# ash_scim v0.1.0 - Table of Contents

> A SCIM 2.0 server extension for the Ash Framework.

## GUIDES

- [README](readme.md)
- [Change Log](changelog.md)

- Tutorials
  - [Get started with AshScim](get-started.md)

- Topics
  - [Multi-valued attributes](multi-valued-attributes.md)
  - [Filter syntax](filters.md)
  - [PATCH operations](patch-operations.md)
  - [Authentication](authentication.md)
  - [Policies & the bypass check](policies.md)
  - [Multi-tenancy](multitenancy.md)
  - [Known limitations](limitations.md)

- Reference
  - [AshScim.User](dsl-ashscim-user.md)
  - [AshScim.Group](dsl-ashscim-group.md)

## Modules

- Internals
  - [AshScim](AshScim.md): AshScim — a SCIM 2.0 server extension for the Ash Framework.
  - [AshScim.Auth](AshScim.Auth.md): Behaviour for authenticating inbound SCIM requests.
  - [AshScim.Auth.AshAuthenticationToken](AshScim.Auth.AshAuthenticationToken.md): Authenticates SCIM requests using JWTs issued by `AshAuthentication`.
  - [AshScim.Auth.StaticBearer](AshScim.Auth.StaticBearer.md): Authenticates SCIM requests against one or more static bearer tokens.
  - [AshScim.Checks.AshScimInteraction](AshScim.Checks.AshScimInteraction.md): Returns `true` when the changeset/query has `context.private.ash_scim?`
set, which `AshScim.Router` does for every internal Ash call.
  - [AshScim.Decoder](AshScim.Decoder.md): Decodes inbound SCIM 2.0 JSON payloads into Ash action input.
  - [AshScim.Discovery](AshScim.Discovery.md): Generates the SCIM 2.0 discovery documents — `Schemas` (RFC 7643 §7) and
`ResourceTypes` (RFC 7644 §4) — directly from the resource DSL.
  - [AshScim.Dsl.Complex](AshScim.Dsl.Complex.md): Represents a SCIM complex (object-valued) attribute, declared via the
`complex/2` block in the `scim` section.
  - [AshScim.Dsl.Extension](AshScim.Dsl.Extension.md): Represents a SCIM schema extension (RFC 7643 §3.3): a group of attributes
that live under a separate schema URN key in the resource JSON — e.g. the
enterprise user extension
`urn:ietf:params:scim:schemas:extension:enterprise:2.0:User`, whose object
carries `manager`, `department`, etc.
  - [AshScim.Dsl.Map](AshScim.Dsl.Map.md): Represents a single SCIM attribute mapping declared via `map/2` in the
`scim` section of a resource.
  - [AshScim.Dsl.Multivalued](AshScim.Dsl.Multivalued.md): Represents a SCIM multi-valued attribute, declared via the `multivalued/2`
block in the `scim` section.
  - [AshScim.Encoder](AshScim.Encoder.md): Encodes Ash records into SCIM 2.0 JSON-shaped maps using the mappings
declared in the resource's `scim` section.
  - [AshScim.Error](AshScim.Error.md): Builders for SCIM 2.0 error response bodies (RFC 7644 §3.12).
  - [AshScim.Filter](AshScim.Filter.md): Parses a SCIM 2.0 filter expression (RFC 7644 §3.4.2.2) directly into the
map-shaped filter input accepted by `Ash.Query.filter/2` and
`Ash.Filter.parse_input/2`.
  - [AshScim.Group](AshScim.Group.md): Marks an Ash resource as a SCIM `Group` resource per RFC 7643 §4.2.
  - [AshScim.Igniter](AshScim.Igniter.md): Igniter helpers used by `mix ash_scim.install` and friends. None of
these touch runtime introspection — they all read and write the
project's source files via `Igniter` so the installer can run before
the user's code is compiled.

  - [AshScim.Info](AshScim.Info.md): Introspection for the `AshScim.User` and `AshScim.Group` extensions.
  - [AshScim.Patch](AshScim.Patch.md): Translates a SCIM 2.0 PATCH request body (RFC 7644 §3.5.2) into a
structured input describing both attribute updates and relationship-level
operations
  - [AshScim.Patch.Path](AshScim.Patch.Path.md): Parser for SCIM 2.0 PATCH `path` expressions (RFC 7644 §3.5.2).
  - [AshScim.Projection](AshScim.Projection.md): Applies the SCIM `attributes` / `excludedAttributes` query parameters to an
encoded resource map (RFC 7644 §3.4.2.5).
  - [AshScim.Router](AshScim.Router.md): A `Plug` that exposes Ash resources as a SCIM 2.0 server.
  - [AshScim.Test.PolicyExample.User](AshScim.Test.PolicyExample.User.md): Fixture for verifying that `AshScim.Checks.AshScimInteraction` bypasses
policies that would otherwise forbid every action.
  - [AshScim.Test.SourceExample.Auth](AshScim.Test.SourceExample.Auth.md): Realistic per-source auth implementation: each SCIM client carries a
JWT issued by AshAuthentication, and the JWT contains a custom
`scim_source` claim identifying which IdP the request is from.
  - [AshScim.Test.SourceExample.ScopeBySource](AshScim.Test.SourceExample.ScopeBySource.md): Filters reads to records whose `:scim_source` matches the request-scoped
`scim_source` set by the auth implementation. Demonstrates the same
context-flowing-through-to-queries pattern as the changeset side.

  - [AshScim.Test.SourceExample.StampSource](AshScim.Test.SourceExample.StampSource.md): Reads the request-scoped `scim_source` that the auth implementation
put on the conn (then onto the changeset's context by the router) and
writes it onto the new record's `:scim_source` attribute.

  - [AshScim.Test.SourceExample.User](AshScim.Test.SourceExample.User.md): Fixture for verifying that auth-time context flows through to
changesets/queries the router builds.
  - [AshScim.Test.TenantExample.User](AshScim.Test.TenantExample.User.md): Multi-tenant fixture using Ash's attribute-based multitenancy strategy.
  - [AshScim.User](AshScim.User.md): Marks an Ash resource as a SCIM `User` resource per RFC 7643 §4.1.
  - [AshScim.Verifiers.Relationship](AshScim.Verifiers.Relationship.md): Compile-time verifier for `multivalued` declarations.

## Mix Tasks

- Internals
  - [mix ash_scim.install](Mix.Tasks.AshScim.Install.md): Installs AshScim. Invoke with `mix igniter.install ash_scim`