@lastshotlabs/slingshot-scim

npm install @lastshotlabs/slingshot-scim

Functions

createScimPlugin

Creates the slingshot-scim plugin, which adds SCIM 2.0 user provisioning to a Slingshot app.

Requires slingshot-auth to be installed and configured with auth.scim settings in the auth plugin config. Routes are mounted at /scim/v2/* during setupRoutes.

Supported SCIM 2.0 endpoints:

• GET /scim/v2/Users — list/search users with single-clause filter support
• GET /scim/v2/Users/:id — retrieve a single user
• POST /scim/v2/Users — provision a new user
• PUT /scim/v2/Users/:id — full user replacement
• PATCH /scim/v2/Users/:id — partial update (PatchOp)
• DELETE /scim/v2/Users/:id — deprovision (suspend or hard-delete, configurable)
• GET /scim/v2/ServiceProviderConfig — capability discovery
• GET /scim/v2/ResourceTypes — resource type discovery

function createScimPlugin(): SlingshotPlugin

Source: packages/slingshot-scim/src/plugin.ts

createScimRouter

Creates the OpenAPIHono router for all SCIM 2.0 endpoints.

Called internally by createScimPlugin. Exposed for advanced use cases where you need to mount the SCIM router manually without the full plugin lifecycle.

All routes require SCIM bearer token authentication via createScimAuth. Rate limiting is applied: 100 req/min for reads, 30 req/min for writes (per client IP).

function createScimRouter(runtime: AuthRuntimeContext): void

Source: packages/slingshot-scim/src/routes/scim.ts

parseScimFilter

Parses a SCIM filter string into a UserQuery object suitable for AuthAdapter.listUsers.

Supports single-clause attr eq "value" filters on: userName, email, externalId, and active. Compound expressions (AND, OR, NOT), grouped expressions, and unsupported attributes are rejected and return null.

function parseScimFilter(filter?: string): UserQuery | null

Source: packages/slingshot-scim/src/lib/scim.ts

scimError

Creates a SCIM 2.0 error Response with the correct application/scim+json content type.

function scimError(status: number, detail: string, scimType?: string): Response

Source: packages/slingshot-scim/src/lib/scim.ts

userRecordToScim

Converts a Slingshot UserRecord to a SCIM 2.0 ScimUser response object.

Maps suspended: true to active: false. Falls back to user.id as userName when no email is present.

function userRecordToScim(user: UserRecord, config?: { userName?: 'email' | 'username' },): ScimUser

Source: packages/slingshot-scim/src/lib/scim.ts

Interfaces

ScimError

A SCIM 2.0 error response body as defined by RFC 7644 §3.12. Returned with the appropriate HTTP status code on SCIM errors.

Source: packages/slingshot-scim/src/lib/scim.ts

ScimListResponse

A SCIM 2.0 ListResponse envelope as defined by RFC 7644 §3.4.2. Wraps paginated ScimUser results returned by GET /scim/v2/Users.

Source: packages/slingshot-scim/src/lib/scim.ts

ScimUser

A SCIM 2.0 User resource as defined by RFC 7643 §4.1. Returned by the /scim/v2/Users endpoints in JSON response bodies.

Source: packages/slingshot-scim/src/lib/scim.ts