[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_194":195,"_196":197},"routes/_app.x.$handle.$name",{"_98":97,"_32":45,"_107":88,"_27":53,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":-5,"_120":25,"_121":122,"_123":124,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",8,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":37,"_35":36,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","scim.ts","latestPath","fileId","62082e24-64e6-11f1-ae7c-1607ee4eb77e","name","fileType","script","content","import type { UserRow } from \"./db.ts\";\n\nexport const USER_SCHEMA = \"urn:ietf:params:scim:schemas:core:2.0:User\";\nexport const LIST_SCHEMA = \"urn:ietf:params:scim:api:messages:2.0:ListResponse\";\nexport const ERROR_SCHEMA = \"urn:ietf:params:scim:api:messages:2.0:Error\";\n\n/** Shape Okta sends on POST/PUT. */\nexport interface ScimUserInput {\n userName?: string;\n externalId?: string;\n active?: boolean;\n name?: { givenName?: string; familyName?: string };\n emails?: Array<{ value?: string; primary?: boolean; type?: string }>;\n}\n\n/** Convert a DB row into a SCIM User resource. */\nexport function toScimUser(u: UserRow, baseUrl: string) {\n return {\n schemas: [USER_SCHEMA],\n id: u.id,\n externalId: u.externalId ?? undefined,\n userName: u.userName,\n name: {\n givenName: u.givenName ?? undefined,\n familyName: u.familyName ?? undefined,\n },\n emails: u.email ? [{ value: u.email, primary: true }] : [],\n active: u.active === 1,\n meta: {\n resourceType: \"User\",\n created: u.createdAt,\n lastModified: u.updatedAt,\n location: `${baseUrl}/Users/${u.id}`,\n },\n };\n}\n\nexport function listResponse(resources: object[], startIndex = 1) {\n return {\n schemas: [LIST_SCHEMA],\n totalResults: resources.length,\n startIndex,\n itemsPerPage: resources.length,\n Resources: resources,\n };\n}\n\nexport function scimError(status: number, detail: string) {\n return { schemas: [ERROR_SCHEMA], status: String(status), detail };\n}\n\n/** Extract the primary (or first) email from an incoming SCIM payload. */\nexport function primaryEmail(body: ScimUserInput): string | null {\n if (!body.emails?.length) return null;\n const primary = body.emails.find((e) => e.primary) ?? body.emails[0];\n return primary?.value ?? null;\n}\n\n/**\n * Parse a SCIM filter like: userName eq \"john@example.com\"\n * Returns the userName value, or null if the filter isn't a userName-eq filter.\n */\nexport function parseUserNameFilter(filter: string | null): string | null {\n if (!filter) return null;\n const m = filter.match(/userName\\s+eq\\s+\"([^\"]+)\"/i);\n return m ? m[1] : null;\n}\n","http","createdAt",["D",1781117989904],"branchVersion","branchId","4228b4ba-b71f-48f6-b08f-de41006deb57","id","a9f1d2d7-3d5e-424a-81d9-121f19b87ca2","test-scim",["D",1781106505649],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","57869f4f-f735-49a7-8cbe-c94d835b43a5","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019eb238-0324-740e-9739-98a6085cae13","tursoName","a9f1d2d73d5e424a81d9121f19b87ca2","tursoHostname","a9f1d2d73d5e424a81d9121f19b87ca2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789494036282],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":55,"_103":104,"_105":25},"branch",{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"isOwned",25,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","robyz7","handle","displayName","Robyz7","avatar","https://lh3.googleusercontent.com/a/ACg8ocJqaB9GyT0LDtIypEn9dLooRukNKqoJ-Gok4-VlN26TIbJ2j67D=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":189,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":190,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":191,"_82":192,"_84":193,"_86":25},"tree",[172,173,174,175],"files",[172,173,174,175],"counts",{"_162":61,"_163":137,"_164":61,"_165":166,"_167":168},"contents",[129,130,131,132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":155,"_32":156,"_30":157,"_134":-5,"_41":42,"_40":158,"_135":124,"_38":159,"_13":61,"_33":20,"_35":160,"_24":25,"_138":-5,"_27":161},{"_43":148,"_32":149,"_30":150,"_134":-5,"_41":42,"_40":151,"_135":25,"_38":152,"_13":61,"_33":34,"_35":153,"_24":25,"_138":-5,"_27":154},{"_43":140,"_32":141,"_30":142,"_134":-5,"_41":42,"_40":143,"_135":25,"_38":144,"_13":145,"_33":37,"_35":146,"_24":25,"_138":-5,"_27":147},{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":136,"_13":137,"_33":37,"_35":36,"_24":25,"_138":-5,"_27":139},"72b059d7-6bbc-478c-8ea8-c9e4b0472b42","parentId","latest",["D",1781117989904],1,"label",[28],"894a38fc-c5e1-41f1-a037-82180c42fe8e","main.ts","d1499f00-64e3-11f1-8c2c-1607ee4eb77e",6,["D",1781107633324],3,"import { Hono } from \"npm:hono\";\nimport {\n deleteUser,\n getUser,\n getUserByUserName,\n initDb,\n insertUser,\n listUsers,\n updateUser,\n type UserRow,\n} from \"./db.ts\";\nimport {\n listResponse,\n parseUserNameFilter,\n primaryEmail,\n type ScimUserInput,\n scimError,\n toScimUser,\n USER_SCHEMA,\n} from \"./scim.ts\";\n\nawait initDb();\n\nconst app = new Hono();\n// Surface real errors instead of Hono's generic 500.\napp.onError((err) => Promise.reject(err));\n\nconst SCIM_CT = { \"Content-Type\": \"application/scim+json\" };\nconst now = () => new Date().toISOString();\nconst baseUrl = (req: Request) => new URL(req.url).origin;\n\n// --- Auth: every route requires the bearer token ---\napp.use(\"*\", async (c, next) => {\n const expected = Deno.env.get(\"SCIM_TOKEN\");\n if (!expected) {\n return c.json(scimError(500, \"Server missing SCIM_TOKEN\"), 500, SCIM_CT);\n }\n if (c.req.header(\"Authorization\") !== `Bearer ${expected}`) {\n return c.json(scimError(401, \"Unauthorized\"), 401, SCIM_CT);\n }\n await next();\n});\n\n// --- Discovery endpoints Okta probes ---\napp.get(\"/ServiceProviderConfig\", (c) =>\n c.json({\n schemas: [\"urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig\"],\n patch: { supported: true },\n bulk: { supported: false, maxOperations: 0, maxPayloadSize: 0 },\n filter: { supported: true, maxResults: 200 },\n changePassword: { supported: false },\n sort: { supported: false },\n etag: { supported: false },\n authenticationSchemes: [{\n type: \"oauthbearertoken\",\n name: \"OAuth Bearer Token\",\n description: \"Authentication via the HTTP Authorization header.\",\n }],\n }, 200, SCIM_CT));\n\napp.get(\"/ResourceTypes\", (c) =>\n c.json(listResponse([{\n schemas: [\"urn:ietf:params:scim:schemas:core:2.0:ResourceType\"],\n id: \"User\",\n name: \"User\",\n endpoint: \"/Users\",\n schema: USER_SCHEMA,\n }]), 200, SCIM_CT));\n\n// --- GET /Users (list + filter) ---\napp.get(\"/Users\", async (c) => {\n const filterUserName = parseUserNameFilter(c.req.query(\"filter\") ?? null);\n const rows = await listUsers(filterUserName ?? undefined);\n const resources = rows.map((r) => toScimUser(r, baseUrl(c.req.raw)));\n return c.json(listResponse(resources), 200, SCIM_CT);\n});\n\n// --- GET /Users/:id ---\napp.get(\"/Users/:id\", async (c) => {\n const row = await getUser(c.req.param(\"id\"));\n if (!row) return c.json(scimError(404, \"User not found\"), 404, SCIM_CT);\n return c.json(toScimUser(row, baseUrl(c.req.raw)), 200, SCIM_CT);\n});\n\n// --- POST /Users (create) ---\napp.post(\"/Users\", async (c) => {\n const body = await c.req.json();\n if (!body.userName) {\n return c.json(scimError(400, \"userName is required\"), 400, SCIM_CT);\n }\n const existing = await getUserByUserName(body.userName);\n if (existing) {\n // 409 tells Okta the user already exists so it switches to update.\n return c.json(scimError(409, \"User already exists\"), 409, SCIM_CT);\n }\n const ts = now();\n const row: UserRow = {\n id: crypto.randomUUID(),\n userName: body.userName,\n givenName: body.name?.givenName ?? null,\n familyName: body.name?.familyName ?? null,\n email: primaryEmail(body),\n active: body.active === false ? 0 : 1,\n externalId: body.externalId ?? null,\n createdAt: ts,\n updatedAt: ts,\n };\n await insertUser(row);\n return c.json(toScimUser(row, baseUrl(c.req.raw)), 201, SCIM_CT);\n});\n\n// --- PUT /Users/:id (full replace) ---\napp.put(\"/Users/:id\", async (c) => {\n const row = await getUser(c.req.param(\"id\"));\n if (!row) return c.json(scimError(404, \"User not found\"), 404, SCIM_CT);\n const body = await c.req.json();\n const updated: UserRow = {\n ...row,\n userName: body.userName ?? row.userName,\n givenName: body.name?.givenName ?? null,\n familyName: body.name?.familyName ?? null,\n email: primaryEmail(body),\n active: body.active === false ? 0 : 1,\n externalId: body.externalId ?? row.externalId,\n updatedAt: now(),\n };\n await updateUser(updated);\n return c.json(toScimUser(updated, baseUrl(c.req.raw)), 200, SCIM_CT);\n});\n\n// --- PATCH /Users/:id (partial; Okta mainly toggles `active`) ---\napp.patch(\"/Users/:id\", async (c) => {\n const row = await getUser(c.req.param(\"id\"));\n if (!row) return c.json(scimError(404, \"User not found\"), 404, SCIM_CT);\n const body = await c.req.json<{ Operations?: Array<{ op: string; path?: string; value: unknown }> }>();\n for (const op of body.Operations ?? []) {\n const value = op.value as Record | boolean;\n // Handle both { path: \"active\", value: false } and { value: { active: false } }\n if (op.path === \"active\") row.active = value === false || value === \"false\" ? 0 : 1;\n else if (typeof value === \"object\" && value && \"active\" in value) {\n row.active = value.active === false ? 0 : 1;\n }\n }\n row.updatedAt = now();\n await updateUser(row);\n return c.json(toScimUser(row, baseUrl(c.req.raw)), 200, SCIM_CT);\n});\n\n// --- DELETE /Users/:id ---\napp.delete(\"/Users/:id\", async (c) => {\n const row = await getUser(c.req.param(\"id\"));\n if (!row) return c.json(scimError(404, \"User not found\"), 404, SCIM_CT);\n await deleteUser(row.id);\n return c.body(null, 204);\n});\n\napp.all(\"*\", (c) => c.json(scimError(404, \"Not found\"), 404, SCIM_CT));\n\nexport default app.fetch;\n",[141],"2d2e7845-b370-41d0-b373-b27107cbf863","db.ts","5b69369e-64e6-11f1-9214-1607ee4eb77e",4,["D",1781107596389],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst TABLE = \"scim_users\";\n\nexport async function initDb() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS ${TABLE} (\n id TEXT PRIMARY KEY,\n userName TEXT UNIQUE NOT NULL,\n givenName TEXT,\n familyName TEXT,\n email TEXT,\n active INTEGER NOT NULL DEFAULT 1,\n externalId TEXT,\n createdAt TEXT NOT NULL,\n updatedAt TEXT NOT NULL\n )`);\n}\n\nexport interface UserRow {\n id: string;\n userName: string;\n givenName: string | null;\n familyName: string | null;\n email: string | null;\n active: number;\n externalId: string | null;\n createdAt: string;\n updatedAt: string;\n}\n\nexport async function listUsers(userNameFilter?: string): Promise {\n const res = userNameFilter\n ? await sqlite.execute({\n sql: `SELECT * FROM ${TABLE} WHERE userName = ? ORDER BY createdAt`,\n args: [userNameFilter],\n })\n : await sqlite.execute(`SELECT * FROM ${TABLE} ORDER BY createdAt`);\n return res.rows as unknown as UserRow[];\n}\n\nexport async function getUser(id: string): Promise {\n const res = await sqlite.execute({\n sql: `SELECT * FROM ${TABLE} WHERE id = ?`,\n args: [id],\n });\n return (res.rows as unknown as UserRow[])[0];\n}\n\nexport async function getUserByUserName(userName: string): Promise {\n const res = await sqlite.execute({\n sql: `SELECT * FROM ${TABLE} WHERE userName = ?`,\n args: [userName],\n });\n return (res.rows as unknown as UserRow[])[0];\n}\n\nexport async function insertUser(u: UserRow): Promise {\n await sqlite.execute({\n sql: `INSERT INTO ${TABLE}\n (id, userName, givenName, familyName, email, active, externalId, createdAt, updatedAt)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n u.id, u.userName, u.givenName, u.familyName, u.email,\n u.active, u.externalId, u.createdAt, u.updatedAt,\n ],\n });\n}\n\nexport async function updateUser(u: UserRow): Promise {\n await sqlite.execute({\n sql: `UPDATE ${TABLE} SET\n userName = ?, givenName = ?, familyName = ?, email = ?,\n active = ?, externalId = ?, updatedAt = ?\n WHERE id = ?`,\n args: [\n u.userName, u.givenName, u.familyName, u.email,\n u.active, u.externalId, u.updatedAt, u.id,\n ],\n });\n}\n\nexport async function deleteUser(id: string): Promise {\n await sqlite.execute({ sql: `DELETE FROM ${TABLE} WHERE id = ?`, args: [id] });\n}\n",[149],"e17f56d0-f2a9-4837-a061-3e5780a70005","README.md","89fd2402-64e6-11f1-a82c-1607ee4eb77e",7,["D",1781107674529],"# test-scim\n\nA SCIM 2.0 server for user provisioning from Okta (or any SCIM client), backed by Val Town SQLite.\n\n## Connecting Okta\n\nIn Okta's SCIM provisioning settings:\n\n| Field | Value |\n| --- | --- |\n| **SCIM base URL** | `https://robyz7--d1499f0064e311f18c2c1607ee4eb77e.web.val.run` |\n| **Unique identifier** | `userName` |\n| **Auth mode** | HTTP Header |\n| **Authorization header** | `Bearer ` |\n\nThe bearer token is read from the `SCIM_TOKEN` environment variable.\n\n👉 Set/rotate the token here: https://www.val.town/x/robyz7/test-scim/environment-variables?key=SCIM_TOKEN\n\n## Supported operations\n\n| Method | Path | Purpose |\n| --- | --- | --- |\n| GET | `/ServiceProviderConfig` | Capability discovery |\n| GET | `/ResourceTypes` | Resource type discovery |\n| GET | `/Users` | List users (supports `?filter=userName eq \"...\"`) |\n| GET | `/Users/:id` | Fetch one user |\n| POST | `/Users` | Create user (409 if `userName` exists) |\n| PUT | `/Users/:id` | Full replace |\n| PATCH | `/Users/:id` | Partial update (e.g. deactivate via `active:false`) |\n| DELETE | `/Users/:id` | Hard delete (204) |\n\n## Architecture\n\n```mermaid\nflowchart LR\n Okta -- \"Bearer SCIM_TOKEN\" --> main[main.ts
Hono router + auth]\n main --> scim[scim.ts
SCIM (de)serialization]\n main --> db[db.ts
SQLite CRUD]\n db --> sqlite[(scim_users table)]\n```\n\n## Files\n\n- **main.ts** — HTTP entrypoint: bearer-token auth middleware + all SCIM routes.\n- **scim.ts** — Converts between DB rows and SCIM JSON; filter parsing; error shapes.\n- **db.ts** — SQLite schema (`scim_users`) and CRUD helpers.\n\n## Notes\n\n- Deactivation: Okta sends `PATCH` with `active:false` to offboard a user; the row is kept but marked inactive. A separate `DELETE` removes it entirely.\n- The legacy hardcoded `john.doe` / `jane.smith` demo users are gone — data is now persisted per real provisioning events.\n",[156],"pulls","branches","forks","envVars",{"_169":137,"_171":61},"connections",{"_169":61,"_170":61},"count","unfilledCount","emptyCount",{"_43":155,"_32":156,"_30":157,"_134":-5,"_41":42,"_40":158,"_135":124,"_38":186,"_13":61,"_33":20,"_35":160,"_24":25,"_138":-5,"_177":187,"_27":188},{"_43":148,"_32":149,"_30":150,"_134":-5,"_41":42,"_40":151,"_135":25,"_38":183,"_13":61,"_33":34,"_35":153,"_24":25,"_138":-5,"_177":184,"_27":185},{"_43":140,"_32":141,"_30":142,"_134":-5,"_41":42,"_40":143,"_135":25,"_38":180,"_13":145,"_33":37,"_35":146,"_24":25,"_138":-5,"_177":181,"_27":182},{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":176,"_13":137,"_33":37,"_35":36,"_24":25,"_138":-5,"_177":178,"_27":179},["D",1781117989904],"children",[],[28],["D",1781107633324],[],[141],["D",1781107596389],[],[149],["D",1781107674529],[],[156],["D",1781106505649],["D",1789494036282],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":55,"_103":104,"_105":25},{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"ctx",{"_80":-5,"_126":227,"_228":229,"_230":231,"_232":25,"_233":25,"_234":25,"_235":124,"_236":-5,"_237":-7,"_238":-7,"_239":61,"_240":25,"_241":25,"_242":-5,"_243":25,"_244":25,"_245":25,"_246":-5},"ENV",{"_198":199,"_200":201,"_202":88,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v8