scim

type AuthScheme struct {
	Type        string `json:"type"`
	Name        string `json:"name"`
	Description string `json:"description"`
	SpecURI     string `json:"specUri,omitempty"`
	Primary     bool   `json:"primary,omitempty"`
}

type BulkSupported struct {
	Supported      bool `json:"supported"`
	MaxOperations  int  `json:"maxOperations"`
	MaxPayloadSize int  `json:"maxPayloadSize"`
}

type Comparison struct {
	// Attribute is the attribute name, lower-cased for comparison.
	//
	// Lower-cased because SCIM attribute names are case-insensitive and providers are inconsistent: "userName",
	// "username" and "UserName" all arrive.
	Attribute string

	// Operator is the comparison: eq, ne, co, sw, ew, pr.
	Operator string

	// Value is the compared value, with its quotes removed. Empty for pr, which takes no value.
	Value string
}

type Email struct {
	Value   string `json:"value"`
	Type    string `json:"type,omitempty"`
	Primary bool   `json:"primary,omitempty"`
}

type ErrUnsupportedFilter struct {
	// Filter is the expression that was refused.
	Filter string

	// Why explains it, for the provisioning log a person will eventually read.
	Why string
}

type Error struct {
	Schemas []string `json:"schemas"`

	// Status is the HTTP status as a string, which is what the specification says despite it being a number.
	Status string `json:"status"`

	// ScimType is a machine-readable error keyword: invalidValue, uniqueness, mutability, invalidSyntax,
	// invalidFilter, tooMany, invalidPath, noTarget, sensitive.
	//
	// Worth setting properly rather than leaving empty. A provider seeing "uniqueness" knows the account already exists
	// and stops retrying; one seeing nothing retries a conflict for ever.
	ScimType string `json:"scimType,omitempty"`

	// Detail is for a person reading a provisioning log.
	Detail string `json:"detail,omitempty"`
}

type Filter struct {
	// Comparisons are the individual comparisons.
	Comparisons []Comparison

	// Conjunction is "and" or "or" when there are two comparisons, empty when there is one.
	Conjunction string
}

type FilterSupported struct {
	Supported  bool `json:"supported"`
	MaxResults int  `json:"maxResults"`
}

type Group struct {
	Schemas     []string    `json:"schemas"`
	ID          string      `json:"id,omitempty"`
	ExternalID  string      `json:"externalId,omitempty"`
	DisplayName string      `json:"displayName"`
	Members     []MemberRef `json:"members,omitempty"`
	Meta        *Meta       `json:"meta,omitempty"`
}

type GroupRef struct {
	Value   string `json:"value"`
	Ref     string `json:"$ref,omitempty"`
	Display string `json:"display,omitempty"`
	Type    string `json:"type,omitempty"`
}

type ListResponse struct {
	Schemas []string `json:"schemas"`

	// TotalResults is how many match in total, not how many are in this page.
	//
	// Identity providers page through by comparing this against StartIndex and ItemsPerPage, so reporting the page size
	// here makes a provider stop after the first page - and every user beyond it is never provisioned or, worse, never
	// deprovisioned.
	TotalResults int `json:"totalResults"`

	// StartIndex is one-based, which is SCIM's choice and not a mistake.
	StartIndex int `json:"startIndex"`

	// ItemsPerPage is how many are in this page.
	ItemsPerPage int `json:"itemsPerPage"`

	// Resources is the page. Named with a capital R by the specification.
	Resources []any `json:"Resources"`
}

type MemberRef struct {
	Value   string `json:"value"`
	Ref     string `json:"$ref,omitempty"`
	Display string `json:"display,omitempty"`
	Type    string `json:"type,omitempty"`
}

type Meta struct {
	ResourceType string `json:"resourceType"`
	Created      string `json:"created,omitempty"`
	LastModified string `json:"lastModified,omitempty"`
	Location     string `json:"location,omitempty"`
	Version      string `json:"version,omitempty"`
}

type Name struct {
	Formatted  string `json:"formatted,omitempty"`
	FamilyName string `json:"familyName,omitempty"`
	GivenName  string `json:"givenName,omitempty"`
	MiddleName string `json:"middleName,omitempty"`
}

type PatchOperation struct {
	// Op is add, remove or replace. Case-insensitive in practice: providers send "Replace" and "replace" both.
	Op string `json:"op"`

	// Path says what to change. Empty on a replace means the value is a whole object of attributes.
	Path string `json:"path,omitempty"`

	// Value is the new value, whose shape depends on the path.
	Value json.RawMessage `json:"value,omitempty"`
}

type PatchRequest struct {
	Schemas    []string         `json:"schemas"`
	Operations []PatchOperation `json:"Operations"`
}

type Role struct {
	Value   string `json:"value"`
	Display string `json:"display,omitempty"`
	Primary bool   `json:"primary,omitempty"`
}

type ServiceProviderConfig struct {
	Schemas               []string        `json:"schemas"`
	DocumentationURI      string          `json:"documentationUri,omitempty"`
	Patch                 Supported       `json:"patch"`
	Bulk                  BulkSupported   `json:"bulk"`
	Filter                FilterSupported `json:"filter"`
	ChangePassword        Supported       `json:"changePassword"`
	Sort                  Supported       `json:"sort"`
	ETag                  Supported       `json:"etag"`
	AuthenticationSchemes []AuthScheme    `json:"authenticationSchemes"`
	Meta                  *Meta           `json:"meta,omitempty"`
}

type Supported struct {
	Supported bool `json:"supported"`
}

type User struct {
	Schemas []string `json:"schemas"`

	// ID is this server's identifier for the account, and is opaque to the identity provider.
	ID string `json:"id,omitempty"`

	// ExternalID is the identity provider's own identifier.
	//
	// The stable join between the two systems, and the reason it matters is renaming: somebody who marries and changes
	// their username is the same person, and matching on username alone would deprovision one account and provision a
	// second - leaving the first enabled.
	ExternalID string `json:"externalId,omitempty"`

	// UserName is the login name. Required by the specification.
	UserName string `json:"userName"`

	// Name is the structured name.
	Name *Name `json:"name,omitempty"`

	// DisplayName is what to show.
	DisplayName string `json:"displayName,omitempty"`

	// Emails are the addresses, with at most one marked primary.
	Emails []Email `json:"emails,omitempty"`

	// Active says whether the account may sign in.
	//
	// A pointer so that absent is distinguishable from false. This is the single most important field in the protocol:
	// an identity provider disabling somebody sends active false, and a PATCH that omits it must not be read as a
	// request to disable - nor a PUT that forgot it be read as a request to enable.
	Active *bool `json:"active,omitempty"`

	// Groups are the groups this user belongs to, which is how a role arrives.
	Groups []GroupRef `json:"groups,omitempty"`

	// Roles is the other way a provider may send a role, used by some directly.
	Roles []Role `json:"roles,omitempty"`

	// Meta carries resource metadata.
	Meta *Meta `json:"meta,omitempty"`

	// Password appears on creation from some providers. Never stored as sent and never echoed.
	//
	// Present in the struct only so that a provider sending one does not get an unknown-attribute error. It is
	// deliberately not in any response, because echoing a password back - even the one just supplied - puts it in the
	// provider's own logs.
	Password string `json:"password,omitempty"`
}