feat(scim): add /ResourceTypes and /Schemas

Add `GET /scim/v2/ResourceTypes` and `GET /scim/v2/Schemas` with
an empty list. Neither endpoint supports filtering.

Author: xlgmokha

internal/api/scim/fixtures/fixtures.go

@@ -7,15 +7,20 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"github.com/supabase/auth/internal/api/scim/fixtures"
 )
 
+const notFoundError = `{
+	"schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
+	"status": "404",
+	"detail": "Endpoint or resource does not exist"
+}`
+
 func TestNewError(t *testing.T) {
 	t.Run("serializes to JSON correctly", func(t *testing.T) {
 		body, err := json.Marshal(NewError(http.StatusNotFound, "", "Endpoint or resource does not exist"))
 
 		require.NoError(t, err)
-		assert.JSONEq(t, fixtures.NotFound, string(body))
+		assert.JSONEq(t, notFoundError, string(body))
 	})
 
 	t.Run("includes the scimType when one is given", func(t *testing.T) {
@@ -48,7 +53,7 @@ func TestErrorStatusCode(t *testing.T) {
 
 	t.Run("survives a round trip through JSON", func(t *testing.T) {
 		var scimErr Error
-		require.NoError(t, json.Unmarshal([]byte(fixtures.NotFound), &scimErr))
+		require.NoError(t, json.Unmarshal([]byte(notFoundError), &scimErr))
 
 		assert.Equal(t, http.StatusNotFound, scimErr.StatusCode())
 		assert.Equal(t, "404", scimErr.Status)

internal/api/scim/fixtures/not_implemented.json

@@ -0,0 +1,25 @@
+package protocol
+
+const SchemaListResponse = "urn:ietf:params:scim:api:messages:2.0:ListResponse"
+
+type ListResponse[T any] struct {
+	Schemas      []string `json:"schemas"`
+	TotalResults int      `json:"totalResults"`
+	StartIndex   int      `json:"startIndex"`
+	ItemsPerPage int      `json:"itemsPerPage"`
+	Resources    []T      `json:"Resources"`
+}
+
+func NewListResponse[T any](resources []T) *ListResponse[T] {
+	if resources == nil {
+		resources = []T{}
+	}
+	n := len(resources)
+	return &ListResponse[T]{
+		Schemas:      []string{SchemaListResponse},
+		TotalResults: n,
+		StartIndex:   1,
+		ItemsPerPage: n,
+		Resources:    resources,
+	}
+}

internal/api/scim/protocol/error_test.go

@@ -0,0 +1,53 @@
+package protocol
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+const emptyListResponse = `{
+	"schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+	"totalResults": 0,
+	"startIndex": 1,
+	"itemsPerPage": 0,
+	"Resources": []
+}`
+
+func TestNewListResponse(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		resources []string
+		expected  string
+	}{
+		{
+			name:      "nil resources marshal to an empty array",
+			resources: nil,
+			expected:  emptyListResponse,
+		},
+		{
+			name:      "empty resources marshal to an empty array",
+			resources: []string{},
+			expected:  emptyListResponse,
+		},
+		{
+			name:      "populated resources are counted",
+			resources: []string{"a", "b"},
+			expected: `{
+				"schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+				"totalResults": 2,
+				"startIndex": 1,
+				"itemsPerPage": 2,
+				"Resources": ["a", "b"]
+			}`,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			body, err := json.Marshal(NewListResponse(tc.resources))
+
+			require.NoError(t, err)
+			require.JSONEq(t, tc.expected, string(body))
+		})
+	}
+}

internal/api/scim/protocol/list_response.go

@@ -29,11 +29,11 @@ func (srv *Server) ServiceProviderConfig(w http.ResponseWriter, r *http.Request)
 }
 
 func (srv *Server) ResourceTypes(w http.ResponseWriter, r *http.Request) error {
-	return notImplemented()
+	return emptyList(w, r, []any{})
 }
 
 func (srv *Server) Schemas(w http.ResponseWriter, r *http.Request) error {
-	return notImplemented()
+	return emptyList(w, r, []any{})
 }
 
 func (srv *Server) NotFound(w http.ResponseWriter, r *http.Request) error {
@@ -45,6 +45,9 @@ func (srv *Server) MethodNotAllowed(w http.ResponseWriter, r *http.Request) erro
 	return protocol.NewError(http.StatusMethodNotAllowed, "", "The request method is not supported by this endpoint")
 }
 
-func notImplemented() error {
-	return protocol.NewError(http.StatusNotImplemented, "", "The request endpoint is not implemented")
+func emptyList[T any](w http.ResponseWriter, r *http.Request, resources []T) error {
+	if r.URL.Query().Get("filter") != "" {
+		return protocol.NewError(http.StatusForbidden, "", "Filtering is not supported on this endpoint")
+	}
+	return protocol.Send(w, http.StatusOK, protocol.NewListResponse(resources))
 }

internal/api/scim/protocol/list_response_test.go

@@ -1,22 +1,33 @@
 package scim
 
 import (
+	"embed"
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	"github.com/supabase/auth/internal/api/scim/fixtures"
 	"github.com/supabase/auth/internal/api/scim/protocol"
 	"github.com/supabase/auth/internal/conf"
 )
 
+//go:embed testdata/*
+var fixtures embed.FS
+
 func newServerFor(externalURL string) *Server {
 	return NewServer(&conf.GlobalConfiguration{
 		API: conf.APIConfiguration{ExternalURL: externalURL},
 	})
 }
 
+func testFixture(t *testing.T, file string) string {
+	data, err := fixtures.ReadFile("testdata/" + file)
+	require.NoError(t, err)
+	return string(data)
+}
+
 func TestServer(t *testing.T) {
 	srv := newServerFor("http://localhost:9999")
 	require.NotNil(t, srv)
@@ -35,7 +46,7 @@ func TestServer(t *testing.T) {
 
 		require.Equal(t, http.StatusOK, w.Code)
 		require.Equal(t, protocol.MediaType, w.Header().Get("Content-Type"))
-		require.JSONEq(t, fixtures.ServiceProviderConfig, w.Body.String())
+		require.JSONEq(t, testFixture(t, "service_provider_config.json"), w.Body.String())
 	})
 
 	for _, tc := range []struct {
@@ -49,10 +60,23 @@ func TestServer(t *testing.T) {
 			r := httptest.NewRequest(http.MethodGet, BasePath+"/"+tc.path, nil)
 			w := httptest.NewRecorder()
 
+			require.NoError(t, tc.handler(w, r))
+
+			require.Equal(t, http.StatusOK, w.Code)
+			require.Equal(t, protocol.MediaType, w.Header().Get("Content-Type"))
+			require.JSONEq(t, testFixture(t, "empty_list_response.json"), w.Body.String())
+		})
+
+		t.Run(tc.path+" rejects filter query parameter", func(t *testing.T) {
+			filter := url.Values{"filter": {`name eq "User"`}}.Encode()
+			r := httptest.NewRequest(http.MethodGet, BasePath+"/"+tc.path+"?"+filter, nil)
+			w := httptest.NewRecorder()
+
 			var scimErr *protocol.Error
 			require.ErrorAs(t, tc.handler(w, r), &scimErr)
 
-			require.Equal(t, http.StatusNotImplemented, scimErr.StatusCode())
+			require.Equal(t, http.StatusForbidden, scimErr.StatusCode())
+			requireMarshalsTo(t, testFixture(t, "filter_forbidden.json"), scimErr)
 		})
 	}
 
@@ -64,7 +88,7 @@ func TestServer(t *testing.T) {
 		require.ErrorAs(t, srv.NotFound(w, r), &scimErr)
 
 		require.Equal(t, http.StatusNotFound, scimErr.StatusCode())
-		require.Equal(t, "Endpoint or resource does not exist", scimErr.Detail)
+		requireMarshalsTo(t, testFixture(t, "not_found.json"), scimErr)
 	})
 
 	t.Run("NotAllowed", func(t *testing.T) {
@@ -76,5 +100,14 @@ func TestServer(t *testing.T) {
 
 		require.Equal(t, http.StatusMethodNotAllowed, scimErr.StatusCode())
 		require.Equal(t, http.MethodGet, w.Header().Get("Allow"))
+		requireMarshalsTo(t, testFixture(t, "method_not_allowed.json"), scimErr)
 	})
 }
+
+func requireMarshalsTo(t *testing.T, expected string, v any) {
+	t.Helper()
+
+	body, err := json.Marshal(v)
+	require.NoError(t, err)
+	require.JSONEq(t, expected, string(body))
+}

internal/api/scim/server.go

@@ -0,0 +1,9 @@
+{
+  "schemas": [
+    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
+  ],
+  "totalResults": 0,
+  "startIndex": 1,
+  "itemsPerPage": 0,
+  "Resources": []
+}

internal/api/scim/server_test.go

@@ -0,0 +1,7 @@
+{
+  "schemas": [
+    "urn:ietf:params:scim:api:messages:2.0:Error"
+  ],
+  "detail": "Filtering is not supported on this endpoint",
+  "status": "403"
+}