WIP

app/server/lib/scim/index.ts

@@ -0,0 +1,24 @@
+import * as express from 'express';
+import { buildUsersRoute, checkPermissionToUsersEndpoint } from './v2/users';
+import { HomeDBManager } from 'app/gen-server/lib/homedb/HomeDBManager';
+import SCIMMY from "scimmy";
+import SCIMMYRouters from "scimmy-routers";
+
+type SCIMMYResource = typeof SCIMMY.Types.Resource;
+
+const buildScimRouter = (dbManager: HomeDBManager) => {
+  const v2 = express.Router();
+  v2.use('/Users', checkPermissionToUsersEndpoint, buildUsersRoute(dbManager));
+
+  SCIMMY.Resources.User.ingress(handler)
+  SCIMMY.Resources.declare(SCIMMY.Resources.User)
+    .ingress((resource: SCIMMYResource, data) => {
+
+
+    });
+  const scim = express.Router();
+  scim.use('/v2', v2);
+  return scim;
+};
+
+export { buildScimRouter };

app/server/lib/scim/v2/users.ts

@@ -0,0 +1,37 @@
+import express, { NextFunction, Request, Response } from 'express';
+import { HomeDBManager } from 'app/gen-server/lib/homedb/HomeDBManager';
+import { expressWrap } from '../../expressWrap';
+import { integerParam } from '../../requestUtils';
+import { ApiError } from 'app/common/ApiError';
+import { RequestWithLogin } from '../../Authorizer';
+
+function checkPermissionToUsersEndpoint(req: Request, res: Response, next: NextFunction) {
+  const mreq = req as RequestWithLogin;
+  const adminEmail = process.env.GRIST_DEFAULT_EMAIL;
+  if (!adminEmail || mreq.user?.loginEmail !== adminEmail) {
+    throw new ApiError('Permission denied', 403);
+  }
+  return next();
+}
+
+const buildUsersRoute = (dbManager: HomeDBManager) => {
+  const userRoute = express.Router();
+
+  async function findUserOrFail(userId: number) {
+    const user = await dbManager.getUser(userId);
+    if (!user) {
+      throw new ApiError('User not found', 404);
+    }
+    return user;
+  }
+
+
+  userRoute.get('/:id', expressWrap(async (req, res) => {
+    const userId = integerParam(req.params.id, 'id');
+    const user = await findUserOrFail(userId);
+    res.status(200).json(user);
+  }));
+  return userRoute;
+};
+
+export { buildUsersRoute, checkPermissionToUsersEndpoint };