a mixed case scheme", "BeArEr scim_abc", "scim_abc"},
+		{"surrounding whitespace", "Bearer   scim_abc  ", "scim_abc"},
+		{"no header at all", "", ""},
+		{"another scheme", "Basic dXNlcjpwYXNzd29yZA==", ""},
+		{"the scheme with nothing after it", "Bearer ", ""},
+		{"the scheme alone", "Bearer", ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, BasePath+"/Users", nil)
+			if tc.header != "" {
+				r.Header.Set("Authorization", tc.header)
+			}
+
+			assert.Equal(t, tc.expected, credential(r))
+		})
+	}
+}

internal/api/scim/models.go

@@ -0,0 +1,37 @@
+package scim
+
+import (
+	"context"
+	"time"
+)
+
+type scimUser struct {
+	ID        string    `db:"id"`
+	Resource  []byte    `db:"resource"`
+	Active    bool      `db:"active"`
+	CreatedAt time.Time `db:"created_at"`
+	UpdatedAt time.Time `db:"updated_at"`
+}
+
+func (u *scimUser) ResourceID() string { return u.ID }
+
+func (u *scimUser) Timestamps() (created, updated time.Time) {
+	return u.CreatedAt, u.UpdatedAt
+}
+
+type scimToken struct {
+	ID            string `db:"id"`
+	SSOProviderID string `db:"sso_provider_id"`
+}
+
+// TODO:: Replace with https://github.com/supabase/auth/pull/2677
+type tenantKey struct{}
+
+func withTenant(ctx context.Context, tenant string) context.Context {
+	return context.WithValue(ctx, tenantKey{}, tenant)
+}
+
+func tenantFrom(ctx context.Context) (string, bool) {
+	tenant, ok := ctx.Value(tenantKey{}).(string)
+	return tenant, ok && tenant != ""
+}