handlers.go

package scim

import (
	"encoding/json"
	"net/http"

	"github.com/elimity-com/scim/errors"
	"github.com/elimity-com/scim/filter"
	"github.com/elimity-com/scim/schema"
)

func (s Server) errorHandler(w http.ResponseWriter, scimErr *errors.ScimError) {
	raw, err := json.Marshal(scimErr)
	if err != nil {
		s.log.Error(
			"failed marshaling scim error",
			"scimError", scimErr,
			"error", err,
		)
		return
	}

	w.WriteHeader(scimErr.Status)
	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// parseSearchRequest reads and parses a search request body, returning a SearchParams.
func (s Server) parseSearchRequest(r *http.Request) (searchRequest, SearchParams, *errors.ScimError) {
	data, err := readBody(r)
	if err != nil {
		return searchRequest{}, SearchParams{}, &errors.ScimErrorInternal
	}

	var sr searchRequest
	if err := json.Unmarshal(data, &sr); err != nil {
		scimErr := errors.ScimError{
			Status: 400,
			Detail: "Invalid search request body.",
		}
		return searchRequest{}, SearchParams{}, &scimErr
	}

	if len(sr.Schemas) != 1 || sr.Schemas[0] != "urn:ietf:params:scim:api:messages:2.0:SearchRequest" {
		return searchRequest{}, SearchParams{}, &errors.ScimErrorInvalidValue
	}

	if sr.SortOrder != "" && sr.SortOrder != "ascending" && sr.SortOrder != "descending" {
		return searchRequest{}, SearchParams{}, &errors.ScimErrorInvalidValue
	}

	defaultCount := s.config.getItemsPerPage()

	count := defaultCount
	if sr.Count != nil {
		count = *sr.Count
	}
	if count > defaultCount {
		count = defaultCount
	}
	if count < 0 {
		count = 0
	}

	startIndex := defaultStartIndex
	if sr.StartIndex != nil {
		startIndex = *sr.StartIndex
	}
	if startIndex < 1 {
		startIndex = defaultStartIndex
	}

	return sr, SearchParams{
		Attributes:         sr.Attributes,
		Count:              count,
		ExcludedAttributes: sr.ExcludedAttributes,
		Filter:             sr.Filter,
		SortBy:             sr.SortBy,
		SortOrder:          sr.SortOrder,
		StartIndex:         startIndex,
	}, nil
}

// resourceDeleteHandler receives an HTTP DELETE request to the resource endpoint, e.g., "/Users/{id}" or "/Groups/{id}",
// where "{id}" is a resource identifier to delete a known resource.
func (s Server) resourceDeleteHandler(w http.ResponseWriter, r *http.Request, id string, resourceType ResourceType) {
	deleteErr := resourceType.Handler.Delete(r, id)
	if deleteErr != nil {
		scimErr := errors.CheckScimError(deleteErr, http.MethodDelete)
		s.errorHandler(w, &scimErr)
		return
	}

	w.WriteHeader(http.StatusNoContent)
}

// resourceGetHandler receives an HTTP GET request to the resource endpoint, e.g., "/Users/{id}" or "/Groups/{id}",
// where "{id}" is a resource identifier to retrieve a known resource.
func (s Server) resourceGetHandler(w http.ResponseWriter, r *http.Request, id string, resourceType ResourceType) {
	resource, getErr := resourceType.Handler.Get(r, id)
	if getErr != nil {
		scimErr := errors.CheckScimError(getErr, http.MethodGet)
		s.errorHandler(w, &scimErr)
		return
	}

	location := resourceLocation(resourceType, id, s.baseURL)
	raw, err := json.Marshal(resource.response(resourceType, location))
	if err != nil {
		s.errorHandler(w, &errors.ScimErrorInternal)
		s.log.Error(
			"failed marshaling resource",
			"resource", resource,
			"error", err,
		)
		return
	}

	if resource.Meta.Version != "" {
		w.Header().Set("Etag", resource.Meta.Version)
	}

	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// resourcePatchHandler receives an HTTP PATCH to the resource endpoint, e.g., "/Users/{id}" or "/Groups/{id}", where
// "{id}" is a resource identifier to replace a resource's attributes.
func (s Server) resourcePatchHandler(w http.ResponseWriter, r *http.Request, id string, resourceType ResourceType) {
	patch, scimErr := resourceType.validatePatch(r)
	if scimErr != nil {
		s.errorHandler(w, scimErr)
		return
	}

	resource, patchErr := resourceType.Handler.Patch(r, id, patch)
	if patchErr != nil {
		scimErr := errors.CheckScimError(patchErr, http.MethodPatch)
		s.errorHandler(w, &scimErr)
		return
	}

	if len(resource.Attributes) == 0 {
		w.WriteHeader(http.StatusNoContent)
		return
	}

	location := resourceLocation(resourceType, id, s.baseURL)
	raw, err := json.Marshal(resource.response(resourceType, location))
	if err != nil {
		s.errorHandler(w, &errors.ScimErrorInternal)
		s.log.Error(
			"failed marshaling resource",
			"resource", resource,
			"error", err,
		)
		return
	}

	if resource.Meta.Version != "" {
		w.Header().Set("Etag", resource.Meta.Version)
	}

	w.WriteHeader(http.StatusOK)

	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// resourcePostHandler receives an HTTP POST request to the resource endpoint, such as "/Users" or "/Groups", as
// defined by the associated resource type endpoint discovery to create new resources.
func (s Server) resourcePostHandler(w http.ResponseWriter, r *http.Request, resourceType ResourceType) {
	data, _ := readBody(r)

	attributes, scimErr := resourceType.validate(data)
	if scimErr != nil {
		s.errorHandler(w, scimErr)
		return
	}

	resource, postErr := resourceType.Handler.Create(r, attributes)
	if postErr != nil {
		scimErr := errors.CheckScimError(postErr, http.MethodPost)
		s.errorHandler(w, &scimErr)
		return
	}

	location := resourceLocation(resourceType, resource.ID, s.baseURL)
	raw, err := json.Marshal(resource.response(resourceType, location))
	if err != nil {
		s.errorHandler(w, &errors.ScimErrorInternal)
		s.log.Error(
			"failed marshaling resource",
			"resource", resource,
			"error", err,
		)
		return
	}

	w.Header().Set("Location", location)
	if resource.Meta.Version != "" {
		w.Header().Set("Etag", resource.Meta.Version)
	}

	w.WriteHeader(http.StatusCreated)

	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// resourcePutHandler receives an HTTP PUT to the resource endpoint, e.g., "/Users/{id}" or "/Groups/{id}", where
// "{id}" is a resource identifier to replace a resource's attributes.
func (s Server) resourcePutHandler(w http.ResponseWriter, r *http.Request, id string, resourceType ResourceType) {
	data, _ := readBody(r)

	attributes, scimErr := resourceType.validate(data)
	if scimErr != nil {
		s.errorHandler(w, scimErr)
		return
	}

	resource, putError := resourceType.Handler.Replace(r, id, attributes)
	if putError != nil {
		scimErr := errors.CheckScimError(putError, http.MethodPut)
		s.errorHandler(w, &scimErr)
		return
	}

	location := resourceLocation(resourceType, id, s.baseURL)
	raw, err := json.Marshal(resource.response(resourceType, location))
	if err != nil {
		s.errorHandler(w, &errors.ScimErrorInternal)
		s.log.Error(
			"failed marshaling resource",
			"resource", resource,
			"error", err,
		)
		return
	}

	if resource.Meta.Version != "" {
		w.Header().Set("Etag", resource.Meta.Version)
	}

	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// resourceSearchHandler receives an HTTP POST request to a resource endpoint's /.search
// (e.g. /Users/.search) to query resources of that type.
func (s Server) resourceSearchHandler(w http.ResponseWriter, r *http.Request, resourceType ResourceType) {
	searcher, ok := resourceType.Handler.(ResourceSearcher)
	if !ok {
		s.errorHandler(w, &errors.ScimError{
			Status: 501,
			Detail: "Search is not supported for this resource type.",
		})
		return
	}

	_, params, scimErr := s.parseSearchRequest(r)
	if scimErr != nil {
		s.errorHandler(w, scimErr)
		return
	}

	if params.Filter != "" {
		validator, err := filter.NewValidator(params.Filter, resourceType.Schema, resourceType.getSchemaExtensions()...)
		if err != nil {
			s.errorHandler(w, &errors.ScimErrorInvalidFilter)
			return
		}
		if err := validator.Validate(); err != nil {
			s.errorHandler(w, &errors.ScimErrorInvalidFilter)
			return
		}
		params.FilterValidator = &validator
	}

	page, searchErr := searcher.Search(r, params)
	if searchErr != nil {
		scimErr := errors.CheckScimError(searchErr, http.MethodPost)
		s.errorHandler(w, &scimErr)
		return
	}

	lr := listResponse{
		TotalResults: page.TotalResults,
		Resources:    page.resources(resourceType, s.baseURL),
		StartIndex:   params.StartIndex,
		ItemsPerPage: params.Count,
	}
	raw, err := json.Marshal(lr)
	if err != nil {
		s.errorHandler(w, &errors.ScimErrorInternal)
		s.log.Error(
			"failed marshaling list response",
			"listResponse", lr,
			"error", err,
		)
		return
	}

	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// resourceTypeHandler receives an HTTP GET to retrieve individual resource types which can be returned by appending the
// resource types name to the /ResourceTypes endpoint. For example: "/ResourceTypes/User".
func (s Server) resourceTypeHandler(w http.ResponseWriter, r *http.Request, name string) {
	var resourceType ResourceType
	for _, r := range s.resourceTypes {
		if r.Name == name {
			resourceType = r
			break
		}
	}

	if resourceType.Name != name {
		scimErr := errors.ScimErrorResourceNotFound(name)
		s.errorHandler(w, &scimErr)
		return
	}

	raw, err := json.Marshal(resourceType.getRaw())
	if err != nil {
		s.errorHandler(w, &errors.ScimErrorInternal)
		s.log.Error(
			"failed marshaling resource type",
			"resourceType", resourceType,
			"error", err,
		)
	}

	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// resourceTypesHandler receives an HTTP GET to this endpoint, "/ResourceTypes", which is used to discover the types of
// resources available on a SCIM service provider (e.g., Users and Groups).  Each resource type defines the endpoints,
// the core schema URI that defines the resource, and any supported schema extensions.
func (s Server) resourceTypesHandler(w http.ResponseWriter, r *http.Request) {
	params, paramsErr := s.parseRequestParams(r, schema.ResourceTypeSchema())
	if paramsErr != nil {
		s.errorHandler(w, paramsErr)
		return
	}

	start, end := clamp(params.StartIndex-1, params.Count, len(s.resourceTypes))
	var resources []interface{}
	for _, v := range s.resourceTypes[start:end] {
		resources = append(resources, v.getRaw())
	}

	lr := listResponse{
		TotalResults: len(s.resourceTypes),
		ItemsPerPage: params.Count,
		StartIndex:   params.StartIndex,
		Resources:    resources,
	}
	raw, err := json.Marshal(lr)
	if err != nil {
		s.errorHandler(w, &errors.ScimErrorInternal)
		s.log.Error(
			"failed marshaling list response",
			"listResponse", lr,
			"error", err,
		)
		return
	}

	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// resourcesGetHandler receives an HTTP GET request to the resource endpoint, e.g., "/Users" or "/Groups", to retrieve
// all known resources.
func (s Server) resourcesGetHandler(w http.ResponseWriter, r *http.Request, resourceType ResourceType) {
	params, paramsErr := s.parseRequestParams(r, resourceType.Schema, resourceType.getSchemaExtensions()...)
	if paramsErr != nil {
		s.errorHandler(w, paramsErr)
		return
	}

	page, getError := resourceType.Handler.GetAll(r, params)
	if getError != nil {
		scimErr := errors.CheckScimError(getError, http.MethodGet)
		s.errorHandler(w, &scimErr)
		return
	}

	lr := listResponse{
		TotalResults: page.TotalResults,
		Resources:    page.resources(resourceType, s.baseURL),
		StartIndex:   params.StartIndex,
		ItemsPerPage: params.Count,
	}
	raw, err := json.Marshal(lr)
	if err != nil {
		s.errorHandler(w, &errors.ScimErrorInternal)
		s.log.Error(
			"failed marshaling list response",
			"listResponse", lr,
			"error", err,
		)
		return
	}

	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// rootResourcesGetHandler receives an HTTP GET request to the server root endpoint to query across all resource types.
func (s Server) rootResourcesGetHandler(w http.ResponseWriter, r *http.Request) {
	count, startIndex, scimErr := s.parsePaginationParams(r)
	if scimErr != nil {
		s.errorHandler(w, scimErr)
		return
	}

	params := ListRequestParams{
		Count:      count,
		StartIndex: startIndex,
	}

	page, getError := s.rootQueryHandler.GetAll(r, params)
	if getError != nil {
		scimErr := errors.CheckScimError(getError, http.MethodGet)
		s.errorHandler(w, &scimErr)
		return
	}

	lr := listResponse{
		TotalResults: page.TotalResults,
		Resources:    page.rawResources(),
		StartIndex:   params.StartIndex,
		ItemsPerPage: params.Count,
	}
	raw, err := json.Marshal(lr)
	if err != nil {
		s.errorHandler(w, &errors.ScimErrorInternal)
		s.log.Error(
			"failed marshaling list response",
			"listResponse", lr,
			"error", err,
		)
		return
	}

	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// rootSearchHandler receives an HTTP POST request to /.search to query across all resource types.
// Per RFC 7644 Section 3.4.3, this is an alternative to GET / with query parameters.
// If the RootQueryHandler also implements ResourceSearcher, the Search method is called
// with full SearchParams. Otherwise, GetAll is called with only Count and StartIndex.
func (s Server) rootSearchHandler(w http.ResponseWriter, r *http.Request) {
	_, params, scimErr := s.parseSearchRequest(r)
	if scimErr != nil {
		s.errorHandler(w, scimErr)
		return
	}

	var (
		page     Page
		getError error
	)
	if searcher, ok := s.rootQueryHandler.(ResourceSearcher); ok {
		page, getError = searcher.Search(r, params)
	} else {
		page, getError = s.rootQueryHandler.GetAll(r, ListRequestParams{
			Count:      params.Count,
			StartIndex: params.StartIndex,
		})
	}
	if getError != nil {
		scimErr := errors.CheckScimError(getError, http.MethodPost)
		s.errorHandler(w, &scimErr)
		return
	}

	lr := listResponse{
		TotalResults: page.TotalResults,
		Resources:    page.rawResources(),
		StartIndex:   params.StartIndex,
		ItemsPerPage: params.Count,
	}
	raw, err := json.Marshal(lr)
	if err != nil {
		s.errorHandler(w, &errors.ScimErrorInternal)
		s.log.Error(
			"failed marshaling list response",
			"listResponse", lr,
			"error", err,
		)
		return
	}

	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// schemaHandler receives an HTTP GET to retrieve individual schema definitions which can be returned by appending the
// schema URI to the /Schemas endpoint. For example: "/Schemas/urn:ietf:params:scim:schemas:core:2.0:User".
func (s Server) schemaHandler(w http.ResponseWriter, r *http.Request, id string) {
	getSchema := s.getSchema(id)
	if getSchema.ID != id {
		scimErr := errors.ScimErrorResourceNotFound(id)
		s.errorHandler(w, &scimErr)
		return
	}

	raw, err := json.Marshal(getSchema)
	if err != nil {
		s.errorHandler(w, &errors.ScimErrorInternal)
		s.log.Error(
			"failed marshaling schema",
			"schema", getSchema,
			"error", err,
		)
	}

	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// schemasHandler receives an HTTP GET to retrieve information about resource schemas supported by a SCIM service
// provider. An HTTP GET to the endpoint "/Schemas" returns all supported schemas in ListResponse format.
func (s Server) schemasHandler(w http.ResponseWriter, r *http.Request) {
	params, paramsErr := s.parseRequestParams(r, schema.Definition())
	if paramsErr != nil {
		s.errorHandler(w, paramsErr)
		return
	}

	var (
		start, end = clamp(params.StartIndex-1, params.Count, len(s.getSchemas()))
		resources  []interface{}
	)
	if validator := params.FilterValidator; validator != nil {
		if err := validator.Validate(); err != nil {
			s.errorHandler(w, &errors.ScimErrorInvalidFilter)
			return
		}
	}
	for _, v := range s.getSchemas()[start:end] {
		resource := v.ToMap()
		if validator := params.FilterValidator; validator != nil {
			if err := validator.PassesFilter(resource); err != nil {
				continue
			}
		}
		resources = append(resources, resource)
	}

	lr := listResponse{
		TotalResults: len(s.getSchemas()),
		ItemsPerPage: params.Count,
		StartIndex:   params.StartIndex,
		Resources:    resources,
	}
	raw, err := json.Marshal(lr)
	if err != nil {
		s.errorHandler(w, &errors.ScimErrorInternal)
		s.log.Error(
			"failed marshaling list response",
			"listResponse", lr,
			"error", err,
		)
		return
	}

	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// serviceProviderConfigHandler receives an HTTP GET to this endpoint will return a JSON structure that describes the
// SCIM specification features available on a service provider.
func (s Server) serviceProviderConfigHandler(w http.ResponseWriter, r *http.Request) {
	raw, err := json.Marshal(s.config.getRaw())
	if err != nil {
		s.errorHandler(w, &errors.ScimErrorInternal)
		s.log.Error(
			"failed marshaling service provider config",
			"serviceProviderConfig", s.config,
			"error", err,
		)
		return
	}

	_, err = w.Write(raw)
	if err != nil {
		s.log.Error(
			"failed writing response",
			"error", err,
		)
	}
}

// searchRequest represents the JSON body of a POST /.search request per RFC 7644 Section 3.4.3.
type searchRequest struct {
	Schemas            []string `json:"schemas"`
	Attributes         []string `json:"attributes"`
	ExcludedAttributes []string `json:"excludedAttributes"`
	Filter             string   `json:"filter"`
	SortBy             string   `json:"sortBy"`
	SortOrder          string   `json:"sortOrder"`
	StartIndex         *int     `json:"startIndex"`
	Count              *int     `json:"count"`
}