Help us shape the future of Go! Take the 2026 Go Developer Survey

store

package
v0.21.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 26, 2026 License: MIT Imports: 25 Imported by: 0

Documentation

Overview

Package store provides SCIM Store implementations.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Config 

type Config struct {
	// BaseURL is the base URL for SCIM resources.
	BaseURL string

	// DefaultRole is the default role for new group members.
	DefaultRole string

	// TrustProvisionedEmail marks emails written through SCIM as verified.
	// Enable it only when the identity provider is trusted to assert email
	// ownership: a verified email lets a later social login with the same
	// address link to the provisioned user automatically. When false (the
	// default), provisioned and changed emails are unverified, and social
	// login refuses to link rather than creating a second identity.
	TrustProvisionedEmail bool

	// Memberships adds, changes and removes organization memberships for
	// SCIM, with their side effects: authorization-graph sync, access-change
	// records, and cleanup of application roles and resource grants. Pass
	// the application's organization service so the graph sync uses its
	// syncer. Default: organization.NewService on the store's client, which
	// records access changes but syncs no authorization graph.
	Memberships Memberships

	// Principals deactivates and reactivates accounts, recording the access
	// change that stops existing tokens being honored. Default:
	// principal.NewService on the store's client.
	Principals Principals

	// Organizations creates, renames and deletes the organizations a
	// platform-scoped credential manages as groups, with the organization
	// service's slug rules and authorization-graph sync. Default: Memberships
	// when it also implements Organizations (as organization.Service does),
	// otherwise organization.NewService on the store's client.
	Organizations Organizations

	// Syncer removes a deleted user's relationships from the authorization
	// graph: its memberships, platform administration, manager relations
	// (both those on the user and those it holds), application roles and
	// resource grants. DeleteUser removes them before the deletion commits,
	// holding the graph locks; if the graph refuses, the user is not
	// deleted. Pass the same syncer as Memberships and Principals use.
	// Default: none, for deployments without a graph.
	Syncer authz.RelationshipSyncer
}

Config holds configuration for the Ent store.

func DefaultConfig 

func DefaultConfig() *Config

DefaultConfig returns the default store configuration.

type EntStore 

type EntStore struct {
	// contains filtered or unexported fields
}

EntStore implements the scim.Store interface using Ent ORM.

func NewEntStore 

func NewEntStore(client *ent.Client, config *Config) *EntStore

NewEntStore creates a new Ent-backed SCIM store.

func (*EntStore) AddMemberToGroup 

func (s *EntStore) AddMemberToGroup(ctx context.Context, groupID, userID string) error

AddMemberToGroup adds a user to a group. Adding an existing member is a no-op; re-adding a deactivated member restores the membership with the default role. A tenant may add only users it already sees: members of its organization, active or not.

func (*EntStore) CreateGroup 

func (s *EntStore) CreateGroup(ctx context.Context, scimGroup *scim.Group) (*scim.Group, error)

CreateGroup creates a new group. Only a platform scope may create groups. The organization is created through the organization service, so its slug obeys the same rules as any other: a valid format, not reserved, not taken and not in another organization's cooling-off period.

func (*EntStore) CreateUser 

func (s *EntStore) CreateUser(ctx context.Context, scimUser *scim.User) (*scim.User, error)

CreateUser creates a new user as a human principal. For a tenant, the user also becomes a member of the tenant's organization, and the tenant is recorded as having provisioned it. A user who already exists elsewhere is linked by adding the membership; their identity is not changed.

The account is created first and the membership is added after through the membership service. If adding it fails, the request fails and the identity provider's retry finds the account by email and links it.

func (*EntStore) DeleteGroup 

func (s *EntStore) DeleteGroup(ctx context.Context, id string) error

DeleteGroup deletes a group. Only a platform scope may delete groups, and never a personal organization. The organization is soft-deleted through the organization service, as an administrator's delete is.

func (*EntStore) DeleteUser 

func (s *EntStore) DeleteUser(ctx context.Context, id string) error

DeleteUser deletes a user. For a tenant, a user the tenant does not own only loses the membership in the tenant's organization. Otherwise every membership is removed through the membership service, the account is deactivated so existing tokens stop being honored, and the account and the records that belong only to it, its manager relations included, are deleted, after its relationships are removed from the authorization graph (Config.Syncer). An organization owner, and a user who actively manages other accounts, are never deleted through SCIM.

func (*EntStore) GetGroupByDisplayName 

func (s *EntStore) GetGroupByDisplayName(ctx context.Context, displayName string) (*scim.Group, error)

GetGroupByDisplayName retrieves a group by displayName.

func (*EntStore) GetGroupByExternalID 

func (s *EntStore) GetGroupByExternalID(ctx context.Context, externalID string) (*scim.Group, error)

GetGroupByExternalID retrieves a group by externalId (the organization slug).

func (*EntStore) GetGroupByID 

func (s *EntStore) GetGroupByID(ctx context.Context, id string) (*scim.Group, error)

GetGroupByID retrieves a group by SCIM ID.

func (*EntStore) GetGroupsForUser 

func (s *EntStore) GetGroupsForUser(ctx context.Context, userID string) ([]scim.GroupRef, error)

GetGroupsForUser returns all groups a user belongs to. A tenant sees only its own organization.

func (*EntStore) GetGroupsForUsers added in v0.21.0 

func (s *EntStore) GetGroupsForUsers(ctx context.Context, userIDs []string) (map[string][]scim.GroupRef, error)

GetGroupsForUsers returns the groups of each user in one query, implementing scim.BatchMembershipStore. A tenant sees only its own organization; IDs that are not UUIDs are skipped.

func (*EntStore) GetMembersForGroup 

func (s *EntStore) GetMembersForGroup(ctx context.Context, groupID string) ([]scim.MemberRef, error)

GetMembersForGroup returns all human members of a group.

func (*EntStore) GetMembersForGroups added in v0.21.0 

func (s *EntStore) GetMembersForGroups(ctx context.Context, groupIDs []string) (map[string][]scim.MemberRef, error)

GetMembersForGroups returns the members of each group in one query, implementing scim.BatchMembershipStore. A tenant sees only its own organization; other IDs, and IDs that are not UUIDs, are skipped.

func (*EntStore) GetUserByExternalID 

func (s *EntStore) GetUserByExternalID(ctx context.Context, externalID string) (*scim.User, error)

GetUserByExternalID retrieves a user by externalId. SystemForge does not store externalId, so this always reports not found.

func (*EntStore) GetUserByID 

func (s *EntStore) GetUserByID(ctx context.Context, id string) (*scim.User, error)

GetUserByID retrieves a user by SCIM ID.

func (*EntStore) GetUserByUserName 

func (s *EntStore) GetUserByUserName(ctx context.Context, userName string) (*scim.User, error)

GetUserByUserName retrieves a user by userName (email). userName is not case-exact (RFC 7643 section 4.1.1), so the match ignores case.

func (*EntStore) ListGroups 

func (s *EntStore) ListGroups(ctx context.Context, opts scim.ListOptions) ([]*scim.Group, int, error)

ListGroups lists groups with filtering and pagination.

func (*EntStore) ListUsers 

func (s *EntStore) ListUsers(ctx context.Context, opts scim.ListOptions) ([]*scim.User, int, error)

ListUsers lists users with filtering and pagination.

func (*EntStore) RemoveMemberFromGroup 

func (s *EntStore) RemoveMemberFromGroup(ctx context.Context, groupID, userID string) error

RemoveMemberFromGroup removes a user from a group. An organization owner cannot be removed through SCIM.

func (*EntStore) UpdateGroup 

func (s *EntStore) UpdateGroup(ctx context.Context, id string, scimGroup *scim.Group) (*scim.Group, error)

UpdateGroup updates an existing group. A tenant may not rename its organization; an update that keeps the name is accepted so that member changes in the same request apply.

func (*EntStore) UpdateUser 

func (s *EntStore) UpdateUser(ctx context.Context, id string, scimUser *scim.User) (*scim.User, error)

UpdateUser updates an existing user. For a platform scope, active deactivates or reactivates the account. For a tenant, active suspends or restores the membership in the tenant's organization, and identity fields change only for users the tenant owns; for other users they are left as they are.

type Memberships added in v0.20.0 

type Memberships interface {
	AddMember(ctx context.Context, input orgsvc.AddMemberInput) (*orgsvc.Membership, error)
	UpdateMember(ctx context.Context, membershipID uuid.UUID, input orgsvc.UpdateMemberInput) (*orgsvc.Membership, error)
	RemoveMember(ctx context.Context, organizationID, principalID uuid.UUID) error
}

Memberships is the part of organization.Service the SCIM store uses.

type Organizations added in v0.21.0 

type Organizations interface {
	Create(ctx context.Context, input orgsvc.CreateOrganizationInput) (*orgsvc.Organization, error)
	Update(ctx context.Context, id uuid.UUID, input orgsvc.UpdateOrganizationInput) (*orgsvc.Organization, error)
	Delete(ctx context.Context, id uuid.UUID) error
	GenerateSlug(ctx context.Context, name string) (string, error)
}

Organizations is the part of organization.Service the SCIM store uses to manage groups.

type Principals added in v0.20.0 

type Principals interface {
	Deactivate(ctx context.Context, id uuid.UUID) error
	Reactivate(ctx context.Context, id uuid.UUID) error
}

Principals is the part of principal.Service the SCIM store uses.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.