SCIM Server Guide

Welcome to the comprehensive guide for the SCIM Server library! This guide will take you from initial setup to advanced usage patterns, helping you build robust identity provisioning systems with Rust.

What is SCIM Server?

SCIM Server is a comprehensive Rust library that implements the SCIM 2.0 (System for Cross-domain Identity Management) protocol. It provides a type-safe, high-performance foundation for building identity provisioning and management systems.

Why SCIM?

SCIM is the industry standard for automating user provisioning between identity providers and applications. Instead of building custom APIs for user management, SCIM provides:

• Standardized Operations: Consistent CRUD operations across all systems
• Rich Filtering: Powerful query capabilities for finding users and groups
• Bulk Operations: Efficient handling of large-scale provisioning tasks
• Schema Validation: Automatic validation against well-defined schemas
• Interoperability: Works with existing identity providers and applications

Why This Library?

The SCIM Server library takes SCIM implementation to the next level with:

• 🛡️ Type Safety: Leverage Rust's type system to prevent runtime errors
• 🏢 Multi-Tenancy: Built-in support for multiple organizations
• ⚡ Performance: Async-first design with minimal overhead
• 🔌 Flexibility: Framework-agnostic with pluggable storage
• 🤖 AI Integration: Built-in Model Context Protocol support
• 🔄 Concurrency Control: ETag-based optimistic locking

Architecture Overview

The SCIM Server follows a clean three-layer architecture:

┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
│   HTTP Layer    │    │   SCIM Server    │    │   Storage       │
│                 │    │                  │    │                 │
│  • Axum         │───▶│  • Validation    │───▶│  • In-Memory    │
│  • Warp         │    │  • Operations    │    │  • Database     │
│  • Actix        │    │  • Multi-tenant  │    │  • Custom       │
│  • Custom       │    │  • Type Safety   │    │                 │
└─────────────────┘    └──────────────────┘    └─────────────────┘

HTTP Layer: Your choice of web framework handles HTTP requests and responses.

SCIM Server: The core library handles SCIM protocol logic, validation, multi-tenancy, and type safety.

Storage: Pluggable storage providers handle data persistence, from simple in-memory stores to enterprise databases.

Value Proposition

Instead of building provisioning logic into every application, the SCIM Server centralizes complexity:

Result: Your applications focus on business logic while SCIM Server handles all provisioning complexity.

Who Should Use This Guide?

This guide is designed for:

• Rust Developers building identity-aware applications
• System Architects designing multi-tenant SaaS platforms
• DevOps Engineers automating user provisioning workflows
• AI Engineers integrating identity management with AI tools
• Security Engineers implementing enterprise identity solutions

How to Use This Guide

The guide is organized into progressive sections:

1. Getting Started: Quick setup and basic usage
2. Core Concepts: Understanding the fundamental ideas
3. Tutorials: Step-by-step guides for common scenarios
4. How-To Guides: Solutions for specific problems
5. Advanced Topics: Deep dives into complex scenarios
6. Reference: Technical specifications and details

Learning Path

New to SCIM? Start with SCIM Protocol Overview to understand the standard.

Ready to code? Jump to Your First SCIM Server for hands-on experience.

Building production systems? Read through Core Concepts and Advanced Topics.

Solving specific problems? Use the How-To Guides section.

What You'll Learn

By the end of this guide, you'll be able to:

• Set up and configure SCIM Server for your use case
• Implement multi-tenant identity provisioning systems
• Handle complex scenarios like custom resources and authentication
• Integrate with web frameworks and AI tools
• Deploy production-ready SCIM services
• Troubleshoot common issues and optimize performance

Getting Help

• Examples: Check the examples directory for working code
• API Documentation: See docs.rs for detailed API reference
• Issues: Report bugs or ask questions on GitHub Issues

Let's get started! 🚀

Installation

This guide covers installing and setting up the SCIM Server library in your Rust project.

Prerequisites

Before you begin, ensure you have:

• Rust 1.75 or later - Install Rust
• Cargo - Comes with Rust installation
• Basic familiarity with Rust and async programming

You can verify your Rust installation:

rustc --version
cargo --version

Adding SCIM Server to Your Project

Option 1: Using Cargo (Recommended)

Add SCIM Server to your Cargo.toml dependencies:

[dependencies]
scim-server = "=0.3.2"
tokio = { version = "1.0", features = ["full"] }
serde_json = "1.0"

⚠️ Version Pinning: Use exact version pinning (=0.3.2) during active development to avoid breaking changes. See Version Strategy for details.

Option 2: Using Cargo Add Command

cargo add scim-server@=0.3.2
cargo add tokio --features full
cargo add serde_json

Feature Flags

SCIM Server provides several optional features to reduce compile time and binary size:

[dependencies]
scim-server = { version = "=0.3.2", features = ["mcp", "auth", "logging"] }

Available features:

Development Dependencies

For development and testing, you may want additional dependencies:

[dev-dependencies]
tokio-test = "0.4"
serde_json = "1.0"
uuid = { version = "1.0", features = ["v4"] }

Verification

Create a simple test to verify your installation:

#![allow(unused)]
fn main() {
use scim_server::{
    providers::StandardResourceProvider,
    storage::InMemoryStorage,
    RequestContext,
};
use serde_json::json;

#[tokio::test]
async fn test_installation() {
    let storage = InMemoryStorage::new();
    let provider = StandardResourceProvider::new(storage);
    let context = RequestContext::new("test".to_string());
    
    // Test creating a simple resource
    let user_data = json!({
        "userName": "test.user",
        "emails": [{"value": "test@example.com", "primary": true}]
    });
    
    let user = provider.create_resource("User", user_data, &context).await.unwrap();
    
    // If this compiles and runs, installation is successful!
    println!("SCIM Server installed successfully!");
    println!("Created test user: {}", user.get_username().unwrap_or("unknown"));
}
}

Run the test:

cargo test test_installation

IDE Setup

Visual Studio Code

For the best development experience with VS Code:

1. Install the rust-analyzer extension
2. Install the Better TOML extension

IntelliJ IDEA / CLion

Install the Rust plugin for full Rust support.

Next Steps

Now that you have SCIM Server installed, you're ready to:

1. Create Your First Server - Build a basic SCIM server
2. Learn Basic Operations - Understand CRUD operations
3. Explore Examples - See working code samples

Troubleshooting

Common Installation Issues

Rust version too old:

rustup update stable

Compilation errors:

• Ensure you're using exact version pinning (=0.3.2)
• Check that all required features are enabled
• Verify tokio features include "full" or at minimum "rt-multi-thread", "macros"

Performance issues during compilation:

• Consider disabling unused features
• Use cargo build --release for optimized builds
• Increase available RAM for compilation

Getting Help

If you encounter issues:

1. Check the Troubleshooting Guide
2. Search existing GitHub Issues
3. Create a new issue with your system details and error messages

Platform-Specific Notes

Windows

No special requirements. SCIM Server works on all Windows versions supported by Rust.

macOS

No special requirements. Works on both Intel and Apple Silicon Macs.

Linux

Works on all major Linux distributions. If using system packages instead of rustup:

Ubuntu/Debian:

sudo apt update
sudo apt install build-essential

CentOS/RHEL/Fedora:

sudo yum groupinstall "Development Tools"
# or for newer versions:
sudo dnf groupinstall "Development Tools"

You're now ready to build with SCIM Server! 🚀

Your First SCIM Server

This tutorial walks you through creating your first SCIM server from scratch. By the end, you'll have a working SCIM server that can manage users and groups with full CRUD operations.

What We'll Build

We'll create a simple SCIM server that:

• Manages users and groups
• Supports basic CRUD operations
• Uses in-memory storage for simplicity
• Includes proper error handling
• Demonstrates multi-tenant capabilities

Step 1: Project Setup

First, create a new Rust project:

cargo new my-scim-server
cd my-scim-server

Add the required dependencies to your Cargo.toml:

[dependencies]
scim-server = "0.3.2"
tokio = { version = "1.0", features = ["full"] }
serde_json = "1.0"
anyhow = "1.0"

Step 2: Basic Server Setup

Create your first SCIM server in src/main.rs:

use scim_server::{
    ScimServer,
    providers::StandardResourceProvider,
    storage::InMemoryStorage,
    resource::{RequestContext, ResourceProvider},
    resource_handlers::{create_user_resource_handler, create_group_resource_handler},
    schema::SchemaRegistry,
    resource::ScimOperation,
};
use serde_json::json;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("🚀 Starting SCIM Server...");
    
    // Create storage backend
    let storage = InMemoryStorage::new();
    
    // Create resource provider with storage
    let provider = StandardResourceProvider::new(storage);
    
    // Create SCIM server with provider
    let mut server = ScimServer::new(provider)?;
    
    // Register User resource type
    let user_schema = SchemaRegistry::new()?.get_core_user_schema()?;
    let user_handler = create_user_resource_handler(user_schema);
    server.register_resource_type(
        "User",
        user_handler,
        vec![
            ScimOperation::Create,
            ScimOperation::Read,
            ScimOperation::Update,
            ScimOperation::Delete,
            ScimOperation::List,
            ScimOperation::Search,
        ],
    )?;
    
    // Register Group resource type
    let group_schema = SchemaRegistry::new()?.get_core_group_schema()?;
    let group_handler = create_group_resource_handler(group_schema);
    server.register_resource_type(
        "Group",
        group_handler,
        vec![
            ScimOperation::Create,
            ScimOperation::Read,
            ScimOperation::Update,
            ScimOperation::Delete,
            ScimOperation::List,
            ScimOperation::Search,
        ],
    )?;
    
    println!("✅ SCIM Server initialized successfully!");
    
    // We'll add operations here in the next steps
    
    Ok(())
}

Run this to verify everything works:

cargo run

You should see:

🚀 Starting SCIM Server...
✅ SCIM Server initialized successfully!

Step 3: Creating Your First User

Now let's create a user. Add this after the server initialization:

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // ... previous setup code ...
    
    println!("✅ SCIM Server initialized successfully!");
    
    // Create a request context for our operations
    let context = RequestContext::with_generated_id();
    
    println!("\n📝 Creating a user...");
    
    // Define user data
    let user_data = json!({
        "userName": "alice@example.com",
        "name": {
            "formatted": "Alice Smith",
            "familyName": "Smith",
            "givenName": "Alice"
        },
        "displayName": "Alice Smith",
        "emails": [
            {
                "value": "alice@example.com",
                "type": "work",
                "primary": true
            }
        ],
        "phoneNumbers": [
            {
                "value": "+1-555-123-4567",
                "type": "work"
            }
        ],
        "active": true
    });
    
    // Create the user
    let user = server.create_resource("User", user_data, &context).await?;
    
    println!("✅ Created user: {} (ID: {})", 
             user.get_username().unwrap_or("unknown"),
             user.get_id().unwrap_or("unknown"));
    
    Ok(())
}

Run this:

cargo run

You should see:

🚀 Starting SCIM Server...
✅ SCIM Server initialized successfully!

📝 Creating a user...
✅ Created user: alice@example.com (ID: user_abc123)

Step 4: Reading and Updating Users

Let's add operations to read and update users:

#![allow(unused)]
fn main() {
// ... after creating the user ...

println!("\n📖 Reading the user...");

// Get the user by ID
let user_id = user.get_id().unwrap();
let retrieved_user = server.get_resource("User", user_id, &context).await?;

match retrieved_user {
    Some(user) => {
        println!("✅ Retrieved user: {} ({})", 
                 user.get_username().unwrap_or("unknown"),
                 user.get_display_name().unwrap_or("unknown"));
    }
    None => {
        println!("❌ User not found");
    }
}

println!("\n📝 Updating the user...");

// Update user data
let updated_data = json!({
    "id": user_id,
    "userName": "alice@example.com",
    "name": {
        "formatted": "Alice Johnson",
        "familyName": "Johnson",  // Changed last name
        "givenName": "Alice"
    },
    "displayName": "Alice Johnson",
    "emails": [
        {
            "value": "alice@example.com",
            "type": "work",
            "primary": true
        },
        {
            "value": "alice.johnson@personal.com",  // Added personal email
            "type": "home",
            "primary": false
        }
    ],
    "active": true
});

// Update the user
let updated_user = server.update_resource("User", user_id, updated_data, &context).await?;

println!("✅ Updated user: {} ({})", 
         updated_user.get_username().unwrap_or("unknown"),
         updated_user.get_display_name().unwrap_or("unknown"));
}

Step 5: Working with Groups

Let's create a group and manage membership:

#![allow(unused)]
fn main() {
// ... after updating the user ...

println!("\n👥 Creating a group...");

let group_data = json!({
    "displayName": "Engineering Team",
    "members": [
        {
            "value": user_id,
            "display": "Alice Johnson",
            "type": "User"
        }
    ]
});

// Create the group
let group = server.create_resource("Group", group_data, &context).await?;

println!("✅ Created group: {} (ID: {})", 
         group.get_display_name().unwrap_or("unknown"),
         group.get_id().unwrap_or("unknown"));
}

Step 6: Listing Resources

Add functionality to list users and groups:

#![allow(unused)]
fn main() {
// ... after creating the group ...

println!("\n📋 Listing all users...");

// List all users
let users = server.list_resources("User", None, &context).await?;
println!("✅ Found {} users:", users.len());
for user in &users {
    println!("  - {} ({})", 
             user.get_username().unwrap_or("unknown"),
             user.get_display_name().unwrap_or("unknown"));
}

println!("\n📋 Listing all groups...");

// List all groups
let groups = server.list_resources("Group", None, &context).await?;
println!("✅ Found {} groups:", groups.len());
for group in &groups {
    println!("  - {} (ID: {})", 
             group.get_display_name().unwrap_or("unknown"),
             group.get_id().unwrap_or("unknown"));
}
}

Step 7: Search Operations

Add search functionality:

#![allow(unused)]
fn main() {
// ... after listing resources ...

println!("\n🔍 Searching for users...");

// Search for user by username
let found_user = server.find_resource_by_attribute(
    "User",
    "userName",
    &json!("alice@example.com"),
    &context,
).await?;

match found_user {
    Some(user) => {
        println!("✅ Found user by username: {} ({})", 
                 user.get_username().unwrap_or("unknown"),
                 user.get_display_name().unwrap_or("unknown"));
    }
    None => {
        println!("❌ User not found");
    }
}
}

Step 8: Multi-Tenant Operations

Finally, let's demonstrate multi-tenant capabilities:

#![allow(unused)]
fn main() {
use scim_server::TenantContext;

// ... after search operations ...

println!("\n🏢 Multi-tenant operations...");

// Create tenant-specific context
let tenant_context = TenantContext::new(
    "company-123".to_string(),
    "app-456".to_string(),
);
let tenant_request_context = RequestContext::with_tenant_generated_id(tenant_context);

// Create user in specific tenant
let tenant_user_data = json!({
    "userName": "bob@company123.com",
    "name": {
        "formatted": "Bob Wilson",
        "familyName": "Wilson",
        "givenName": "Bob"
    },
    "displayName": "Bob Wilson",
    "active": true
});

let tenant_user = server.create_resource("User", tenant_user_data, &tenant_request_context).await?;

println!("✅ Created user in tenant: {} (ID: {})", 
         tenant_user.get_username().unwrap_or("unknown"),
         tenant_user.get_id().unwrap_or("unknown"));

// Show tenant isolation
let default_users = server.list_resources("User", None, &context).await?;
let tenant_users = server.list_resources("User", None, &tenant_request_context).await?;

println!("📊 Default tenant has {} users", default_users.len());
println!("📊 Company-123 tenant has {} users", tenant_users.len());
println!("✅ Tenant isolation working correctly!");
}

Complete Example

Here's the complete working example:

use scim_server::{
    ScimServer,
    providers::StandardResourceProvider,
    storage::InMemoryStorage,
    resource::{RequestContext, TenantContext, ResourceProvider},
    resource_handlers::{create_user_resource_handler, create_group_resource_handler},
    schema::SchemaRegistry,
    resource::ScimOperation,
};
use serde_json::json;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("🚀 Starting SCIM Server...");
    
    // Create storage backend
    let storage = InMemoryStorage::new();
    
    // Create resource provider with storage
    let provider = StandardResourceProvider::new(storage);
    
    // Create SCIM server with provider
    let mut server = ScimServer::new(provider)?;
    
    // Register User resource type
    let user_schema = SchemaRegistry::new()?.get_core_user_schema()?;
    let user_handler = create_user_resource_handler(user_schema);
    server.register_resource_type(
        "User",
        user_handler,
        vec![
            ScimOperation::Create,
            ScimOperation::Read,
            ScimOperation::Update,
            ScimOperation::Delete,
            ScimOperation::List,
            ScimOperation::Search,
        ],
    )?;
    
    // Register Group resource type
    let group_schema = SchemaRegistry::new()?.get_core_group_schema()?;
    let group_handler = create_group_resource_handler(group_schema);
    server.register_resource_type(
        "Group",
        group_handler,
        vec![
            ScimOperation::Create,
            ScimOperation::Read,
            ScimOperation::Update,
            ScimOperation::Delete,
            ScimOperation::List,
            ScimOperation::Search,
        ],
    )?;
    
    println!("✅ SCIM Server initialized successfully!");
    
    // Create request context
    let context = RequestContext::with_generated_id();
    
    // Create a user
    let user_data = json!({
        "userName": "alice@example.com",
        "name": {
            "formatted": "Alice Smith",
            "familyName": "Smith",
            "givenName": "Alice"
        },
        "displayName": "Alice Smith",
        "emails": [
            {
                "value": "alice@example.com",
                "type": "work",
                "primary": true
            }
        ],
        "active": true
    });
    
    let user = server.create_resource("User", user_data, &context).await?;
    let user_id = user.get_id().unwrap();
    
    println!("✅ Created user: {} (ID: {})", 
             user.get_username().unwrap_or("unknown"), user_id);
    
    // Create a group
    let group_data = json!({
        "displayName": "Engineering Team",
        "members": [
            {
                "value": user_id,
                "display": "Alice Smith",
                "type": "User"
            }
        ]
    });
    
    let group = server.create_resource("Group", group_data, &context).await?;
    
    println!("✅ Created group: {} (ID: {})", 
             group.get_display_name().unwrap_or("unknown"),
             group.get_id().unwrap_or("unknown"));
    
    // List resources
    let users = server.list_resources("User", None, &context).await?;
    let groups = server.list_resources("Group", None, &context).await?;
    
    println!("📊 Total: {} users, {} groups", users.len(), groups.len());
    
    println!("🎉 SCIM Server example completed successfully!");
    
    Ok(())
}

Next Steps

Now that you have a working SCIM server, you can:

1. Add Authentication - Secure your SCIM endpoints
2. Implement Custom Resources - Extend beyond Users and Groups
3. Deploy for Production - Scale your SCIM server
4. Add Database Storage - Replace in-memory storage with persistence
5. Set up Multi-Tenancy - Support multiple customers

Troubleshooting

Common Issues

Compilation Errors

• Make sure you're using the correct version: scim-server = "0.3.2"
• Ensure all required features are enabled

Runtime Errors

• Check that all resource types are registered before use
• Verify request contexts are properly created

Resource Not Found

• Ensure you're using the correct tenant context
• Check that the resource was created successfully

For more help, see the Troubleshooting Guide.

Basic Operations

This guide covers the fundamental SCIM operations you'll use most frequently. After reading this, you'll understand how to perform all basic CRUD operations and work with SCIM resources effectively.

Overview

SCIM (System for Cross-domain Identity Management) defines standard operations for managing identity resources. SCIM Server implements all core operations:

• Create - Add new resources
• Read - Retrieve existing resources
• Update - Modify existing resources
• Delete - Remove resources
• List - Query multiple resources with filtering and pagination

Prerequisites

Before starting, ensure you have:

• SCIM Server installed and configured
• Basic understanding of JSON structure
• Familiarity with async/await in Rust

Basic Setup

All examples assume this basic setup:

use scim_server::{
    providers::StandardResourceProvider,
    storage::InMemoryStorage,
    RequestContext,
};
use serde_json::json;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let storage = InMemoryStorage::new();
    let provider = StandardResourceProvider::new(storage);
    let context = RequestContext::new("my-request".to_string());
    
    // Operations go here...
    
    Ok(())
}

User Operations

Creating Users

The most basic operation is creating a user:

#![allow(unused)]
fn main() {
// Minimal user creation
let user_data = json!({
    "userName": "alice@example.com"
});

let user = provider.create_resource("User", user_data, &context).await?;
println!("Created user: {} with ID: {}", 
         user.get_username().unwrap_or("unknown"),
         user.get_id().unwrap_or("unknown"));
}

Complete user with all common fields:

#![allow(unused)]
fn main() {
let full_user_data = json!({
    "userName": "alice@example.com",
    "name": {
        "givenName": "Alice",
        "familyName": "Smith",
        "middleName": "M",
        "honorificPrefix": "Ms.",
        "honorificSuffix": "PhD"
    },
    "displayName": "Alice Smith",
    "nickName": "Ally",
    "emails": [
        {
            "value": "alice@example.com",
            "type": "work",
            "primary": true
        },
        {
            "value": "alice.personal@gmail.com",
            "type": "home",
            "primary": false
        }
    ],
    "phoneNumbers": [
        {
            "value": "+1-555-123-4567",
            "type": "work",
            "primary": true
        }
    ],
    "addresses": [
        {
            "type": "work",
            "streetAddress": "123 Business St",
            "locality": "Springfield",
            "region": "IL",
            "postalCode": "62701",
            "country": "US",
            "primary": true
        }
    ],
    "active": true,
    "title": "Senior Developer",
    "userType": "Employee",
    "preferredLanguage": "en-US",
    "locale": "en-US",
    "timezone": "America/Chicago"
});

let full_user = provider.create_resource("User", full_user_data, &context).await?;

// Access user data using typed methods
if let Some(name) = full_user.get_name() {
    println!("Created user: {} {}", 
             name.given_name.as_ref().unwrap_or(&"".to_string()),
             name.family_name.as_ref().unwrap_or(&"".to_string()));
}
}

Reading Users

Get a specific user by ID:

#![allow(unused)]
fn main() {
let user = provider.get_resource("User", &user_id, &context).await?;
println!("User: {}", user.get_username().unwrap_or("unknown"));
println!("Active: {}", user.get_active().unwrap_or(false));
if let Some(meta) = user.get_meta() {
    println!("Created: {}", meta.created);
    println!("Version: {}", meta.version.as_ref().unwrap_or(&"unknown".to_string()));
}
}

Check if user exists:

#![allow(unused)]
fn main() {
match provider.get_resource("User", &user_id, &context).await {
    Ok(user) => println!("User exists: {}", user.get_username().unwrap_or("unknown")),
    Err(e) if e.to_string().contains("not found") => println!("User not found"),
    Err(e) => println!("Error: {}", e),
}

// Or use the dedicated exists method
let exists = provider.resource_exists("User", &user_id, &context).await?;
println!("User exists: {}", exists);
}

Updating Users

Replace entire user (PUT semantics):

#![allow(unused)]
fn main() {
let updated_data = json!({
    "userName": "alice@example.com",
    "name": {
        "givenName": "Alice",
        "familyName": "Johnson" // Changed last name
    },
    "active": false // Deactivated user
});

let updated_user = provider.update_resource("User", &user_id, updated_data, &context).await?;
println!("Updated user: {}", updated_user.get_username().unwrap_or("unknown"));
}

Partial update:

#![allow(unused)]
fn main() {
// Get current user first
let current_user = provider.get_resource("User", &user_id, &context).await?;

// Create updated data with changes
let mut updated_data = current_user.data.clone();
updated_data["active"] = json!(false);
updated_data["title"] = json!("Lead Developer");

let patched_user = provider.update_resource("User", &user_id, updated_data, &context).await?;
}

Working with ETags for concurrency control:

#![allow(unused)]
fn main() {
// Get current user to check ETag
let current_user = provider.get_resource("User", &user_id, &context).await?;
if let Some(meta) = current_user.get_meta() {
    println!("Current ETag: {}", meta.version.as_ref().unwrap_or(&"none".to_string()));
}

// Update with the current version
let mut update_data = current_user.data.clone();
update_data["active"] = json!(false);

let updated_user = provider.update_resource("User", &user_id, update_data, &context).await?;

// Check new ETag
if let Some(meta) = updated_user.get_meta() {
    println!("New ETag: {}", meta.version.as_ref().unwrap_or(&"none".to_string()));
}
}

Deleting Users

Simple deletion:

#![allow(unused)]
fn main() {
provider.delete_resource("User", &user_id, &context).await?;
println!("User deleted successfully");
}

Verify deletion:

#![allow(unused)]
fn main() {
// Check if user still exists
let exists = provider.resource_exists("User", &user_id, &context).await?;
println!("User exists after deletion: {}", exists);
}

Safe deletion with existence check:

#![allow(unused)]
fn main() {
// Check if user exists before deleting
if provider.resource_exists("User", &user_id, &context).await? {
    provider.delete_resource("User", &user_id, &context).await?;
    println!("User deleted successfully");
} else {
    println!("User does not exist");
}
}

Group Operations

Creating Groups

Basic group:

#![allow(unused)]
fn main() {
let group_data = json!({
    "displayName": "Developers"
});

let group = provider.create_resource("Group", group_data, &context).await?;
println!("Created group: {}", group.get_display_name().unwrap_or("unknown"));
}

Group with members:

#![allow(unused)]
fn main() {
// Assuming you have user IDs from previous operations
let group_with_members = json!({
    "displayName": "Engineering Team",
    "members": [
        {
            "value": user1_id,
            "display": "Alice Smith"
        },
        {
            "value": user2_id,
            "display": "Bob Johnson"
        }
    ]
});

let group = provider.create_resource("Group", group_with_members, &context).await?;
println!("Created group with {} members", 
         group.get_members().map(|m| m.len()).unwrap_or(0));
}

Managing Group Membership

Add user to group:

#![allow(unused)]
fn main() {
// Get current group
let mut group = provider.get_resource("Group", &group_id, &context).await?;

// Add member to the group data
let mut group_data = group.data.clone();
let mut members = group_data.get("members").unwrap_or(&json!([])).as_array().unwrap().clone();
members.push(json!({
    "value": user_id,
    "display": "User Display Name"
}));
group_data["members"] = json!(members);

// Update the group
let updated_group = provider.update_resource("Group", &group_id, group_data, &context).await?;
}

Remove user from group:

#![allow(unused)]
fn main() {
// Get current group
let mut group = provider.get_resource("Group", &group_id, &context).await?;

// Remove member from the group data
let mut group_data = group.data.clone();
if let Some(members) = group_data.get_mut("members") {
    if let Some(members_array) = members.as_array_mut() {
        members_array.retain(|member| {
            member.get("value").and_then(|v| v.as_str()) != Some(&user_id)
        });
        group_data["members"] = json!(members_array);
    }
}

// Update the group
let updated_group = provider.update_resource("Group", &group_id, group_data, &context).await?;
}

Get group members:

#![allow(unused)]
fn main() {
let group = provider.get_resource("Group", &group_id, &context).await?;
if let Some(members) = group.get_members() {
    println!("Group has {} members:", members.len());
    for member in members {
        println!("  - {} ({})", 
                 member.display.as_ref().unwrap_or(&"unknown".to_string()), 
                 member.value);
    }
}
}

Listing and Querying

Basic Listing

List all users:

#![allow(unused)]
fn main() {
let users = provider.list_resources("User", None, &context).await?;
println!("Found {} users", users.len());

for user in users {
    println!("  - {} ({})", 
             user.get_username().unwrap_or("unknown"),
             user.get_id().unwrap_or("unknown"));
}
}

List all groups:

#![allow(unused)]
fn main() {
let groups = provider.list_resources("Group", None, &context).await?;
println!("Found {} groups", groups.len());

for group in groups {
    println!("  - {} ({})",
             group.get_display_name().unwrap_or("unknown"),
             group.get_id().unwrap_or("unknown"));
}
}

Pagination

Using provider's built-in pagination:

#![allow(unused)]
fn main() {
// The StandardResourceProvider handles pagination internally
// For large datasets, you can implement pagination by querying in chunks

let all_users = provider.list_resources("User", None, &context).await?;
println!("Total users: {}", all_users.len());

// For manual pagination, you can filter results
let first_10_users: Vec<_> = all_users.into_iter().take(10).collect();
println!("First 10 users:");
for user in first_10_users {
    println!("  - {}", user.get_username().unwrap_or("unknown"));
}
}

Working with large datasets:

#![allow(unused)]
fn main() {
// For very large datasets, consider implementing pagination at the storage level
// This example shows conceptual pagination handling

async fn get_users_page(
    provider: &StandardResourceProvider<InMemoryStorage>,
    context: &RequestContext,
    page: usize,
    page_size: usize
) -> Result<Vec<ScimResource>, Box<dyn std::error::Error>> {
    let all_users = provider.list_resources("User", None, context).await?;
    let start = page * page_size;
    let end = std::cmp::min(start + page_size, all_users.len());
    
    if start >= all_users.len() {
        return Ok(Vec::new());
    }
    
    Ok(all_users[start..end].to_vec())
}

// Example usage:
let page_0 = get_users_page(&provider, &context, 0, 10).await?;
let page_1 = get_users_page(&provider, &context, 1, 10).await?;
}

Filtering

The StandardResourceProvider supports attribute-based filtering:

Basic attribute filtering:

#![allow(unused)]
fn main() {
// Find user by username
let user = provider.find_resource_by_attribute(
    "User",
    "userName", 
    &json!("alice@example.com"),
    &context
).await?;

if let Some(user) = user {
    println!("Found user: {}", user.get_username().unwrap_or("unknown"));
}
}

Find by email:

#![allow(unused)]
fn main() {
// Find user by email address
let user_by_email = provider.find_resource_by_attribute(
    "User",
    "emails.value",
    &json!("alice@example.com"),
    &context
).await?;
}

Client-side filtering for complex queries:

#![allow(unused)]
fn main() {
// Get all users and filter on the client side
let all_users = provider.list_resources("User", None, &context).await?;

// Filter active users
let active_users: Vec<_> = all_users.into_iter()
    .filter(|user| user.get_active().unwrap_or(false))
    .collect();

println!("Found {} active users", active_users.len());
}

Filter by email domain:

#![allow(unused)]
fn main() {
let all_users = provider.list_resources("User", None, &context).await?;

let company_users: Vec<_> = all_users.into_iter()
    .filter(|user| {
        if let Some(emails) = user.get_emails() {
            emails.iter().any(|email| email.value.contains("@company.com"))
        } else {
            false
        }
    })
    .collect();

println!("Found {} company users", company_users.len());
}

Sorting

Client-side sorting:

#![allow(unused)]
fn main() {
let all_users = provider.list_resources("User", None, &context).await?;

// Sort by username
let mut sorted_users = all_users;
sorted_users.sort_by(|a, b| {
    let a_name = a.get_username().unwrap_or("");
    let b_name = b.get_username().unwrap_or("");
    a_name.cmp(b_name)
});

println!("Users sorted by username:");
for user in sorted_users.iter().take(5) {
    println!("  - {}", user.get_username().unwrap_or("unknown"));
}
}

Sort by creation date:

#![allow(unused)]
fn main() {
let all_users = provider.list_resources("User", None, &context).await?;

// Sort by creation date (newest first)
let mut users_by_date = all_users;
users_by_date.sort_by(|a, b| {
    let a_created = a.get_meta().and_then(|m| m.created.as_ref());
    let b_created = b.get_meta().and_then(|m| m.created.as_ref());
    b_created.cmp(&a_created) // Reverse for newest first
});
}

Bulk Operations

The StandardResourceProvider processes operations individually. For bulk efficiency, use async iteration:

Create multiple users:

#![allow(unused)]
fn main() {
let bulk_users = vec![
    json!({
        "userName": "user1@example.com",
        "active": true
    }),
    json!({
        "userName": "user2@example.com", 
        "active": true
    }),
    json!({
        "userName": "user3@example.com",
        "active": true
    })
];

// Create users concurrently
let mut created_users = Vec::new();
for user_data in bulk_users {
    match provider.create_resource("User", user_data, &context).await {
        Ok(user) => {
            println!("Created user: {}", user.get_username().unwrap_or("unknown"));
            created_users.push(user);
        },
        Err(e) => {
            println!("Failed to create user: {}", e);
        }
    }
}

println!("Successfully created {} users", created_users.len());
}

Bulk update multiple users:

#![allow(unused)]
fn main() {
let user_ids = vec!["user1", "user2", "user3"];

for user_id in user_ids {
    // Get current user
    if let Ok(mut user) = provider.get_resource("User", user_id, &context).await {
        // Update the user data
        let mut user_data = user.data.clone();
        user_data["active"] = json!(false);
        
        match provider.update_resource("User", user_id, user_data, &context).await {
            Ok(_) => println!("Updated user: {}", user_id),
            Err(e) => println!("Failed to update user {}: {}", user_id, e),
        }
    }
}
}

Error Handling Patterns

Comprehensive Error Handling

#![allow(unused)]
fn main() {
async fn safe_user_operation(
    provider: &StandardResourceProvider<InMemoryStorage>,
    context: &RequestContext,
    user_id: &str,
) -> Result<(), Box<dyn std::error::Error>> {
    match provider.get_resource("User", user_id, context).await {
        Ok(user) => {
            println!("Found user: {}", user.get_username().unwrap_or("unknown"));
            Ok(())
        },
        Err(e) if e.to_string().contains("not found") => {
            println!("User {} not found", user_id);
            Err("User not found".into())
        },
        Err(e) if e.to_string().contains("validation") => {
            println!("Validation failed: {}", e);
            Err("Invalid data".into())
        },
        Err(e) if e.to_string().contains("conflict") => {
            println!("Conflict detected for resource: {}", user_id);
            Err("Resource conflict".into())
        },
        Err(e) if e.to_string().contains("storage") => {
            println!("Storage error: {}", e);
            Err("Storage issue".into())
        },
        Err(e) => {
            println!("Unexpected error: {}", e);
            Err(e.into())
        }
    }
}
}

Retry Logic for Conflicts

#![allow(unused)]
fn main() {
use tokio::time::{sleep, Duration};

async fn retry_update_user(
    provider: &StandardResourceProvider<InMemoryStorage>,
    context: &RequestContext,
    user_id: &str,
    update_data: serde_json::Value,
    max_retries: u32,
) -> Result<ScimResource, Box<dyn std::error::Error>> {
    for attempt in 0..max_retries {
        // Get current user and version
        let current_user = provider.get_resource("User", user_id, context).await?;
        let current_version = current_user.get_meta()
            .and_then(|m| m.version.as_ref())
            .cloned();
        
        // Attempt update
        match provider.update_resource("User", user_id, update_data.clone(), context).await {
            Ok(updated_user) => {
                println!("Successfully updated user after {} attempt(s)", attempt + 1);
                return Ok(updated_user);
            },
            Err(e) if e.to_string().contains("conflict") => {
                if attempt < max_retries - 1 {
                    // Exponential backoff
                    let delay = Duration::from_millis(100 * 2_u64.pow(attempt));
                    println!("Conflict detected, retrying in {:?}...", delay);
                    sleep(delay).await;
                    continue;
                } else {
                    return Err(format!("Max retries ({}) exceeded due to conflicts", max_retries).into());
                }
            },
            Err(e) => return Err(e.into()),
        }
    }
    
    unreachable!()
}

// Example usage:
let update_data = json!({ "active": false });
match retry_update_user(&provider, &context, "user123", update_data, 3).await {
    Ok(user) => println!("Updated user successfully"),
    Err(e) => println!("Failed to update user: {}", e),
}
}

Best Practices

1. Always Use Request Context

#![allow(unused)]
fn main() {
// Good: Always provide request context
let context = RequestContext::new("operation-123".to_string());
let user = provider.get_resource("User", &user_id, &context).await?;

// The request context provides operation tracking and audit trails
}

2. Handle Versions for Updates

#![allow(unused)]
fn main() {
// Good: Check versions for safe updates
let current_user = provider.get_resource("User", &user_id, &context).await?;
if let Some(meta) = current_user.get_meta() {
    println!("Current version: {}", meta.version.as_ref().unwrap_or(&"none".to_string()));
}

// Update with current data
let mut update_data = current_user.data.clone();
update_data["active"] = json!(false);
let result = provider.update_resource("User", &user_id, update_data, &context).await?;

// Check new version
if let Some(meta) = result.get_meta() {
    println!("New version: {}", meta.version.as_ref().unwrap_or(&"none".to_string()));
}
}

3. Use Appropriate Operations

#![allow(unused)]
fn main() {
// For creating new resources
let user = provider.create_resource("User", user_data, &context).await?;

// For updating existing resources
let updated_user = provider.update_resource("User", &user_id, updated_data, &context).await?;

// For retrieving resources
let user = provider.get_resource("User", &user_id, &context).await?;

// For deleting resources
provider.delete_resource("User", &user_id, &context).await?;
}

4. Validate Data Before Operations

#![allow(unused)]
fn main() {
fn validate_email(email: &str) -> bool {
    email.contains('@') && email.contains('.')
}

async fn create_user_safely(
    provider: &StandardResourceProvider<InMemoryStorage>,
    context: &RequestContext,
    user_data: serde_json::Value,
) -> Result<ScimResource, Box<dyn std::error::Error>> {
    // Validate email if present
    if let Some(username) = user_data.get("userName").and_then(|v| v.as_str()) {
        if !validate_email(username) {
            return Err("Invalid email format".into());
        }
    }
    
    // Validate required fields
    if user_data.get("userName").is_none() {
        return Err("userName is required".into());
    }
    
    // Create user if validation passes
    provider.create_resource("User", user_data, context).await
        .map_err(|e| e.into())
}
}

5. Use Pagination for Large Results

#![allow(unused)]
fn main() {
async fn process_all_users(
    provider: &StandardResourceProvider<InMemoryStorage>,
    context: &RequestContext,
) -> Result<(), Box<dyn std::error::Error>> {
    let all_users = provider.list_resources("User", None, context).await?;
    
    // Process in chunks for memory efficiency
    for chunk in all_users.chunks(100) {
        for user in chunk {
            // Process each user
            println!("Processing user: {}", user.get_username().unwrap_or("unknown"));
        }
        
        // Optional: Add delay between chunks to avoid overwhelming the system
        tokio::time::sleep(std::time::Duration::from_millis(10)).await;
    }
    
    Ok(())
}
}

Summary

This guide covered all fundamental SCIM operations using the StandardResourceProvider:

CRUD Operations:

• ✅ Create resources with create_resource()
• ✅ Read resources with get_resource() and list_resources()
• ✅ Update resources with update_resource()
• ✅ Delete resources with delete_resource()

Advanced Features:

• ✅ Attribute search with find_resource_by_attribute()
• ✅ Resource existence checks with resource_exists()
• ✅ Version management with ETag support
• ✅ Client-side filtering and sorting
• ✅ Bulk operations with async iteration
• ✅ Error handling patterns and retry logic

Key Takeaways:

1. Always use RequestContext for operation tracking
2. Leverage typed methods like get_username(), get_emails() for safe data access
3. Handle errors gracefully with proper pattern matching
4. Use ETags for concurrency control in multi-client scenarios
5. Implement client-side filtering for complex queries

You're now ready to build robust SCIM applications! Next, explore Custom Resource Types or Multi-Tenant Deployment for advanced scenarios.

SCIM Protocol Overview

Welcome to the SCIM (System for Cross-domain Identity Management) protocol! This chapter provides a comprehensive introduction to SCIM 2.0 and explains why it's essential for modern identity provisioning.

What is SCIM?

SCIM is an open standard for automating the exchange of user identity information between identity domains or IT systems. Think of it as "REST for identity management" - it provides a standardized way to create, read, update, and delete user and group information across different systems.

The Problem SCIM Solves

Before SCIM, organizations faced these challenges:

Manual Provisioning:

• IT administrators manually creating accounts in each system
• Human errors leading to security gaps
• Slow onboarding and offboarding processes

Custom Integrations:

• Each system had its own API for user management
• Expensive custom integration development
• Maintenance nightmares when systems changed

Security Risks:

• Orphaned accounts when employees left
• Inconsistent access control across systems
• No centralized audit trail

SCIM's Solution: A standardized protocol that enables automatic, secure, and consistent identity provisioning across all systems.

SCIM 2.0 Core Concepts

Resources

SCIM models identity information as resources. The two primary resource types are:

Users

Represent individual people with attributes like:

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "id": "2819c223-7f76-453a-919d-413861904646",
  "userName": "bjensen@example.com",
  "name": {
    "formatted": "Ms. Barbara J Jensen III",
    "familyName": "Jensen",
    "givenName": "Barbara"
  },
  "emails": [
    {
      "value": "bjensen@example.com",
      "type": "work",
      "primary": true
    }
  ],
  "active": true
}

Groups

Represent collections of users:

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
  "id": "e9e30dba-f08f-4109-8486-d5c6a331660a",
  "displayName": "Tour Guides",
  "members": [
    {
      "value": "2819c223-7f76-453a-919d-413861904646",
      "$ref": "../Users/2819c223-7f76-453a-919d-413861904646",
      "display": "Barbara Jensen"
    }
  ]
}

Schemas

SCIM uses schemas to define the structure and validation rules for resources. Every resource must declare which schemas it conforms to.

Core Schemas:

• urn:ietf:params:scim:schemas:core:2.0:User - Standard user attributes
• urn:ietf:params:scim:schemas:core:2.0:Group - Standard group attributes

Extension Schemas:

• urn:ietf:params:scim:schemas:extension:enterprise:2.0:User - Enterprise attributes (employee ID, manager, etc.)
• Custom schemas for organization-specific attributes

Operations

SCIM defines standard HTTP operations for resource management:

SCIM Endpoints

A SCIM server exposes these standard endpoints:

Resource Endpoints

GET    /Users                    # List all users
POST   /Users                    # Create new user
GET    /Users/{id}               # Get specific user
PUT    /Users/{id}               # Replace user
PATCH  /Users/{id}               # Update user
DELETE /Users/{id}               # Delete user

GET    /Groups                   # List all groups
POST   /Groups                   # Create new group
GET    /Groups/{id}              # Get specific group
PUT    /Groups/{id}              # Replace group
PATCH  /Groups/{id}              # Update group
DELETE /Groups/{id}              # Delete group

Special Endpoints

GET    /ServiceProviderConfig    # Server capabilities
GET    /ResourceTypes            # Available resource types
GET    /Schemas                  # Schema definitions
POST   /Bulk                     # Bulk operations (not yet implemented)

Filtering and Querying

SCIM provides powerful filtering capabilities for finding specific resources:

Basic Filters

# Find users by email
GET /Users?filter=emails.value eq "bjensen@example.com"

# Find active users
GET /Users?filter=active eq true

# Find users by department
GET /Users?filter=department eq "Engineering"

Complex Filters

# Multiple conditions
GET /Users?filter=active eq true and emails.type eq "work"

# Pattern matching
GET /Users?filter=userName sw "john"

# Date comparisons
GET /Users?filter=meta.lastModified gt "2023-01-01T00:00:00Z"

Pagination

# Paginated results
GET /Users?startIndex=1&count=50

# Sorted results
GET /Users?sortBy=meta.lastModified&sortOrder=descending

Versioning and Concurrency

SCIM uses ETags for optimistic concurrency control:

Version Detection

GET /Users/123
Response Headers:
ETag: "W/\"3694e05e9dff590\""

Conditional Updates

PUT /Users/123
If-Match: "W/\"3694e05e9dff590\""

If the resource was modified by someone else, the server returns 412 Precondition Failed.

Error Handling

SCIM defines standard error responses:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "scimType": "invalidFilter",
  "detail": "The specified filter syntax is invalid"
}

Common error types:

• invalidFilter - Malformed filter expression
• tooMany - Query returned too many results
• uniqueness - Unique constraint violation
• mutability - Attempt to modify read-only attribute

Bulk Operations

⚠️ Implementation Status: Bulk operations are not yet implemented in this library.

While the SCIM 2.0 specification includes bulk operations for efficiency, this library currently requires individual API calls for each operation:

#![allow(unused)]
fn main() {
// Current approach: Individual operations
async fn create_multiple_users(
    provider: &impl ResourceProvider,
    tenant_id: &str,
    users: Vec<serde_json::Value>
) -> Result<Vec<ScimUser>, Box<dyn std::error::Error>> {
    let context = RequestContext::new("batch-create", None);
    let mut created_users = Vec::new();
    
    for user_data in users {
        let user = provider.create_resource("User", user_data, &context).await?;
        created_users.push(user);
    }
    
    Ok(created_users)
}
}

Future Implementation: The SCIM bulk endpoint specification would look like:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:BulkRequest"],
  "Operations": [
    {
      "method": "POST",
      "path": "/Users",
      "bulkId": "qwerty",
      "data": {
        "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
        "userName": "alice@example.com"
      }
    }
  ]
}

Benefits of SCIM

For Organizations

• Automated Provisioning: Eliminate manual account management
• Security: Consistent access control and rapid deprovisioning
• Compliance: Centralized audit trails and access reviews
• Cost Reduction: Reduce IT overhead and integration costs

For Developers

• Standardization: One API to learn instead of dozens
• Interoperability: Works with existing identity providers
• Type Safety: Well-defined schemas prevent errors
• Scalability: Pagination support and planned bulk operations

For Users

• Faster Onboarding: Immediate access to necessary systems
• Self-Service: Update profile information in one place
• Better Experience: Consistent identity across applications

SCIM in Practice

Common Use Cases

Employee Lifecycle Management:

• Automatically create accounts when employees join
• Update access when roles change
• Remove access when employees leave

Application Integration:

• Sync users from Active Directory to SaaS applications
• Provision groups based on organizational structure
• Maintain consistent user profiles across systems

Compliance and Auditing:

• Track all identity changes with timestamps
• Generate access reports for compliance reviews
• Ensure timely deprovisioning for security

Integration Patterns

Identity Provider → Applications:

[Active Directory] → [SCIM Server] → [Slack, GitHub, Salesforce]

HR System → Everything:

[HR System] → [SCIM Server] → [All IT Systems]

Federated Identity:

[Company A SCIM] ←→ [Company B SCIM] (via secure federation)

Why Choose SCIM Server Library?

While SCIM standardizes the protocol, implementation quality varies widely. This library provides:

Enterprise-Grade Features

• Multi-tenancy: Isolate different organizations
• Type Safety: Prevent runtime errors with Rust's type system
• Performance: Async-first design with minimal overhead
• Extensibility: Easy schema customization and validation

Developer Experience

• Framework Agnostic: Works with Axum, Warp, Actix, or custom HTTP
• Rich Filtering: Full SCIM filter expression support
• Comprehensive Testing: Battle-tested with extensive test suites
• Clear Documentation: This guide plus API documentation

Production Ready

• Concurrency Control: Automatic ETag handling
• Error Handling: Comprehensive error types and messages
• Monitoring: Built-in observability hooks
• Security: Input validation and sanitization

Next Steps

Now that you understand SCIM fundamentals, you're ready to:

1. Set up your development environment
2. Build your first SCIM server
3. Learn the architecture behind this library
4. Explore multi-tenancy for enterprise deployments

The SCIM protocol provides the foundation for modern identity management. With this library, you can focus on your business logic while we handle the complex protocol details.

Ready to provision some identities? Let's get started! 🚀

Architecture

This chapter explains the SCIM Server's three-layer architecture and how it enables flexible, scalable identity provisioning systems.

Overview

The SCIM Server acts as intelligent middleware that handles all provisioning complexity so your applications don't have to. It follows a clean three-layer architecture that separates concerns and enables flexibility:

┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
│   Client Layer  │    │   SCIM Server    │    │  Storage Layer  │
│                 │    │                  │    │                 │
│  • Web Apps     │───▶│  • Validation    │───▶│  • In-Memory    │
│  • AI Tools     │    │  • Operations    │    │  • Database     │
│  • CLI Scripts  │    │  • Multi-tenant  │    │  • Custom       │
│  • Custom APIs  │    │  • Type Safety   │    │                 │
└─────────────────┘    └──────────────────┘    └─────────────────┘

This design provides flexibility at each layer while maintaining consistency and type safety throughout.

Client Layer: Multiple Ways to Connect

The SCIM Server supports diverse client types through standardized interfaces:

Web Applications

• Admin Portals: Full-featured management interfaces
• User Dashboards: Self-service identity management
• Sync Tools: Automated synchronization between systems
• Integration APIs: RESTful endpoints for custom applications

AI Assistants

• Natural Language Processing: Convert human requests to SCIM operations
• Model Context Protocol (MCP): Direct integration with Claude, ChatGPT, and custom bots
• Conversational Interfaces: Chat-based identity management
• Intelligent Automation: AI-driven provisioning decisions

Automation Tools

• CLI Scripts: Command-line tools for bulk operations
• Migration Scripts: Data import/export utilities
• DevOps Pipelines: CI/CD integration for automated provisioning
• Batch Processing: Scheduled bulk operations

Custom Integrations

• GraphQL: Type-safe query interfaces
• gRPC: High-performance binary protocols
• Message Queues: Asynchronous processing workflows
• Webhooks: Event-driven integrations
• Custom Protocols: Adapt to any existing system

Intelligence Layer: The SCIM Server Core

The SCIM Server core provides enterprise-grade capabilities that would take months to build yourself:

Dynamic Schema Management

• Custom Resource Types: Define schemas beyond users and groups
• Automatic Validation: Schema-driven input validation
• Schema Evolution: Version and migrate schemas over time
• Type Safety: Compile-time schema validation

Comprehensive Validation

• Input Validation: Automatic validation against SCIM schemas
• Business Rules: Custom validation logic
• Error Reporting: Detailed, actionable error messages
• Data Integrity: Ensure consistency across operations

Standardized Operations

• CRUD Operations: Create, Read, Update, Delete with SCIM semantics
• Filtering: Rich query capabilities with SCIM filter syntax
• Bulk Operations: Efficient batch processing
• PATCH Operations: Granular updates with RFC 7644 compliance

Multi-Tenant Architecture

• Organization Isolation: Complete data separation between tenants
• Configuration Management: Tenant-specific settings and schemas
• Resource Scoping: Automatic tenant boundary enforcement
• Performance Isolation: Independent scaling per tenant

Automatic Capabilities

• Service Provider Configuration: Self-documenting API features
• Schema Discovery: Runtime schema introspection
• Capability Advertisement: Automatic feature detection
• API Documentation: Generated OpenAPI specifications

Storage Layer: Flexible Backend Options

Choose your data storage strategy without changing your application code:

Development Options

• In-Memory Storage: Fast prototyping and testing
• SQLite: Local file-based persistence
• Mock Providers: Testing and simulation

Enterprise Options

• PostgreSQL: ACID compliance with advanced features
• MySQL: Reliable relational database
• SQL Server: Enterprise Microsoft integration

Cloud-Native Options

• DynamoDB: AWS NoSQL for massive scale
• MongoDB: Document-based flexible schemas
• Redis: High-performance caching layer
• S3: Object storage for archival

Custom Providers

• Trait-Based: Implement the StorageProvider trait
• Async Support: Full async/await compatibility
• Error Handling: Rich error types and recovery
• Testing: Built-in test utilities

Value Proposition: Complexity Reduction

Instead of building provisioning logic into every application, SCIM Server centralizes complexity:

Result: Your applications focus on business logic while SCIM Server handles all provisioning complexity with enterprise-grade capabilities.

Design Principles

The architecture follows key design principles:

Separation of Concerns

• HTTP handling is separate from SCIM logic
• Business logic is separate from data storage
• Validation is separate from persistence
• Multi-tenancy is handled at the core, not storage level

Type Safety

• Compile-time validation prevents runtime errors
• Strong typing throughout the API
• Schema validation ensures data integrity
• Error types provide rich error handling

Performance

• Async-first design for high concurrency
• Minimal allocations in hot paths
• Efficient serialization with zero-copy where possible
• Connection pooling for database providers

Flexibility

• Pluggable storage adapts to any backend
• Framework agnostic works with any HTTP library
• Extensible schemas support custom resource types
• Configuration driven behavior without code changes

Scalability Considerations

The architecture scales in multiple dimensions:

Horizontal Scaling

• Stateless design enables multiple server instances
• Database scaling through read replicas and sharding
• Load balancing across SCIM server instances
• Cache layers for frequently accessed data

Vertical Scaling

• Async processing maximizes CPU utilization
• Memory efficiency through careful allocation patterns
• Connection reuse reduces resource overhead
• Batching optimizes database interactions

Multi-Tenant Scaling

• Tenant isolation prevents noisy neighbor problems
• Resource quotas enable fair resource sharing
• Performance monitoring per tenant
• Independent scaling based on tenant needs

Security Architecture

Security is built into every layer:

Authentication & Authorization

• Compile-time auth prevents unauthorized access
• Tenant isolation enforces data boundaries
• Role-based access with fine-grained permissions
• API key management with rotation support

Data Protection

• Encryption at rest through storage providers
• Encryption in transit via HTTPS
• PII handling with appropriate safeguards
• Audit logging for compliance requirements

Concurrency Safety

• ETag versioning prevents lost updates
• Atomic operations ensure data consistency
• Transaction support where available
• Conflict resolution with clear error messages

This architecture provides a solid foundation for building scalable, secure, and maintainable identity provisioning systems while keeping complexity manageable for developers.

Resource Model

The SCIM Server's resource model provides a type-safe, extensible foundation for identity management. This chapter explains how resources work, how to customize them, and how the type system prevents common errors.

Overview

In SCIM, everything is a resource - users, groups, and custom objects all follow the same fundamental patterns. The SCIM Server library models these as Rust types that provide compile-time safety while maintaining runtime flexibility.

#![allow(unused)]
fn main() {
use scim_server::{ScimUser, ScimGroup, ScimResource};

// Type-safe resource creation
let user = ScimUser::builder()
    .username("alice@example.com")
    .given_name("Alice")
    .family_name("Johnson")
    .email("alice@example.com")
    .build()?;

// Compile-time guarantees
let id = user.id(); // Always returns a valid UUID
let version = user.version(); // ETag for concurrency control
}

This design provides the flexibility of JSON with the safety of Rust's type system.

Core Resource Structure

Base Resource Traits

All SCIM resources implement the ScimResource trait:

#![allow(unused)]
fn main() {
pub trait ScimResource {
    fn id(&self) -> &str;
    fn schemas(&self) -> &[String];
    fn meta(&self) -> &ResourceMeta;
    fn external_id(&self) -> Option<&str>;
}
}

Resource Metadata

Every resource includes metadata for versioning and auditing:

#![allow(unused)]
fn main() {
pub struct ResourceMeta {
    pub resource_type: String,
    pub created: DateTime<Utc>,
    pub last_modified: DateTime<Utc>,
    pub version: String,  // ETag for concurrency control
    pub location: Option<String>,
}
}

The metadata is automatically managed by the SCIM Server:

{
  "meta": {
    "resourceType": "User",
    "created": "2023-12-01T10:30:00Z",
    "lastModified": "2023-12-01T15:45:00Z",
    "version": "W/\"3694e05e9dff590\"",
    "location": "https://api.example.com/scim/v2/Users/123"
  }
}

User Resources

Core User Attributes

The ScimUser type models the standard SCIM user schema:

#![allow(unused)]
fn main() {
use scim_server::{ScimUser, Name, Email, PhoneNumber};

let user = ScimUser::builder()
    .username("bjensen@example.com")
    .name(Name {
        formatted: Some("Ms. Barbara J Jensen III".to_string()),
        family_name: Some("Jensen".to_string()),
        given_name: Some("Barbara".to_string()),
        middle_name: Some("Jane".to_string()),
        honorific_prefix: Some("Ms.".to_string()),
        honorific_suffix: Some("III".to_string()),
    })
    .display_name("Babs Jensen")
    .nick_name("Babs")
    .profile_url("https://login.example.com/bjensen")
    .email(Email {
        value: "bjensen@example.com".to_string(),
        type_: Some("work".to_string()),
        primary: Some(true),
    })
    .phone_number(PhoneNumber {
        value: "+1-555-555-8377".to_string(),
        type_: Some("work".to_string()),
        primary: Some(true),
    })
    .active(true)
    .build()?;
}

Multi-Value Attributes

SCIM supports multi-value attributes for emails, phone numbers, and addresses:

#![allow(unused)]
fn main() {
let user = ScimUser::builder()
    .username("alice@example.com")
    .emails(vec![
        Email {
            value: "alice@work.com".to_string(),
            type_: Some("work".to_string()),
            primary: Some(true),
        },
        Email {
            value: "alice@personal.com".to_string(),
            type_: Some("home".to_string()),
            primary: Some(false),
        },
    ])
    .phone_numbers(vec![
        PhoneNumber {
            value: "+1-555-555-1234".to_string(),
            type_: Some("work".to_string()),
            primary: Some(true),
        },
        PhoneNumber {
            value: "+1-555-555-5678".to_string(),
            type_: Some("mobile".to_string()),
            primary: Some(false),
        },
    ])
    .build()?;
}

Enterprise Extensions

For enterprise environments, SCIM provides additional attributes:

#![allow(unused)]
fn main() {
use scim_server::{ScimUser, EnterpriseUser};

let user = ScimUser::builder()
    .username("alice@example.com")
    .given_name("Alice")
    .family_name("Johnson")
    .enterprise(EnterpriseUser {
        employee_number: Some("12345".to_string()),
        cost_center: Some("Engineering".to_string()),
        organization: Some("ACME Corp".to_string()),
        division: Some("Technology".to_string()),
        department: Some("Software Development".to_string()),
        manager: Some(Manager {
            value: "manager-id-456".to_string(),
            ref_: Some("../Users/manager-id-456".to_string()),
            display_name: Some("Bob Smith".to_string()),
        }),
    })
    .build()?;
}

Group Resources

Basic Group Structure

Groups represent collections of users with optional hierarchical relationships:

#![allow(unused)]
fn main() {
use scim_server::{ScimGroup, GroupMember};

let group = ScimGroup::builder()
    .display_name("Engineering Team")
    .members(vec![
        GroupMember {
            value: "user-id-123".to_string(),
            ref_: Some("../Users/user-id-123".to_string()),
            type_: Some("User".to_string()),
            display: Some("Alice Johnson".to_string()),
        },
        GroupMember {
            value: "user-id-456".to_string(),
            ref_: Some("../Users/user-id-456".to_string()),
            type_: Some("User".to_string()),
            display: Some("Bob Smith".to_string()),
        },
    ])
    .build()?;
}

Nested Groups

Groups can contain other groups for hierarchical organization:

#![allow(unused)]
fn main() {
let parent_group = ScimGroup::builder()
    .display_name("All Engineering")
    .members(vec![
        GroupMember {
            value: "group-frontend".to_string(),
            ref_: Some("../Groups/group-frontend".to_string()),
            type_: Some("Group".to_string()),
            display: Some("Frontend Team".to_string()),
        },
        GroupMember {
            value: "group-backend".to_string(),
            ref_: Some("../Groups/group-backend".to_string()),
            type_: Some("Group".to_string()),
            display: Some("Backend Team".to_string()),
        },
    ])
    .build()?;
}

Schema System

Schema Definition

Schemas define the structure and validation rules for resources:

#![allow(unused)]
fn main() {
use scim_server::{Schema, Attribute, AttributeType, Mutability, Returned};

let user_schema = Schema::builder()
    .id("urn:ietf:params:scim:schemas:core:2.0:User")
    .name("User")
    .description("User Account")
    .attribute(
        Attribute::builder()
            .name("userName")
            .type_(AttributeType::String)
            .mutability(Mutability::ReadWrite)
            .returned(Returned::Default)
            .uniqueness(true)
            .required(true)
            .case_exact(false)
            .build()
    )
    .attribute(
        Attribute::builder()
            .name("name")
            .type_(AttributeType::Complex)
            .mutability(Mutability::ReadWrite)
            .returned(Returned::Default)
            .sub_attribute(
                Attribute::builder()
                    .name("givenName")
                    .type_(AttributeType::String)
                    .mutability(Mutability::ReadWrite)
                    .build()
            )
            .build()
    )
    .build()?;
}

Dynamic Schema Registry

The SCIM Server maintains a registry of available schemas:

#![allow(unused)]
fn main() {
use scim_server::{SchemaRegistry, CoreSchemas};

let mut registry = SchemaRegistry::new();

// Register core schemas
registry.register(CoreSchemas::user());
registry.register(CoreSchemas::group());
registry.register(CoreSchemas::enterprise_user());

// Register custom schemas
registry.register(custom_department_schema());

// Validate resources against schemas
let validation_result = registry.validate_user(&user)?;
}

Custom Resources

Defining Custom Resource Types

You can extend SCIM with custom resource types:

#![allow(unused)]
fn main() {
use scim_server::{ScimResource, ResourceMeta};
use serde::{Deserialize, Serialize};

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Project {
    pub id: String,
    pub schemas: Vec<String>,
    pub meta: ResourceMeta,
    pub external_id: Option<String>,
    
    // Custom attributes
    pub name: String,
    pub description: Option<String>,
    pub owner: String,
    pub status: ProjectStatus,
    pub created_date: DateTime<Utc>,
    pub budget: Option<f64>,
    pub team_members: Vec<String>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum ProjectStatus {
    Planning,
    Active,
    OnHold,
    Completed,
    Cancelled,
}

impl ScimResource for Project {
    fn id(&self) -> &str {
        &self.id
    }
    
    fn schemas(&self) -> &[String] {
        &self.schemas
    }
    
    fn meta(&self) -> &ResourceMeta {
        &self.meta
    }
    
    fn external_id(&self) -> Option<&str> {
        self.external_id.as_deref()
    }
}
}

Custom Schema Definition

Define the schema for your custom resource:

#![allow(unused)]
fn main() {
fn project_schema() -> Schema {
    Schema::builder()
        .id("urn:company:params:scim:schemas:core:2.0:Project")
        .name("Project")
        .description("Project Management Resource")
        .attribute(
            Attribute::builder()
                .name("name")
                .type_(AttributeType::String)
                .mutability(Mutability::ReadWrite)
                .returned(Returned::Default)
                .required(true)
                .case_exact(false)
                .build()
        )
        .attribute(
            Attribute::builder()
                .name("status")
                .type_(AttributeType::String)
                .mutability(Mutability::ReadWrite)
                .returned(Returned::Default)
                .canonical_values(vec![
                    "Planning".to_string(),
                    "Active".to_string(),
                    "OnHold".to_string(),
                    "Completed".to_string(),
                    "Cancelled".to_string(),
                ])
                .build()
        )
        .build()
        .unwrap()
}
}

Type Safety Features

Compile-Time Validation

The type system prevents many common errors:

#![allow(unused)]
fn main() {
// ✅ This compiles - valid email
let user = ScimUser::builder()
    .email("alice@example.com")
    .build()?;

// ❌ This won't compile - wrong type
let user = ScimUser::builder()
    .email(123)  // Error: expected String, found integer
    .build()?;
}

Builder Pattern Safety

The builder pattern ensures required fields are provided:

#![allow(unused)]
fn main() {
// ✅ This compiles - username is required and provided
let user = ScimUser::builder()
    .username("alice@example.com")
    .build()?;

// ❌ This won't compile - missing required username
let user = ScimUser::builder()
    .given_name("Alice")
    .build()?;  // Error: username is required
}

Option Types for Optional Fields

Optional fields use Rust's Option type:

#![allow(unused)]
fn main() {
let user = ScimUser::builder()
    .username("alice@example.com")
    .given_name("Alice")  // Option<String> - automatically wrapped
    .middle_name(None)    // Explicitly no middle name
    .family_name(Some("Johnson".to_string()))  // Explicitly provided
    .build()?;

// Safe access to optional fields
match user.middle_name() {
    Some(middle) => println!("Middle name: {}", middle),
    None => println!("No middle name provided"),
}
}

Validation and Constraints

Built-in Validation

The SCIM Server provides automatic validation:

#![allow(unused)]
fn main() {
use scim_server::{ScimUser, ValidationError};

// Email format validation
let result = ScimUser::builder()
    .username("invalid-email")  // Missing @ symbol
    .build();

match result {
    Ok(user) => println!("User created: {}", user.username()),
    Err(ValidationError::InvalidEmail(email)) => {
        println!("Invalid email format: {}", email);
    },
    Err(e) => println!("Other validation error: {}", e),
}
}

Custom Validation Rules

Add your own validation logic:

#![allow(unused)]
fn main() {
impl ScimUser {
    pub fn validate_business_rules(&self) -> Result<(), ValidationError> {
        // Custom rule: work emails must be from company domain
        if let Some(work_email) = self.work_email() {
            if !work_email.ends_with("@company.com") {
                return Err(ValidationError::InvalidWorkEmail);
            }
        }
        
        // Custom rule: employee number format
        if let Some(employee_number) = self.employee_number() {
            if !employee_number.starts_with("EMP") {
                return Err(ValidationError::InvalidEmployeeNumber);
            }
        }
        
        Ok(())
    }
}
}

Serialization and JSON

Automatic JSON Serialization

Resources automatically serialize to SCIM-compliant JSON:

#![allow(unused)]
fn main() {
use serde_json;

let user = ScimUser::builder()
    .username("alice@example.com")
    .given_name("Alice")
    .family_name("Johnson")
    .build()?;

let json = serde_json::to_string_pretty(&user)?;
println!("{}", json);
}

Output:

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "id": "2819c223-7f76-453a-919d-413861904646",
  "userName": "alice@example.com",
  "name": {
    "givenName": "Alice",
    "familyName": "Johnson"
  },
  "meta": {
    "resourceType": "User",
    "created": "2023-12-01T10:30:00Z",
    "lastModified": "2023-12-01T10:30:00Z",
    "version": "W/\"1\""
  }
}

JSON Deserialization

Parse JSON into type-safe resources:

#![allow(unused)]
fn main() {
let json = r#"
{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "alice@example.com",
  "name": {
    "givenName": "Alice",
    "familyName": "Johnson"
  }
}
"#;

let user: ScimUser = serde_json::from_str(json)?;
println!("User: {} {}", user.given_name(), user.family_name());
}

Performance Considerations

Memory Efficiency

The resource model is designed for efficiency:

#![allow(unused)]
fn main() {
// Zero-copy string references where possible
impl ScimUser {
    pub fn username(&self) -> &str {  // Returns reference, not owned String
        &self.username
    }
    
    pub fn display_name(&self) -> Option<&str> {  // Optional reference
        self.display_name.as_deref()
    }
}
}

Lazy Loading

Complex attributes can be loaded on demand:

#![allow(unused)]
fn main() {
// Only load enterprise attributes when needed
impl ScimUser {
    pub fn enterprise(&self) -> Option<&EnterpriseUser> {
        self.enterprise.as_ref()
    }
    
    pub fn load_enterprise(&mut self, provider: &impl Provider) -> Result<(), Error> {
        if self.enterprise.is_none() {
            self.enterprise = provider.load_enterprise_data(&self.id)?;
        }
        Ok(())
    }
}
}

Best Practices

Resource Creation

Use builders for complex resources:

#![allow(unused)]
fn main() {
let user = ScimUser::builder()
    .username("alice@example.com")
    .given_name("Alice")
    .family_name("Johnson")
    .email("alice@example.com")
    .active(true)
    .build()?;
}

Validate early and often:

#![allow(unused)]
fn main() {
// Validate during creation
let user = ScimUser::builder()
    .username("alice@example.com")
    .validate()  // Explicit validation
    .build()?;

// Validate before persistence
user.validate_business_rules()?;
provider.create_user(user)?;
}

Schema Management

Register schemas at startup:

#![allow(unused)]
fn main() {
fn setup_schemas(registry: &mut SchemaRegistry) {
    registry.register(CoreSchemas::user());
    registry.register(CoreSchemas::group());
    registry.register(custom_project_schema());
}
}

Version your custom schemas:

#![allow(unused)]
fn main() {
const PROJECT_SCHEMA_V1: &str = "urn:company:scim:schemas:project:1.0";
const PROJECT_SCHEMA_V2: &str = "urn:company:scim:schemas:project:2.0";
}

Error Handling

Handle validation errors gracefully:

#![allow(unused)]
fn main() {
match ScimUser::builder().username("invalid").build() {
    Ok(user) => process_user(user),
    Err(ValidationError::InvalidUsername(username)) => {
        log::warn!("Invalid username format: {}", username);
        return_error_response("Invalid username format");
    },
    Err(e) => {
        log::error!("Unexpected validation error: {}", e);
        return_error_response("Internal validation error");
    }
}
}

Next Steps

Now that you understand the resource model, you're ready to:

1. Learn about multi-tenancy for isolating resources
2. Explore storage providers for persistence
3. Understand ETag concurrency for safe updates
4. Build custom resources for your domain

The resource model provides the foundation for type-safe SCIM operations. Combined with Rust's ownership system, it prevents many classes of runtime errors while maintaining the flexibility needed for diverse identity management scenarios.

Multi-Tenancy

Multi-tenancy is a core architectural pattern that allows a single SCIM Server instance to serve multiple organizations while keeping their data completely isolated. This chapter explains how SCIM Server implements multi-tenancy and how to use it effectively.

What is Multi-Tenancy?

Multi-tenancy is a software architecture where a single instance of an application serves multiple customers (tenants). Each tenant's data is isolated and invisible to other tenants, creating the appearance of having their own dedicated instance.

Benefits of Multi-Tenancy

• Cost Efficiency: Shared infrastructure reduces operational costs
• Simplified Management: Single deployment to maintain and update
• Resource Optimization: Better utilization of hardware and services
• Faster Scaling: Add new tenants without new infrastructure
• Centralized Security: Consistent security policies across all tenants

SCIM Server's Multi-Tenant Approach

SCIM Server implements multi-tenancy at the application layer, providing:

• Complete Data Isolation: No tenant can access another's data
• Tenant-Specific Configuration: Schemas and settings per tenant
• Performance Isolation: Resource quotas and monitoring per tenant
• Independent Scaling: Different tenants can have different performance profiles

Core Concepts

Tenant Identification

Each tenant is identified by a unique tenant ID that's used throughout the system:

#![allow(unused)]
fn main() {
use scim_server::{ScimServer, TenantId, storage::InMemoryStorage};

// Create a server with multi-tenant support
let storage = InMemoryStorage::new();
let server = ScimServer::new(storage).await?;

// Operations are scoped to specific tenants
let tenant_id = TenantId::new("acme-corp");
let user = server.create_user(&tenant_id, user_data).await?;
}

Tenant Isolation

Data isolation is enforced at multiple levels:

1. API Level: All operations require a tenant context
2. Validation Level: Schemas are tenant-specific
3. Storage Level: Data is partitioned by tenant
4. Authentication Level: Users belong to specific tenants

Tenant Configuration

Each tenant can have its own configuration:

#![allow(unused)]
fn main() {
use scim_server::{TenantConfig, SchemaConfig};

let tenant_config = TenantConfig::builder()
    .tenant_id("acme-corp")
    .display_name("Acme Corporation")
    .max_users(1000)
    .custom_schema(custom_employee_schema)
    .features(vec!["bulk_operations", "filtering"])
    .build();

server.configure_tenant(tenant_config).await?;
}

Implementation Patterns

Basic Multi-Tenant Setup

The simplest multi-tenant setup uses tenant IDs in all operations:

use scim_server::{ScimServer, TenantId, storage::InMemoryStorage};
use serde_json::json;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let storage = InMemoryStorage::new();
    let server = ScimServer::new(storage).await?;
    
    // Create users for different tenants
    let acme_tenant = TenantId::new("acme-corp");
    let beta_tenant = TenantId::new("beta-inc");
    
    // Acme Corp user
    let acme_user = server.create_user(&acme_tenant, json!({
        "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
        "userName": "alice@acme.com",
        "displayName": "Alice Smith"
    })).await?;
    
    // Beta Inc user
    let beta_user = server.create_user(&beta_tenant, json!({
        "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
        "userName": "bob@beta.com",
        "displayName": "Bob Johnson"
    })).await?;
    
    // Users are completely isolated
    let acme_users = server.list_users(&acme_tenant).await?;
    let beta_users = server.list_users(&beta_tenant).await?;
    
    // acme_users contains only Alice, beta_users contains only Bob
    
    Ok(())
}

HTTP Integration with Tenant Context

When integrating with HTTP frameworks, extract tenant ID from the request:

#![allow(unused)]
fn main() {
use axum::{extract::Path, Extension, Json};
use scim_server::{ScimServer, TenantId};

async fn create_user(
    Path(tenant_id): Path<String>,
    Extension(server): Extension<ScimServer>,
    Json(user_data): Json<serde_json::Value>,
) -> Result<Json<serde_json::Value>, AppError> {
    let tenant = TenantId::new(tenant_id);
    let user = server.create_user(&tenant, user_data).await?;
    Ok(Json(user))
}

// Route: POST /tenants/{tenant_id}/scim/v2/Users
}

Tenant-Specific Schemas

Different tenants can have different schema requirements:

#![allow(unused)]
fn main() {
use scim_server::{CustomSchema, AttributeType, TenantId};

// Healthcare tenant needs additional fields
let healthcare_schema = CustomSchema::builder()
    .id("urn:healthcare:schemas:Employee")
    .add_attribute("licenseNumber", AttributeType::String, false)
    .add_attribute("department", AttributeType::String, false)
    .add_attribute("certifications", AttributeType::MultiValue, false)
    .build();

let healthcare_tenant = TenantId::new("healthcare-corp");
server.register_schema(&healthcare_tenant, healthcare_schema).await?;

// Financial tenant needs different fields
let financial_schema = CustomSchema::builder()
    .id("urn:financial:schemas:Employee")
    .add_attribute("employeeId", AttributeType::String, true)
    .add_attribute("clearanceLevel", AttributeType::String, false)
    .add_attribute("tradingPermissions", AttributeType::MultiValue, false)
    .build();

let financial_tenant = TenantId::new("financial-corp");
server.register_schema(&financial_tenant, financial_schema).await?;
}

Tenant Management

Creating and Configuring Tenants

#![allow(unused)]
fn main() {
use scim_server::{TenantConfig, ResourceQuota, TenantFeatures};

async fn setup_new_tenant(
    server: &ScimServer,
    tenant_id: &str,
    org_name: &str,
) -> Result<(), Box<dyn std::error::Error>> {
    let tenant = TenantId::new(tenant_id);
    
    // Configure tenant with specific limits and features
    let config = TenantConfig::builder()
        .tenant_id(tenant_id)
        .display_name(org_name)
        .quota(ResourceQuota {
            max_users: 500,
            max_groups: 50,
            max_custom_resources: 100,
        })
        .features(TenantFeatures {
            bulk_operations: true,
            patch_operations: true,
            filtering: true,
            sorting: true,
            ai_integration: false, // Disabled for basic plan
        })
        .build();
    
    server.create_tenant(config).await?;
    
    // Set up default schemas
    server.register_default_schemas(&tenant).await?;
    
    Ok(())
}
}

Tenant Discovery and Listing

#![allow(unused)]
fn main() {
// List all configured tenants
let tenants = server.list_tenants().await?;

for tenant in tenants {
    println!("Tenant: {} ({})", tenant.id, tenant.display_name);
    println!("  Users: {}/{}", tenant.user_count, tenant.max_users);
    println!("  Features: {:?}", tenant.enabled_features);
}

// Get specific tenant information
let tenant_info = server.get_tenant_info(&TenantId::new("acme-corp")).await?;
}

Storage Considerations

Database Multi-Tenancy

When using database storage, tenant isolation can be implemented in several ways:

Shared Database, Separate Schemas

-- Each tenant gets its own schema
CREATE SCHEMA tenant_acme_corp;
CREATE SCHEMA tenant_beta_inc;

-- Tables are created in tenant-specific schemas
CREATE TABLE tenant_acme_corp.users (...);
CREATE TABLE tenant_beta_inc.users (...);

Shared Database, Shared Tables with Tenant Column

-- Single table with tenant_id column
CREATE TABLE users (
    tenant_id VARCHAR(255) NOT NULL,
    user_id VARCHAR(255) NOT NULL,
    username VARCHAR(255) NOT NULL,
    -- ... other columns
    PRIMARY KEY (tenant_id, user_id)
);

-- All queries include tenant_id in WHERE clause
SELECT * FROM users WHERE tenant_id = 'acme-corp';

Separate Databases per Tenant

#![allow(unused)]
fn main() {
use scim_server::storage::DatabaseConfig;

// Configure separate databases per tenant
let acme_config = DatabaseConfig::new("postgresql://host/acme_corp_db");
let beta_config = DatabaseConfig::new("postgresql://host/beta_inc_db");

// Storage provider handles routing based on tenant
let storage = MultiTenantDatabaseStorage::new()
    .add_tenant("acme-corp", acme_config)
    .add_tenant("beta-inc", beta_config);
}

Security and Compliance

Authentication Integration

Combine multi-tenancy with authentication for complete security:

#![allow(unused)]
fn main() {
use scim_server::auth::{AuthenticationWitness, TenantAuthority};

async fn authenticated_operation(
    auth: AuthenticationWitness<Authenticated>,
    tenant_id: TenantId,
    server: &ScimServer,
) -> Result<(), AuthError> {
    // Verify user has access to this tenant
    let tenant_authority = auth.verify_tenant_access(&tenant_id)?;
    
    // Operation is now both authenticated and tenant-scoped
    let users = server.list_users_with_auth(
        &tenant_id,
        &auth,
        &tenant_authority
    ).await?;
    
    Ok(())
}
}

Audit Logging

Multi-tenant systems require comprehensive audit trails:

#![allow(unused)]
fn main() {
use scim_server::audit::{AuditEvent, AuditLogger};

// All operations are logged with tenant context
let audit_logger = AuditLogger::new();

// Log tenant-scoped operations
audit_logger.log(AuditEvent::UserCreated {
    tenant_id: "acme-corp",
    user_id: "user123",
    performed_by: "admin@acme.com",
    timestamp: Utc::now(),
}).await?;
}

Data Residency and Compliance

Different tenants may have different compliance requirements:

#![allow(unused)]
fn main() {
use scim_server::{DataResidency, ComplianceMode};

let eu_tenant_config = TenantConfig::builder()
    .tenant_id("eu-customer")
    .data_residency(DataResidency::EuropeanUnion)
    .compliance_mode(ComplianceMode::GDPR)
    .encryption_required(true)
    .audit_retention_days(2555) // 7 years
    .build();

let us_tenant_config = TenantConfig::builder()
    .tenant_id("us-customer")
    .data_residency(DataResidency::UnitedStates)
    .compliance_mode(ComplianceMode::SOX)
    .encryption_required(true)
    .audit_retention_days(2555)
    .build();
}

Performance and Scaling

Resource Isolation

Prevent one tenant from affecting others:

#![allow(unused)]
fn main() {
use scim_server::{ResourceLimits, RateLimiting};

let tenant_limits = ResourceLimits::builder()
    .max_requests_per_minute(1000)
    .max_concurrent_operations(50)
    .max_query_complexity(100)
    .memory_limit_mb(512)
    .build();

server.set_tenant_limits(&tenant_id, tenant_limits).await?;
}

Monitoring per Tenant

Track performance and usage metrics per tenant:

#![allow(unused)]
fn main() {
use scim_server::metrics::{TenantMetrics, MetricsCollector};

let metrics = server.get_tenant_metrics(&tenant_id).await?;

println!("Tenant {} metrics:", tenant_id);
println!("  Requests/minute: {}", metrics.requests_per_minute);
println!("  Average response time: {}ms", metrics.avg_response_time);
println!("  Storage usage: {}MB", metrics.storage_usage_mb);
println!("  Error rate: {}%", metrics.error_rate);
}

Best Practices

Tenant ID Strategy

Choose tenant IDs carefully:

#![allow(unused)]
fn main() {
// Good: Clear, unique, URL-safe
let tenant_id = TenantId::new("acme-corp-prod");

// Avoid: Ambiguous or containing sensitive data
let bad_tenant_id = TenantId::new("customer-123-secret-key");
}

Configuration Management

Use environment-specific configurations:

#![allow(unused)]
fn main() {
use scim_server::config::TenantConfigLoader;

// Load tenant configurations from external sources
let config_loader = TenantConfigLoader::new()
    .from_file("tenants.yaml")
    .from_env_prefix("SCIM_TENANT_")
    .from_database(&config_db);

let tenant_configs = config_loader.load_all().await?;
}

Error Handling

Provide tenant-aware error messages:

#![allow(unused)]
fn main() {
use scim_server::error::{ScimError, TenantError};

match server.get_user(&tenant_id, &user_id).await {
    Ok(user) => Ok(user),
    Err(ScimError::TenantNotFound(tenant)) => {
        Err(format!("Organization '{}' not found", tenant))
    },
    Err(ScimError::UserNotFound { tenant, user_id }) => {
        Err(format!("User '{}' not found in organization '{}'", user_id, tenant))
    },
    Err(e) => Err(e.into()),
}
}

Testing Multi-Tenant Code

Test with multiple tenants to ensure isolation:

#![allow(unused)]
fn main() {
#[tokio::test]
async fn test_tenant_isolation() {
    let server = test_server().await;
    
    let tenant_a = TenantId::new("tenant-a");
    let tenant_b = TenantId::new("tenant-b");
    
    // Create user in tenant A
    let user_a = server.create_user(&tenant_a, user_data.clone()).await?;
    
    // Verify user is not visible in tenant B
    let tenant_b_users = server.list_users(&tenant_b).await?;
    assert!(tenant_b_users.is_empty());
    
    // Verify user is visible in tenant A
    let tenant_a_users = server.list_users(&tenant_a).await?;
    assert_eq!(tenant_a_users.len(), 1);
}
}

Multi-tenancy in SCIM Server provides a robust foundation for building SaaS applications that serve multiple organizations while maintaining security, performance, and compliance requirements.

Storage Providers

Storage providers are the backbone of the SCIM Server library, handling all data persistence and retrieval operations. The library uses a two-layer architecture that cleanly separates storage concerns from SCIM protocol logic.

Overview

The SCIM Server implements data access through two complementary abstractions:

• StorageProvider: Low-level trait for pure data persistence operations
• ResourceProvider: High-level trait for SCIM-aware resource management

This separation allows you to plug in different storage backends (database, file system, cloud storage) without changing SCIM protocol logic, and conversely modify SCIM behavior without touching storage implementation.

#![allow(unused)]
fn main() {
use scim_server::{
    providers::StandardResourceProvider,
    storage::InMemoryStorage,
    resource::{RequestContext, ResourceProvider},
};

// Create storage backend
let storage = InMemoryStorage::new();

// Create SCIM provider with storage
let provider = StandardResourceProvider::new(storage);

// Use for SCIM operations
let context = RequestContext::with_generated_id();
let user = provider.create_resource("User", user_data, &context).await?;
}

StorageProvider Layer

The StorageProvider trait defines protocol-agnostic storage operations:

Core Operations

#![allow(unused)]
fn main() {
pub trait StorageProvider: Send + Sync {
    type Error: std::error::Error + Send + Sync + 'static;

    // Basic CRUD operations
    async fn put(&self, key: StorageKey, data: Value) -> Result<Value, Self::Error>;
    async fn get(&self, key: StorageKey) -> Result<Option<Value>, Self::Error>;
    async fn delete(&self, key: StorageKey) -> Result<bool, Self::Error>;
    
    // Query operations
    async fn list(&self, prefix: StoragePrefix, offset: usize, limit: usize) 
        -> Result<Vec<(StorageKey, Value)>, Self::Error>;
    async fn find_by_attribute(&self, prefix: StoragePrefix, attribute: &str, value: &str) 
        -> Result<Vec<(StorageKey, Value)>, Self::Error>;
    async fn exists(&self, key: StorageKey) -> Result<bool, Self::Error>;
    async fn count(&self, prefix: StoragePrefix) -> Result<usize, Self::Error>;
}
}

Tenant Isolation

All storage operations are scoped by tenant through hierarchical keys:

#![allow(unused)]
fn main() {
pub struct StorageKey {
    tenant_id: String,      // "tenant-1" or "default"
    resource_type: String,  // "User", "Group", etc.
    resource_id: String,    // "user-123"
}

// Examples:
// StorageKey::new("tenant-1", "User", "alice-123")
// StorageKey::new("default", "Group", "admins-456")
}

This provides automatic tenant isolation without complex tenant management systems.

Built-in Storage Providers

InMemoryStorage

Thread-safe in-memory storage using HashMap:

#![allow(unused)]
fn main() {
use scim_server::storage::InMemoryStorage;

let storage = InMemoryStorage::new();

// Get statistics
let stats = storage.stats().await;
println!("Total resources: {}", stats.total_resources);
println!("Tenants: {}", stats.tenant_count);
}

Use Cases:

• Development and testing
• Proof of concepts
• Small deployments without persistence requirements

Characteristics:

• Thread-safe with RwLock
• No persistence across restarts
• Excellent performance for development
• Built-in statistics and metrics

Custom Storage Implementation

Implement StorageProvider for custom backends:

#![allow(unused)]
fn main() {
use scim_server::storage::{StorageProvider, StorageKey, StorageError};
use serde_json::Value;

#[derive(Clone)]
pub struct DatabaseStorage {
    pool: sqlx::PgPool,
}

impl StorageProvider for DatabaseStorage {
    type Error = StorageError;
    
    async fn put(&self, key: StorageKey, data: Value) -> Result<Value, Self::Error> {
        sqlx::query!(
            "INSERT INTO scim_resources (tenant_id, resource_type, resource_id, data) 
             VALUES ($1, $2, $3, $4) 
             ON CONFLICT (tenant_id, resource_type, resource_id) 
             DO UPDATE SET data = $4, updated_at = NOW()",
            key.tenant_id(),
            key.resource_type(), 
            key.resource_id(),
            data
        )
        .execute(&self.pool)
        .await
        .map_err(|e| StorageError::Internal(e.to_string()))?;
        
        Ok(data)
    }
    
    async fn get(&self, key: StorageKey) -> Result<Option<Value>, Self::Error> {
        let row = sqlx::query!(
            "SELECT data FROM scim_resources 
             WHERE tenant_id = $1 AND resource_type = $2 AND resource_id = $3",
            key.tenant_id(),
            key.resource_type(),
            key.resource_id()
        )
        .fetch_optional(&self.pool)
        .await
        .map_err(|e| StorageError::Internal(e.to_string()))?;
        
        Ok(row.map(|r| r.data))
    }
    
    // ... implement other methods
}
}

ResourceProvider Layer

The ResourceProvider trait handles SCIM-specific logic:

Standard Implementation

Most applications use StandardResourceProvider with a pluggable storage backend:

#![allow(unused)]
fn main() {
use scim_server::providers::StandardResourceProvider;

let storage = DatabaseStorage::new(pool);
let provider = StandardResourceProvider::new(storage);

// The provider handles:
// - SCIM metadata generation (timestamps, ETags)
// - Resource validation
// - Tenant context processing
// - Error translation
}

Direct Implementation

For custom SCIM behavior, implement ResourceProvider directly:

#![allow(unused)]
fn main() {
use scim_server::resource::{ResourceProvider, Resource, RequestContext};

pub struct CustomResourceProvider {
    storage: Box<dyn StorageProvider<Error = StorageError>>,
    validator: CustomValidator,
}

impl ResourceProvider for CustomResourceProvider {
    type Error = CustomError;
    
    async fn create_resource(
        &self,
        resource_type: &str,
        data: Value,
        context: &RequestContext,
    ) -> Result<Resource, Self::Error> {
        // Custom validation
        self.validator.validate_resource(resource_type, &data)?;
        
        // Custom metadata
        let enriched_data = self.add_custom_metadata(data, context)?;
        
        // Delegate to storage
        let key = self.build_storage_key(resource_type, context);
        let stored = self.storage.put(key, enriched_data).await?;
        
        Ok(Resource::from_json(resource_type.to_string(), stored)?)
    }
    
    // ... implement other methods
}
}

Multi-Tenancy Support

Context-Driven Isolation

The library provides automatic tenant isolation through RequestContext:

#![allow(unused)]
fn main() {
use scim_server::resource::{RequestContext, TenantContext};

// Single-tenant operation (uses "default" tenant)
let single_context = RequestContext::with_generated_id();

// Multi-tenant operation
let tenant_context = TenantContext::new(
    "customer-123".to_string(),
    "app-456".to_string(),
);
let multi_context = RequestContext::with_tenant_generated_id(tenant_context);

// Same provider, different tenant isolation
let user1 = provider.create_resource("User", data1, &single_context).await?;
let user2 = provider.create_resource("User", data2, &multi_context).await?;
}

Storage Layout

Resources are automatically organized by tenant:

Storage Hierarchy:
├── default/           # Single-tenant operations
│   ├── User/
│   │   ├── user-1 → {user data}
│   │   └── user-2 → {user data}
│   └── Group/
│       └── group-1 → {group data}
├── customer-123/      # Tenant-specific data
│   ├── User/
│   │   └── user-1 → {different user data}
│   └── Group/
└── customer-456/      # Another tenant
    └── User/
        └── user-1 → {yet different user data}

Error Handling

Storage Error Types

#![allow(unused)]
fn main() {
use scim_server::storage::StorageError;

pub enum StorageError {
    NotFound(String),
    Conflict(String),
    Internal(String),
}

// Usage in custom storage
impl StorageProvider for MyStorage {
    type Error = StorageError;
    
    async fn get(&self, key: StorageKey) -> Result<Option<Value>, Self::Error> {
        self.database.get(&key)
            .await
            .map_err(|e| StorageError::Internal(e.to_string()))
    }
}
}

Error Propagation

The architecture provides clean error propagation from storage to SCIM:

#![allow(unused)]
fn main() {
StorageError → ResourceProviderError → SCIM HTTP Status
NotFound     → ResourceNotFound       → 404 Not Found
Conflict     → ResourceConflict       → 409 Conflict
Internal     → InternalError          → 500 Internal Server Error
}

Performance Considerations

Storage Layer Optimizations

#![allow(unused)]
fn main() {
// Connection pooling in storage
pub struct PooledStorage {
    pool: Arc<Pool<PostgresConnectionManager>>,
}

// Caching decorator
pub struct CachedStorage<S> {
    inner: S,
    cache: Arc<Cache<String, Value>>,
}

impl<S: StorageProvider> StorageProvider for CachedStorage<S> {
    type Error = S::Error;
    
    async fn get(&self, key: StorageKey) -> Result<Option<Value>, Self::Error> {
        let cache_key = format!("{}", key);
        
        // Check cache first
        if let Some(cached) = self.cache.get(&cache_key).await {
            return Ok(Some(cached));
        }
        
        // Fallback to storage
        let result = self.inner.get(key).await?;
        
        // Cache the result
        if let Some(ref value) = result {
            self.cache.insert(cache_key, value.clone()).await;
        }
        
        Ok(result)
    }
}
}

Resource Layer Optimizations

• Metadata Caching: Cache computed SCIM metadata
• Validation Caching: Cache validation results for schemas
• Bulk Operations: Implement batch processing for list operations

Testing Strategies

Unit Testing Storage

#![allow(unused)]
fn main() {
#[cfg(test)]
mod tests {
    use super::*;
    use scim_server::storage::{StorageKey, StoragePrefix};
    use serde_json::json;
    
    #[tokio::test]
    async fn test_storage_crud() {
        let storage = MyStorage::new();
        let key = StorageKey::new("tenant1", "User", "123");
        let data = json!({"userName": "test"});
        
        // Test put
        let stored = storage.put(key.clone(), data.clone()).await.unwrap();
        assert_eq!(stored, data);
        
        // Test get
        let retrieved = storage.get(key.clone()).await.unwrap();
        assert_eq!(retrieved, Some(data));
        
        // Test delete
        let deleted = storage.delete(key.clone()).await.unwrap();
        assert!(deleted);
        
        // Verify deletion
        let after_delete = storage.get(key).await.unwrap();
        assert_eq!(after_delete, None);
    }
    
    #[tokio::test]
    async fn test_tenant_isolation() {
        let storage = MyStorage::new();
        
        let key1 = StorageKey::new("tenant1", "User", "123");
        let key2 = StorageKey::new("tenant2", "User", "123");
        
        let data1 = json!({"userName": "user1"});
        let data2 = json!({"userName": "user2"});
        
        storage.put(key1.clone(), data1.clone()).await.unwrap();
        storage.put(key2.clone(), data2.clone()).await.unwrap();
        
        // Verify isolation
        assert_eq!(storage.get(key1).await.unwrap(), Some(data1));
        assert_eq!(storage.get(key2).await.unwrap(), Some(data2));
    }
}
}

Integration Testing

#![allow(unused)]
fn main() {
#[tokio::test]
async fn test_full_provider_stack() {
    let storage = InMemoryStorage::new();
    let provider = StandardResourceProvider::new(storage);
    
    let context = RequestContext::with_generated_id();
    
    // Test full SCIM workflow
    let user = provider.create_resource(
        "User",
        json!({
            "userName": "alice@example.com",
            "displayName": "Alice Smith"
        }),
        &context,
    ).await.unwrap();
    
    assert!(user.get_id().is_some());
    assert_eq!(user.get_username().unwrap(), "alice@example.com");
    
    // Test retrieval
    let retrieved = provider.get_resource(
        "User",
        user.get_id().unwrap(),
        &context,
    ).await.unwrap();
    
    assert!(retrieved.is_some());
    assert_eq!(retrieved.unwrap().get_username().unwrap(), "alice@example.com");
}
}

Best Practices

Provider Selection

Choose the right provider pattern for your use case:

• Standard + InMemory: Development, testing, proof of concepts
• Standard + Database: Production deployments with persistence
• Standard + Custom: Specialized storage requirements (cloud, distributed)
• Custom ResourceProvider: Non-standard SCIM behavior or extensive customization

Configuration Management

#![allow(unused)]
fn main() {
use serde::{Deserialize, Serialize};

#[derive(Debug, Deserialize, Serialize)]
pub struct StorageConfig {
    pub storage_type: String,
    pub connection_url: Option<String>,
    pub max_connections: Option<u32>,
    pub enable_ssl: bool,
    pub cache_ttl_seconds: Option<u64>,
}

pub async fn create_storage_provider(config: &StorageConfig) -> Result<Box<dyn StorageProvider<Error = StorageError>>, ConfigError> {
    match config.storage_type.as_str() {
        "memory" => Ok(Box::new(InMemoryStorage::new())),
        "postgres" => {
            let pool = create_postgres_pool(&config.connection_url.as_ref().unwrap()).await?;
            Ok(Box::new(PostgresStorage::new(pool)))
        }
        "redis" => {
            let client = create_redis_client(&config.connection_url.as_ref().unwrap()).await?;
            Ok(Box::new(RedisStorage::new(client)))
        }
        _ => Err(ConfigError::UnsupportedStorageType(config.storage_type.clone())),
    }
}
}

Monitoring and Observability

#![allow(unused)]
fn main() {
use tracing::{info, error, instrument};

impl<S: StorageProvider> StandardResourceProvider<S> {
    #[instrument(skip(self, data, context))]
    async fn create_resource(
        &self,
        resource_type: &str,
        data: Value,
        context: &RequestContext,
    ) -> Result<Resource, Self::Error> {
        info!(
            resource_type = resource_type,
            tenant_id = context.tenant_context.as_ref().map(|t| t.tenant_id.as_str()),
            "Creating resource"
        );
        
        let result = self.inner_create_resource(resource_type, data, context).await;
        
        match &result {
            Ok(resource) => {
                info!(
                    resource_type = resource_type,
                    resource_id = resource.get_id().unwrap_or("unknown"),
                    "Resource created successfully"
                );
            }
            Err(e) => {
                error!(
                    resource_type = resource_type,
                    error = %e,
                    "Failed to create resource"
                );
            }
        }
        
        result
    }
}
}

Next Steps

• Provider Architecture - Deep dive into the two-layer architecture
• Basic Implementation - Learn to implement storage providers
• Advanced Features - Explore advanced provider capabilities
• Multi-Tenancy - Comprehensive guide to multi-tenant deployments

ETag Concurrency Control

ETag concurrency control is a critical feature for preventing lost updates in multi-client environments. This chapter explains how SCIM Server implements enterprise-grade optimistic locking using ETags to ensure data consistency.

What are ETags?

ETags (Entity Tags) are HTTP headers that represent the version of a resource. They enable optimistic concurrency control, where multiple clients can work on the same resource without locking, but updates are validated to prevent conflicts.

Benefits of ETag Concurrency Control

• Prevent Lost Updates: Avoid scenarios where one client overwrites another's changes
• Optimistic Locking: No blocking - clients work independently until conflict detection
• Performance: Better than pessimistic locking for distributed systems
• Consistency: Ensure data integrity in concurrent environments
• Auditability: Track version changes for compliance and debugging

How ETags Work in SCIM Server

SCIM Server automatically manages ETags for all resources, providing seamless concurrency control:

use scim_server::{ScimServer, storage::InMemoryStorage};
use serde_json::json;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let storage = InMemoryStorage::new();
    let server = ScimServer::new(storage).await?;
    
    // Create a user - ETag is automatically generated
    let user_data = json!({
        "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
        "userName": "alice@example.com",
        "active": true
    });

    let user = server.create_user("tenant-1", user_data).await?;
    println!("Created user with ETag: {}", user.meta.version);
    // Output: W/"1-abc123def456"
    
    Ok(())
}

ETag Format and Structure

SCIM Server uses weak ETags following HTTP standards:

W/"<version>-<hash>"

• W/: Indicates a weak ETag (semantic equivalence)
• version: Monotonically increasing version number
• hash: Content hash for additional validation

Examples:

• W/"1-a1b2c3d4" - Version 1, first creation
• W/"2-e5f6g7h8" - Version 2, after first update
• W/"3-i9j0k1l2" - Version 3, after second update

Basic Concurrency Control

Reading Resources with ETags

All read operations return the current ETag:

#![allow(unused)]
fn main() {
use scim_server::{ScimServer, TenantId};

async fn read_user_with_etag(
    server: &ScimServer,
    tenant_id: &TenantId,
    user_id: &str,
) -> Result<(), Box<dyn std::error::Error>> {
    let user = server.get_user(tenant_id, user_id).await?;
    
    println!("User: {}", user.user_name);
    println!("Current ETag: {}", user.meta.version);
    println!("Last Modified: {}", user.meta.last_modified);
    
    Ok(())
}
}

Conditional Updates

Use ETags to ensure updates only succeed if the resource hasn't changed:

#![allow(unused)]
fn main() {
use scim_server::{ScimServer, ETag, ConditionalResult};

async fn safe_update_user(
    server: &ScimServer,
    tenant_id: &TenantId,
    user_id: &str,
    expected_etag: &ETag,
    updates: serde_json::Value,
) -> Result<(), Box<dyn std::error::Error>> {
    match server.conditional_update_user(
        tenant_id,
        user_id,
        updates,
        Some(expected_etag),
    ).await? {
        ConditionalResult::Success(updated_user) => {
            println!("Update successful!");
            println!("New ETag: {}", updated_user.meta.version);
        },
        ConditionalResult::VersionMismatch { expected, current } => {
            println!("Version conflict detected!");
            println!("Expected: {}, Current: {}", expected, current);
            // Handle conflict - see conflict resolution section
        },
        ConditionalResult::NotFound => {
            println!("User no longer exists");
        }
    }
    
    Ok(())
}
}

Advanced Concurrency Patterns

Optimistic Update with Retry

Handle conflicts gracefully with automatic retry:

#![allow(unused)]
fn main() {
use scim_server::{ScimServer, ConditionalResult, BackoffStrategy};
use tokio::time::{sleep, Duration};

async fn optimistic_update_with_retry(
    server: &ScimServer,
    tenant_id: &TenantId,
    user_id: &str,
    update_fn: impl Fn(&serde_json::Value) -> serde_json::Value,
    max_retries: u32,
) -> Result<serde_json::Value, Box<dyn std::error::Error>> {
    for attempt in 0..max_retries {
        // Get current version
        let current_user = server.get_user(tenant_id, user_id).await?;
        let current_etag = &current_user.meta.version;
        
        // Apply updates
        let updated_data = update_fn(&current_user);
        
        // Attempt conditional update
        match server.conditional_update_user(
            tenant_id,
            user_id,
            updated_data,
            Some(current_etag),
        ).await? {
            ConditionalResult::Success(user) => return Ok(user),
            ConditionalResult::VersionMismatch { .. } => {
                if attempt < max_retries - 1 {
                    // Exponential backoff before retry
                    let delay = Duration::from_millis(100 * 2_u64.pow(attempt));
                    sleep(delay).await;
                    continue;
                } else {
                    return Err("Max retries exceeded".into());
                }
            },
            ConditionalResult::NotFound => {
                return Err("User was deleted during update".into());
            }
        }
    }
    
    unreachable!()
}
}

Batch Operations with Version Checking

Advanced Patterns

Multiple Operations with ETags

#![allow(unused)]
fn main() {
use scim_server::{ConditionalResult, VersionedResource};

async fn batch_update_with_etags(
    provider: &impl ResourceProvider,
    tenant_id: &TenantId,
    operations: Vec<(String, serde_json::Value, ETag)>, // (user_id, data, expected_etag)
) -> Result<Vec<ConditionalResult<VersionedResource>>, Box<dyn std::error::Error>> {
    let mut results = Vec::new();
    let context = RequestContext::new("batch-update", None);
    
    // Process each operation individually (bulk operations not yet implemented)
    for (user_id, data, expected_etag) in operations {
        let result = provider.conditional_update(
            "User",
            &user_id,
            data,
            &expected_etag,
            &context
        ).await?;
        
        match &result {
            ConditionalResult::Success(versioned) => {
                println!("Updated {}: new version {}", user_id, versioned.version());
            },
            ConditionalResult::VersionMismatch(conflict) => {
                println!("Conflict on {}: expected {}, got {}", 
                         user_id, expected_etag, conflict.current_version);
            },
            ConditionalResult::NotFound => {
                println!("User {} not found", user_id);
            }
        }
        
        results.push(result);
    }
    
    Ok(results)
}
}

Conflict Resolution Strategies

When version conflicts occur, several strategies can be employed:

Strategy 1: Last Writer Wins (Forced Update)

#![allow(unused)]
fn main() {
async fn force_update(
    server: &ScimServer,
    tenant_id: &TenantId,
    user_id: &str,
    updates: serde_json::Value,
) -> Result<serde_json::Value, Box<dyn std::error::Error>> {
    // Update without ETag check - potentially dangerous!
    let result = server.update_user(tenant_id, user_id, updates).await?;
    println!("Forced update completed");
    Ok(result)
}
}

⚠️ Warning: Use this strategy only when you're certain it's safe to overwrite changes.

Strategy 2: Merge Changes

#![allow(unused)]
fn main() {
use serde_json::{Value, Map};

async fn merge_and_update(
    server: &ScimServer,
    tenant_id: &TenantId,
    user_id: &str,
    my_changes: serde_json::Value,
    max_attempts: u32,
) -> Result<serde_json::Value, Box<dyn std::error::Error>> {
    for attempt in 0..max_attempts {
        // Get current state
        let current_user = server.get_user(tenant_id, user_id).await?;
        let current_etag = &current_user.meta.version;
        
        // Merge changes (simple field-level merge)
        let merged_data = merge_user_data(&current_user, &my_changes)?;
        
        // Attempt update with current ETag
        match server.conditional_update_user(
            tenant_id,
            user_id,
            merged_data,
            Some(current_etag),
        ).await? {
            ConditionalResult::Success(user) => return Ok(user),
            ConditionalResult::VersionMismatch { .. } => {
                // Retry with fresh data
                continue;
            },
            ConditionalResult::NotFound => {
                return Err("User was deleted".into());
            }
        }
    }
    
    Err("Failed to merge after maximum attempts".into())
}

fn merge_user_data(
    current: &serde_json::Value,
    changes: &serde_json::Value,
) -> Result<serde_json::Value, Box<dyn std::error::Error>> {
    let mut merged = current.clone();
    
    if let (Some(current_obj), Some(changes_obj)) = (
        merged.as_object_mut(),
        changes.as_object()
    ) {
        for (key, value) in changes_obj {
            // Simple field replacement - you might want more sophisticated merging
            current_obj.insert(key.clone(), value.clone());
        }
    }
    
    Ok(merged)
}
}

Strategy 3: User-Mediated Resolution

#![allow(unused)]
fn main() {
use scim_server::ConflictResolution;

async fn resolve_conflict_interactively(
    server: &ScimServer,
    tenant_id: &TenantId,
    user_id: &str,
    my_changes: serde_json::Value,
    conflict: ConflictResolution,
) -> Result<serde_json::Value, Box<dyn std::error::Error>> {
    println!("Conflict detected for user {}", user_id);
    println!("Your changes: {}", serde_json::to_string_pretty(&my_changes)?);
    println!("Current state: {}", serde_json::to_string_pretty(&conflict.current_state)?);
    
    // In a real application, present UI for user to choose resolution
    let resolution = prompt_user_for_resolution(&my_changes, &conflict.current_state)?;
    
    match resolution {
        UserChoice::KeepMine => {
            // Force update with my changes
            server.update_user(tenant_id, user_id, my_changes).await
        },
        UserChoice::KeepTheirs => {
            // Return current state, no update needed
            Ok(conflict.current_state)
        },
        UserChoice::Merge(merged_data) => {
            // Use user-provided merge
            server.update_user(tenant_id, user_id, merged_data).await
        }
    }
}

enum UserChoice {
    KeepMine,
    KeepTheirs,
    Merge(serde_json::Value),
}
}

HTTP Integration

ETag Headers in HTTP Responses

SCIM Server automatically includes ETag headers in HTTP responses:

#![allow(unused)]
fn main() {
use axum::{response::Response, http::HeaderMap};

async fn http_get_user(
    tenant_id: String,
    user_id: String,
    server: ScimServer,
) -> Result<Response, AppError> {
    let user = server.get_user(&TenantId::new(tenant_id), &user_id).await?;
    
    let mut headers = HeaderMap::new();
    headers.insert("ETag", user.meta.version.to_string().parse()?);
    headers.insert("Last-Modified", user.meta.last_modified.to_rfc2822().parse()?);
    
    let response = Response::builder()
        .status(200)
        .header("Content-Type", "application/scim+json")
        .header("ETag", user.meta.version.to_string())
        .body(serde_json::to_string(&user)?)
        .unwrap();
    
    Ok(response)
}
}

Conditional Requests with If-Match

Handle conditional updates via HTTP If-Match headers:

#![allow(unused)]
fn main() {
use axum::{extract::HeaderMap, http::StatusCode};

async fn http_update_user(
    tenant_id: String,
    user_id: String,
    headers: HeaderMap,
    Json(updates): Json<serde_json::Value>,
    server: ScimServer,
) -> Result<Response, AppError> {
    let if_match = headers.get("If-Match")
        .and_then(|v| v.to_str().ok())
        .map(ETag::parse)
        .transpose()?;
    
    match server.conditional_update_user(
        &TenantId::new(tenant_id),
        &user_id,
        updates,
        if_match.as_ref(),
    ).await? {
        ConditionalResult::Success(user) => {
            Ok(Response::builder()
                .status(200)
                .header("ETag", user.meta.version.to_string())
                .body(serde_json::to_string(&user)?)
                .unwrap())
        },
        ConditionalResult::VersionMismatch { expected, current } => {
            Ok(Response::builder()
                .status(StatusCode::PRECONDITION_FAILED)
                .header("ETag", current.to_string())
                .body(format!("Version mismatch: expected {}, current {}", expected, current))
                .unwrap())
        },
        ConditionalResult::NotFound => {
            Ok(Response::builder()
                .status(StatusCode::NOT_FOUND)
                .body("User not found")
                .unwrap())
        }
    }
}
}

Performance Considerations

ETag Storage Optimization

ETags are stored efficiently to minimize overhead:

#![allow(unused)]
fn main() {
use scim_server::storage::{ETagStorage, CompressionLevel};

// Configure ETag storage for optimal performance
let etag_config = ETagStorage::builder()
    .compression(CompressionLevel::Fast)
    .cache_size_mb(256)
    .cleanup_interval_hours(24)
    .build();

let storage = InMemoryStorage::new()
    .with_etag_config(etag_config);
}

Batch ETag Operations

Efficiently handle ETags in bulk operations:

#![allow(unused)]
fn main() {
// Pre-fetch ETags for bulk validation
let user_ids = vec!["user1", "user2", "user3"];
let etags = server.get_etags(&tenant_id, &user_ids).await?;

// Validate all ETags before proceeding with bulk operation
for (user_id, expected_etag) in expected_etags {
    let current_etag = etags.get(user_id).ok_or("User not found")?;
    if current_etag != &expected_etag {
        return Err(format!("Version mismatch for user {}", user_id).into());
    }
}
}

AI Integration and ETags

ETags work seamlessly with AI tools via MCP:

#![allow(unused)]
fn main() {
use scim_server::mcp::{McpTool, ConflictResolutionStrategy};

// AI can handle conflicts intelligently
let ai_conflict_resolver = McpTool::new("claude-3-5-sonnet")
    .with_conflict_strategy(ConflictResolutionStrategy::SmartMerge)
    .with_retry_limit(3);

// AI assistant automatically handles ETag conflicts
let result = ai_conflict_resolver.update_user_safe(
    &tenant_id,
    &user_id,
    json!({
        "active": false,
        "lastLogin": "2024-01-15T10:30:00Z"
    })
).await?;
}

Best Practices

Always Use ETags for Updates

#![allow(unused)]
fn main() {
// Good: Always check ETags for updates
let user = server.get_user(&tenant_id, &user_id).await?;
let current_etag = &user.meta.version;
let result = server.conditional_update_user(&tenant_id, &user_id, updates, Some(current_etag)).await?;

// Avoid: Blind updates without version checking
let result = server.update_user(&tenant_id, &user_id, updates).await?; // Risky!
}

Handle All Conflict Cases

#![allow(unused)]
fn main() {
match server.conditional_update_user(&tenant_id, &user_id, updates, Some(&etag)).await? {
    ConditionalResult::Success(user) => {
        // Success case
    },
    ConditionalResult::VersionMismatch { expected, current } => {
        // Always handle conflicts
    },
    ConditionalResult::NotFound => {
        // Handle deletion case
    }
}
}

Monitor Conflict Rates

#![allow(unused)]
fn main() {
use scim_server::metrics::ConflictMetrics;

// Track conflict rates to identify problematic access patterns
let metrics = server.get_conflict_metrics(&tenant_id).await?;
if metrics.conflict_rate_percent > 5.0 {
    log::warn!("High conflict rate detected: {}%", metrics.conflict_rate_percent);
    // Consider implementing additional coordination mechanisms
}
}

ETag concurrency control in SCIM Server provides robust protection against data loss while maintaining high performance in concurrent environments. By understanding and properly implementing these patterns, you can build reliable multi-client systems that handle conflicts gracefully.

Custom Resource Types

This tutorial shows you how to extend the SCIM Server with custom resource types beyond the standard User and Group resources. You'll learn to define schemas, implement type-safe resources, and integrate them with your SCIM server.

Why Custom Resources?

While SCIM's User and Group resources cover most identity scenarios, enterprise environments often need additional resource types:

• Projects: Development projects with team assignments
• Roles: Fine-grained permission sets
• Devices: Mobile devices and laptops assigned to users
• Applications: SaaS applications and their configurations
• Departments: Organizational units with hierarchies
• Locations: Office locations and room assignments

Custom resources let you manage these entities with the same SCIM operations and guarantees as built-in resources.

Quick Start Example

Let's start with a simple Device resource:

#![allow(unused)]
fn main() {
use scim_server::{ScimResource, ResourceMeta, Schema, Attribute};
use serde::{Deserialize, Serialize};
use chrono::{DateTime, Utc};

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Device {
    pub id: String,
    pub schemas: Vec<String>,
    pub meta: ResourceMeta,
    pub external_id: Option<String>,
    
    // Custom attributes
    pub serial_number: String,
    pub device_type: DeviceType,
    pub manufacturer: String,
    pub model: String,
    pub assigned_to: Option<String>,  // User ID
    pub status: DeviceStatus,
    pub purchase_date: Option<DateTime<Utc>>,
    pub warranty_expires: Option<DateTime<Utc>>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum DeviceType {
    Laptop,
    Desktop,
    Tablet,
    Phone,
    Other(String),
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum DeviceStatus {
    Available,
    Assigned,
    InRepair,
    Retired,
}

impl ScimResource for Device {
    fn id(&self) -> &str {
        &self.id
    }
    
    fn schemas(&self) -> &[String] {
        &self.schemas
    }
    
    fn meta(&self) -> &ResourceMeta {
        &self.meta
    }
    
    fn external_id(&self) -> Option<&str> {
        self.external_id.as_deref()
    }
}
}

Step 1: Define Your Resource Schema

Every custom resource needs a schema that defines its structure and validation rules:

#![allow(unused)]
fn main() {
use scim_server::{Schema, Attribute, AttributeType, Mutability, Returned, Uniqueness};

pub fn device_schema() -> Schema {
    Schema::builder()
        .id("urn:company:params:scim:schemas:core:2.0:Device")
        .name("Device")
        .description("IT Device Resource")
        .attribute(
            Attribute::builder()
                .name("serialNumber")
                .type_(AttributeType::String)
                .mutability(Mutability::Immutable)  // Can't change after creation
                .returned(Returned::Default)
                .uniqueness(Uniqueness::Server)     // Must be unique
                .required(true)
                .case_exact(true)
                .description("Device serial number")
                .build()
        )
        .attribute(
            Attribute::builder()
                .name("deviceType")
                .type_(AttributeType::String)
                .mutability(Mutability::ReadWrite)
                .returned(Returned::Default)
                .required(true)
                .canonical_values(vec![
                    "Laptop".to_string(),
                    "Desktop".to_string(),
                    "Tablet".to_string(),
                    "Phone".to_string(),
                ])
                .description("Type of device")
                .build()
        )
        .attribute(
            Attribute::builder()
                .name("assignedTo")
                .type_(AttributeType::Reference)
                .mutability(Mutability::ReadWrite)
                .returned(Returned::Default)
                .reference_types(vec!["User".to_string()])
                .description("User this device is assigned to")
                .build()
        )
        .attribute(
            Attribute::builder()
                .name("status")
                .type_(AttributeType::String)
                .mutability(Mutability::ReadWrite)
                .returned(Returned::Default)
                .required(true)
                .canonical_values(vec![
                    "Available".to_string(),
                    "Assigned".to_string(),
                    "InRepair".to_string(),
                    "Retired".to_string(),
                ])
                .build()
        )
        .build()
        .unwrap()
}
}

Step 2: Implement the Builder Pattern

Provide a convenient builder for creating resources:

#![allow(unused)]
fn main() {
impl Device {
    pub fn builder() -> DeviceBuilder {
        DeviceBuilder::new()
    }
}

pub struct DeviceBuilder {
    device: Device,
}

impl DeviceBuilder {
    pub fn new() -> Self {
        Self {
            device: Device {
                id: uuid::Uuid::new_v4().to_string(),
                schemas: vec!["urn:company:params:scim:schemas:core:2.0:Device".to_string()],
                meta: ResourceMeta::new("Device"),
                external_id: None,
                serial_number: String::new(),
                device_type: DeviceType::Laptop,
                manufacturer: String::new(),
                model: String::new(),
                assigned_to: None,
                status: DeviceStatus::Available,
                purchase_date: None,
                warranty_expires: None,
            },
        }
    }
    
    pub fn serial_number(mut self, serial: impl Into<String>) -> Self {
        self.device.serial_number = serial.into();
        self
    }
    
    pub fn device_type(mut self, device_type: DeviceType) -> Self {
        self.device.device_type = device_type;
        self
    }
    
    pub fn manufacturer(mut self, manufacturer: impl Into<String>) -> Self {
        self.device.manufacturer = manufacturer.into();
        self
    }
    
    pub fn model(mut self, model: impl Into<String>) -> Self {
        self.device.model = model.into();
        self
    }
    
    pub fn assigned_to(mut self, user_id: Option<impl Into<String>>) -> Self {
        self.device.assigned_to = user_id.map(|id| id.into());
        self
    }
    
    pub fn status(mut self, status: DeviceStatus) -> Self {
        self.device.status = status;
        self
    }
    
    pub fn purchase_date(mut self, date: DateTime<Utc>) -> Self {
        self.device.purchase_date = Some(date);
        self
    }
    
    pub fn warranty_expires(mut self, date: DateTime<Utc>) -> Self {
        self.device.warranty_expires = Some(date);
        self
    }
    
    pub fn build(self) -> Result<Device, ValidationError> {
        // Validate required fields
        if self.device.serial_number.is_empty() {
            return Err(ValidationError::RequiredField("serialNumber"));
        }
        
        if self.device.manufacturer.is_empty() {
            return Err(ValidationError::RequiredField("manufacturer"));
        }
        
        if self.device.model.is_empty() {
            return Err(ValidationError::RequiredField("model"));
        }
        
        Ok(self.device)
    }
}
}

Step 3: Extend Your Provider

Add support for your custom resource to your storage provider:

#![allow(unused)]
fn main() {
use async_trait::async_trait;
use scim_server::{Provider, ProviderError, ListOptions, ListResponse};

#[async_trait]
pub trait DeviceProvider: Provider {
    async fn create_device(&self, tenant_id: &str, device: Device) -> Result<Device, ProviderError>;
    async fn get_device(&self, tenant_id: &str, device_id: &str) -> Result<Option<Device>, ProviderError>;
    async fn update_device(&self, tenant_id: &str, device: Device) -> Result<Device, ProviderError>;
    async fn delete_device(&self, tenant_id: &str, device_id: &str) -> Result<(), ProviderError>;
    async fn list_devices(&self, tenant_id: &str, options: &ListOptions) -> Result<ListResponse<Device>, ProviderError>;
}

// Implement for InMemoryProvider
#[async_trait]
impl DeviceProvider for InMemoryProvider {
    async fn create_device(&self, tenant_id: &str, mut device: Device) -> Result<Device, ProviderError> {
        // Update metadata
        device.meta.created = Utc::now();
        device.meta.last_modified = device.meta.created;
        device.meta.version = "1".to_string();
        
        let mut devices = self.devices.write().await;
        let tenant_devices = devices.entry(tenant_id.to_string()).or_insert_with(HashMap::new);
        
        // Check for duplicate serial number
        for existing_device in tenant_devices.values() {
            if existing_device.serial_number == device.serial_number {
                return Err(ProviderError::Conflict(
                    format!("Device with serial number {} already exists", device.serial_number)
                ));
            }
        }
        
        tenant_devices.insert(device.id.clone(), device.clone());
        Ok(device)
    }
    
    async fn get_device(&self, tenant_id: &str, device_id: &str) -> Result<Option<Device>, ProviderError> {
        let devices = self.devices.read().await;
        let result = devices
            .get(tenant_id)
            .and_then(|tenant_devices| tenant_devices.get(device_id))
            .cloned();
        Ok(result)
    }
    
    async fn update_device(&self, tenant_id: &str, mut device: Device) -> Result<Device, ProviderError> {
        let mut devices = self.devices.write().await;
        let tenant_devices = devices.entry(tenant_id.to_string()).or_insert_with(HashMap::new);
        
        // Check if device exists
        let existing = tenant_devices.get(&device.id)
            .ok_or_else(|| ProviderError::NotFound {
                resource_type: "Device".to_string(),
                id: device.id.clone(),
            })?;
        
        // Version check for concurrency control
        if existing.meta.version != device.meta.version {
            return Err(ProviderError::VersionConflict {
                current_version: existing.meta.version.clone(),
                provided_version: device.meta.version.clone(),
            });
        }
        
        // Update metadata
        device.meta.last_modified = Utc::now();
        device.meta.version = (existing.meta.version.parse::<u64>().unwrap_or(0) + 1).to_string();
        
        tenant_devices.insert(device.id.clone(), device.clone());
        Ok(device)
    }
    
    async fn delete_device(&self, tenant_id: &str, device_id: &str) -> Result<(), ProviderError> {
        let mut devices = self.devices.write().await;
        let tenant_devices = devices.entry(tenant_id.to_string()).or_insert_with(HashMap::new);
        
        tenant_devices.remove(device_id)
            .ok_or_else(|| ProviderError::NotFound {
                resource_type: "Device".to_string(),
                id: device_id.to_string(),
            })?;
        
        Ok(())
    }
    
    async fn list_devices(&self, tenant_id: &str, options: &ListOptions) -> Result<ListResponse<Device>, ProviderError> {
        let devices = self.devices.read().await;
        let tenant_devices = devices.get(tenant_id).map(|d| d.values().cloned().collect::<Vec<_>>())
            .unwrap_or_default();
        
        // Apply filtering
        let filtered: Vec<Device> = if let Some(ref filter) = options.filter {
            tenant_devices.into_iter()
                .filter(|device| self.matches_filter(device, filter))
                .collect()
        } else {
            tenant_devices
        };
        
        // Apply sorting
        let mut sorted = filtered;
        if let Some(ref sort_by) = options.sort_by {
            sorted.sort_by(|a, b| self.compare_devices(a, b, sort_by, &options.sort_order));
        }
        
        // Apply pagination
        let total_results = sorted.len();
        let start_index = options.start_index.unwrap_or(1).max(1) - 1;
        let count = options.count.unwrap_or(100).min(1000);
        
        let page: Vec<Device> = sorted
            .into_iter()
            .skip(start_index)
            .take(count)
            .collect();
        
        Ok(ListResponse {
            schemas: vec!["urn:ietf:params:scim:api:messages:2.0:ListResponse".to_string()],
            total_results,
            start_index: start_index + 1,
            items_per_page: page.len(),
            resources: page,
        })
    }
}
}

Step 4: Add HTTP Endpoints

Create HTTP endpoints for your custom resource:

#![allow(unused)]
fn main() {
use axum::{
    extract::{Path, Query, State},
    http::StatusCode,
    response::Json,
    routing::{get, post, put, delete},
    Router,
};
use serde_json::Value;

pub fn device_routes() -> Router<AppState> {
    Router::new()
        .route("/Devices", get(list_devices).post(create_device))
        .route("/Devices/:id", get(get_device).put(update_device).delete(delete_device))
}

async fn create_device(
    State(state): State<AppState>,
    Path(tenant_id): Path<String>,
    Json(payload): Json<Value>,
) -> Result<Json<Device>, (StatusCode, Json<ScimError>)> {
    // Parse the JSON into a Device
    let device: Device = serde_json::from_value(payload)
        .map_err(|e| (StatusCode::BAD_REQUEST, Json(ScimError::invalid_syntax(e.to_string()))))?;
    
    // Create the device
    let created_device = state.provider.create_device(&tenant_id, device).await
        .map_err(|e| match e {
            ProviderError::Conflict(msg) => (StatusCode::CONFLICT, Json(ScimError::uniqueness(msg))),
            ProviderError::ValidationError { message } => (StatusCode::BAD_REQUEST, Json(ScimError::invalid_value(message))),
            _ => (StatusCode::INTERNAL_SERVER_ERROR, Json(ScimError::internal_error())),
        })?;
    
    Ok(Json(created_device))
}

async fn get_device(
    State(state): State<AppState>,
    Path((tenant_id, device_id)): Path<(String, String)>,
) -> Result<Json<Device>, (StatusCode, Json<ScimError>)> {
    let device = state.provider.get_device(&tenant_id, &device_id).await
        .map_err(|_| (StatusCode::INTERNAL_SERVER_ERROR, Json(ScimError::internal_error())))?
        .ok_or_else(|| (StatusCode::NOT_FOUND, Json(ScimError::not_found("Device", &device_id))))?;
    
    Ok(Json(device))
}

async fn update_device(
    State(state): State<AppState>,
    Path((tenant_id, device_id)): Path<(String, String)>,
    Json(mut payload): Json<Device>,
) -> Result<Json<Device>, (StatusCode, Json<ScimError>)> {
    // Ensure the ID matches the path
    payload.id = device_id;
    
    let updated_device = state.provider.update_device(&tenant_id, payload).await
        .map_err(|e| match e {
            ProviderError::NotFound { .. } => (StatusCode::NOT_FOUND, Json(ScimError::not_found("Device", &payload.id))),
            ProviderError::VersionConflict { .. } => (StatusCode::PRECONDITION_FAILED, Json(ScimError::version_conflict())),
            _ => (StatusCode::INTERNAL_SERVER_ERROR, Json(ScimError::internal_error())),
        })?;
    
    Ok(Json(updated_device))
}

async fn delete_device(
    State(state): State<AppState>,
    Path((tenant_id, device_id)): Path<(String, String)>,
) -> Result<StatusCode, (StatusCode, Json<ScimError>)> {
    state.provider.delete_device(&tenant_id, &device_id).await
        .map_err(|e| match e {
            ProviderError::NotFound { .. } => (StatusCode::NOT_FOUND, Json(ScimError::not_found("Device", &device_id))),
            _ => (StatusCode::INTERNAL_SERVER_ERROR, Json(ScimError::internal_error())),
        })?;
    
    Ok(StatusCode::NO_CONTENT)
}

async fn list_devices(
    State(state): State<AppState>,
    Path(tenant_id): Path<String>,
    Query(params): Query<ListParameters>,
) -> Result<Json<ListResponse<Device>>, (StatusCode, Json<ScimError>)> {
    let options = ListOptions::from_query_params(params);
    
    let response = state.provider.list_devices(&tenant_id, &options).await
        .map_err(|_| (StatusCode::INTERNAL_SERVER_ERROR, Json(ScimError::internal_error())))?;
    
    Ok(Json(response))
}
}

Step 5: Register Your Resource

Register your custom resource and schema with the SCIM server:

use scim_server::{ScimServer, SchemaRegistry};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Create provider
    let provider = InMemoryProvider::new();
    
    // Create schema registry and register schemas
    let mut schema_registry = SchemaRegistry::new();
    schema_registry.register(CoreSchemas::user());
    schema_registry.register(CoreSchemas::group());
    schema_registry.register(device_schema());  // Register our custom schema
    
    // Create SCIM server
    let scim_server = ScimServer::builder()
        .provider(provider)
        .schema_registry(schema_registry)
        .build();
    
    // Create HTTP router
    let app = Router::new()
        .nest("/scim/v2/:tenant_id", user_routes())
        .nest("/scim/v2/:tenant_id", group_routes())
        .nest("/scim/v2/:tenant_id", device_routes())  // Add device routes
        .route("/scim/v2/:tenant_id/Schemas", get(get_schemas))
        .route("/scim/v2/:tenant_id/ResourceTypes", get(get_resource_types))
        .with_state(AppState { provider: scim_server });
    
    // Start server
    let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await?;
    println!("SCIM server running on http://localhost:3000");
    axum::serve(listener, app).await?;
    
    Ok(())
}

Step 6: Add Resource Type Configuration

Expose your custom resource through the /ResourceTypes endpoint:

#![allow(unused)]
fn main() {
async fn get_resource_types(
    State(state): State<AppState>,
    Path(tenant_id): Path<String>,
) -> Json<ListResponse<ResourceType>> {
    let resource_types = vec![
        ResourceType {
            schemas: vec!["urn:ietf:params:scim:schemas:core:2.0:ResourceType".to_string()],
            id: "User".to_string(),
            name: "User".to_string(),
            endpoint: "/Users".to_string(),
            description: Some("User Account".to_string()),
            schema: "urn:ietf:params:scim:schemas:core:2.0:User".to_string(),
            schema_extensions: vec![
                SchemaExtension {
                    schema: "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User".to_string(),
                    required: false,
                }
            ],
            meta: ResourceMeta::new("ResourceType"),
        },
        ResourceType {
            schemas: vec!["urn:ietf:params:scim:schemas:core:2.0:ResourceType".to_string()],
            id: "Group".to_string(),
            name: "Group".to_string(),
            endpoint: "/Groups".to_string(),
            description: Some("Group".to_string()),
            schema: "urn:ietf:params:scim:schemas:core:2.0:Group".to_string(),
            schema_extensions: vec![],
            meta: ResourceMeta::new("ResourceType"),
        },
        ResourceType {
            schemas: vec!["urn:ietf:params:scim:schemas:core:2.0:ResourceType".to_string()],
            id: "Device".to_string(),
            name: "Device".to_string(),
            endpoint: "/Devices".to_string(),
            description: Some("IT Device".to_string()),
            schema: "urn:company:params:scim:schemas:core:2.0:Device".to_string(),
            schema_extensions: vec![],
            meta: ResourceMeta::new("ResourceType"),
        },
    ];
    
    Json(ListResponse {
        schemas: vec!["urn:ietf:params:scim:api:messages:2.0:ListResponse".to_string()],
        total_results: resource_types.len(),
        start_index: 1,
        items_per_page: resource_types.len(),
        resources: resource_types,
    })
}
}

Advanced Examples

Complex Resource with Relationships

Here's a more complex example - a Project resource that references users and groups:

#![allow(unused)]
fn main() {
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Project {
    pub id: String,
    pub schemas: Vec<String>,
    pub meta: ResourceMeta,
    pub external_id: Option<String>,
    
    // Basic attributes
    pub name: String,
    pub description: Option<String>,
    pub status: ProjectStatus,
    pub priority: Priority,
    
    // Relationships
    pub owner: Reference,
    pub team_members: Vec<Reference>,
    pub stakeholder_groups: Vec<Reference>,
    
    // Dates
    pub start_date: DateTime<Utc>,
    pub end_date: Option<DateTime<Utc>>,
    pub created_date: DateTime<Utc>,
    
    // Business attributes
    pub budget: Option<Money>,
    pub tags: Vec<String>,
    pub custom_fields: HashMap<String, Value>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Reference {
    pub value: String,
    #[serde(rename = "$ref")]
    pub ref_: Option<String>,
    #[serde(rename = "type")]
    pub type_: Option<String>,
    pub display: Option<String>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Money {
    pub amount: f64,
    pub currency: String,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum ProjectStatus {
    Planning,
    Active,
    OnHold,
    Completed,
    Cancelled,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum Priority {
    Low,
    Medium,
    High,
    Critical,
}
}

Resource with Validation Rules

Add complex validation logic:

#![allow(unused)]
fn main() {
impl Project {
    pub fn validate(&self) -> Result<(), ValidationError> {
        // Name validation
        if self.name.trim().is_empty() {
            return Err(ValidationError::RequiredField("name"));
        }
        
        if self.name.len() > 100 {
            return Err(ValidationError::ValueTooLong("name", 100));
        }
        
        // Date validation
        if let Some(end_date) = self.end_date {
            if end_date <= self.start_date {
                return Err(ValidationError::InvalidDateRange);
            }
        }
        
        // Budget validation
        if let Some(ref budget) = self.budget {
            if budget.amount < 0.0 {
                return Err(ValidationError::InvalidValue("budget.amount", "must be non-negative"));
            }
        }
        
        // Team size validation
        if self.team_members.len() > 50 {
            return Err(ValidationError::ValueTooLong("teamMembers", 50));
        }
        
        // Custom business rules
        if self.status == ProjectStatus::Active && self.team_members.is_empty() {
            return Err(ValidationError::BusinessRule("Active projects must have team members"));
        }
        
        Ok(())
    }
}
}

Testing Your Custom Resource

Create comprehensive tests for your custom resource:

#![allow(unused)]
fn main() {
#[cfg(test)]
mod tests {
    use super::*;
    use chrono::Utc;
    
    #[tokio::test]
    async fn test_device_lifecycle() {
        let provider = InMemoryProvider::new();
        let tenant_id = "test-tenant";
        
        // Create device
        let device = Device::builder()
            .serial_number("ABC123")
            .device_type(DeviceType::Laptop)
            .manufacturer("Dell")
            .model("XPS 13")
            .status(DeviceStatus::Available)
            .build()
            .unwrap();
        
        let created = provider.create_device(tenant_id, device.clone()).await.unwrap();
        assert_eq!(created.serial_number, "ABC123");
        assert_eq!(created.status, DeviceStatus::Available);
        
        // Assign device to user
        let mut assigned = created.clone();
        assigned.assigned_to = Some("user-123".to_string());
        assigned.status = DeviceStatus::Assigned;
        
        let updated = provider.update_device(tenant_id, assigned).await.unwrap();
        assert_eq!(updated.assigned_to, Some("user-123".to_string()));
        assert_eq!(updated.status, DeviceStatus::Assigned);
        
        // List devices
        let list_response = provider.list_devices(tenant_id, &ListOptions::default()).await.unwrap();
        assert_eq!(list_response.total_results, 1);
        assert_eq!(list_response.resources[0].id, created.id);
        
        // Delete device
        provider.delete_device(tenant_id, &created.id).await.unwrap();
        let deleted = provider.get_device(tenant_id, &created.id).await.unwrap();
        assert!(deleted.is_none());
    }
    
    #[tokio::test]
    async fn test_device_validation() {
        // Test missing serial number
        let result = Device::builder()
            .manufacturer("Dell")
            .model("XPS 13")
            .build();
        
        assert!(result.is_err());
        
        // Test valid device
        let result = Device::builder()
            .serial_number("ABC123")
            .manufacturer("Dell")
            .model("XPS 13")
            .build();
        
        assert!(result.is_ok());
    }
    
    #[tokio::test]
    async fn test_device_filtering() {
        let provider = InMemoryProvider::new();
        let tenant_id = "test-tenant";
        
        // Create test devices
        let devices = vec![
            Device::builder().serial_number("LAP001").device_type(DeviceType::Laptop).build().unwrap(),
            Device::builder().serial_number("PHN001").device_type(DeviceType::Phone).build().unwrap(),
            Device::builder().serial_number("LAP002").device_type(DeviceType::Laptop).build().unwrap(),
        ];
        
        for device in devices {
            provider.create_device(tenant_id, device).await.unwrap();
        }
        
        // List all devices and filter in memory (database filtering not yet implemented)
        let options = ListOptions::default();
        let response = provider.list_devices(tenant_id, &options).await.unwrap();
        
        // Filter by device type in memory
        let laptops: Vec<_> = response.resources.into_iter()
            .filter(|device| device.device_type == DeviceType::Laptop)
            .collect();
        
        assert_eq!(laptops.len(), 2);
        for device in laptops {
            assert_eq!(device.device_type, DeviceType::Laptop);
        }
    }
}
}

Best Practices

Schema Design

Use meaningful schema IDs:

#![allow(unused)]
fn main() {
// Good: Company-specific with versioning
"urn:company:params:scim:schemas:core:2.0:Device"

// Bad: Generic or unversioned
"device"
"urn:scim:schemas:device"
}

Define appropriate constraints:

#![allow(unused)]
fn main() {
.attribute(
    Attribute::builder()
        .name("serialNumber")
        .mutability(Mutability::Immutable)  // Can't change after creation
        .uniqueness(Uniqueness::Server)     // Must be unique across tenant
        .required(true)                     // Must be provided
        .case_exact(true)                   // Exact case matching
        .build()
)
}

Type Safety

Use enums for constrained values:

#![allow(unused)]
fn main() {
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum DeviceStatus {
    Available,
    Assigned,
    InRepair,
    Retired,
}

// Instead of just String
}

Implement strong validation:

#![allow(unused)]
fn main() {
impl DeviceBuilder {
    pub fn serial_number(mut self, serial: impl Into<String>) -> Self {
        let serial = serial.into();
        
        // Validate format (example: must be alphanumeric, 6-20 chars)
        if !serial.chars().all(|c| c.is_alphanumeric()) {
            panic!("Serial number must be alphanumeric");
        }
        
        if serial.len() < 6 || serial.len() > 20 {
            panic!("Serial number must be 6-20 characters");
        }
        
        self.device.serial_number = serial;
        self
    }
}
}

Error Handling

Provide meaningful error messages:

#![allow(unused)]
fn main() {
#[derive(Debug, thiserror::Error)]
pub enum DeviceError {
    #[error("Serial number {0} is already in use")]
    DuplicateSerial(String),
    
    #[error("Device {device_id} is currently assigned to user {user_id}")]
    DeviceInUse { device_id: String, user_id: String },
    
    #[error("Cannot assign retired device {0}")]
    RetiredDevice(String),
}
}

Performance

Add appropriate indexes for your provider:

-- For database providers
CREATE INDEX idx_devices_serial_number ON devices(tenant_id, serial_number);
CREATE INDEX idx_devices_assigned_to ON devices(tenant_id, assigned_to);
CREATE INDEX idx_devices_status ON devices(tenant_id, status);

Implement efficient querying:

#![allow(unused)]
fn main() {
// For now, implement pagination and in-memory filtering
impl DatabaseProvider {
    async fn list_devices_paginated(&self, tenant_id: &str, start_index: Option<usize>, count: Option<usize>) -> Result<Vec<Device>, ProviderError> {
        let skip = start_index.unwrap_or(1).saturating_sub(1);
        let limit = count.unwrap_or(50).min(1000); // Cap at 1000 for performance
        
        // Database query with pagination
        let devices = sqlx::query_as!(
            Device,
            "SELECT * FROM devices WHERE tenant_id = $1 ORDER BY created_at LIMIT $2 OFFSET $3",
            tenant_id, limit as i64, skip as i64
        )
        .fetch_all(&self.pool)
        .await?;
        
        Ok(devices)
    }
    
    // Helper method for common filtering patterns
    async fn find_devices_by_type(&self, tenant_id: &str, device_type: &DeviceType) -> Result<Vec<Device>, ProviderError> {
        let devices = sqlx::query_as!(
            Device,
            "SELECT * FROM devices WHERE tenant_id = $1 AND device_type = $2",
            tenant_id, device_type.to_string()
        )
        .fetch_all(&self.pool)
        .await?;
        
        Ok(devices)
}

Authentication Setup

This tutorial shows you how to implement authentication and authorization for your SCIM Server, covering OAuth 2.0, API keys, and custom authentication schemes.

Overview

SCIM servers typically operate in enterprise environments where security is paramount. The SCIM Server library provides flexible authentication mechanisms that can integrate with existing identity providers and security infrastructure.

Common Authentication Patterns

1. OAuth 2.0 Bearer Tokens - Industry standard for API authentication
2. API Keys - Simple shared secrets for service-to-service communication
3. JWT Tokens - Self-contained tokens with embedded claims
4. Basic Authentication - Username/password for development and testing
5. Custom Authentication - Integration with proprietary systems

Quick Start: Basic Authentication

Let's start with a simple development setup using basic authentication:

use scim_server::{ScimServer, InMemoryProvider};
use axum::{
    extract::{Request, State},
    http::{StatusCode, HeaderMap},
    middleware::{self, Next},
    response::Response,
    Router,
};
use base64::{Engine as _, engine::general_purpose};

#[derive(Clone)]
struct AppState {
    scim_server: ScimServer,
    admin_credentials: (String, String), // (username, password)
}

async fn basic_auth_middleware(
    State(state): State<AppState>,
    headers: HeaderMap,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    // Get Authorization header
    let auth_header = headers
        .get("Authorization")
        .and_then(|h| h.to_str().ok())
        .ok_or(StatusCode::UNAUTHORIZED)?;

    // Check Basic auth format
    if !auth_header.starts_with("Basic ") {
        return Err(StatusCode::UNAUTHORIZED);
    }

    // Decode credentials
    let encoded = &auth_header[6..];
    let decoded = general_purpose::STANDARD
        .decode(encoded)
        .map_err(|_| StatusCode::UNAUTHORIZED)?;
    
    let credentials = String::from_utf8(decoded)
        .map_err(|_| StatusCode::UNAUTHORIZED)?;
    
    let mut parts = credentials.splitn(2, ':');
    let username = parts.next().ok_or(StatusCode::UNAUTHORIZED)?;
    let password = parts.next().ok_or(StatusCode::UNAUTHORIZED)?;

    // Validate credentials
    if username == state.admin_credentials.0 && password == state.admin_credentials.1 {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::UNAUTHORIZED)
    }
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let provider = InMemoryProvider::new();
    let scim_server = ScimServer::builder()
        .provider(provider)
        .build();

    let state = AppState {
        scim_server,
        admin_credentials: ("admin".to_string(), "secret123".to_string()),
    };

    let app = Router::new()
        .nest("/scim/v2/:tenant_id", scim_routes())
        .layer(middleware::from_fn_with_state(state.clone(), basic_auth_middleware))
        .with_state(state);

    println!("SCIM server with basic auth running on http://localhost:3000");
    println!("Use credentials: admin:secret123");
    
    let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await?;
    axum::serve(listener, app).await?;
    Ok(())
}

OAuth 2.0 Bearer Token Authentication

For production deployments, OAuth 2.0 is the recommended approach:

JWT Token Validation

#![allow(unused)]
fn main() {
use jsonwebtoken::{decode, DecodingKey, Validation, Algorithm};
use serde::{Deserialize, Serialize};

#[derive(Debug, Serialize, Deserialize)]
struct Claims {
    sub: String,    // Subject (user ID)
    exp: usize,     // Expiration time
    iat: usize,     // Issued at
    iss: String,    // Issuer
    aud: String,    // Audience
    scope: String,  // OAuth scopes
    tenant_id: Option<String>, // Tenant context
}

async fn oauth_middleware(
    State(state): State<AppState>,
    headers: HeaderMap,
    mut request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    // Extract Bearer token
    let auth_header = headers
        .get("Authorization")
        .and_then(|h| h.to_str().ok())
        .ok_or(StatusCode::UNAUTHORIZED)?;

    if !auth_header.starts_with("Bearer ") {
        return Err(StatusCode::UNAUTHORIZED);
    }

    let token = &auth_header[7..];

    // Validate JWT token
    let decoding_key = DecodingKey::from_secret(state.jwt_secret.as_ref());
    let validation = Validation::new(Algorithm::HS256);
    
    let token_data = decode::<Claims>(token, &decoding_key, &validation)
        .map_err(|_| StatusCode::UNAUTHORIZED)?;

    // Check token expiration
    let now = chrono::Utc::now().timestamp() as usize;
    if token_data.claims.exp < now {
        return Err(StatusCode::UNAUTHORIZED);
    }

    // Check required scopes
    let scopes: Vec<&str> = token_data.claims.scope.split(' ').collect();
    if !scopes.contains(&"scim:read") && !scopes.contains(&"scim:write") {
        return Err(StatusCode::FORBIDDEN);
    }

    // Add user context to request
    request.extensions_mut().insert(UserContext {
        user_id: token_data.claims.sub,
        tenant_id: token_data.claims.tenant_id,
        scopes,
    });

    Ok(next.run(request).await)
}

#[derive(Clone)]
struct UserContext {
    user_id: String,
    tenant_id: Option<String>,
    scopes: Vec<String>,
}
}

Integration with External OAuth Providers

#![allow(unused)]
fn main() {
use reqwest::Client;
use serde_json::Value;

#[derive(Clone)]
struct OAuthConfig {
    introspection_url: String,
    client_id: String,
    client_secret: String,
}

async fn validate_oauth_token(
    config: &OAuthConfig,
    token: &str,
) -> Result<Claims, String> {
    let client = Client::new();
    
    // Call OAuth provider's introspection endpoint
    let response = client
        .post(&config.introspection_url)
        .basic_auth(&config.client_id, Some(&config.client_secret))
        .form(&[("token", token)])
        .send()
        .await
        .map_err(|e| format!("Failed to validate token: {}", e))?;

    let introspection: Value = response
        .json()
        .await
        .map_err(|e| format!("Failed to parse response: {}", e))?;

    // Check if token is active
    if !introspection["active"].as_bool().unwrap_or(false) {
        return Err("Token is not active".to_string());
    }

    // Extract claims
    Ok(Claims {
        sub: introspection["sub"].as_str().unwrap_or("").to_string(),
        exp: introspection["exp"].as_u64().unwrap_or(0) as usize,
        iat: introspection["iat"].as_u64().unwrap_or(0) as usize,
        iss: introspection["iss"].as_str().unwrap_or("").to_string(),
        aud: introspection["aud"].as_str().unwrap_or("").to_string(),
        scope: introspection["scope"].as_str().unwrap_or("").to_string(),
        tenant_id: introspection["tenant_id"].as_str().map(|s| s.to_string()),
    })
}
}

API Key Authentication

For service-to-service communication, API keys provide a simpler alternative:

#![allow(unused)]
fn main() {
use sha2::{Sha256, Digest};
use std::collections::HashMap;

#[derive(Clone)]
struct ApiKeyStore {
    keys: HashMap<String, ApiKeyInfo>,
}

#[derive(Clone)]
struct ApiKeyInfo {
    name: String,
    tenant_id: String,
    permissions: Vec<String>,
    created_at: chrono::DateTime<chrono::Utc>,
    last_used: Option<chrono::DateTime<chrono::Utc>>,
}

impl ApiKeyStore {
    fn new() -> Self {
        let mut keys = HashMap::new();
        
        // Example API key (in production, store these securely)
        keys.insert(
            "sk_test_1234567890abcdef".to_string(),
            ApiKeyInfo {
                name: "Development Key".to_string(),
                tenant_id: "tenant-1".to_string(),
                permissions: vec!["scim:read".to_string(), "scim:write".to_string()],
                created_at: chrono::Utc::now(),
                last_used: None,
            },
        );
        
        Self { keys }
    }
    
    async fn validate_key(&mut self, api_key: &str) -> Option<&ApiKeyInfo> {
        if let Some(key_info) = self.keys.get_mut(api_key) {
            key_info.last_used = Some(chrono::Utc::now());
            Some(key_info)
        } else {
            None
        }
    }
}

async fn api_key_middleware(
    State(mut state): State<AppState>,
    headers: HeaderMap,
    mut request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    // Extract API key from header
    let api_key = headers
        .get("X-API-Key")
        .or_else(|| headers.get("Authorization").and_then(|h| {
            h.to_str().ok().and_then(|s| {
                if s.starts_with("Bearer ") {
                    Some(&s[7..])
                } else {
                    None
                }
            })
        }))
        .and_then(|h| h.to_str().ok())
        .ok_or(StatusCode::UNAUTHORIZED)?;

    // Validate API key
    let key_info = state.api_keys.validate_key(api_key).await
        .ok_or(StatusCode::UNAUTHORIZED)?;

    // Add context to request
    request.extensions_mut().insert(ApiKeyContext {
        tenant_id: key_info.tenant_id.clone(),
        permissions: key_info.permissions.clone(),
        key_name: key_info.name.clone(),
    });

    Ok(next.run(request).await)
}

#[derive(Clone)]
struct ApiKeyContext {
    tenant_id: String,
    permissions: Vec<String>,
    key_name: String,
}
}

Multi-Tenant Authentication

Handle different authentication schemes per tenant:

#![allow(unused)]
fn main() {
#[derive(Clone)]
enum AuthScheme {
    OAuth {
        jwks_url: String,
        audience: String,
        issuer: String,
    },
    ApiKey {
        keys: HashMap<String, String>, // key -> permissions
    },
    Basic {
        username: String,
        password_hash: String,
    },
}

#[derive(Clone)]
struct TenantAuthConfig {
    tenant_configs: HashMap<String, AuthScheme>,
}

impl TenantAuthConfig {
    async fn authenticate(
        &self,
        tenant_id: &str,
        headers: &HeaderMap,
    ) -> Result<AuthContext, StatusCode> {
        let auth_scheme = self.tenant_configs
            .get(tenant_id)
            .ok_or(StatusCode::NOT_FOUND)?;

        match auth_scheme {
            AuthScheme::OAuth { jwks_url, audience, issuer } => {
                self.validate_oauth(headers, jwks_url, audience, issuer).await
            },
            AuthScheme::ApiKey { keys } => {
                self.validate_api_key(headers, keys).await
            },
            AuthScheme::Basic { username, password_hash } => {
                self.validate_basic(headers, username, password_hash).await
            },
        }
    }
    
    async fn validate_oauth(
        &self,
        headers: &HeaderMap,
        jwks_url: &str,
        audience: &str,
        issuer: &str,
    ) -> Result<AuthContext, StatusCode> {
        // OAuth validation logic
        todo!("Implement OAuth validation")
    }
    
    async fn validate_api_key(
        &self,
        headers: &HeaderMap,
        keys: &HashMap<String, String>,
    ) -> Result<AuthContext, StatusCode> {
        // API key validation logic
        todo!("Implement API key validation")
    }
    
    async fn validate_basic(
        &self,
        headers: &HeaderMap,
        username: &str,
        password_hash: &str,
    ) -> Result<AuthContext, StatusCode> {
        // Basic auth validation logic
        todo!("Implement basic auth validation")
    }
}

#[derive(Clone)]
struct AuthContext {
    tenant_id: String,
    user_id: Option<String>,
    permissions: Vec<String>,
    auth_type: String,
}
}

Authorization and Permissions

Implement fine-grained access control:

#![allow(unused)]
fn main() {
#[derive(Clone)]
struct PermissionChecker {
    // Define permission patterns
}

impl PermissionChecker {
    fn can_access_resource(
        &self,
        context: &AuthContext,
        resource_type: &str,
        operation: &str,
        resource_id: Option<&str>,
    ) -> bool {
        // Check if user has required permissions
        let required_permission = format!("scim:{}:{}", resource_type, operation);
        
        if context.permissions.contains(&required_permission) {
            return true;
        }
        
        // Check wildcard permissions
        let wildcard_permission = format!("scim:{}:*", resource_type);
        if context.permissions.contains(&wildcard_permission) {
            return true;
        }
        
        // Check admin permission
        if context.permissions.contains(&"scim:admin".to_string()) {
            return true;
        }
        
        // Resource-specific checks
        if let Some(id) = resource_id {
            let specific_permission = format!("scim:{}:{}:{}", resource_type, operation, id);
            if context.permissions.contains(&specific_permission) {
                return true;
            }
        }
        
        false
    }
}

// Usage in handlers
async fn get_user_handler(
    State(state): State<AppState>,
    Extension(auth_context): Extension<AuthContext>,
    Path((tenant_id, user_id)): Path<(String, String)>,
) -> Result<Json<ScimUser>, StatusCode> {
    // Check permissions
    if !state.permissions.can_access_resource(
        &auth_context,
        "users",
        "read",
        Some(&user_id),
    ) {
        return Err(StatusCode::FORBIDDEN);
    }
    
    // Proceed with operation
    let user = state.scim_server
        .get_user(&tenant_id, &user_id)
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
        .ok_or(StatusCode::NOT_FOUND)?;
    
    Ok(Json(user))
}
}

Production Security Considerations

Rate Limiting

#![allow(unused)]
fn main() {
use tower_governor::{GovernorLayer, governor::GovernorConfig};
use std::time::Duration;

// Add rate limiting middleware
let governor_conf = GovernorConfig::default()
    .per_second(10)
    .burst_size(20)
    .period(Duration::from_secs(60));

let app = Router::new()
    .nest("/scim/v2", scim_routes())
    .layer(GovernorLayer::new(&governor_conf))
    .layer(middleware::from_fn(auth_middleware));
}

Request Logging and Audit

#![allow(unused)]
fn main() {
async fn audit_middleware(
    Extension(auth_context): Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Response {
    let method = request.method().clone();
    let uri = request.uri().clone();
    let start_time = std::time::Instant::now();
    
    let response = next.run(request).await;
    
    let duration = start_time.elapsed();
    let status = response.status();
    
    // Log the request
    tracing::info!(
        user_id = auth_context.user_id,
        tenant_id = auth_context.tenant_id,
        method = %method,
        uri = %uri,
        status = %status,
        duration_ms = duration.as_millis(),
        "SCIM API request"
    );
    
    response
}
}

HTTPS and Security Headers

#![allow(unused)]
fn main() {
use tower_http::{
    set_header::SetResponseHeaderLayer,
    cors::CorsLayer,
};

let app = Router::new()
    .nest("/scim/v2", scim_routes())
    .layer(SetResponseHeaderLayer::overriding(
        http::header::STRICT_TRANSPORT_SECURITY,
        http::HeaderValue::from_static("max-age=31536000; includeSubDomains"),
    ))
    .layer(SetResponseHeaderLayer::overriding(
        http::header::X_CONTENT_TYPE_OPTIONS,
        http::HeaderValue::from_static("nosniff"),
    ))
    .layer(SetResponseHeaderLayer::overriding(
        http::header::X_FRAME_OPTIONS,
        http::HeaderValue::from_static("DENY"),
    ))
    .layer(CorsLayer::permissive()) // Configure CORS appropriately
    .layer(middleware::from_fn(auth_middleware));
}

Testing Authentication

#![allow(unused)]
fn main() {
#[cfg(test)]
mod tests {
    use super::*;
    use axum_test::TestServer;
    
    #[tokio::test]
    async fn test_basic_auth_success() {
        let app = create_test_app().await;
        let server = TestServer::new(app).unwrap();
        
        let response = server
            .get("/scim/v2/tenant-1/Users")
            .add_header("Authorization", "Basic YWRtaW46c2VjcmV0MTIz") // admin:secret123
            .await;
        
        assert_eq!(response.status_code(), 200);
    }
    
    #[tokio::test]
    async fn test_basic_auth_failure() {
        let app = create_test_app().await;
        let server = TestServer::new(app).unwrap();
        
        let response = server
            .get("/scim/v2/tenant-1/Users")
            .add_header("Authorization", "Basic aW52YWxpZA==") // invalid
            .await;
        
        assert_eq!(response.status_code(), 401);
    }
    
    #[tokio::test]
    async fn test_api_key_auth() {
        let app = create_test_app().await;
        let server = TestServer::new(app).unwrap();
        
        let response = server
            .get("/scim/v2/tenant-1/Users")
            .add_header("X-API-Key", "sk_test_1234567890abcdef")
            .await;
        
        assert_eq!(response.status_code(), 200);
    }
}
}

Configuration

Create a configuration system for different environments:

#![allow(unused)]
fn main() {
#[derive(serde::Deserialize)]
struct AuthConfig {
    #[serde(default)]
    basic_auth: Option<BasicAuthConfig>,
    #[serde(default)]
    oauth: Option<OAuthConfig>,
    #[serde(default)]
    api_keys: Option<ApiKeyConfig>,
}

#[derive(serde::Deserialize)]
struct BasicAuthConfig {
    username: String,
    password: String, // In production, use password hash
}

#[derive(serde::Deserialize)]
struct OAuthConfig {
    jwks_url: String,
    audience: String,
    issuer: String,
}

#[derive(serde::Deserialize)]
struct ApiKeyConfig {
    keys_file: String, // Path to API keys file
}

// Load from environment or config file
fn load_auth_config() -> AuthConfig {
    let config_str = std::fs::read_to_string("auth_config.toml")
        .expect("Failed to read auth config");
    
    toml::from_str(&config_str)
        .expect("Failed to parse auth config")
}
}

This comprehensive authentication setup provides enterprise-grade security for your SCIM Server while maintaining flexibility for different deployment scenarios.

Next Steps

• Implement custom validation for additional security
• Set up monitoring for security events
• Configure production deployment with proper security

Multi-Tenant Deployment

This tutorial shows how to deploy and configure SCIM Server for multi-tenant environments, where you need to isolate data and operations between different organizations or customers.

Overview

Multi-tenancy in SCIM Server provides complete isolation between different organizations while sharing the same infrastructure. Each tenant gets:

• Complete data isolation - No tenant can access another's data
• Independent configuration - Per-tenant authentication and settings
• Separate namespaces - Tenant-specific resource URLs
• Isolated operations - All SCIM operations are tenant-scoped

Basic Multi-Tenant Setup

Single Instance, Multiple Tenants

use scim_server::{
    providers::StandardResourceProvider,
    storage::InMemoryStorage,
    RequestContext,
};
use axum::{
    extract::{Path, State},
    response::Json,
    routing::{get, post, put, delete},
    Router,
};
use serde_json::{json, Value};
use std::collections::HashMap;
use std::sync::Arc;
use uuid::Uuid;

// Multi-tenant configuration
#[derive(Debug, Clone)]
struct TenantConfig {
    name: String,
    max_users: Option<usize>,
    features: Vec<String>,
    auth_config: AuthConfig,
}

#[derive(Debug, Clone)]
enum AuthConfig {
    OAuth { jwks_url: String, audience: String },
    ApiKey { keys: Vec<String> },
    Basic { username: String, password: String },
}

#[derive(Clone)]
struct MultiTenantApp {
    provider: Arc<StandardResourceProvider<InMemoryStorage>>,
    tenant_configs: HashMap<String, TenantConfig>,
}

impl MultiTenantApp {
    fn new() -> Self {
        // Single storage provider with tenant isolation via RequestContext
        let storage = InMemoryStorage::new();
        let provider = Arc::new(StandardResourceProvider::new(storage));

        // Configure tenants
        let mut tenant_configs = HashMap::new();
        
        tenant_configs.insert("company-a".to_string(), TenantConfig {
            name: "Company A".to_string(),
            auth_config: AuthConfig::OAuth {
                jwks_url: "https://company-a.auth0.com/.well-known/jwks.json".to_string(),
                audience: "scim-api".to_string(),
            },
            max_users: Some(1000),
            features: vec!["bulk_operations".to_string(), "custom_schemas".to_string()],
        });

        tenant_configs.insert("company-b".to_string(), TenantConfig {
            name: "Company B".to_string(),
            auth_config: AuthConfig::ApiKey {
                keys: vec!["sk_live_abc123".to_string()],
            },
            max_users: Some(500),
            features: vec!["basic_operations".to_string()],
        });

        Self {
            provider,
            tenant_configs,
        }
    }

    // Create tenant-aware RequestContext
    fn create_context(&self, tenant_id: &str, operation: &str) -> RequestContext {
        RequestContext::new(format!("tenant-{}-{}-{}", tenant_id, operation, Uuid::new_v4()))
    }

    // Validate tenant exists and is authorized
    fn validate_tenant(&self, tenant_id: &str) -> Result<&TenantConfig, String> {
        self.tenant_configs
            .get(tenant_id)
            .ok_or_else(|| format!("Tenant '{}' not found", tenant_id))
    }
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let app = MultiTenantApp::new();

    let router = Router::new()
        // Multi-tenant endpoints: /tenants/{tenant_id}/scim/v2/*
        .route("/tenants/:tenant_id/scim/v2/Users", 
               post(create_user).get(list_users))
        .route("/tenants/:tenant_id/scim/v2/Users/:user_id", 
               get(get_user).put(update_user).delete(delete_user))
        .route("/tenants/:tenant_id/scim/v2/Groups", 
               post(create_group).get(list_groups))
        .route("/tenants/:tenant_id/scim/v2/Groups/:group_id", 
               get(get_group).put(update_group).delete(delete_group))
        // Tenant management endpoints
        .route("/tenants", get(list_tenants))
        .route("/tenants/:tenant_id", get(get_tenant_info))
        .with_state(app);

    let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await?;
    println!("Multi-tenant SCIM server running on http://localhost:3000");
    println!("Example endpoints:");
    println!("  POST http://localhost:3000/tenants/company-a/scim/v2/Users");
    println!("  GET  http://localhost:3000/tenants/company-b/scim/v2/Users");
    axum::serve(listener, router).await?;
    
    Ok(())
}

Tenant-Specific Endpoints

#![allow(unused)]
fn main() {
use axum::http::StatusCode;

// Error type for multi-tenant operations
#[derive(Debug)]
enum MultiTenantError {
    TenantNotFound(String),
    TenantLimitExceeded(String),
    FeatureNotEnabled(String),
    InternalError(String),
}

impl axum::response::IntoResponse for MultiTenantError {
    fn into_response(self) -> axum::response::Response {
        let (status, message) = match self {
            MultiTenantError::TenantNotFound(tenant) => 
                (StatusCode::NOT_FOUND, format!("Tenant '{}' not found", tenant)),
            MultiTenantError::TenantLimitExceeded(limit) => 
                (StatusCode::FORBIDDEN, format!("Tenant limit exceeded: {}", limit)),
            MultiTenantError::FeatureNotEnabled(feature) => 
                (StatusCode::FORBIDDEN, format!("Feature '{}' not enabled for tenant", feature)),
            MultiTenantError::InternalError(msg) => 
                (StatusCode::INTERNAL_SERVER_ERROR, msg),
        };

        let body = json!({
            "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
            "status": status.as_u16().to_string(),
            "detail": message
        });

        (status, Json(body)).into_response()
    }
}

// Create user with tenant isolation
async fn create_user(
    State(app): State<MultiTenantApp>,
    Path(tenant_id): Path<String>,
    Json(user_data): Json<Value>,
) -> Result<Json<Value>, MultiTenantError> {
    // Validate tenant exists and get config
    let tenant_config = app.validate_tenant(&tenant_id)
        .map_err(|_| MultiTenantError::TenantNotFound(tenant_id.clone()))?;

    // Check tenant limits
    if let Some(max_users) = tenant_config.max_users {
        let context = app.create_context(&tenant_id, "count-users");
        let current_users = app.provider.list_resources("User", None, &context).await
            .map_err(|e| MultiTenantError::InternalError(e.to_string()))?;
        
        if current_users.len() >= max_users {
            return Err(MultiTenantError::TenantLimitExceeded(max_users.to_string()));
        }
    }

    // Create tenant-scoped context
    let context = app.create_context(&tenant_id, "create-user");
    
    // Create user with tenant isolation
    let user = app.provider.create_resource("User", user_data, &context).await
        .map_err(|e| MultiTenantError::InternalError(e.to_string()))?;

    Ok(Json(user.data))
}

// Get user with tenant isolation
async fn get_user(
    State(app): State<MultiTenantApp>,
    Path((tenant_id, user_id)): Path<(String, String)>,
) -> Result<Json<Value>, MultiTenantError> {
    // Validate tenant
    let _tenant_config = app.validate_tenant(&tenant_id)
        .map_err(|_| MultiTenantError::TenantNotFound(tenant_id.clone()))?;

    // Create tenant-scoped context
    let context = app.create_context(&tenant_id, "get-user");
    
    // Get user (automatically isolated by tenant context)
    let user = app.provider.get_resource("User", &user_id, &context).await
        .map_err(|e| MultiTenantError::InternalError(e.to_string()))?;

    Ok(Json(user.data))
}

// List users with tenant isolation
async fn list_users(
    State(app): State<MultiTenantApp>,
    Path(tenant_id): Path<String>,
) -> Result<Json<Value>, MultiTenantError> {
    // Validate tenant
    let _tenant_config = app.validate_tenant(&tenant_id)
        .map_err(|_| MultiTenantError::TenantNotFound(tenant_id.clone()))?;

    // Create tenant-scoped context
    let context = app.create_context(&tenant_id, "list-users");
    
    // List users (automatically isolated by tenant context)
    let users = app.provider.list_resources("User", None, &context).await
        .map_err(|e| MultiTenantError::InternalError(e.to_string()))?;

    let response = json!({
        "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
        "totalResults": users.len(),
        "startIndex": 1,
        "itemsPerPage": users.len(),
        "Resources": users.iter().map(|u| &u.data).collect::<Vec<_>>()
    });

    Ok(Json(response))
}

// Update user with tenant isolation
async fn update_user(
    State(app): State<MultiTenantApp>,
    Path((tenant_id, user_id)): Path<(String, String)>,
    Json(user_data): Json<Value>,
) -> Result<Json<Value>, MultiTenantError> {
    // Validate tenant
    let _tenant_config = app.validate_tenant(&tenant_id)
        .map_err(|_| MultiTenantError::TenantNotFound(tenant_id.clone()))?;

    // Create tenant-scoped context
    let context = app.create_context(&tenant_id, "update-user");
    
    // Update user (automatically isolated by tenant context)
    let user = app.provider.update_resource("User", &user_id, user_data, &context).await
        .map_err(|e| MultiTenantError::InternalError(e.to_string()))?;

    Ok(Json(user.data))
}

// Delete user with tenant isolation
async fn delete_user(
    State(app): State<MultiTenantApp>,
    Path((tenant_id, user_id)): Path<(String, String)>,
) -> Result<StatusCode, MultiTenantError> {
    // Validate tenant
    let _tenant_config = app.validate_tenant(&tenant_id)
        .map_err(|_| MultiTenantError::TenantNotFound(tenant_id.clone()))?;

    // Create tenant-scoped context
    let context = app.create_context(&tenant_id, "delete-user");
    
    // Delete user (automatically isolated by tenant context)
    app.provider.delete_resource("User", &user_id, &context).await
        .map_err(|e| MultiTenantError::InternalError(e.to_string()))?;

    Ok(StatusCode::NO_CONTENT)
}

// Example tenant-scoped URLs:
// POST /tenants/company-a/scim/v2/Users
// GET  /tenants/company-a/scim/v2/Users/123
// POST /tenants/company-b/scim/v2/Users
// GET  /tenants/company-b/scim/v2/Users/456
}

Group Operations

#![allow(unused)]
fn main() {
// Group operations follow the same patterns
async fn create_group(
    State(app): State<MultiTenantApp>,
    Path(tenant_id): Path<String>,
    Json(group_data): Json<Value>,
) -> Result<Json<Value>, MultiTenantError> {
    let _tenant_config = app.validate_tenant(&tenant_id)
        .map_err(|_| MultiTenantError::TenantNotFound(tenant_id.clone()))?;

    let context = app.create_context(&tenant_id, "create-group");
    let group = app.provider.create_resource("Group", group_data, &context).await
        .map_err(|e| MultiTenantError::InternalError(e.to_string()))?;

    Ok(Json(group.data))
}

async fn list_groups(
    State(app): State<MultiTenantApp>,
    Path(tenant_id): Path<String>,
) -> Result<Json<Value>, MultiTenantError> {
    let _tenant_config = app.validate_tenant(&tenant_id)
        .map_err(|_| MultiTenantError::TenantNotFound(tenant_id.clone()))?;

    let context = app.create_context(&tenant_id, "list-groups");
    let groups = app.provider.list_resources("Group", None, &context).await
        .map_err(|e| MultiTenantError::InternalError(e.to_string()))?;

    let response = json!({
        "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
        "totalResults": groups.len(),
        "startIndex": 1,
        "itemsPerPage": groups.len(),
        "Resources": groups.iter().map(|g| &g.data).collect::<Vec<_>>()
    });

    Ok(Json(response))
}

// Additional group operations (get_group, update_group, delete_group) follow same pattern...
}

Tenant Management Endpoints

#![allow(unused)]
fn main() {
// List all tenants
async fn list_tenants(
    State(app): State<MultiTenantApp>,
) -> Json<Value> {
    let tenants: Vec<_> = app.tenant_configs.iter()
        .map(|(id, config)| json!({
            "id": id,
            "name": config.name,
            "maxUsers": config.max_users,
            "features": config.features
        }))
        .collect();

    Json(json!({
        "tenants": tenants,
        "total": tenants.len()
    }))
}

// Get tenant information
async fn get_tenant_info(
    State(app): State<MultiTenantApp>,
    Path(tenant_id): Path<String>,
) -> Result<Json<Value>, MultiTenantError> {
    let tenant_config = app.validate_tenant(&tenant_id)
        .map_err(|_| MultiTenantError::TenantNotFound(tenant_id.clone()))?;

    // Get usage statistics
    let context = app.create_context(&tenant_id, "get-stats");
    let users = app.provider.list_resources("User", None, &context).await
        .map_err(|e| MultiTenantError::InternalError(e.to_string()))?;
    let groups = app.provider.list_resources("Group", None, &context).await
        .map_err(|e| MultiTenantError::InternalError(e.to_string()))?;

    Ok(Json(json!({
        "id": tenant_id,
        "name": tenant_config.name,
        "maxUsers": tenant_config.max_users,
        "features": tenant_config.features,
        "usage": {
            "users": users.len(),
            "groups": groups.len()
        }
    })))
}
}

Data Isolation Strategies

Application-Level Isolation (Current Implementation)

The StandardResourceProvider provides tenant isolation through the RequestContext:

#![allow(unused)]
fn main() {
use scim_server::storage::StorageKey;

// The storage layer automatically handles tenant isolation
impl MultiTenantApp {
    fn create_context(&self, tenant_id: &str, operation: &str) -> RequestContext {
        // The tenant ID becomes part of the request context
        // This ensures all storage operations are tenant-scoped
        RequestContext::new(format!("tenant-{}-{}-{}", tenant_id, operation, Uuid::new_v4()))
    }
}

// Example: How storage keys work with tenants
// For tenant "company-a" creating user "123":
let storage_key = StorageKey::new("company-a", "User", "123");
// Results in storage path: "company-a/User/123"

// This provides automatic isolation:
// - company-a can only access "company-a/User/*" 
// - company-b can only access "company-b/User/*"
// - No cross-tenant data access possible
}

Database-Level Isolation (Advanced)

For production deployments with database storage, implement row-level security:

-- Example PostgreSQL schema with tenant isolation
CREATE TABLE scim_resources (
    tenant_id VARCHAR(255) NOT NULL,
    resource_type VARCHAR(50) NOT NULL,
    resource_id VARCHAR(255) NOT NULL,
    data JSONB NOT NULL,
    created_at TIMESTAMPTZ DEFAULT NOW(),
    updated_at TIMESTAMPTZ DEFAULT NOW(),
    version VARCHAR(255) NOT NULL,
    PRIMARY KEY (tenant_id, resource_type, resource_id)
);

-- Enable Row-Level Security
ALTER TABLE scim_resources ENABLE ROW LEVEL SECURITY;

-- Create tenant isolation policy
CREATE POLICY tenant_isolation ON scim_resources
    USING (tenant_id = current_setting('app.current_tenant_id'));

-- Function to set tenant context
CREATE OR REPLACE FUNCTION set_tenant_context(p_tenant_id text)
RETURNS void AS $$
BEGIN
    PERFORM set_config('app.current_tenant_id', p_tenant_id, true);
END;
$$ LANGUAGE plpgsql;

Custom Storage Provider for Database

#![allow(unused)]
fn main() {
use scim_server::storage::{StorageProvider, StorageKey, StoragePrefix};
use sqlx::PgPool;
use serde_json::Value;

#[derive(Clone)]
pub struct PostgresStorageProvider {
    pool: PgPool,
}

#[async_trait]
impl StorageProvider for PostgresStorageProvider {
    type Error = sqlx::Error;

    async fn put(&self, key: StorageKey, data: Value) -> Result<Value, Self::Error> {
        // Extract tenant from storage key
        let tenant_id = key.tenant_id();
        
        // Set tenant context for RLS
        sqlx::query("SELECT set_tenant_context($1)")
            .bind(tenant_id)
            .execute(&self.pool)
            .await?;

        // Insert with automatic tenant filtering
        let stored_data = sqlx::query_scalar!(
            "INSERT INTO scim_resources (tenant_id, resource_type, resource_id, data, version)
             VALUES ($1, $2, $3, $4, gen_random_uuid()::text)
             RETURNING data",
            tenant_id,
            key.resource_type(),
            key.resource_id(),
            data
        )
        .fetch_one(&self.pool)
        .await?;

        Ok(stored_data)
    }

    async fn get(&self, key: StorageKey) -> Result<Option<Value>, Self::Error> {
        // Set tenant context
        sqlx::query("SELECT set_tenant_context($1)")
            .bind(key.tenant_id())
            .execute(&self.pool)
            .await?;

        // Query with automatic tenant filtering
        let data = sqlx::query_scalar!(
            "SELECT data FROM scim_resources 
             WHERE resource_type = $1 AND resource_id = $2",
            key.resource_type(),
            key.resource_id()
        )
        .fetch_optional(&self.pool)
        .await?;

        Ok(data)
    }

    async fn delete(&self, key: StorageKey) -> Result<bool, Self::Error> {
        sqlx::query("SELECT set_tenant_context($1)")
            .bind(key.tenant_id())
            .execute(&self.pool)
            .await?;

        let result = sqlx::query!(
            "DELETE FROM scim_resources 
             WHERE resource_type = $1 AND resource_id = $2",
            key.resource_type(),
            key.resource_id()
        )
        .execute(&self.pool)
        .await?;

        Ok(result.rows_affected() > 0)
    }

    async fn list(
        &self,
        prefix: StoragePrefix,
        offset: usize,
        limit: usize,
    ) -> Result<Vec<(StorageKey, Value)>, Self::Error> {
        sqlx::query("SELECT set_tenant_context($1)")
            .bind(prefix.tenant_id())
            .execute(&self.pool)
            .await?;

        let rows = sqlx::query!(
            "SELECT resource_id, data FROM scim_resources 
             WHERE resource_type = $1 
             ORDER BY resource_id 
             LIMIT $2 OFFSET $3",
            prefix.resource_type(),
            limit as i64,
            offset as i64
        )
        .fetch_all(&self.pool)
        .await?;

        let results = rows.into_iter()
            .map(|row| {
                let key = StorageKey::new(
                    prefix.tenant_id(),
                    prefix.resource_type(),
                    &row.resource_id
                );
                (key, row.data)
            })
            .collect();

        Ok(results)
    }

    async fn find_by_attribute(
        &self,
        prefix: StoragePrefix,
        attribute: &str,
        value: &str,
    ) -> Result<Vec<(StorageKey, Value)>, Self::Error> {
        sqlx::query("SELECT set_tenant_context($1)")
            .bind(prefix.tenant_id())
            .execute(&self.pool)
            .await?;

        // Use JSONB operators for efficient attribute search
        let rows = sqlx::query!(
            "SELECT resource_id, data FROM scim_resources 
             WHERE resource_type = $1 AND data ->> $2 = $3",
            prefix.resource_type(),
            attribute,
            value
        )
        .fetch_all(&self.pool)
        .await?;

        let results = rows.into_iter()
            .map(|row| {
                let key = StorageKey::new(
                    prefix.tenant_id(),
                    prefix.resource_type(),
                    &row.resource_id
                );
                (key, row.data)
            })
            .collect();

        Ok(results)
    }

    async fn exists(&self, key: StorageKey) -> Result<bool, Self::Error> {
        sqlx::query("SELECT set_tenant_context($1)")
            .bind(key.tenant_id())
            .execute(&self.pool)
            .await?;

        let exists = sqlx::query_scalar!(
            "SELECT EXISTS(SELECT 1 FROM scim_resources 
             WHERE resource_type = $1 AND resource_id = $2)",
            key.resource_type(),
            key.resource_id()
        )
        .fetch_one(&self.pool)
        .await?;

        Ok(exists.unwrap_or(false))
    }

    async fn count(&self, prefix: StoragePrefix) -> Result<usize, Self::Error> {
        sqlx::query("SELECT set_tenant_context($1)")
            .bind(prefix.tenant_id())
            .execute(&self.pool)
            .await?;

        let count = sqlx::query_scalar!(
            "SELECT COUNT(*) FROM scim_resources WHERE resource_type = $1",
            prefix.resource_type()
        )
        .fetch_one(&self.pool)
        .await?;

        Ok(count.unwrap_or(0) as usize)
    }
}
}

Deployment Patterns

Single Instance, Multiple Tenants

The most common pattern for multi-tenant SCIM deployments:

// Production multi-tenant setup
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Load tenant configurations from environment/config file
    let tenant_configs = load_tenant_configs_from_env()?;
    
    // Create storage provider (could be database, Redis, etc.)
    let storage = create_storage_provider().await?;
    let provider = Arc::new(StandardResourceProvider::new(storage));
    
    let app = MultiTenantApp {
        provider,
        tenant_configs,
    };

    // Production server with proper middleware
    let router = Router::new()
        .route("/tenants/:tenant_id/scim/v2/Users", 
               post(create_user).get(list_users))
        .route("/tenants/:tenant_id/scim/v2/Users/:user_id", 
               get(get_user).put(update_user).delete(delete_user))
        .route("/tenants/:tenant_id/scim/v2/Groups", 
               post(create_group).get(list_groups))
        .route("/tenants/:tenant_id/scim/v2/Groups/:group_id", 
               get(get_group).put(update_group).delete(delete_group))
        .layer(
            ServiceBuilder::new()
                .layer(TraceLayer::new_for_http())
                .layer(TimeoutLayer::new(Duration::from_secs(30)))
                .layer(CompressionLayer::new())
                .layer(cors_layer())
        )
        .with_state(app);

    let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await?;
    println!("Multi-tenant SCIM server running on port 3000");
    axum::serve(listener, router).await?;
    
    Ok(())
}

fn load_tenant_configs_from_env() -> Result<HashMap<String, TenantConfig>, Box<dyn std::error::Error>> {
    let mut configs = HashMap::new();
    
    // Load from environment variables or config files
    for tenant_id in std::env::var("TENANT_IDS")?.split(',') {
        let config = TenantConfig {
            name: std::env::var(format!("TENANT_{}_NAME", tenant_id.to_uppercase()))?,
            max_users: std::env::var(format!("TENANT_{}_MAX_USERS", tenant_id.to_uppercase()))
                .ok().and_then(|s| s.parse().ok()),
            features: std::env::var(format!("TENANT_{}_FEATURES", tenant_id.to_uppercase()))
                .unwrap_or_default()
                .split(',')
                .map(|s| s.to_string())
                .collect(),
            auth_config: load_auth_config_for_tenant(tenant_id)?,
        };
        configs.insert(tenant_id.to_string(), config);
    }
    
    Ok(configs)
}

Separate Instances Per Tenant

For high-isolation requirements:

// Per-tenant instance deployment
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let tenant_id = std::env::var("TENANT_ID")
        .expect("TENANT_ID environment variable required");
    
    // Dedicated storage for this tenant
    let storage_url = format!("postgresql://user:pass@localhost/scim_{}", tenant_id);
    let storage = PostgresStorageProvider::new(&storage_url).await?;
    let provider = StandardResourceProvider::new(storage);
    
    // Single-tenant routes (no tenant_id in path)
    let router = Router::new()
        .route("/scim/v2/Users", post(create_user).get(list_users))
        .route("/scim/v2/Users/:user_id", 
               get(get_user).put(update_user).delete(delete_user))
        .route("/scim/v2/Groups", post(create_group).get(list_groups))
        .with_state(SingleTenantApp { provider, tenant_id });

    let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await?;
    axum::serve(listener, router).await?;
    
    Ok(())
}

#[derive(Clone)]
struct SingleTenantApp {
    provider: StandardResourceProvider<PostgresStorageProvider>,
    tenant_id: String,
}

impl SingleTenantApp {
    fn create_context(&self, operation: &str) -> RequestContext {
        RequestContext::new(format!("{}-{}-{}", self.tenant_id, operation, Uuid::new_v4()))
    }
}

Configuration Management

Environment-Based Configuration

#![allow(unused)]
fn main() {
use serde::{Deserialize, Serialize};

#[derive(Debug, Clone, Deserialize, Serialize)]
pub struct TenantConfig {
    pub name: String,
    pub max_users: Option<usize>,
    pub features: Vec<String>,
    pub auth_config: AuthConfig,
}

// Load from environment variables
fn load_tenant_config(tenant_id: &str) -> Result<TenantConfig, Box<dyn std::error::Error>> {
    let prefix = format!("TENANT_{}", tenant_id.to_uppercase());
    
    Ok(TenantConfig {
        name: std::env::var(format!("{}_NAME", prefix))?,
        max_users: std::env::var(format!("{}_MAX_USERS", prefix))
            .ok().and_then(|s| s.parse().ok()),
        features: std::env::var(format!("{}_FEATURES", prefix))
            .unwrap_or_default()
            .split(',')
            .filter(|s| !s.is_empty())
            .map(|s| s.to_string())
            .collect(),
        auth_config: AuthConfig::OAuth {
            jwks_url: std::env::var(format!("{}_JWKS_URL", prefix))?,
            audience: std::env::var(format!("{}_AUDIENCE", prefix))?,
        },
    })
}
}

File-Based Configuration

#![allow(unused)]
fn main() {
// config/tenants.yaml
use serde_yaml;

#[derive(Debug, Deserialize)]
struct TenantsConfig {
    tenants: HashMap<String, TenantConfig>,
}

async fn load_tenant_configs_from_file() -> Result<HashMap<String, TenantConfig>, Box<dyn std::error::Error>> {
    let config_content = tokio::fs::read_to_string("config/tenants.yaml").await?;
    let config: TenantsConfig = serde_yaml::from_str(&config_content)?;
    Ok(config.tenants)
}
}

Example config/tenants.yaml:

tenants:
  company-a:
    name: "Company A"
    max_users: 1000
    features: ["bulk_operations", "custom_schemas"]
    auth_config:
      OAuth:
        jwks_url: "https://company-a.auth0.com/.well-known/jwks.json"
        audience: "scim-api"
  
  company-b:
    name: "Company B"
    max_users: 500
    features: ["basic_operations"]
    auth_config:
      ApiKey:
        keys: ["sk_live_abc123"]

Security Considerations

Authentication Per Tenant

#![allow(unused)]
fn main() {
use axum::http::HeaderMap;

async fn authenticate_tenant_request(
    headers: &HeaderMap,
    tenant_id: &str,
    tenant_configs: &HashMap<String, TenantConfig>,
) -> Result<(), MultiTenantError> {
    let tenant_config = tenant_configs.get(tenant_id)
        .ok_or_else(|| MultiTenantError::TenantNotFound(tenant_id.to_string()))?;

    match &tenant_config.auth_config {
        AuthConfig::OAuth { jwks_url, audience } => {
            // Validate JWT token
            let auth_header = headers.get("authorization")
                .and_then(|h| h.to_str().ok())
                .ok_or_else(|| MultiTenantError::InternalError("Missing authorization header".to_string()))?;
                
            if !auth_header.starts_with("Bearer ") {
                return Err(MultiTenantError::InternalError("Invalid authorization format".to_string()));
            }
            
            let token = &auth_header[7..];
            validate_jwt_token(token, jwks_url, audience).await?;
        },
        
        AuthConfig::ApiKey { keys } => {
            // Validate API key
            let api_key = headers.get("x-api-key")
                .and_then(|h| h.to_str().ok())
                .ok_or_else(|| MultiTenantError::InternalError("Missing API key".to_string()))?;
                
            if !keys.contains(&api_key.to_string()) {
                return Err(MultiTenantError::InternalError("Invalid API key".to_string()));
            }
        },
        
        AuthConfig::Basic { username, password } => {
            // Validate basic auth
            let auth_header = headers.get("authorization")
                .and_then(|h| h.to_str().ok())
                .ok_or_else(|| MultiTenantError::InternalError("Missing authorization header".to_string()))?;
                
            // Decode and validate basic auth credentials
            validate_basic_auth(auth_header, username, password)?;
        },
    }

    Ok(())
}

async fn validate_jwt_token(token: &str, jwks_url: &str, audience: &str) -> Result<(), MultiTenantError> {
    // JWT validation implementation
    // This would use a JWT library to validate the token
    Ok(())
}
}

Rate Limiting Per Tenant

#![allow(unused)]
fn main() {
use std::time::{Duration, Instant};
use std::collections::HashMap;
use std::sync::{Arc, Mutex};

#[derive(Debug, Clone)]
struct RateLimiter {
    requests: Arc<Mutex<HashMap<String, Vec<Instant>>>>,
}

impl RateLimiter {
    fn new() -> Self {
        Self {
            requests: Arc::new(Mutex::new(HashMap::new())),
        }
    }

    fn check_rate_limit(&self, tenant_id: &str, limit_per_minute: usize) -> bool {
        let mut requests = self.requests.lock().unwrap();
        let now = Instant::now();
        let minute_ago = now - Duration::from_secs(60);
        
        let tenant_requests = requests.entry(tenant_id.to_string()).or_insert_with(Vec::new);
        
        // Remove old requests
        tenant_requests.retain(|&request_time| request_time > minute_ago);
        
        if tenant_requests.len() >= limit_per_minute {
            false
        } else {
            tenant_requests.push(now);
            true
        }
    }
}

// Usage in middleware
async fn rate_limit_middleware(
    tenant_id: &str,
    tenant_config: &TenantConfig,
    rate_limiter: &RateLimiter,
) -> Result<(), MultiTenantError> {
    if let Some(limit) = tenant_config.max_requests_per_minute {
        if !rate_limiter.check_rate_limit(tenant_id, limit) {
            return Err(MultiTenantError::TenantLimitExceeded(
                format!("Rate limit of {} requests per minute exceeded", limit)
            ));
        }
    }
    Ok(())
}
}

Monitoring and Observability

Per-Tenant Metrics

#![allow(unused)]
fn main() {
use prometheus::{Counter, Histogram, Gauge, Registry};
use std::collections::HashMap;

#[derive(Clone)]
struct TenantMetrics {
    request_counter: Counter,
    response_time: Histogram,
    active_users: Gauge,
    active_groups: Gauge,
}

struct MultiTenantMetrics {
    registry: Registry,
    tenant_metrics: HashMap<String, TenantMetrics>,
}

impl MultiTenantMetrics {
    fn new() -> Self {
        Self {
            registry: Registry::new(),
            tenant_metrics: HashMap::new(),
        }
    }

    fn get_or_create_tenant_metrics(&mut self, tenant_id: &str) -> &TenantMetrics {
        self.tenant_metrics.entry(tenant_id.to_string()).or_insert_with(|| {
            let request_counter = Counter::new(
                "scim_requests_total",
                "Total number of SCIM requests per tenant"
            ).unwrap();
            
            let response_time = Histogram::new(
                "scim_request_duration_seconds",
                "SCIM request duration in seconds"
            ).unwrap();
            
            let active_users = Gauge::new(
                "scim_active_users",
                "Number of active users per tenant"
            ).unwrap();
            
            let active_groups = Gauge::new(
                "scim_active_groups", 
                "Number of active groups per tenant"
            ).unwrap();

            TenantMetrics {
                request_counter,
                response_time,
                active_users,
                active_groups,
            }
        })
    }

    fn record_request(&mut self, tenant_id: &str, duration: Duration) {
        let metrics = self.get_or_create_tenant_metrics(tenant_id);
        metrics.request_counter.inc();
        metrics.response_time.observe(duration.as_secs_f64());
    }
}
}

Best Practices

1. Tenant Validation

• Always validate tenant existence before processing requests
• Implement consistent error responses for invalid tenants
• Use meaningful tenant identifiers (avoid sequential IDs)

2. Data Isolation

• Use tenant-aware RequestContext for all operations
• Implement database-level isolation for sensitive deployments
• Audit cross-tenant access attempts

3. Configuration Management

• Store tenant configs securely (encrypted secrets)
• Implement hot-reloading for configuration changes
• Version configuration changes for rollback capability

4. Performance

• Implement per-tenant rate limiting
• Monitor tenant resource usage
• Scale storage based on tenant data growth

5. Security

• Use different authentication schemes per tenant as needed
• Implement audit logging for all tenant operations
• Regular security reviews of tenant isolation

Testing Multi-Tenant Deployments

Integration Tests

#![allow(unused)]
fn main() {
#[cfg(test)]
mod tests {
    use super::*;

    #[tokio::test]
    async fn test_tenant_isolation() {
        let app = MultiTenantApp::new();
        
        // Create users in different tenants
        let tenant_a_context = app.create_context("tenant-a", "test");
        let tenant_b_context = app.create_context("tenant-b", "test");
        
        let user_data = json!({"userName": "test@example.com"});
        
        let user_a = app.provider.create_resource("User", user_data.clone(), &tenant_a_context).await.unwrap();
        let user_b = app.provider.create_resource("User", user_data, &tenant_b_context).await.unwrap();
        
        // Verify isolation - tenant A cannot see tenant B's user
        let tenant_a_users = app.provider.list_resources("User", None, &tenant_a_context).await.unwrap();
        let tenant_b_users = app.provider.list_resources("User", None, &tenant_b_context).await.unwrap();
        
        assert_eq!(tenant_a_users.len(), 1);
        assert_eq!(tenant_b_users.len(), 1);
        assert_ne!(user_a.get_id(), user_b.get_id());
    }

    #[tokio::test]
    async fn test_tenant_limits() {
        let mut tenant_configs = HashMap::new();
        tenant_configs.insert("limited-tenant".to_string(), TenantConfig {
            name: "Limited Tenant".to_string(),
            max_users: Some(1),
            features: vec![],
            auth_config: AuthConfig::ApiKey { keys: vec!["test".to_string()] },
        });
        
        let app = MultiTenantApp {
            provider: Arc::new(StandardResourceProvider::new(InMemoryStorage::new())),
            tenant_configs,
        };
        
        // Create first user (should succeed)
        let context = app.create_context("limited-tenant", "test");
        let user_data = json!({"userName": "user1@example.com"});
        let result1 = app.provider.create_resource("User", user_data, &context).await;
        assert!(result1.is_ok());
        
        // Try to create second user (should fail due to limit)
        let user_data2 = json!({"userName": "user2@example.com"});
        let context2 = app.create_context("limited-tenant", "test");
        
        // In a real implementation, this would be checked in the handler
        let users = app.provider.list_resources("User", None, &context2).await.unwrap();
        assert_eq!(users.len(), 1); // At limit
    }
}
}

Summary

This tutorial demonstrated comprehensive multi-tenant SCIM deployments:

✅ Multi-Tenant Architecture:

• Application-level isolation via RequestContext
• Database-level isolation with Row-Level Security
• Flexible deployment patterns (single vs. separate instances)

✅ Configuration Management:

• Environment and file-based tenant configuration
• Per-tenant authentication schemes
• Feature flags and limits per tenant

✅ Security & Isolation:

• Complete data isolation between tenants
• Per-tenant authentication and authorization
• Rate limiting and resource controls

✅ Production Considerations:

• Monitoring and metrics per tenant
• Performance optimization strategies
• Comprehensive testing approaches

Next Steps:

• Authentication Setup - Secure your multi-tenant endpoints

• Custom Resources - Extend SCIM for tenant-specific needs

• Performance Optimization - Scale for multiple tenants let mut configs = HashMap::new();

  // Load from database let rows = sqlx::query("SELECT tenant_id, config FROM tenant_configs") .fetch_all(&pool) .await?;

  for row in rows { let tenant_id: String = row.get("tenant_id"); let config_json: serde_json::Value = row.get("config"); let config: TenantConfig = serde_json::from_value(config_json)?; configs.insert(tenant_id, config); }

  Ok(configs) }

### Tenant Registration

```rust
async fn register_tenant(
    State(app): State<MultiTenantApp>,
    Json(registration): Json<TenantRegistration>,
) -> Result<Json<TenantInfo>, (StatusCode, Json<ScimError>)> {
    // Validate registration
    if registration.tenant_id.is_empty() || registration.name.is_empty() {
        return Err((StatusCode::BAD_REQUEST, Json(ScimError::invalid_value("Missing required fields"))));
    }

    // Check if tenant already exists
    if app.tenant_configs.contains_key(&registration.tenant_id) {
        return Err((StatusCode::CONFLICT, Json(ScimError::uniqueness("Tenant ID already exists"))));
    }

    // Create tenant configuration
    let config = TenantConfig {
        name: registration.name,
        display_name: registration.display_name,
        auth_scheme: registration.auth_scheme,
        limits: TenantLimits {
            max_users: Some(1000),
            max_groups: Some(100),
            max_requests_per_minute: Some(1000),
            max_bulk_operations: Some(100),
        },
        features: vec!["basic_operations".to_string()],
        custom_schemas: vec![],
        webhook_endpoints: vec![],
    };

    // Save to database
    sqlx::query(
        "INSERT INTO tenant_configs (tenant_id, config) VALUES ($1, $2)"
    )
    .bind(&registration.tenant_id)
    .bind(serde_json::to_value(&config)?)
    .execute(&app.pool)
    .await?;

    // Generate API key for the tenant
    let api_key = generate_api_key(&registration.tenant_id);

    Ok(Json(TenantInfo {
        tenant_id: registration.tenant_id,
        name: config.name,
        api_key,
        endpoints: TenantEndpoints {
            base_url: format!("https://api.example.com/scim/v2/{}", registration.tenant_id),
            users: format!("https://api.example.com/scim/v2/{}/Users", registration.tenant_id),
            groups: format!("https://api.example.com/scim/v2/{}/Groups", registration.tenant_id),
        },
    }))
}

Advanced Multi-Tenant Patterns

Tenant Middleware

#![allow(unused)]
fn main() {
use axum::{extract::Request, middleware::Next, response::Response};

async fn tenant_middleware(
    mut request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    // Extract tenant ID from path
    let tenant_id = request
        .uri()
        .path()
        .split('/')
        .nth(3) // /scim/v2/:tenant_id/...
        .ok_or(StatusCode::BAD_REQUEST)?;

    // Validate tenant exists
    let tenant_config = TENANT_CONFIGS
        .get(tenant_id)
        .ok_or(StatusCode::NOT_FOUND)?;

    // Add tenant context to request
    request.extensions_mut().insert(TenantContext {
        tenant_id: tenant_id.to_string(),
        config: tenant_config.clone(),
    });

    // Check tenant limits
    if let Err(status) = check_tenant_limits(&tenant_config, &request).await {
        return Err(status);
    }

    Ok(next.run(request).await)
}

async fn check_tenant_limits(
    config: &TenantConfig,
    request: &Request,
) -> Result<(), StatusCode> {
    // Check rate limits
    if let Some(limit) = config.limits.max_requests_per_minute {
        let current_rate = get_current_request_rate(&config.name).await;
        if current_rate > limit {
            return Err(StatusCode::TOO_MANY_REQUESTS);
        }
    }

    // Check feature availability
    let requested_feature = extract_feature_from_request(request);
    if let Some(feature) = requested_feature {
        if !config.features.contains(&feature) {
            return Err(StatusCode::FORBIDDEN);
        }
    }

    Ok(())
}
}

Tenant Isolation Testing

#![allow(unused)]
fn main() {
#[cfg(test)]
mod tests {
    use super::*;
    use axum_test::TestServer;

    #[tokio::test]
    async fn test_tenant_isolation() {
        let app = create_test_app().await;
        let server = TestServer::new(app).unwrap();

        // Create user in tenant A
        let user_a = create_test_user("alice@company-a.com");
        let response = server
            .post("/scim/v2/company-a/Users")
            .json(&user_a)
            .await;
        assert_eq!(response.status_code(), 201);
        let created_user_a: ScimUser = response.json();

        // Create user in tenant B
        let user_b = create_test_user("bob@company-b.com");
        let response = server
            .post("/scim/v2/company-b/Users")
            .json(&user_b)
            .await;
        assert_eq!(response.status_code(), 201);
        let created_user_b: ScimUser = response.json();

        // Verify tenant A cannot see tenant B's users
        let response = server
            .get(&format!("/scim/v2/company-a/Users/{}", created_user_b.id()))
            .await;
        assert_eq!(response.status_code(), 404);

        // Verify tenant B cannot see tenant A's users
        let response = server
            .get(&format!("/scim/v2/company-b/Users/{}", created_user_a.id()))
            .await;
        assert_eq!(response.status_code(), 404);

        // Verify each tenant can see their own users
        let response = server
            .get(&format!("/scim/v2/company-a/Users/{}", created_user_a.id()))
            .await;
        assert_eq!(response.status_code(), 200);

        let response = server
            .get(&format!("/scim/v2/company-b/Users/{}", created_user_b.id()))
            .await;
        assert_eq!(response.status_code(), 200);
    }

    #[tokio::test]
    async fn test_tenant_limits() {
        let app = create_test_app().await;
        let server = TestServer::new(app).unwrap();

        // Create users up to the limit
        for i in 0..1000 {
            let user = create_test_user(&format!("user{}@company-a.com", i));
            let response = server
                .post("/scim/v2/company-a/Users")
                .json(&user)
                .await;
            assert_eq!(response.status_code(), 201);
        }

        // Try to create one more user (should fail)
        let user = create_test_user("overflow@company-a.com");
        let response = server
            .post("/scim/v2/company-a/Users")
            .json(&user)
            .await;
        assert_eq!(response.status_code(), 403);
    }
}
}

Deployment Strategies

Shared Infrastructure

# docker-compose.yml for shared infrastructure
version: '3.8'

services:
  scim-server:
    image: scim-server:latest
    environment:
      - DATABASE_URL=postgresql://scim:password@postgres:5432/scim
      - REDIS_URL=redis://redis:6379
      - TENANT_CONFIG_URL=file:///config/tenants.json
    volumes:
      - ./tenant-configs:/config
    ports:
      - "3000:3000"
    depends_on:
      - postgres
      - redis

  postgres:
    image: postgres:15
    environment:
      - POSTGRES_DB=scim
      - POSTGRES_USER=scim
      - POSTGRES_PASSWORD=password
    volumes:
      - postgres_data:/var/lib/postgresql/data

  redis:
    image: redis:7-alpine
    volumes:
      - redis_data:/data

volumes:
  postgres_data:
  redis_data:

Kubernetes Multi-Tenant Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: scim-server-multitenant
spec:
  replicas: 3
  selector:
    matchLabels:
      app: scim-server
  template:
    metadata:
      labels:
        app: scim-server
    spec:
      containers:
      - name: scim-server
        image: scim-server:latest
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: database-credentials
              key: url
        - name: TENANT_CONFIGS
          valueFrom:
            configMapKeyRef:
              name: tenant-configs
              key: config.json
        ports:
        - containerPort: 3000
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: tenant-configs
data:
  config.json: |
    {
      "company-a": {
        "name": "Company A",
        "auth_scheme": {
          "OAuth": {
            "jwks_url": "https://company-a.auth0.com/.well-known/jwks.json",
            "audience": "scim-api"
          }
        },
        "limits": {
          "max_users": 1000,
          "max_requests_per_minute": 1000
        }
      },
      "company-b": {
        "name": "Company B",
        "auth_scheme": {
          "ApiKey": {
            "keys": ["sk_live_abc123"]
          }
        },
        "limits": {
          "max_users": 500,
          "max_requests_per_minute": 500
        }
      }
    }

Monitoring and Observability

Per-Tenant Metrics

#![allow(unused)]
fn main() {
use prometheus::{Counter, Histogram, register_counter_vec, register_histogram_vec};

lazy_static! {
    static ref REQUESTS_TOTAL: Counter = register_counter_vec!(
        "scim_requests_total",
        "Total number of SCIM requests",
        &["tenant_id", "method", "status"]
    ).unwrap();
    
    static ref REQUEST_DURATION: Histogram = register_histogram_vec!(
        "scim_request_duration_seconds",
        "Duration of SCIM requests",
        &["tenant_id", "method"]
    ).unwrap();
}

async fn metrics_middleware(
    Extension(tenant_context): Extension<TenantContext>,
    request: Request,
    next: Next,
) -> Response {
    let method = request.method().to_string();
    let start = std::time::Instant::now();
    
    let response = next.run(request).await;
    
    let duration = start.elapsed().as_secs_f64();
    let status = response.status().as_u16().to_string();
    
    REQUESTS_TOTAL
        .with_label_values(&[&tenant_context.tenant_id, &method, &status])
        .inc();
    
    REQUEST_DURATION
        .with_label_values(&[&tenant_context.tenant_id, &method])
        .observe(duration);
    
    response
}
}

Tenant Health Dashboard

#![allow(unused)]
fn main() {
async fn tenant_health_endpoint(
    State(app): State<MultiTenantApp>,
) -> Json<serde_json::Value> {
    let mut tenant_health = serde_json::Map::new();
    
    for (tenant_id, config) in &app.tenant_configs {
        let user_count = app.scim_server
            .count_users(tenant_id)
            .await
            .unwrap_or(0);
        
        let group_count = app.scim_server
            .count_groups(tenant_id)
            .await
            .unwrap_or(0);
        
        tenant_health.insert(tenant_id.clone(), json!({
            "name": config.name,
            "status": "healthy",
            "user_count": user_count,
            "group_count": group_count,
            "limits": {
                "max_users": config.limits.max_users,
                "user_utilization": config.limits.max_users.map(|max| (user_count as f64 / max as f64) * 100.0)
            }
        }));
    }
    
    Json(json!({
        "tenant_count": tenant_health.len(),
        "tenants": tenant_health
    }))
}
}

This comprehensive guide covers all aspects of deploying SCIM Server in multi-tenant environments, from basic setup to advanced production patterns with complete isolation and monitoring.

Web Framework Integration

This tutorial shows how to integrate SCIM Server with popular Rust web frameworks. SCIM Server is framework-agnostic, meaning it works with any HTTP library while providing consistent SCIM functionality.

Overview

SCIM Server follows a layered architecture that separates HTTP handling from SCIM logic:

┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
│   HTTP Layer    │    │ Resource Provider│    │   Storage       │
│                 │    │                  │    │                 │
│  • Axum         │───▶│  • Validation    │───▶│  • In-Memory    │
│  • Warp         │    │  • Operations    │    │  • Database     │
│  • Actix        │    │  • Type Safety   │    │  • Custom       │
│  • Custom       │    │  • Multi-tenant  │    │                 │
└─────────────────┘    └──────────────────┘    └─────────────────┘

This design allows you to use your preferred web framework while leveraging SCIM Server's enterprise-grade capabilities.

Integration Patterns

Common Integration Pattern

All framework integrations follow a similar pattern:

1. Create RequestContext from request metadata
2. Parse JSON body for create/update operations
3. Handle ETags for concurrency control
4. Call StandardResourceProvider with the extracted data
5. Return SCIM-compliant responses with proper headers

Axum Integration

Axum is a modern, ergonomic web framework built on tokio and hyper.

Dependencies

[dependencies]
scim-server = "=0.3.2"
axum = "0.7"
tokio = { version = "1.0", features = ["full"] }
tower = "0.4"
tower-http = { version = "0.5", features = ["cors"] }
serde_json = "1.0"

Basic Server Setup

use axum::{
    extract::{Path, Query, State},
    http::{StatusCode, HeaderMap, HeaderValue},
    response::Json,
    routing::{get, post, put, delete},
    Router,
};
use scim_server::{
    providers::StandardResourceProvider,
    storage::InMemoryStorage,
    RequestContext,
};
use serde_json::{Value, json};
use std::collections::HashMap;
use tower_http::cors::CorsLayer;
use uuid::Uuid;

type AppState = StandardResourceProvider<InMemoryStorage>;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Initialize SCIM Server with StandardResourceProvider
    let storage = InMemoryStorage::new();
    let provider = StandardResourceProvider::new(storage);

    // Build application with routes
    let app = Router::new()
        // SCIM v2 endpoints
        .route("/scim/v2/Users", post(create_user).get(list_users))
        .route("/scim/v2/Users/:id", 
            get(get_user).put(update_user).delete(delete_user))
        .route("/scim/v2/Groups", post(create_group).get(list_groups))
        .route("/scim/v2/Groups/:id", 
            get(get_group).put(update_group).delete(delete_group))
        // Multi-tenant endpoints
        .route("/tenants/:tenant_id/scim/v2/Users", post(create_user_mt).get(list_users_mt))
        .route("/tenants/:tenant_id/scim/v2/Users/:id", 
            get(get_user_mt).put(update_user_mt).delete(delete_user_mt))
        .with_state(provider)
        .layer(CorsLayer::permissive());

    // Start server
    let listener = tokio::net::TcpListener::bind("127.0.0.1:3000").await?;
    println!("SCIM Server running on http://127.0.0.1:3000");
    axum::serve(listener, app).await?;

    Ok(())
}

CRUD Operations

#![allow(unused)]
fn main() {
// Helper to create RequestContext from HTTP request
fn create_request_context() -> RequestContext {
    RequestContext::new(Uuid::new_v4().to_string())
}

// Create User
async fn create_user(
    State(provider): State<AppState>,
    Json(user_data): Json<Value>,
) -> Result<(StatusCode, HeaderMap, Json<Value>), AppError> {
    let context = create_request_context();
    let user = provider.create_resource("User", user_data, &context).await?;
    
    let mut headers = HeaderMap::new();
    headers.insert("Location", format!("/scim/v2/Users/{}", 
        user.get_id().unwrap_or("unknown")).parse()?);
    
    if let Some(meta) = user.get_meta() {
        if let Some(version) = &meta.version {
            headers.insert("ETag", format!("\"{}\"", version).parse()?);
        }
    }
    
    Ok((StatusCode::CREATED, headers, Json(user.data)))
}

// Get User
async fn get_user(
    State(provider): State<AppState>,
    Path(user_id): Path<String>,
) -> Result<(HeaderMap, Json<Value>), AppError> {
    let context = create_request_context();
    let user = provider.get_resource("User", &user_id, &context).await?;
    
    let mut headers = HeaderMap::new();
    if let Some(meta) = user.get_meta() {
        if let Some(version) = &meta.version {
            headers.insert("ETag", format!("\"{}\"", version).parse()?);
        }
    }
    
    Ok((headers, Json(user.data)))
}

// List Users with Filtering
async fn list_users(
    State(provider): State<AppState>,
    Query(params): Query<HashMap<String, String>>,
) -> Result<Json<Value>, AppError> {
    let context = create_request_context();
    
    // Get all users (provider handles this internally)
    let users = provider.list_resources("User", None, &context).await?;
    
    // Apply client-side filtering if filter parameter provided
    let filtered_users = if let Some(filter_str) = params.get("filter") {
        // Simple filtering example - extend for full SCIM filter syntax
        users.into_iter()
            .filter(|user| {
                if filter_str.contains("active eq true") {
                    user.get_active().unwrap_or(true)
                } else {
                    true
                }
            })
            .collect::<Vec<_>>()
    } else {
        users
    };
    
    // Apply pagination
    let start_index = params.get("startIndex")
        .and_then(|s| s.parse::<usize>().ok())
        .unwrap_or(1);
    let count = params.get("count")
        .and_then(|s| s.parse::<usize>().ok())
        .unwrap_or(20);
    
    let start = (start_index - 1).min(filtered_users.len());
    let end = (start + count).min(filtered_users.len());
    let page_users = &filtered_users[start..end];
    
    // Create SCIM list response
    let response = json!({
        "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
        "totalResults": filtered_users.len(),
        "startIndex": start_index,
        "itemsPerPage": page_users.len(),
        "Resources": page_users.iter().map(|u| &u.data).collect::<Vec<_>>()
    });
    
    Ok(Json(response))
}

// Update User with ETag support
async fn update_user(
    State(provider): State<AppState>,
    Path(user_id): Path<String>,
    headers: HeaderMap,
    Json(user_data): Json<Value>,
) -> Result<(HeaderMap, Json<Value>), AppError> {
    let context = create_request_context();
    
    // Extract If-Match header for conditional updates
    let if_match = headers.get("if-match")
        .and_then(|v| v.to_str().ok())
        .map(|s| s.trim_matches('"'));
    
    // For ETag support, you could verify the version matches current resource
    if let Some(_expected_version) = if_match {
        // Get current user to check version
        let current_user = provider.get_resource("User", &user_id, &context).await?;
        if let Some(meta) = current_user.get_meta() {
            if let Some(current_version) = &meta.version {
                if current_version != _expected_version {
                    return Err(AppError::VersionMismatch);
                }
            }
        }
    }
    
    let user = provider.update_resource("User", &user_id, user_data, &context).await?;
    
    let mut response_headers = HeaderMap::new();
    if let Some(meta) = user.get_meta() {
        if let Some(version) = &meta.version {
            response_headers.insert("ETag", format!("\"{}\"", version).parse()?);
        }
    }
    
    Ok((response_headers, Json(user.data)))
}

// Delete User
async fn delete_user(
    State(provider): State<AppState>,
    Path(user_id): Path<String>,
) -> Result<StatusCode, AppError> {
    let context = create_request_context();
    provider.delete_resource("User", &user_id, &context).await?;
    Ok(StatusCode::NO_CONTENT)
}
}

Multi-Tenant Endpoints

#![allow(unused)]
fn main() {
// Multi-tenant user creation
async fn create_user_mt(
    State(provider): State<AppState>,
    Path(tenant_id): Path<String>,
    Json(user_data): Json<Value>,
) -> Result<(StatusCode, HeaderMap, Json<Value>), AppError> {
    // Create context with tenant information
    let context = RequestContext::new(format!("tenant-{}-{}", tenant_id, Uuid::new_v4()));
    let user = provider.create_resource("User", user_data, &context).await?;
    
    let mut headers = HeaderMap::new();
    headers.insert("Location", 
        format!("/tenants/{}/scim/v2/Users/{}", tenant_id, 
        user.get_id().unwrap_or("unknown")).parse()?);
    
    if let Some(meta) = user.get_meta() {
        if let Some(version) = &meta.version {
            headers.insert("ETag", format!("\"{}\"", version).parse()?);
        }
    }
    
    Ok((StatusCode::CREATED, headers, Json(user.data)))
}

// Multi-tenant user retrieval
async fn get_user_mt(
    State(provider): State<AppState>,
    Path((tenant_id, user_id)): Path<(String, String)>,
) -> Result<(HeaderMap, Json<Value>), AppError> {
    let context = RequestContext::new(format!("tenant-{}-{}", tenant_id, Uuid::new_v4()));
    let user = provider.get_resource("User", &user_id, &context).await?;
    
    let mut headers = HeaderMap::new();
    if let Some(meta) = user.get_meta() {
        if let Some(version) = &meta.version {
            headers.insert("ETag", format!("\"{}\"", version).parse()?);
        }
    }
    
    Ok((headers, Json(user.data)))
}

// Multi-tenant user listing
async fn list_users_mt(
    State(provider): State<AppState>,
    Path(tenant_id): Path<String>,
    Query(params): Query<HashMap<String, String>>,
) -> Result<Json<Value>, AppError> {
    let context = RequestContext::new(format!("tenant-{}-{}", tenant_id, Uuid::new_v4()));
    let users = provider.list_resources("User", None, &context).await?;
    
    // Apply pagination
    let start_index = params.get("startIndex")
        .and_then(|s| s.parse::<usize>().ok())
        .unwrap_or(1);
    let count = params.get("count")
        .and_then(|s| s.parse::<usize>().ok())
        .unwrap_or(20);
    
    let start = (start_index - 1).min(users.len());
    let end = (start + count).min(users.len());
    let page_users = &users[start..end];
    
    let response = json!({
        "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
        "totalResults": users.len(),
        "startIndex": start_index,
        "itemsPerPage": page_users.len(),
        "Resources": page_users.iter().map(|u| &u.data).collect::<Vec<_>>()
    });
    
    Ok(Json(response))
}

// Multi-tenant user update
async fn update_user_mt(
    State(provider): State<AppState>,
    Path((tenant_id, user_id)): Path<(String, String)>,
    headers: HeaderMap,
    Json(user_data): Json<Value>,
) -> Result<(HeaderMap, Json<Value>), AppError> {
    let context = RequestContext::new(format!("tenant-{}-{}", tenant_id, Uuid::new_v4()));
    
    // Handle ETag if present
    if let Some(if_match) = headers.get("if-match").and_then(|v| v.to_str().ok()) {
        let expected_version = if_match.trim_matches('"');
        let current_user = provider.get_resource("User", &user_id, &context).await?;
        if let Some(meta) = current_user.get_meta() {
            if let Some(current_version) = &meta.version {
                if current_version != expected_version {
                    return Err(AppError::VersionMismatch);
                }
            }
        }
    }
    
    let user = provider.update_resource("User", &user_id, user_data, &context).await?;
    
    let mut response_headers = HeaderMap::new();
    if let Some(meta) = user.get_meta() {
        if let Some(version) = &meta.version {
            response_headers.insert("ETag", format!("\"{}\"", version).parse()?);
        }
    }
    
    Ok((response_headers, Json(user.data)))
}

// Multi-tenant user deletion
async fn delete_user_mt(
    State(provider): State<AppState>,
    Path((tenant_id, user_id)): Path<(String, String)>,
) -> Result<StatusCode, AppError> {
    let context = RequestContext::new(format!("tenant-{}-{}", tenant_id, Uuid::new_v4()));
    provider.delete_resource("User", &user_id, &context).await?;
    Ok(StatusCode::NO_CONTENT)
}
}

Error Handling

#![allow(unused)]
fn main() {
use axum::{response::{Response, IntoResponse}, http::StatusCode};
use serde_json::json;

#[derive(Debug)]
enum AppError {
    NotFound,
    VersionMismatch,
    ValidationError(String),
    InternalError(String),
}

impl IntoResponse for AppError {
    fn into_response(self) -> Response {
        let (status, error_code, message) = match self {
            AppError::NotFound => (
                StatusCode::NOT_FOUND,
                "resourceNotFound",
                "The specified resource was not found",
            ),
            AppError::VersionMismatch => (
                StatusCode::PRECONDITION_FAILED,
                "versionMismatch", 
                "The resource version does not match",
            ),
            AppError::ValidationError(msg) => (
                StatusCode::BAD_REQUEST,
                "invalidData",
                &msg,
            ),
            AppError::InternalError(msg) => (
                StatusCode::INTERNAL_SERVER_ERROR,
                "internalError",
                &msg,
            ),
        };

        let body = json!({
            "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
            "status": status.as_u16().to_string(),
            "scimType": error_code,
            "detail": message
        });

        (status, axum::Json(body)).into_response()
    }
}

impl<E> From<E> for AppError
where
    E: std::error::Error + Send + Sync + 'static,
{
    fn from(err: E) -> Self {
        let error_str = err.to_string();
        if error_str.contains("not found") {
            AppError::NotFound
        } else if error_str.contains("validation") {
            AppError::ValidationError(error_str)
        } else {
            AppError::InternalError(error_str)
        }
    }
}

}

Group Operations

#![allow(unused)]
fn main() {
// Create Group
async fn create_group(
    State(provider): State<AppState>,
    Json(group_data): Json<Value>,
) -> Result<(StatusCode, HeaderMap, Json<Value>), AppError> {
    let context = create_request_context();
    let group = provider.create_resource("Group", group_data, &context).await?;
    
    let mut headers = HeaderMap::new();
    headers.insert("Location", format!("/scim/v2/Groups/{}", 
        group.get_id().unwrap_or("unknown")).parse()?);
    
    if let Some(meta) = group.get_meta() {
        if let Some(version) = &meta.version {
            headers.insert("ETag", format!("\"{}\"", version).parse()?);
        }
    }
    
    Ok((StatusCode::CREATED, headers, Json(group.data)))
}

// Get Group
async fn get_group(
    State(provider): State<AppState>,
    Path(group_id): Path<String>,
) -> Result<(HeaderMap, Json<Value>), AppError> {
    let context = create_request_context();
    let group = provider.get_resource("Group", &group_id, &context).await?;
    
    let mut headers = HeaderMap::new();
    if let Some(meta) = group.get_meta() {
        if let Some(version) = &meta.version {
            headers.insert("ETag", format!("\"{}\"", version).parse()?);
        }
    }
    
    Ok((headers, Json(group.data)))
}

// List Groups
async fn list_groups(
    State(provider): State<AppState>,
    Query(params): Query<HashMap<String, String>>,
) -> Result<Json<Value>, AppError> {
    let context = create_request_context();
    let groups = provider.list_resources("Group", None, &context).await?;
    
    // Apply pagination
    let start_index = params.get("startIndex")
        .and_then(|s| s.parse::<usize>().ok())
        .unwrap_or(1);
    let count = params.get("count")
        .and_then(|s| s.parse::<usize>().ok())
        .unwrap_or(20);
    
    let start = (start_index - 1).min(groups.len());
    let end = (start + count).min(groups.len());
    let page_groups = &groups[start..end];
    
    let response = json!({
        "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
        "totalResults": groups.len(),
        "startIndex": start_index,
        "itemsPerPage": page_groups.len(),
        "Resources": page_groups.iter().map(|g| &g.data).collect::<Vec<_>>()
    });
    
    Ok(Json(response))
}

// Update Group
async fn update_group(
    State(provider): State<AppState>,
    Path(group_id): Path<String>,
    headers: HeaderMap,
    Json(group_data): Json<Value>,
) -> Result<(HeaderMap, Json<Value>), AppError> {
    let context = create_request_context();
    
    // Handle ETag if present
    if let Some(if_match) = headers.get("if-match").and_then(|v| v.to_str().ok()) {
        let expected_version = if_match.trim_matches('"');
        let current_group = provider.get_resource("Group", &group_id, &context).await?;
        if let Some(meta) = current_group.get_meta() {
            if let Some(current_version) = &meta.version {
                if current_version != expected_version {
                    return Err(AppError::VersionMismatch);
                }
            }
        }
    }
    
    let group = provider.update_resource("Group", &group_id, group_data, &context).await?;
    
    let mut response_headers = HeaderMap::new();
    if let Some(meta) = group.get_meta() {
        if let Some(version) = &meta.version {
            response_headers.insert("ETag", format!("\"{}\"", version).parse()?);
        }
    }
    
    Ok((response_headers, Json(group.data)))
}

// Delete Group
async fn delete_group(
    State(provider): State<AppState>,
    Path(group_id): Path<String>,
) -> Result<StatusCode, AppError> {
    let context = create_request_context();
    provider.delete_resource("Group", &group_id, &context).await?;
    Ok(StatusCode::NO_CONTENT)
}
}

Warp Integration

Warp is a composable web framework focusing on filters and type safety.

Dependencies

[dependencies]
scim-server = "=0.3.2"
warp = "0.3"
tokio = { version = "1.0", features = ["full"] }
serde_json = "1.0"
uuid = { version = "1.0", features = ["v4"] }

Basic Server Setup

use warp::{Filter, Reply, Rejection};
use scim_server::{
    providers::StandardResourceProvider,
    storage::InMemoryStorage,
    RequestContext,
};
use serde_json::{Value, json};
use std::convert::Infallible;
use std::sync::Arc;
use uuid::Uuid;

type SharedProvider = Arc<StandardResourceProvider<InMemoryStorage>>;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Initialize SCIM Server with StandardResourceProvider
    let storage = InMemoryStorage::new();
    let provider = Arc::new(StandardResourceProvider::new(storage));

    // CORS configuration
    let cors = warp::cors()
        .allow_any_origin()
        .allow_headers(vec!["content-type", "authorization", "if-match"])
        .allow_methods(vec!["GET", "POST", "PUT", "DELETE"]);

    // Base path filter
    let scim_v2 = warp::path("scim").and(warp::path("v2"));
    
    // Provider state filter
    let with_provider = warp::any().map(move || provider.clone());

    // User routes
    let users = scim_v2
        .and(warp::path("Users"))
        .and(with_provider.clone())
        .and(
            // POST /scim/v2/Users
            warp::post()
                .and(warp::body::json())
                .and_then(create_user_handler)
            .or(
                // GET /scim/v2/Users
                warp::get()
                    .and(warp::query::query())
                    .and_then(list_users_handler)
            )
        );

    let user_by_id = scim_v2
        .and(warp::path("Users"))
        .and(warp::path::param::<String>())
        .and(with_provider.clone())
        .and(
            // GET /scim/v2/Users/{id}
            warp::get()
                .and_then(get_user_handler)
            .or(
                // PUT /scim/v2/Users/{id}
                warp::put()
                    .and(warp::header::optional::<String>("if-match"))
                    .and(warp::body::json())
                    .and_then(update_user_handler)
            )
            .or(
                // DELETE /scim/v2/Users/{id}
                warp::delete()
                    .and_then(delete_user_handler)
            )
        );

    let routes = users
        .or(user_by_id)
        .with(cors)
        .recover(handle_rejection);
    // Start server
    println!("SCIM Server running on http://127.0.0.1:3030");
    warp::serve(routes)
        .run(([127, 0, 0, 1], 3030))
        .await;

    Ok(())
}

// Helper to create RequestContext
fn create_request_context() -> RequestContext {
    RequestContext::new(Uuid::new_v4().to_string())
}

// Warp handlers
async fn create_user_handler(
    provider: SharedProvider,
    user_data: Value,
) -> Result<impl Reply, Rejection> {
    let context = create_request_context();
    
    match provider.create_resource("User", user_data, &context).await {
        Ok(user) => {
            let mut response = warp::reply::with_status(
                warp::reply::json(&user.data), 
                warp::http::StatusCode::CREATED
            );
            
            if let Some(meta) = user.get_meta() {
                if let Some(version) = &meta.version {
                    response = warp::reply::with_header(
                        response,
                        "ETag",
                        format!("\"{}\"", version)
                    );
                }
            }
            
            Ok(response)
        },
        Err(e) => Err(warp::reject::custom(WarpError::from(e))),
    }
}

async fn list_users_handler(
    provider: SharedProvider,
    params: std::collections::HashMap<String, String>,
) -> Result<impl Reply, Rejection> {
    let context = create_request_context();
    
    match provider.list_resources("User", None, &context).await {
        Ok(users) => {
            let start_index = params.get("startIndex")
                .and_then(|s| s.parse::<usize>().ok())
                .unwrap_or(1);
            let count = params.get("count")
                .and_then(|s| s.parse::<usize>().ok())
                .unwrap_or(20);
            
            let start = (start_index - 1).min(users.len());
            let end = (start + count).min(users.len());
            let page_users = &users[start..end];
            
            let response = json!({
                "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
                "totalResults": users.len(),
                "startIndex": start_index,
                "itemsPerPage": page_users.len(),
                "Resources": page_users.iter().map(|u| &u.data).collect::<Vec<_>>()
            });
            
            Ok(warp::reply::json(&response))
        },
        Err(e) => Err(warp::reject::custom(WarpError::from(e))),
    }
}

// Error handling for Warp
#[derive(Debug)]
struct WarpError {
    message: String,
    status: warp::http::StatusCode,
}

impl warp::reject::Reject for WarpError {}

impl<E> From<E> for WarpError
where
    E: std::error::Error + Send + Sync + 'static,
{
    fn from(err: E) -> Self {
        let error_str = err.to_string();
        let status = if error_str.contains("not found") {
            warp::http::StatusCode::NOT_FOUND
        } else if error_str.contains("validation") {
            warp::http::StatusCode::BAD_REQUEST
        } else {
            warp::http::StatusCode::INTERNAL_SERVER_ERROR
        };
        
        Self { message: error_str, status }
    }
}

async fn handle_rejection(err: Rejection) -> Result<impl Reply, std::convert::Infallible> {
    if let Some(warp_error) = err.find::<WarpError>() {
        let body = json!({
            "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
            "status": warp_error.status.as_u16().to_string(),
            "detail": warp_error.message
        });
        
        Ok(warp::reply::with_status(
            warp::reply::json(&body),
            warp_error.status
        ))
    } else {
        let body = json!({
            "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
            "status": "500",
            "detail": "Internal server error"
        });
        
        Ok(warp::reply::with_status(
            warp::reply::json(&body),
            warp::http::StatusCode::INTERNAL_SERVER_ERROR
        ))
    }
}

Actix Web Integration

Actix Web is a powerful, pragmatic web framework for Rust.

Dependencies

[dependencies]
scim-server = "=0.3.2"
actix-web = "4"
tokio = { version = "1.0", features = ["full"] }
serde_json = "1.0"

Basic Server Setup

use actix_web::{
    web, App, HttpServer, HttpRequest, HttpResponse, Result,
    middleware::Logger,
};
use scim_server::{
    providers::StandardResourceProvider,
    storage::InMemoryStorage,
    RequestContext,
};
use serde_json::{Value, json};
use std::sync::Arc;
use uuid::Uuid;

type AppData = web::Data<StandardResourceProvider<InMemoryStorage>>;

// Helper to create RequestContext
fn create_request_context() -> RequestContext {
    RequestContext::new(Uuid::new_v4().to_string())
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    env_logger::init();

    // Initialize SCIM Server with StandardResourceProvider
    let storage = InMemoryStorage::new();
    let provider = StandardResourceProvider::new(storage);
    let app_data = web::Data::new(provider);

    HttpServer::new(move || {
        App::new()
            .app_data(app_data.clone())
            .wrap(Logger::default())
            .service(
                web::scope("/scim/v2")
                    .service(
                        web::resource("/Users")
                            .route(web::post().to(create_user))
                            .route(web::get().to(list_users))
                    )
                    .service(
                        web::resource("/Users/{id}")
                            .route(web::get().to(get_user))
                            .route(web::put().to(update_user))
                            .route(web::delete().to(delete_user))
                    )
                    .service(
                        web::resource("/Groups")
                            .route(web::post().to(create_group))
                            .route(web::get().to(list_groups))
                    )
            )
    })
    .bind("127.0.0.1:8080")?
    .run()
    .await
}

Handler Functions

#![allow(unused)]
fn main() {
use actix_web::{web::Path, web::Json, web::Query, HttpRequest};
use std::collections::HashMap;

async fn create_user(
    provider: AppData,
    user_data: Json<Value>,
) -> Result<HttpResponse> {
    let context = create_request_context();
    
    match provider.create_resource("User", user_data.into_inner(), &context).await {
        Ok(user) => {
            let mut response = HttpResponse::Created().json(&user.data);
            
            if let Some(meta) = user.get_meta() {
                if let Some(version) = &meta.version {
                    response.headers_mut().insert(
                        actix_web::http::header::ETAG,
                        actix_web::http::header::HeaderValue::from_str(&format!("\"{}\"", version)).unwrap()
                    );
                }
            }
            
            Ok(response)
        },
        Err(e) => Ok(HttpResponse::BadRequest().json(json!({
            "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
            "detail": e.to_string(),
            "status": "400"
        }))),
    }
}

async fn get_user(
    provider: AppData,
    path: Path<String>,
) -> Result<HttpResponse> {
    let user_id = path.into_inner();
    let context = create_request_context();
    
    match provider.get_resource("User", &user_id, &context).await {
        Ok(user) => {
            let mut response = HttpResponse::Ok().json(&user.data);
            
            if let Some(meta) = user.get_meta() {
                if let Some(version) = &meta.version {
                    response.headers_mut().insert(
                        actix_web::http::header::ETAG,
                        actix_web::http::header::HeaderValue::from_str(&format!("\"{}\"", version)).unwrap()
                    );
                }
            }
            
            Ok(response)
        },
        Err(e) => Ok(HttpResponse::NotFound().json(json!({
            "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
            "detail": e.to_string(),
            "status": "404"
        }))),
    }
}

async fn list_users(
    provider: AppData,
    query: Query<HashMap<String, String>>,
) -> Result<HttpResponse> {
    let context = create_request_context();
    
    match provider.list_resources("User", None, &context).await {
        Ok(users) => {
            let start_index = query.get("startIndex")
                .and_then(|s| s.parse::<usize>().ok())
                .unwrap_or(1);
            let count = query.get("count")
                .and_then(|s| s.parse::<usize>().ok())
                .unwrap_or(20);
            
            let start = (start_index - 1).min(users.len());
            let end = (start + count).min(users.len());
            let page_users = &users[start..end];
            
            let response = json!({
                "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
                "totalResults": users.len(),
                "startIndex": start_index,
                "itemsPerPage": page_users.len(),
                "Resources": page_users.iter().map(|u| &u.data).collect::<Vec<_>>()
            });
            
            Ok(HttpResponse::Ok().json(response))
        },
        Err(e) => Ok(HttpResponse::InternalServerError().json(json!({
            "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
            "detail": e.to_string(),
            "status": "500"
        }))),
    }
}

async fn update_user(
    provider: AppData,
    path: Path<String>,
    user_data: Json<Value>,
    req: HttpRequest,
) -> Result<HttpResponse> {
    let user_id = path.into_inner();
    let context = create_request_context();
    
    // Handle ETag if present
    if let Some(if_match) = req.headers().get("if-match") {
        if let Ok(expected_version) = if_match.to_str() {
            let expected_version = expected_version.trim_matches('"');
            
            match provider.get_resource("User", &user_id, &context).await {
                Ok(current_user) => {
                    if let Some(meta) = current_user.get_meta() {
                        if let Some(current_version) = &meta.version {
                            if current_version != expected_version {
                                return Ok(HttpResponse::PreconditionFailed().json(json!({
                                    "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
                                    "detail": "Version mismatch",
                                    "status": "412"
                                })));
                            }
                        }
                    }
                },
                Err(_) => return Ok(HttpResponse::NotFound().json(json!({
                    "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
                    "detail": "User not found",
                    "status": "404"
                }))),
            }
        }
    }
    
    match provider.update_resource("User", &user_id, user_data.into_inner(), &context).await {
        Ok(user) => {
            let mut response = HttpResponse::Ok().json(&user.data);
            
            if let Some(meta) = user.get_meta() {
                if let Some(version) = &meta.version {
                    response.headers_mut().insert(
                        actix_web::http::header::ETAG,
                        actix_web::http::header::HeaderValue::from_str(&format!("\"{}\"", version)).unwrap()
                    );
                }
            }
            
            Ok(response)
        },
        Err(e) => Ok(HttpResponse::BadRequest().json(json!({
            "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
            "detail": e.to_string(),
            "status": "400"
        }))),
    }
}

async fn delete_user(
    provider: AppData,
    path: Path<String>,
) -> Result<HttpResponse> {
    let user_id = path.into_inner();
    let context = create_request_context();
    
    match provider.delete_resource("User", &user_id, &context).await {
        Ok(_) => Ok(HttpResponse::NoContent().finish()),
        Err(e) => Ok(HttpResponse::NotFound().json(json!({
            "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
            "detail": e.to_string(),
            "status": "404"
        }))),
    }
}

// Group handlers follow the same pattern
async fn create_group(
    provider: AppData,
    group_data: Json<Value>,
) -> Result<HttpResponse> {
    let context = create_request_context();
    
    match provider.create_resource("Group", group_data.into_inner(), &context).await {
        Ok(group) => Ok(HttpResponse::Created().json(&group.data)),
        Err(e) => Ok(HttpResponse::BadRequest().json(json!({
            "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
            "detail": e.to_string(),
            "status": "400"
        }))),
    }
}

async fn list_groups(
    provider: AppData,
    query: Query<HashMap<String, String>>,
) -> Result<HttpResponse> {
    let context = create_request_context();
    
    match provider.list_resources("Group", None, &context).await {
        Ok(groups) => {
            let response = json!({
                "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
                "totalResults": groups.len(),
                "startIndex": 1,
                "itemsPerPage": groups.len(),
                "Resources": groups.iter().map(|g| &g.data).collect::<Vec<_>>()
            });
            
            Ok(HttpResponse::Ok().json(response))
        },
        Err(e) => Ok(HttpResponse::InternalServerError().json(json!({
            "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
            "detail": e.to_string(),
            "status": "500"
        }))),
    }
}
}

Framework-Specific Considerations

Axum

• Strengths: Modern async design, excellent type safety, minimal boilerplate
• Best for: New projects, type-safe APIs, microservices
• SCIM Integration: Clean state management with State<T>, built-in JSON handling

Warp

• Strengths: Functional approach, composable filters, zero-cost abstractions
• Best for: High-performance APIs, functional programming enthusiasts
• SCIM Integration: Filter composition allows flexible middleware

Actix Web

• Strengths: Mature ecosystem, high performance, extensive middleware
• Best for: Production applications, teams familiar with traditional web frameworks
• SCIM Integration: Straightforward handler patterns, robust error handling

Common Patterns Across Frameworks

Request Context Creation

All integrations use the same pattern for creating request contexts:

#![allow(unused)]
fn main() {
fn create_request_context() -> RequestContext {
    RequestContext::new(Uuid::new_v4().to_string())
}
}

ETag Handling

Consistent ETag support across frameworks:

#![allow(unused)]
fn main() {
// Extract If-Match header
let if_match = headers.get("if-match")
    .and_then(|v| v.to_str().ok())
    .map(|s| s.trim_matches('"'));

// Set ETag in response
if let Some(version) = &meta.version {
    headers.insert("ETag", format!("\"{}\"", version));
}
}

Error Response Format

Standard SCIM error responses:

#![allow(unused)]
fn main() {
let error_response = json!({
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
    "status": status_code.to_string(),
    "detail": error_message
});
}

Multi-Tenant URL Patterns

All frameworks support multi-tenant deployments with URL patterns like:

• Single tenant: /scim/v2/Users
• Multi-tenant: /tenants/{tenant_id}/scim/v2/Users

The key is creating request contexts that include tenant information:

#![allow(unused)]
fn main() {
let context = RequestContext::new(format!("tenant-{}-{}", tenant_id, Uuid::new_v4()));
}

Best Practices

1. Consistent Error Handling

• Always return SCIM-compliant error responses
• Include proper HTTP status codes
• Provide meaningful error messages

2. ETag Support

• Implement conditional requests for concurrency control
• Return ETags in response headers
• Handle If-Match headers for updates

3. Request Context Management

• Create unique request contexts for operation tracking
• Include tenant information for multi-tenant scenarios
• Use UUIDs for request correlation

4. Performance Considerations

• Use async/await throughout the request pipeline
• Leverage framework-specific optimizations
• Consider connection pooling for database storage

5. Security

• Validate all input data
• Implement proper authentication middleware
• Use HTTPS in production
• Sanitize error messages to avoid information leakage

Testing Your Integration

Unit Tests

Test individual handlers with mock data:

#![allow(unused)]
fn main() {
#[cfg(test)]
mod tests {
    use super::*;
    use scim_server::storage::InMemoryStorage;

    #[tokio::test]
    async fn test_create_user() {
        let storage = InMemoryStorage::new();
        let provider = StandardResourceProvider::new(storage);
        let context = RequestContext::new("test".to_string());
        
        let user_data = json!({
            "userName": "test@example.com",
            "active": true
        });
        
        let result = provider.create_resource("User", user_data, &context).await;
        assert!(result.is_ok());
    }
}
}

Integration Tests

Test complete HTTP request/response cycles:

#![allow(unused)]
fn main() {
#[actix_web::test]
async fn test_user_creation_endpoint() {
    let app = test::init_service(
        App::new()
            .app_data(create_test_app_data())
            .service(web::resource("/Users").route(web::post().to(create_user)))
    ).await;

    let req = test::TestRequest::post()
        .uri("/Users")
        .set_json(&json!({"userName": "test@example.com"}))
        .to_request();

    let resp = test::call_service(&app, req).await;
    assert_eq!(resp.status(), 201);
}
}

Summary

This tutorial demonstrated how to integrate SCIM Server with three popular Rust web frameworks:

✅ Framework Integration Patterns:

• Axum: Modern, type-safe with excellent async support
• Warp: Functional, composable filters for flexibility
• Actix Web: Mature, high-performance with extensive middleware

✅ Key Implementation Details:

• StandardResourceProvider usage across all frameworks
• RequestContext creation and management
• ETag support for concurrency control
• SCIM-compliant error handling
• Multi-tenant URL patterns

✅ Production Considerations:

• Security best practices
• Performance optimization
• Testing strategies
• Error handling standards

Choose the framework that best fits your team's expertise and project requirements. All three provide excellent foundations for building production SCIM servers with the SCIM Server library.

Next Steps:

• Authentication Setup - Secure your SCIM endpoints
• Multi-Tenant Deployment - Scale to multiple organizations
• Custom Resources - Extend beyond Users and Groups let tenant_id = TenantId::default();

AI Integration with MCP

This tutorial shows you how to integrate your SCIM Server with AI assistants using the Model Context Protocol (MCP). You'll learn to expose SCIM operations as MCP tools, enabling AI assistants to manage identity resources through natural language.

What is MCP?

The Model Context Protocol (MCP) is a standardized way for AI applications to connect to external data sources and tools. It enables AI assistants like Claude, ChatGPT, and custom bots to:

• Execute operations through defined tools
• Access real-time data from external systems
• Maintain context across conversations
• Provide structured responses based on live data

For SCIM servers, MCP integration means AI assistants can:

• Create, read, update, and delete users and groups
• Query identity data with natural language
• Automate complex provisioning workflows
• Generate reports and insights from identity data

Quick Start Example

Here's a simple MCP server that exposes SCIM operations:

use scim_server::{ScimServer, InMemoryProvider, ScimUser, ScimGroup};
use mcp_server::{McpServer, Tool, ToolResult, McpError};
use serde_json::{json, Value};
use tokio::net::TcpListener;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Create SCIM server
    let provider = InMemoryProvider::new();
    let scim_server = ScimServer::builder()
        .provider(provider)
        .build();
    
    // Create MCP server with SCIM tools
    let mcp_server = McpServer::builder()
        .name("SCIM Identity Manager")
        .version("1.0.0")
        .tool(create_user_tool(scim_server.clone()))
        .tool(get_user_tool(scim_server.clone()))
        .tool(list_users_tool(scim_server.clone()))
        .tool(create_group_tool(scim_server.clone()))
        .build();
    
    // Start MCP server
    let listener = TcpListener::bind("127.0.0.1:3001").await?;
    println!("MCP Server running on localhost:3001");
    mcp_server.serve(listener).await?;
    
    Ok(())
}

With this setup, an AI assistant can perform operations like:

• "Create a new user named Alice Johnson with email alice@company.com"
• "Show me all users in the Engineering department"
• "Add Alice to the Administrators group"

Step 1: Define MCP Tools

MCP tools are functions that AI assistants can call. Let's define tools for common SCIM operations:

Create User Tool

#![allow(unused)]
fn main() {
use mcp_server::{Tool, ToolInput, ToolResult};
use serde_json::{json, Value};

fn create_user_tool(scim_server: ScimServer) -> Tool {
    Tool::builder()
        .name("create_user")
        .description("Create a new user in the SCIM system")
        .input_schema(json!({
            "type": "object",
            "properties": {
                "tenant_id": {
                    "type": "string",
                    "description": "Tenant identifier"
                },
                "username": {
                    "type": "string",
                    "description": "User's username/email"
                },
                "given_name": {
                    "type": "string",
                    "description": "User's first name"
                },
                "family_name": {
                    "type": "string",
                    "description": "User's last name"
                },
                "email": {
                    "type": "string",
                    "description": "User's email address"
                },
                "active": {
                    "type": "boolean",
                    "description": "Whether the user is active",
                    "default": true
                },
                "department": {
                    "type": "string",
                    "description": "User's department"
                }
            },
            "required": ["tenant_id", "username", "given_name", "family_name", "email"]
        }))
        .handler(move |input: ToolInput| {
            let scim_server = scim_server.clone();
            async move {
                let tenant_id = input.get_string("tenant_id")?;
                let username = input.get_string("username")?;
                let given_name = input.get_string("given_name")?;
                let family_name = input.get_string("family_name")?;
                let email = input.get_string("email")?;
                let active = input.get_bool("active").unwrap_or(true);
                let department = input.get_optional_string("department");
                
                // Build the user
                let mut user_builder = ScimUser::builder()
                    .username(&username)
                    .given_name(&given_name)
                    .family_name(&family_name)
                    .email(&email)
                    .active(active);
                
                if let Some(dept) = department {
                    user_builder = user_builder.department(&dept);
                }
                
                let user = user_builder.build()?;
                
                // Create the user
                let created_user = scim_server.create_user(&tenant_id, user).await?;
                
                ToolResult::success(json!({
                    "message": format!("Successfully created user {} ({})", created_user.username(), created_user.id()),
                    "user": {
                        "id": created_user.id(),
                        "username": created_user.username(),
                        "name": {
                            "givenName": created_user.given_name(),
                            "familyName": created_user.family_name()
                        },
                        "email": created_user.primary_email(),
                        "active": created_user.active(),
                        "department": created_user.department()
                    }
                }))
            }
        })
        .build()
}
}

Get User Tool

#![allow(unused)]
fn main() {
fn get_user_tool(scim_server: ScimServer) -> Tool {
    Tool::builder()
        .name("get_user")
        .description("Retrieve a user by ID or username")
        .input_schema(json!({
            "type": "object",
            "properties": {
                "tenant_id": {
                    "type": "string",
                    "description": "Tenant identifier"
                },
                "identifier": {
                    "type": "string",
                    "description": "User ID or username"
                }
            },
            "required": ["tenant_id", "identifier"]
        }))
        .handler(move |input: ToolInput| {
            let scim_server = scim_server.clone();
            async move {
                let tenant_id = input.get_string("tenant_id")?;
                let identifier = input.get_string("identifier")?;
                
                // Try to get user by ID first, then by username
                let user = if identifier.contains('@') {
                    scim_server.find_user_by_username(&tenant_id, &identifier).await?
                } else {
                    scim_server.get_user(&tenant_id, &identifier).await?
                };
                
                match user {
                    Some(user) => ToolResult::success(json!({
                        "user": {
                            "id": user.id(),
                            "username": user.username(),
                            "name": {
                                "formatted": user.formatted_name(),
                                "givenName": user.given_name(),
                                "familyName": user.family_name()
                            },
                            "emails": user.emails(),
                            "active": user.active(),
                            "department": user.department(),
                            "title": user.title(),
                            "manager": user.manager().map(|m| m.display_name()),
                            "meta": {
                                "created": user.meta().created,
                                "lastModified": user.meta().last_modified,
                                "version": user.meta().version
                            }
                        }
                    })),
                    None => ToolResult::error(format!("User '{}' not found", identifier))
                }
            }
        })
        .build()
}
}

List Users Tool

#![allow(unused)]
fn main() {
fn list_users_tool(scim_server: ScimServer) -> Tool {
    Tool::builder()
        .name("list_users")
        .description("List users with optional filtering")
        .input_schema(json!({
            "type": "object",
            "properties": {
                "tenant_id": {
                    "type": "string",
                    "description": "Tenant identifier"
                },
                "filter": {
                    "type": "string",
                    "description": "SCIM filter expression (e.g., 'department eq \"Engineering\"')"
                },
                "count": {
                    "type": "integer",
                    "description": "Maximum number of results",
                    "default": 50,
                    "maximum": 200
                },
                "sort_by": {
                    "type": "string",
                    "description": "Attribute to sort by",
                    "default": "meta.lastModified"
                }
            },
            "required": ["tenant_id"]
        }))
        .handler(move |input: ToolInput| {
            let scim_server = scim_server.clone();
            async move {
                let tenant_id = input.get_string("tenant_id")?;
                let filter = input.get_optional_string("filter");
                let count = input.get_optional_int("count").unwrap_or(50).min(200);
                let sort_by = input.get_optional_string("sort_by").unwrap_or_else(|| "meta.lastModified".to_string());
                
                let mut options = ListOptions::builder()
                    .count(count as usize)
                    .sort_by(&sort_by);
                
                // Note: Filter expressions are not yet implemented
                // For now, we'll load all users and filter in memory if needed
                
                let response = scim_server.list_users(&tenant_id, &options.build()).await?;
                
                let users: Vec<Value> = response.resources.into_iter().map(|user| {
                    json!({
                        "id": user.id(),
                        "username": user.username(),
                        "name": {
                            "formatted": user.formatted_name(),
                            "givenName": user.given_name(),
                            "familyName": user.family_name()
                        },
                        "email": user.primary_email(),
                        "active": user.active(),
                        "department": user.department(),
                        "title": user.title(),
                        "lastModified": user.meta().last_modified
                    })
                }).collect();
                
                ToolResult::success(json!({
                    "totalResults": response.total_results,
                    "startIndex": response.start_index,
                    "itemsPerPage": response.items_per_page,
                    "users": users
                }))
            }
        })
        .build()
}
}

Step 2: Group Management Tools

Add tools for group operations:

Create Group Tool

#![allow(unused)]
fn main() {
fn create_group_tool(scim_server: ScimServer) -> Tool {
    Tool::builder()
        .name("create_group")
        .description("Create a new group")
        .input_schema(json!({
            "type": "object",
            "properties": {
                "tenant_id": {
                    "type": "string",
                    "description": "Tenant identifier"
                },
                "display_name": {
                    "type": "string",
                    "description": "Group display name"
                },
                "description": {
                    "type": "string",
                    "description": "Group description"
                },
                "members": {
                    "type": "array",
                    "items": {
                        "type": "string"
                    },
                    "description": "Array of user IDs or usernames to add as members"
                }
            },
            "required": ["tenant_id", "display_name"]
        }))
        .handler(move |input: ToolInput| {
            let scim_server = scim_server.clone();
            async move {
                let tenant_id = input.get_string("tenant_id")?;
                let display_name = input.get_string("display_name")?;
                let description = input.get_optional_string("description");
                let member_identifiers = input.get_optional_array("members").unwrap_or_default();
                
                // Resolve member identifiers to user IDs
                let mut members = Vec::new();
                for identifier_value in member_identifiers {
                    if let Some(identifier) = identifier_value.as_str() {
                        let user = if identifier.contains('@') {
                            scim_server.find_user_by_username(&tenant_id, identifier).await?
                        } else {
                            scim_server.get_user(&tenant_id, identifier).await?
                        };
                        
                        if let Some(user) = user {
                            members.push(GroupMember {
                                value: user.id().to_string(),
                                ref_: Some(format!("../Users/{}", user.id())),
                                type_: Some("User".to_string()),
                                display: user.formatted_name(),
                            });
                        } else {
                            return ToolResult::error(format!("User '{}' not found", identifier));
                        }
                    }
                }
                
                // Build the group
                let mut group_builder = ScimGroup::builder()
                    .display_name(&display_name)
                    .members(members);
                
                if let Some(desc) = description {
                    group_builder = group_builder.description(&desc);
                }
                
                let group = group_builder.build()?;
                
                // Create the group
                let created_group = scim_server.create_group(&tenant_id, group).await?;
                
                ToolResult::success(json!({
                    "message": format!("Successfully created group '{}' with {} members", 
                                     created_group.display_name(), 
                                     created_group.members().len()),
                    "group": {
                        "id": created_group.id(),
                        "displayName": created_group.display_name(),
                        "description": created_group.description(),
                        "memberCount": created_group.members().len(),
                        "members": created_group.members().iter().map(|m| json!({
                            "id": m.value,
                            "display": m.display
                        })).collect::<Vec<_>>()
                    }
                }))
            }
        })
        .build()
}
}

Add User to Group Tool

#![allow(unused)]
fn main() {
fn add_user_to_group_tool(scim_server: ScimServer) -> Tool {
    Tool::builder()
        .name("add_user_to_group")
        .description("Add a user to a group")
        .input_schema(json!({
            "type": "object",
            "properties": {
                "tenant_id": {
                    "type": "string",
                    "description": "Tenant identifier"
                },
                "group_identifier": {
                    "type": "string", 
                    "description": "Group ID or display name"
                },
                "user_identifier": {
                    "type": "string",
                    "description": "User ID or username"
                }
            },
            "required": ["tenant_id", "group_identifier", "user_identifier"]
        }))
        .handler(move |input: ToolInput| {
            let scim_server = scim_server.clone();
            async move {
                let tenant_id = input.get_string("tenant_id")?;
                let group_identifier = input.get_string("group_identifier")?;
                let user_identifier = input.get_string("user_identifier")?;
                
                // Find the group
                let group = scim_server.find_group(&tenant_id, &group_identifier).await?
                    .ok_or_else(|| format!("Group '{}' not found", group_identifier))?;
                
                // Find the user
                let user = if user_identifier.contains('@') {
                    scim_server.find_user_by_username(&tenant_id, &user_identifier).await?
                } else {
                    scim_server.get_user(&tenant_id, &user_identifier).await?
                }.ok_or_else(|| format!("User '{}' not found", user_identifier))?;
                
                // Add user to group using PATCH operation
                let patch_op = PatchOperation {
                    op: PatchOp::Add,
                    path: Some("members".to_string()),
                    value: Some(json!([{
                        "value": user.id(),
                        "$ref": format!("../Users/{}", user.id()),
                        "type": "User",
                        "display": user.formatted_name()
                    }])),
                };
                
                let updated_group = scim_server.patch_group(&tenant_id, group.id(), vec![patch_op]).await?;
                
                ToolResult::success(json!({
                    "message": format!("Successfully added {} to group '{}'", 
                                     user.formatted_name(), 
                                     updated_group.display_name()),
                    "group": {
                        "id": updated_group.id(),
                        "displayName": updated_group.display_name(),
                        "memberCount": updated_group.members().len()
                    },
                    "user": {
                        "id": user.id(),
                        "username": user.username(),
                        "name": user.formatted_name()
                    }
                }))
            }
        })
        .build()
}
}

Step 3: Advanced Query Tools

Create intelligent tools that can understand natural language queries:

Search Tool

#![allow(unused)]
fn main() {
fn search_tool(scim_server: ScimServer) -> Tool {
    Tool::builder()
        .name("search")
        .description("Search for users or groups using natural language")
        .input_schema(json!({
            "type": "object",
            "properties": {
                "tenant_id": {
                    "type": "string",
                    "description": "Tenant identifier"
                },
                "query": {
                    "type": "string",
                    "description": "Natural language search query"
                },
                "resource_type": {
                    "type": "string",
                    "enum": ["users", "groups", "both"],
                    "default": "both",
                    "description": "Type of resources to search"
                }
            },
            "required": ["tenant_id", "query"]
        }))
        .handler(move |input: ToolInput| {
            let scim_server = scim_server.clone();
            async move {
                let tenant_id = input.get_string("tenant_id")?;
                let query = input.get_string("query")?;
                let resource_type = input.get_optional_string("resource_type").unwrap_or_else(|| "both".to_string());
                
                let mut results = json!({
                    "query": query,
                    "results": {}
                });
                
                // Load users and apply in-memory filtering based on query
                let options = ListOptions::builder()
                    .count(200)  // Load more to filter in memory
                    .build();
                
                // Search users
                if resource_type == "users" || resource_type == "both" {
                    let user_response = scim_server.list_users(&tenant_id, &options).await?;
                    
                    // Filter users in memory based on query
                    let filtered_users: Vec<_> = user_response.resources.into_iter()
                        .filter(|user| matches_query(user, &query))
                        .collect();
                    
                    let users: Vec<Value> = filtered_users.into_iter().map(|user| {
                        json!({
                            "id": user.id(),
                            "username": user.username(),
                            "name": user.formatted_name(),
                            "email": user.primary_email(),
                            "department": user.department(),
                            "active": user.active()
                        })
                    }).collect();
                    
                    results["results"]["users"] = json!({
                        "count": users.len(),
                        "items": users
                    });
                }
                
                // Search groups
                if resource_type == "groups" || resource_type == "both" {
                    let group_response = scim_server.list_groups(&tenant_id, &options).await?;
                    let groups: Vec<Value> = group_response.resources.into_iter().map(|group| {
                        json!({
                            "id": group.id(),
                            "displayName": group.display_name(),
                            "description": group.description(),
                            "memberCount": group.members().len()
                        })
                    }).collect();
                    
                    results["results"]["groups"] = json!({
                        "count": groups.len(),
                        "items": groups
                    });
                }
                
                ToolResult::success(results)
            }
        })
        .build()
}

// Helper function to match users against natural language queries
fn matches_query(user: &ScimUser, query: &str) -> bool {
    let query_lower = query.to_lowercase();
    
    // Check various user fields for matches
    if let Some(username) = user.username() {
        if username.to_lowercase().contains(&query_lower) {
            return true;
        }
    }
    
    if let Some(email) = user.primary_email() {
        if email.to_lowercase().contains(&query_lower) {
            return true;
        }
    }
    
    if let Some(name) = user.formatted_name() {
        if name.to_lowercase().contains(&query_lower) {
            return true;
        }
    }
    
    if let Some(department) = user.department() {
        if department.to_lowercase().contains(&query_lower) {
            return true;
        }
    }
    
    // Specific keyword matching
    if query_lower.contains("engineer") || query_lower.contains("engineering") {
        return user.department().map_or(false, |d| d.to_lowercase().contains("engineer"));
    }
    
    if query_lower.contains("active") {
        return user.active();
    }
    
    if query_lower.contains("inactive") || query_lower.contains("disabled") {
        return !user.active();
    }
    
    false
}

fn extract_email(query: &str) -> Option<String> {
    // Simple email extraction
    let email_regex = regex::Regex::new(r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}").ok()?;
    email_regex.find(query).map(|m| m.as_str().to_string())
}

fn extract_name(query: &str) -> Option<String> {
    // Extract quoted names or capitalize first word
    if let Some(start) = query.find('"') {
        if let Some(end) = query[start + 1..].find('"') {
            return Some(query[start + 1..start + 1 + end].to_string());
        }
    }
    
    // Take first word as potential name
    query.split_whitespace().next().map(|s| s.to_string())
}
}

Step 4: Analytics and Reporting Tools

Add tools for generating insights:

User Analytics Tool

#![allow(unused)]
fn main() {
fn user_analytics_tool(scim_server: ScimServer) -> Tool {
    Tool::builder()
        .name("user_analytics")
        .description("Generate analytics and insights about users")
        .input_schema(json!({
            "type": "object",
            "properties": {
                "tenant_id": {
                    "type": "string",
                    "description": "Tenant identifier"
                },
                "report_type": {
                    "type": "string",
                    "enum": ["summary", "department_breakdown", "activity_report", "growth_trends"],
                    "default": "summary",
                    "description": "Type of analytics report to generate"
                },
                "date_range": {
                    "type": "string",
                    "description": "Date range for the report (e.g., 'last_30_days', 'last_quarter')",
                    "default": "last_30_days"
                }
            },
            "required": ["tenant_id"]
        }))
        .handler(move |input: ToolInput| {
            let scim_server = scim_server.clone();
            async move {
                let tenant_id = input.get_string("tenant_id")?;
                let report_type = input.get_optional_string("report_type").unwrap_or_else(|| "summary".to_string());
                let date_range = input.get_optional_string("date_range").unwrap_or_else(|| "last_30_days".to_string());
                
                match report_type.as_str() {
                    "summary" => generate_user_summary(&scim_server, &tenant_id).await,
                    "department_breakdown" => generate_department_breakdown(&scim_server, &tenant_id).await,
                    "activity_report" => generate_activity_report(&scim_server, &tenant_id, &date_range).await,
                    "growth_trends" => generate_growth_trends(&scim_server, &tenant_id, &date_range).await,
                    _ => ToolResult::error("Unknown report type".to_string())
                }
            }
        })
        .build()
}

async fn generate_user_summary(scim_server: &ScimServer, tenant_id: &str) -> ToolResult {
    let all_users = scim_server.list_users(tenant_id, &ListOptions::default()).await?;
    
    let total_users = all_users.total_results;
    let active_users = all_users.resources.iter().filter(|u| u.active()).count();
    let inactive_users = total_users - active_users;
    
    // Department breakdown
    let mut departments = std::collections::HashMap::new();
    for user in &all_users.resources {
        if let Some(dept) = user.department() {
            *departments.entry(dept.to_string()).or_insert(0) += 1;
        } else {
            *departments.entry("Unassigned".to_string()).or_insert(0) += 1;
        }
    }
    
    // Recent activity (last 7 days)
    let week_ago = chrono::Utc::now() - chrono::Duration::days(7);
    let recent_users = all_users.resources.iter()
        .filter(|u| u.meta().created > week_ago)
        .count();
    
    ToolResult::success(json!({
        "report": "User Summary",
        "generated_at": chrono::Utc::now(),
        "total_users": total_users,
        "active_users": active_users,
        "inactive_users": inactive_users,
        "activity_rate": format!("{:.1}%", (active_users as f64 / total_users as f64) * 100.0),
        "new_users_last_7_days": recent_users,
        "department_breakdown": departments,
        "top_departments": {
            let mut dept_vec: Vec<_> = departments.iter().collect();
            dept_vec.sort_by(|a, b| b.1.cmp(a.1));
            dept_vec.into_iter().take(5).map(|(k, v)| json!({"department": k, "count": v})).collect::<Vec<_>>()
        }
    }))
}

async fn generate_department_breakdown(scim_server: &ScimServer, tenant_id: &str) -> ToolResult {
    let all_users = scim_server.list_users(tenant_id, &ListOptions::default()).await?;
    
    let mut department_stats = std::collections::HashMap::new();
    
    for user in &all_users.resources {
        let dept = user.department().unwrap_or("Unassigned");
        let entry = department_stats.entry(dept.to_string()).or_insert_with(|| json!({
            "name": dept,
            "total_users": 0,
            "active_users": 0,
            "managers": 0,
            "recent_additions": 0
        }));
        
        entry["total_users"] = json!(entry["total_users"].as_u64().unwrap() + 1);
        
        if user.active() {
            entry["active_users"] = json!(entry["active_users"].as_u64().unwrap() + 1);
        }
        
        if user.title().map_or(false, |t| t.to_lowercase().contains("manager")) {
            entry["managers"] = json!(entry["managers"].as_u64().unwrap() + 1);
        }
        
        let week_ago = chrono::Utc::now() - chrono::Duration::days(7);
        if user.meta().created > week_ago {
            entry["recent_additions"] = json!(entry["recent_additions"].as_u64().unwrap() + 1);
        }
    }
    
    let departments: Vec<_> = department_stats.into_values().collect();
    
    ToolResult::success(json!({
        "report": "Department Breakdown",
        "generated_at": chrono::Utc::now(),
        "total_departments": departments.len(),
        "departments": departments
    }))
}
}

Step 5: Complete MCP Server Setup

Put it all together in a complete MCP server:

use scim_server::{ScimServer, InMemoryProvider, DatabaseProvider};
use mcp_server::{McpServer, ServerInfo};
use serde_json::json;
use std::sync::Arc;
use tokio::net::TcpListener;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Initialize logging
    tracing_subscriber::init();
    
    // Create SCIM server with your choice of provider
    let provider = if std::env::var("DATABASE_URL").is_ok() {
        let db_url = std::env::var("DATABASE_URL")?;
        Box::new(DatabaseProvider::new(&db_url).await?) as Box<dyn Provider>
    } else {
        Box::new(InMemoryProvider::new()) as Box<dyn Provider>
    };
    
    let scim_server = Arc::new(ScimServer::builder()
        .provider(provider)
        .build());
    
    // Create MCP server with comprehensive tool set
    let mcp_server = McpServer::builder()
        .server_info(ServerInfo {
            name: "SCIM Identity Manager".to_string(),
            version: "1.0.0".to_string(),
            description: Some("AI-powered identity management through SCIM protocol".to_string()),
            author: Some("Your Organization".to_string()),
            license: Some("MIT".to_string()),
        })
        // User management tools
        .tool(create_user_tool(scim_server.clone()))
        .tool(get_user_tool(scim_server.clone()))
        .tool(list_users_tool(scim_server.clone()))
        .tool(update_user_tool(scim_server.clone()))
        .tool(delete_user_tool(scim_server.clone()))
        // Group management tools
        .tool(create_group_tool(scim_server.clone()))
        .tool(get_group_tool(scim_server.

Performance Optimization

This tutorial covers techniques for optimizing SCIM Server performance, including database optimization, caching strategies, connection pooling, and monitoring performance bottlenecks.

Overview

Performance optimization in SCIM Server involves several layers:

• Database Performance: Query optimization, indexing, and connection pooling
• Application Performance: Efficient data structures and algorithms
• Caching: Strategic caching of frequently accessed data
• Network Performance: Connection reuse and payload optimization
• Monitoring: Identifying and resolving bottlenecks

Database Optimization

Query Performance

Efficient data loading patterns:

#![allow(unused)]
fn main() {
use scim_server::{ListOptions};

// Inefficient: Load all users then filter in memory
async fn get_active_users_slow(provider: &impl Provider, tenant_id: &str) -> Result<Vec<ScimUser>, Error> {
    let all_users = provider.list_users(tenant_id, &ListOptions::default()).await?;
    let active_users: Vec<_> = all_users.resources.into_iter()
        .filter(|user| user.active())
        .collect();
    Ok(active_users)
}

// Better: Use pagination to limit memory usage
async fn get_users_paginated(provider: &impl Provider, tenant_id: &str) -> Result<Vec<ScimUser>, Error> {
    let options = ListOptions::builder()
        .count(Some(100))        // Limit to 100 users per request
        .start_index(Some(1))    // Start from first user
        .build();
    
    let response = provider.list_users(tenant_id, &options).await?;
    
    // Filter in memory for now (database filtering not yet implemented)
    let active_users: Vec<_> = response.resources.into_iter()
        .filter(|user| user.active())
        .collect();
    
    Ok(active_users)
}
}

Optimize complex queries:

-- Add indexes for common filter patterns
CREATE INDEX CONCURRENTLY idx_users_active_dept ON users(tenant_id, active, department) 
WHERE active = true;

CREATE INDEX CONCURRENTLY idx_users_email_lookup ON users(tenant_id, (data->>'primaryEmail'));

CREATE INDEX CONCURRENTLY idx_users_last_modified ON users(tenant_id, updated_at) 
WHERE updated_at > NOW() - INTERVAL '30 days';

-- Use partial indexes for common conditions
CREATE INDEX CONCURRENTLY idx_groups_with_members ON groups(tenant_id, display_name) 
WHERE jsonb_array_length(data->'members') > 0;

Connection Pooling

Optimize database connections:

#![allow(unused)]
fn main() {
use sqlx::postgres::PgPoolOptions;
use std::time::Duration;

pub async fn create_optimized_pool(database_url: &str) -> Result<sqlx::PgPool, sqlx::Error> {
    PgPoolOptions::new()
        .max_connections(20)                    // Adjust based on your load
        .min_connections(5)                     // Keep minimum connections warm
        .acquire_timeout(Duration::from_secs(30))
        .idle_timeout(Some(Duration::from_secs(600)))
        .max_lifetime(Some(Duration::from_secs(1800)))
        .test_before_acquire(true)              // Test connections before use
        .after_connect(|conn, _meta| {
            Box::pin(async move {
                // Optimize connection settings
                sqlx::query("SET statement_timeout = '30s'")
                    .execute(conn)
                    .await?;
                sqlx::query("SET lock_timeout = '10s'")
                    .execute(conn)
                    .await?;
                Ok(())
            })
        })
        .connect(database_url)
        .await
}
}

Batch Operations

Use transactions for related operations:

#![allow(unused)]
fn main() {
use sqlx::{Transaction, Postgres};

async fn create_user_with_groups_optimized(
    provider: &DatabaseProvider,
    tenant_id: &str,
    user: ScimUser,
    group_ids: Vec<String>,
) -> Result<ScimUser, ProviderError> {
    let mut tx = provider.begin_transaction().await?;
    
    // Create user
    let created_user = tx.create_user(tenant_id, user).await?;
    
    // Add to groups in batch
    if !group_ids.is_empty() {
        let query = format!(
            "INSERT INTO group_memberships (group_id, user_id) VALUES {}",
            group_ids.iter()
                .map(|_| "($1, $2)")
                .collect::<Vec<_>>()
                .join(", ")
        );
        
        let mut query_builder = sqlx::query(&query);
        for group_id in &group_ids {
            query_builder = query_builder.bind(group_id).bind(created_user.id());
        }
        
        query_builder.execute(&mut *tx).await?;
    }
    
    tx.commit().await?;
    Ok(created_user)
}
}

Caching Strategies

Redis Caching

Implement multi-layer caching:

#![allow(unused)]
fn main() {
use redis::{AsyncCommands, Client};
use serde::{Serialize, Deserialize};
use std::time::Duration;

#[derive(Clone)]
pub struct CachedProvider {
    inner: DatabaseProvider,
    redis: Client,
    cache_ttl: Duration,
}

impl CachedProvider {
    pub fn new(inner: DatabaseProvider, redis_url: &str, cache_ttl: Duration) -> Result<Self, redis::RedisError> {
        let redis = Client::open(redis_url)?;
        Ok(Self { inner, redis, cache_ttl })
    }
    
    async fn get_user_cached(&self, tenant_id: &str, user_id: &str) -> Result<Option<ScimUser>, ProviderError> {
        let cache_key = format!("user:{}:{}", tenant_id, user_id);
        
        // Try L1 cache (Redis)
        if let Ok(mut conn) = self.redis.get_async_connection().await {
            if let Ok(cached_data) = conn.get::<_, String>(&cache_key).await {
                if let Ok(user) = serde_json::from_str::<ScimUser>(&cached_data) {
                    return Ok(Some(user));
                }
            }
        }
        
        // L2 cache miss - fetch from database
        let user = self.inner.get_user(tenant_id, user_id).await?;
        
        // Cache the result
        if let (Some(ref user), Ok(mut conn)) = (&user, self.redis.get_async_connection().await) {
            if let Ok(serialized) = serde_json::to_string(user) {
                let _: Result<(), _> = conn.setex(&cache_key, self.cache_ttl.as_secs(), serialized).await;
            }
        }
        
        Ok(user)
    }
    
    async fn invalidate_user_cache(&self, tenant_id: &str, user_id: &str) -> Result<(), redis::RedisError> {
        let cache_key = format!("user:{}:{}", tenant_id, user_id);
        let mut conn = self.redis.get_async_connection().await?;
        conn.del(&cache_key).await?;
        
        // Also invalidate related caches
        let pattern = format!("users:{}:*", tenant_id);
        self.invalidate_pattern(&pattern).await?;
        
        Ok(())
    }
    
    async fn invalidate_pattern(&self, pattern: &str) -> Result<(), redis::RedisError> {
        let mut conn = self.redis.get_async_connection().await?;
        let keys: Vec<String> = conn.keys(pattern).await?;
        
        if !keys.is_empty() {
            conn.del(&keys).await?;
        }
        
        Ok(())
    }
}

// Implement cache-aware operations
#[async_trait]
impl Provider for CachedProvider {
    async fn get_user(&self, tenant_id: &str, user_id: &str) -> Result<Option<ScimUser>, ProviderError> {
        self.get_user_cached(tenant_id, user_id).await
    }
    
    async fn update_user(&self, tenant_id: &str, user: ScimUser) -> Result<ScimUser, ProviderError> {
        let updated_user = self.inner.update_user(tenant_id, user).await?;
        
        // Invalidate cache
        if let Err(e) = self.invalidate_user_cache(tenant_id, updated_user.id()).await {
            tracing::warn!("Failed to invalidate user cache: {}", e);
        }
        
        Ok(updated_user)
    }
}
}

In-Memory Caching

Application-level caching for frequently accessed data:

#![allow(unused)]
fn main() {
use std::sync::Arc;
use tokio::sync::RwLock;
use std::collections::HashMap;
use std::time::{Duration, Instant};

#[derive(Clone)]
struct CacheEntry<T> {
    value: T,
    expires_at: Instant,
}

#[derive(Clone)]
pub struct MemoryCache<T> {
    data: Arc<RwLock<HashMap<String, CacheEntry<T>>>>,
    ttl: Duration,
}

impl<T: Clone> MemoryCache<T> {
    pub fn new(ttl: Duration) -> Self {
        Self {
            data: Arc::new(RwLock::new(HashMap::new())),
            ttl,
        }
    }
    
    pub async fn get(&self, key: &str) -> Option<T> {
        let data = self.data.read().await;
        
        if let Some(entry) = data.get(key) {
            if entry.expires_at > Instant::now() {
                return Some(entry.value.clone());
            }
        }
        
        None
    }
    
    pub async fn set(&self, key: String, value: T) {
        let mut data = self.data.write().await;
        data.insert(key, CacheEntry {
            value,
            expires_at: Instant::now() + self.ttl,
        });
    }
    
    pub async fn invalidate(&self, key: &str) {
        let mut data = self.data.write().await;
        data.remove(key);
    }
    
    // Background cleanup task
    pub async fn cleanup_expired(&self) {
        let mut data = self.data.write().await;
        let now = Instant::now();
        data.retain(|_, entry| entry.expires_at > now);
    }
}

// Usage in provider
#[derive(Clone)]
pub struct MemoryCachedProvider {
    inner: DatabaseProvider,
    user_cache: MemoryCache<ScimUser>,
    schema_cache: MemoryCache<Schema>,
}

impl MemoryCachedProvider {
    pub fn new(inner: DatabaseProvider) -> Self {
        let provider = Self {
            inner,
            user_cache: MemoryCache::new(Duration::from_secs(300)), // 5 minutes
            schema_cache: MemoryCache::new(Duration::from_secs(3600)), // 1 hour
        };
        
        // Start cleanup task
        let cache = provider.user_cache.clone();
        tokio::spawn(async move {
            let mut interval = tokio::time::interval(Duration::from_secs(60));
            loop {
                interval.tick().await;
                cache.cleanup_expired().await;
            }
        });
        
        provider
    }
}
}

Connection and Resource Management

HTTP Client Optimization

Reuse HTTP connections:

#![allow(unused)]
fn main() {
use reqwest::Client;
use std::time::Duration;

lazy_static! {
    static ref HTTP_CLIENT: Client = Client::builder()
        .timeout(Duration::from_secs(30))
        .connect_timeout(Duration::from_secs(10))
        .pool_max_idle_per_host(10)
        .pool_idle_timeout(Duration::from_secs(90))
        .build()
        .expect("Failed to create HTTP client");
}

// Use the shared client for external API calls
async fn validate_oauth_token(token: &str) -> Result<Claims, Error> {
    let response = HTTP_CLIENT
        .post("https://oauth.provider.com/introspect")
        .form(&[("token", token)])
        .send()
        .await?;
    
    let claims: Claims = response.json().await?;
    Ok(claims)
}
}

Resource Pooling

Implement object pooling for expensive operations:

#![allow(unused)]
fn main() {
use deadpool::managed::{Manager, Object, Pool, PoolError};
use async_trait::async_trait;

#[derive(Clone)]
pub struct ExpensiveResource {
    // Some expensive-to-create resource
    id: uuid::Uuid,
    data: Vec<u8>,
}

pub struct ResourceManager;

#[async_trait]
impl Manager for ResourceManager {
    type Type = ExpensiveResource;
    type Error = Box<dyn std::error::Error + Send + Sync>;
    
    async fn create(&self) -> Result<Self::Type, Self::Error> {
        // Expensive resource creation
        tokio::time::sleep(Duration::from_millis(100)).await;
        
        Ok(ExpensiveResource {
            id: uuid::Uuid::new_v4(),
            data: vec![0u8; 1024 * 1024], // 1MB
        })
    }
    
    async fn recycle(&self, _obj: &mut Self::Type) -> Result<(), Self::Error> {
        // Reset/cleanup resource for reuse
        Ok(())
    }
}

// Usage
pub async fn create_resource_pool() -> Pool<ResourceManager> {
    Pool::builder(ResourceManager)
        .max_size(10)
        .build()
        .expect("Failed to create resource pool")
}
}

Algorithm and Data Structure Optimization

Efficient Data Structures

Use appropriate data structures for different access patterns:

#![allow(unused)]
fn main() {
use std::collections::{HashMap, BTreeMap, HashSet};
use indexmap::IndexMap;

#[derive(Clone)]
pub struct OptimizedUserStore {
    // Fast lookup by ID
    users_by_id: HashMap<String, ScimUser>,
    
    // Fast lookup by username (unique)
    users_by_username: HashMap<String, String>, // username -> id
    
    // Fast lookup by email
    users_by_email: HashMap<String, String>, // email -> id
    
    // Ordered access for pagination
    users_ordered: IndexMap<String, ScimUser>, // maintains insertion order
    
    // Fast membership testing
    active_user_ids: HashSet<String>,
}

impl OptimizedUserStore {
    pub fn new() -> Self {
        Self {
            users_by_id: HashMap::new(),
            users_by_username: HashMap::new(),
            users_by_email: HashMap::new(),
            users_ordered: IndexMap::new(),
            active_user_ids: HashSet::new(),
        }
    }
    
    pub fn add_user(&mut self, user: ScimUser) {
        let id = user.id().to_string();
        let username = user.username().to_string();
        
        // Update all indexes
        self.users_by_username.insert(username, id.clone());
        
        if let Some(email) = user.primary_email() {
            self.users_by_email.insert(email.to_string(), id.clone());
        }
        
        if user.active() {
            self.active_user_ids.insert(id.clone());
        }
        
        self.users_by_id.insert(id.clone(), user.clone());
        self.users_ordered.insert(id, user);
    }
    
    pub fn get_by_username(&self, username: &str) -> Option<&ScimUser> {
        self.users_by_username
            .get(username)
            .and_then(|id| self.users_by_id.get(id))
    }
    
    pub fn get_active_users(&self) -> impl Iterator<Item = &ScimUser> {
        self.active_user_ids
            .iter()
            .filter_map(|id| self.users_by_id.get(id))
    }
    
    pub fn paginate(&self, start: usize, count: usize) -> impl Iterator<Item = &ScimUser> {
        self.users_ordered
            .values()
            .skip(start)
            .take(count)
    }
}
}

Bulk Processing

Optimize bulk operations:

#![allow(unused)]
fn main() {
use futures::stream::{self, StreamExt};
use std::sync::atomic::{AtomicUsize, Ordering};

pub struct BulkProcessor {
    concurrency_limit: usize,
    batch_size: usize,
}

impl BulkProcessor {
    pub fn new(concurrency_limit: usize, batch_size: usize) -> Self {
        Self {
            concurrency_limit,
            batch_size,
        }
    }
    
    pub async fn process_users_bulk<F, Fut>(
        &self,
        users: Vec<ScimUser>,
        processor: F,
    ) -> Result<Vec<ProcessResult>, Error>
    where
        F: Fn(ScimUser) -> Fut + Clone + Send + 'static,
        Fut: Future<Output = Result<ScimUser, Error>> + Send,
    {
        let processed_count = AtomicUsize::new(0);
        let total_count = users.len();
        
        let results = stream::iter(users)
            .map(move |user| {
                let processor = processor.clone();
                let processed_count = &processed_count;
                
                async move {
                    let result = processor(user).await;
                    let count = processed_count.fetch_add(1, Ordering::Relaxed) + 1;
                    
                    if count % 100 == 0 {
                        tracing::info!("Processed {}/{} users", count, total_count);
                    }
                    
                    result
                }
            })
            .buffer_unordered(self.concurrency_limit)
            .collect::<Vec<_>>()
            .await;
        
        Ok(results.into_iter().collect())
    }
    
    pub async fn process_in_batches<T, F, Fut>(
        &self,
        items: Vec<T>,
        processor: F,
    ) -> Result<Vec<T>, Error>
    where
        T: Send + 'static,
        F: Fn(Vec<T>) -> Fut + Send + 'static,
        Fut: Future<Output = Result<Vec<T>, Error>> + Send,
    {
        let mut results = Vec::new();
        
        for batch in items.chunks(self.batch_size) {
            let batch_result = processor(batch.to_vec()).await?;
            results.extend(batch_result);
        }
        
        Ok(results)
    }
}
}

Performance Monitoring

Metrics Collection

Track key performance indicators:

#![allow(unused)]
fn main() {
use prometheus::{Counter, Histogram, Gauge, register_counter, register_histogram, register_gauge};
use std::time::Instant;

lazy_static! {
    static ref OPERATION_DURATION: Histogram = register_histogram!(
        "scim_operation_duration_seconds",
        "Duration of SCIM operations",
        vec![0.001, 0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1.0, 2.5, 5.0, 10.0]
    ).unwrap();
    
    static ref CACHE_HITS: Counter = register_counter!(
        "scim_cache_hits_total",
        "Total cache hits"
    ).unwrap();
    
    static ref CACHE_MISSES: Counter = register_counter!(
        "scim_cache_misses_total",
        "Total cache misses"
    ).unwrap();
    
    static ref ACTIVE_CONNECTIONS: Gauge = register_gauge!(
        "scim_active_db_connections",
        "Number of active database connections"
    ).unwrap();
}

pub struct PerformanceTracker;

impl PerformanceTracker {
    pub fn time_operation<F, T>(operation_name: &str, f: F) -> T
    where
        F: FnOnce() -> T,
    {
        let _timer = OPERATION_DURATION
            .with_label_values(&[operation_name])
            .start_timer();
        
        f()
    }
    
    pub async fn time_async_operation<F, Fut, T>(operation_name: &str, f: F) -> T
    where
        F: FnOnce() -> Fut,
        Fut: Future<Output = T>,
    {
        let _timer = OPERATION_DURATION
            .with_label_values(&[operation_name])
            .start_timer();
        
        f().await
    }
    
    pub fn record_cache_hit() {
        CACHE_HITS.inc();
    }
    
    pub fn record_cache_miss() {
        CACHE_MISSES.inc();
    }
    
    pub fn set_active_connections(count: i64) {
        ACTIVE_CONNECTIONS.set(count as f64);
    }
}

// Usage in provider
impl CachedProvider {
    async fn get_user(&self, tenant_id: &str, user_id: &str) -> Result<Option<ScimUser>, ProviderError> {
        PerformanceTracker::time_async_operation("get_user", async {
            if let Some(user) = self.get_from_cache(tenant_id, user_id).await {
                PerformanceTracker::record_cache_hit();
                return Ok(Some(user));
            }
            
            PerformanceTracker::record_cache_miss();
            let user = self.inner.get_user(tenant_id, user_id).await?;
            
            if let Some(ref user) = user {
                self.cache_user(tenant_id, user).await;
            }
            
            Ok(user)
        }).await
    }
}
}

Performance Profiling

Add profiling capabilities:

#![allow(unused)]
fn main() {
use std::time::{Duration, Instant};
use std::collections::HashMap;
use tokio::sync::RwLock;

#[derive(Clone)]
pub struct ProfileData {
    pub calls: u64,
    pub total_duration: Duration,
    pub min_duration: Duration,
    pub max_duration: Duration,
    pub avg_duration: Duration,
}

#[derive(Clone)]
pub struct Profiler {
    data: Arc<RwLock<HashMap<String, ProfileData>>>,
}

impl Profiler {
    pub fn new() -> Self {
        Self {
            data: Arc::new(RwLock::new(HashMap::new())),
        }
    }
    
    pub async fn profile<F, T>(&self, name: &str, f: F) -> T
    where
        F: FnOnce() -> T,
    {
        let start = Instant::now();
        let result = f();
        let duration = start.elapsed();
        
        self.record(name, duration).await;
        result
    }
    
    pub async fn profile_async<F, Fut, T>(&self, name: &str, f: F) -> T
    where
        F: FnOnce() -> Fut,
        Fut: Future<Output = T>,
    {
        let start = Instant::now();
        let result = f().await;
        let duration = start.elapsed();
        
        self.record(name, duration).await;
        result
    }
    
    async fn record(&self, name: &str, duration: Duration) {
        let mut data = self.data.write().await;
        
        let entry = data.entry(name.to_string()).or_insert(ProfileData {
            calls: 0,
            total_duration: Duration::ZERO,
            min_duration: Duration::MAX,
            max_duration: Duration::ZERO,
            avg_duration: Duration::ZERO,
        });
        
        entry.calls += 1;
        entry.total_duration += duration;
        entry.min_duration = entry.min_duration.min(duration);
        entry.max_duration = entry.max_duration.max(duration);
        entry.avg_duration = entry.total_duration / entry.calls as u32;
    }
    
    pub async fn get_report(&self) -> HashMap<String, ProfileData> {
        self.data.read().await.clone()
    }
    
    pub async fn reset(&self) {
        self.data.write().await.clear();
    }
}

// Usage
lazy_static! {
    static ref GLOBAL_PROFILER: Profiler = Profiler::new();
}

// Endpoint to get profiling data
async fn profiling_report() -> Json<serde_json::Value> {
    let report = GLOBAL_PROFILER.get_report().await;
    
    let formatted_report: HashMap<String, serde_json::Value> = report
        .into_iter()
        .map(|(name, data)| {
            (name, json!({
                "calls": data.calls,
                "total_duration_ms": data.total_duration.as_millis(),
                "avg_duration_ms": data.avg_duration.as_millis(),
                "min_duration_ms": data.min_duration.as_millis(),
                "max_duration_ms": data.max_duration.as_millis(),
            }))
        })
        .collect();
    
    Json(json!(formatted_report))
}
}

Load Testing and Benchmarking

Load Testing Setup

Create load tests to identify bottlenecks:

#![allow(unused)]
fn main() {
#[cfg(test)]
mod load_tests {
    use super::*;
    use tokio::task::JoinSet;
    use std::sync::Arc;
    use std::time::{Duration, Instant};
    
    #[tokio::test]
    #[ignore] // Run with --ignored flag
    async fn load_test_user_operations() {
        let provider = create_test_provider().await;
        let tenant_id = "load-test-tenant";
        
        let concurrent_operations = 100;
        let operations_per_task = 10;
        
        let start_time = Instant::now();
        let mut tasks = JoinSet::new();
        
        for task_id in 0..concurrent_operations {
            let provider = provider.clone();
            let tenant_id = tenant_id.to_string();
            
            tasks.spawn(async move {
                for i in 0..operations_per_task {
                    let user = ScimUser::builder()
                        .username(&format!("user-{}-{}", task_id, i))
                        .given_name("Load")
                        .family_name("Test")
                        .email(&format!("user-{}-{}@test.com", task_id, i))
                        .build()
                        .unwrap();
                    
                    // Create user
                    let created = provider.create_user(&tenant_id, user).await.unwrap();
                    
                    // Read user
                    let _read = provider.get_user(&tenant_id, created.id()).await.unwrap();
                    
                    // Update user
                    let mut updated = created;
                    updated.set_given_name("Updated");
                    let _updated = provider.update_user(&tenant_id, updated).await.unwrap();
                }
            });
        }
        
        // Wait for all tasks to complete
        while let Some(result) = tasks.join_next().await {
            result.unwrap();
        }
        
        let total_duration = start_time.elapsed();
        let total_operations = concurrent_operations * operations_per_task * 3; // create, read, update
        let ops_per_second = total_operations as f64 / total_duration.as_secs_f64();
        
        println!("Load test completed:");
        println!("  Total operations: {}", total_operations);
        println!("  Total duration: {:?}", total_duration);
        println!("  Operations per second: {:.2}", ops_per_second);
        
        // Assert minimum performance requirements
        assert!(ops_per_second > 100.0, "Performance below threshold: {} ops/sec", ops_per_second);
    }
    
    #[tokio::test]
    #[ignore]
    async fn benchmark_filtering_performance() {
        let provider = create_test_provider().await;
        let tenant_id = "benchmark-tenant";
        
        // Create test data
        for i in 0..1000 {
            let user = ScimUser::builder()
                .username(&format!("user-{}", i))
                .given_name("Benchmark")
                .family_name("User")
                .department(if i % 3 == 0 { "Engineering" } else { "Sales" })
                .active(i % 2 == 0)
                .build()
                .unwrap();
            
            provider.create_user(tenant_id, user).await.unwrap();
        }
        
        // Benchmark different page sizes for pagination performance
        let page_sizes = [10, 50, 100, 500, 1000];
        
        for page_size in page_sizes {
            let start = Instant::now();
            let iterations = 50;
            
            for _ in 0..iterations {
                let options = ListOptions::builder()
                    .count(Some(page_size))
                    .start_index(Some(1))
                    .build();
                
                let results = provider.list_users(tenant_id, &options).await.unwrap();
                
                // Simulate in-memory filtering work
                let _active_users: Vec<_> = results.resources.into_iter()
                    .filter(|user| user.active())
                    .collect();
            }
            
            let duration = start.elapsed();
            let avg_duration = duration / iterations;
            
            println!("Page size {}: avg {}ms", page_size, avg_duration.as_millis());
        }
    }
}
}

This comprehensive performance optimization guide covers all major aspects of making SCIM Server performant at scale, from database optimization to application-level caching and monitoring.

Validation Overview

This section covers the validation architecture and concepts in the SCIM Server library. While the library provides comprehensive built-in validation based on SCIM schemas, you can extend it with custom validation for business rules, compliance requirements, and organization-specific constraints.

What is Custom Validation?

Custom validation in SCIM Server allows you to:

• Enforce business rules - Complex validation logic beyond schema constraints
• Implement compliance requirements - GDPR, HIPAA, or industry-specific rules
• Add organization-specific constraints - Custom attribute validation
• Integrate with external systems - Real-time validation against external APIs
• Implement cross-field validation - Dependencies between multiple attributes

Validation Architecture

Validation Pipeline

The SCIM Server validation pipeline processes requests in this order:

1. Schema Validation - Built-in SCIM schema compliance
2. Type Validation - Data type checking and format validation
3. Custom Validation - Your business logic
4. Storage Validation - Database constraints and uniqueness checks

#![allow(unused)]
fn main() {
use scim_server::validation::{
    ValidationPipeline, 
    ValidatorChain, 
    SchemaValidator,
    CustomValidator,
    ValidationResult
};

let validation_pipeline = ValidationPipeline::builder()
    .add_validator(SchemaValidator::new())
    .add_validator(TypeValidator::new())
    .add_validator(CustomBusinessRuleValidator::new())
    .add_validator(ComplianceValidator::new())
    .build();
}

Core Components

The validation system consists of several key components:

ValidationContext

Provides context information during validation:

#![allow(unused)]
fn main() {
pub struct ValidationContext {
    pub tenant_id: String,
    pub operation: Operation,
    pub resource_type: ResourceType,
    pub authenticated_user: Option<String>,
    pub client_info: ClientInfo,
    pub timestamp: DateTime<Utc>,
}

pub enum Operation {
    Create,
    Update,
    Patch,
    Delete,
    BulkCreate,
    BulkUpdate,
}
}

ValidationError

Represents validation failures with detailed information:

#![allow(unused)]
fn main() {
pub struct ValidationError {
    pub code: String,
    pub message: String,
    pub field_path: Option<String>,
    pub severity: ValidationSeverity,
    pub details: Option<serde_json::Value>,
}

impl ValidationError {
    pub fn new(code: &str, message: &str) -> Self {
        Self {
            code: code.to_string(),
            message: message.to_string(),
            field_path: None,
            severity: ValidationSeverity::Error,
            details: None,
        }
    }

    pub fn with_field(mut self, field_path: &str) -> Self {
        self.field_path = Some(field_path.to_string());
        self
    }

    pub fn with_severity(mut self, severity: ValidationSeverity) -> Self {
        self.severity = severity;
        self
    }
}
}

Custom Validator Trait

Implement the CustomValidator trait for your validation logic:

#![allow(unused)]
fn main() {
use scim_server::validation::{CustomValidator, ValidationContext, ValidationError};
use scim_server::models::{User, Group};
use async_trait::async_trait;

#[async_trait]
pub trait CustomValidator: Send + Sync {
    /// Validate a user during creation or update
    async fn validate_user(
        &self,
        user: &User,
        context: &ValidationContext,
    ) -> Result<(), ValidationError>;
    
    /// Validate a group during creation or update
    async fn validate_group(
        &self,
        group: &Group,
        context: &ValidationContext,
    ) -> Result<(), ValidationError>;
    
    /// Validate patch operations before applying
    async fn validate_patch_operations(
        &self,
        resource_type: &str,
        resource_id: &str,
        operations: &[PatchOperation],
        context: &ValidationContext,
    ) -> Result<(), ValidationError>;
    
    /// Custom validation for batch operations (individual operations in sequence)
    async fn validate_batch_operation(
        &self,
        resource_type: &str,
        operation_type: &str,
        data: &serde_json::Value,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Default implementation - override if needed
        // Validate each operation individually since bulk operations aren't implemented
        match operation_type {
            "CREATE" => self.validate_create(resource_type, data, context).await,
            "UPDATE" => self.validate_update(resource_type, data, context).await,
            "PATCH" => {
                // For patch operations, extract patch operations from data
                if let Ok(operations) = serde_json::from_value::<Vec<PatchOperation>>(data.clone()) {
                    self.validate_patch(resource_type, &operations, context).await
                } else {
                    Err(ValidationError::InvalidData("Invalid patch operations".to_string()))
                }
            },
            _ => Ok(())
        }
    }
}
}

Validation Strategies

1. Synchronous vs Asynchronous

• Synchronous validation - Fast, local checks (regex, length, format)
• Asynchronous validation - External API calls, database lookups

2. Fail-Fast vs Collect-All

• Fail-Fast - Stop on first validation error
• Collect-All - Gather all validation errors before failing

3. Severity Levels

#![allow(unused)]
fn main() {
pub enum ValidationSeverity {
    Error,   // Blocks the operation
    Warning, // Logs but allows operation  
    Info,    // Informational only
}
}

Integration Points

Server Configuration

Register validators during server startup:

#![allow(unused)]
fn main() {
use scim_server::ScimServerBuilder;

let server = ScimServerBuilder::new()
    .with_provider(my_provider)
    .add_validator(BusinessRuleValidator::new())
    .add_validator(ComplianceValidator::new())
    .build();
}

Tenant-Specific Validation

Different validation rules per tenant:

#![allow(unused)]
fn main() {
pub struct TenantValidatorRegistry {
    validators: HashMap<String, Vec<Box<dyn CustomValidator>>>,
}

impl TenantValidatorRegistry {
    pub async fn validate_for_tenant(
        &self,
        tenant_id: &str,
        user: &User,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        if let Some(validators) = self.validators.get(tenant_id) {
            for validator in validators {
                validator.validate_user(user, context).await?;
            }
        }
        Ok(())
    }
}
}

Error Handling

Validation Error Aggregation

#![allow(unused)]
fn main() {
pub struct ValidationResult {
    pub errors: Vec<ValidationError>,
    pub warnings: Vec<ValidationError>,
}

impl ValidationResult {
    pub fn is_valid(&self) -> bool {
        self.errors.is_empty()
    }

    pub fn add_error(&mut self, error: ValidationError) {
        match error.severity {
            ValidationSeverity::Error => self.errors.push(error),
            ValidationSeverity::Warning => self.warnings.push(error),
            ValidationSeverity::Info => { /* Log only */ }
        }
    }
}
}

Client Error Response

Validation errors are returned as SCIM-compliant error responses:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "scimType": "invalidValue",
  "detail": "Validation failed",
  "errors": [
    {
      "code": "INVALID_EMAIL_DOMAIN",
      "message": "Email domain 'example.com' is not allowed",
      "field": "emails[0].value"
    }
  ]
}

Next Steps

• Basic Validation - Simple business rule validators
• Advanced Validation - External integrations and complex logic
• Field-Level Validation - Custom attribute validators
• Configuration - Configurable validation rules

Basic Validation

This guide covers implementing simple, synchronous validation rules for common business requirements. These validators typically perform local checks without external dependencies.

Simple Business Rule Validator

Here's a comprehensive example of a basic validator that enforces common organizational policies:

#![allow(unused)]
fn main() {
use scim_server::validation::{CustomValidator, ValidationContext, ValidationError};
use scim_server::models::{User, Group};
use regex::Regex;
use async_trait::async_trait;

pub struct BusinessRuleValidator {
    employee_id_pattern: Regex,
    allowed_domains: Vec<String>,
    password_policy: PasswordPolicy,
}

#[derive(Clone)]
pub struct PasswordPolicy {
    pub min_length: usize,
    pub require_uppercase: bool,
    pub require_lowercase: bool,
    pub require_numbers: bool,
    pub require_special_chars: bool,
    pub forbidden_patterns: Vec<Regex>,
}

impl BusinessRuleValidator {
    pub fn new() -> Self {
        Self {
            employee_id_pattern: Regex::new(r"^EMP\d{6}$").unwrap(),
            allowed_domains: vec![
                "company.com".to_string(),
                "subsidiary.com".to_string(),
            ],
            password_policy: PasswordPolicy {
                min_length: 12,
                require_uppercase: true,
                require_lowercase: true,
                require_numbers: true,
                require_special_chars: true,
                forbidden_patterns: vec![
                    Regex::new(r"password").unwrap(),
                    Regex::new(r"123456").unwrap(),
                    Regex::new(r"qwerty").unwrap(),
                ],
            },
        }
    }
}

#[async_trait]
impl CustomValidator for BusinessRuleValidator {
    async fn validate_user(
        &self,
        user: &User,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Validate employee ID format
        if let Some(employee_id) = user.external_id.as_ref() {
            if !self.employee_id_pattern.is_match(employee_id) {
                return Err(ValidationError::new(
                    "INVALID_EMPLOYEE_ID",
                    "Employee ID must follow format EMP123456",
                ).with_field("externalId"));
            }
        }

        // Validate email domain
        if let Some(emails) = &user.emails {
            for (index, email) in emails.iter().enumerate() {
                if let Some(domain) = email.value.split('@').nth(1) {
                    if !self.allowed_domains.contains(&domain.to_lowercase()) {
                        return Err(ValidationError::new(
                            "INVALID_EMAIL_DOMAIN",
                            &format!("Email domain '{}' is not allowed", domain),
                        ).with_field(&format!("emails[{}].value", index)));
                    }
                }
            }
        }

        // Validate password policy (if password is being set)
        if let Some(password) = user.password.as_ref() {
            self.validate_password_policy(password)?;
        }

        // Validate name requirements
        if user.name.is_none() {
            return Err(ValidationError::new(
                "MISSING_NAME",
                "User must have a name",
            ).with_field("name"));
        }

        // Validate username format
        if let Some(username) = &user.username {
            if username.len() < 3 {
                return Err(ValidationError::new(
                    "USERNAME_TOO_SHORT",
                    "Username must be at least 3 characters",
                ).with_field("userName"));
            }
            
            if username.contains(' ') {
                return Err(ValidationError::new(
                    "USERNAME_INVALID_CHARS",
                    "Username cannot contain spaces",
                ).with_field("userName"));
            }
        }

        Ok(())
    }

    async fn validate_group(
        &self,
        group: &Group,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Validate group display name
        if group.display_name.is_empty() {
            return Err(ValidationError::new(
                "EMPTY_GROUP_NAME",
                "Group display name cannot be empty",
            ).with_field("displayName"));
        }

        // Validate group name format
        if group.display_name.len() > 64 {
            return Err(ValidationError::new(
                "GROUP_NAME_TOO_LONG",
                "Group display name cannot exceed 64 characters",
            ).with_field("displayName"));
        }

        // Check for reserved group names
        let reserved_names = vec!["admin", "root", "system", "administrator"];
        if reserved_names.contains(&group.display_name.to_lowercase().as_str()) {
            return Err(ValidationError::new(
                "RESERVED_GROUP_NAME",
                &format!("'{}' is a reserved group name", group.display_name),
            ).with_field("displayName"));
        }

        // Validate member limit
        if let Some(members) = &group.members {
            if members.len() > 1000 {
                return Err(ValidationError::new(
                    "TOO_MANY_MEMBERS",
                    "Group cannot have more than 1000 members",
                ).with_field("members"));
            }
        }

        Ok(())
    }
}

impl BusinessRuleValidator {
    fn validate_password_policy(&self, password: &str) -> Result<(), ValidationError> {
        let policy = &self.password_policy;

        // Check minimum length
        if password.len() < policy.min_length {
            return Err(ValidationError::new(
                "PASSWORD_TOO_SHORT",
                &format!("Password must be at least {} characters", policy.min_length),
            ).with_field("password"));
        }

        // Check character requirements
        if policy.require_uppercase && !password.chars().any(|c| c.is_uppercase()) {
            return Err(ValidationError::new(
                "PASSWORD_MISSING_UPPERCASE",
                "Password must contain at least one uppercase letter",
            ).with_field("password"));
        }

        if policy.require_lowercase && !password.chars().any(|c| c.is_lowercase()) {
            return Err(ValidationError::new(
                "PASSWORD_MISSING_LOWERCASE",
                "Password must contain at least one lowercase letter",
            ).with_field("password"));
        }

        if policy.require_numbers && !password.chars().any(|c| c.is_numeric()) {
            return Err(ValidationError::new(
                "PASSWORD_MISSING_NUMBER",
                "Password must contain at least one number",
            ).with_field("password"));
        }

        if policy.require_special_chars && !password.chars().any(|c| "!@#$%^&*()".contains(c)) {
            return Err(ValidationError::new(
                "PASSWORD_MISSING_SPECIAL",
                "Password must contain at least one special character",
            ).with_field("password"));
        }

        // Check forbidden patterns
        for pattern in &policy.forbidden_patterns {
            if pattern.is_match(&password.to_lowercase()) {
                return Err(ValidationError::new(
                    "PASSWORD_FORBIDDEN_PATTERN",
                    "Password contains forbidden pattern",
                ).with_field("password"));
            }
        }

        Ok(())
    }
}
}

Department-Based Validation

Validate users based on their department or role:

#![allow(unused)]
fn main() {
use scim_server::validation::{CustomValidator, ValidationContext, ValidationError};
use std::collections::HashMap;

pub struct DepartmentValidator {
    department_rules: HashMap<String, DepartmentRules>,
}

#[derive(Clone)]
pub struct DepartmentRules {
    pub required_attributes: Vec<String>,
    pub allowed_email_domains: Vec<String>,
    pub max_group_memberships: usize,
    pub requires_manager: bool,
}

impl DepartmentValidator {
    pub fn new() -> Self {
        let mut department_rules = HashMap::new();
        
        // IT Department rules
        department_rules.insert("IT".to_string(), DepartmentRules {
            required_attributes: vec!["employeeNumber".to_string(), "title".to_string()],
            allowed_email_domains: vec!["company.com".to_string()],
            max_group_memberships: 20,
            requires_manager: true,
        });
        
        // HR Department rules  
        department_rules.insert("HR".to_string(), DepartmentRules {
            required_attributes: vec!["employeeNumber".to_string(), "title".to_string(), "phoneNumber".to_string()],
            allowed_email_domains: vec!["company.com".to_string()],
            max_group_memberships: 10,
            requires_manager: true,
        });
        
        // Contractor rules
        department_rules.insert("CONTRACTOR".to_string(), DepartmentRules {
            required_attributes: vec!["contractEndDate".to_string()],
            allowed_email_domains: vec!["contractor.company.com".to_string()],
            max_group_memberships: 5,
            requires_manager: false,
        });

        Self { department_rules }
    }
}

#[async_trait]
impl CustomValidator for DepartmentValidator {
    async fn validate_user(
        &self,
        user: &User,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Get user's department from custom attributes
        let department = user.extension_attributes
            .as_ref()
            .and_then(|attrs| attrs.get("department"))
            .and_then(|v| v.as_str())
            .unwrap_or("UNKNOWN");

        if let Some(rules) = self.department_rules.get(department) {
            // Check required attributes
            for required_attr in &rules.required_attributes {
                if !user.extension_attributes
                    .as_ref()
                    .map(|attrs| attrs.contains_key(required_attr))
                    .unwrap_or(false) {
                    return Err(ValidationError::new(
                        "MISSING_REQUIRED_ATTRIBUTE",
                        &format!("Department {} requires attribute '{}'", department, required_attr),
                    ).with_field(&format!("enterpriseUser:{}", required_attr)));
                }
            }

            // Validate email domain for department
            if let Some(emails) = &user.emails {
                for (index, email) in emails.iter().enumerate() {
                    if let Some(domain) = email.value.split('@').nth(1) {
                        if !rules.allowed_email_domains.contains(&domain.to_lowercase()) {
                            return Err(ValidationError::new(
                                "INVALID_DEPARTMENT_EMAIL_DOMAIN",
                                &format!("Department {} does not allow email domain '{}'", department, domain),
                            ).with_field(&format!("emails[{}].value", index)));
                        }
                    }
                }
            }

            // Check manager requirement
            if rules.requires_manager {
                let has_manager = user.extension_attributes
                    .as_ref()
                    .and_then(|attrs| attrs.get("manager"))
                    .is_some();
                    
                if !has_manager {
                    return Err(ValidationError::new(
                        "MISSING_MANAGER",
                        &format!("Department {} requires a manager to be assigned", department),
                    ).with_field("enterpriseUser:manager"));
                }
            }
        }

        Ok(())
    }

    async fn validate_group(
        &self,
        group: &Group,
        _context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Basic group validation for department-based rules
        Ok(())
    }
}
}

Attribute Format Validation

Validate specific attribute formats beyond basic schema validation:

#![allow(unused)]
fn main() {
pub struct AttributeFormatValidator {
    phone_regex: Regex,
    ssn_regex: Regex,
    employee_id_regex: Regex,
}

impl AttributeFormatValidator {
    pub fn new() -> Self {
        Self {
            phone_regex: Regex::new(r"^\+1-\d{3}-\d{3}-\d{4}$").unwrap(),
            ssn_regex: Regex::new(r"^\d{3}-\d{2}-\d{4}$").unwrap(), 
            employee_id_regex: Regex::new(r"^[A-Z]{2}\d{6}$").unwrap(),
        }
    }

    fn validate_phone_number(&self, phone: &str) -> Result<(), ValidationError> {
        if !self.phone_regex.is_match(phone) {
            return Err(ValidationError::new(
                "INVALID_PHONE_FORMAT",
                "Phone number must be in format +1-XXX-XXX-XXXX",
            ));
        }
        Ok(())
    }

    fn validate_ssn(&self, ssn: &str) -> Result<(), ValidationError> {
        if !self.ssn_regex.is_match(ssn) {
            return Err(ValidationError::new(
                "INVALID_SSN_FORMAT", 
                "SSN must be in format XXX-XX-XXXX",
            ));
        }

        // Additional SSN validation rules
        let parts: Vec<&str> = ssn.split('-').collect();
        if parts.len() == 3 {
            // Check for invalid area numbers
            if let Ok(area) = parts[0].parse::<u32>() {
                if area == 0 || area == 666 || area >= 900 {
                    return Err(ValidationError::new(
                        "INVALID_SSN_AREA",
                        "Invalid SSN area number",
                    ));
                }
            }
        }
        Ok(())
    }
}

#[async_trait]
impl CustomValidator for AttributeFormatValidator {
    async fn validate_user(
        &self,
        user: &User,
        _context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Validate phone numbers
        if let Some(phone_numbers) = &user.phone_numbers {
            for (index, phone) in phone_numbers.iter().enumerate() {
                self.validate_phone_number(&phone.value)
                    .map_err(|mut e| {
                        e.field_path = Some(format!("phoneNumbers[{}].value", index));
                        e
                    })?;
            }
        }

        // Validate custom attributes
        if let Some(attrs) = &user.extension_attributes {
            // Validate SSN if present
            if let Some(ssn_value) = attrs.get("ssn") {
                if let Some(ssn_str) = ssn_value.as_str() {
                    self.validate_ssn(ssn_str)
                        .map_err(|mut e| {
                            e.field_path = Some("enterpriseUser:ssn".to_string());
                            e
                        })?;
                }
            }

            // Validate employee ID
            if let Some(emp_id_value) = attrs.get("employeeNumber") {
                if let Some(emp_id_str) = emp_id_value.as_str() {
                    if !self.employee_id_regex.is_match(emp_id_str) {
                        return Err(ValidationError::new(
                            "INVALID_EMPLOYEE_ID_FORMAT",
                            "Employee ID must be in format XX123456",
                        ).with_field("enterpriseUser:employeeNumber"));
                    }
                }
            }
        }

        Ok(())
    }

    async fn validate_group(
        &self,
        _group: &Group,
        _context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        Ok(())
    }
}
}

Usage Example

Here's how to register and use these basic validators:

use scim_server::ScimServerBuilder;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let server = ScimServerBuilder::new()
        .with_provider(my_provider)
        .add_validator(BusinessRuleValidator::new())
        .add_validator(DepartmentValidator::new())
        .add_validator(AttributeFormatValidator::new())
        .build();

    // Start server
    server.run().await?;
    Ok(())
}

Testing Basic Validators

#![allow(unused)]
fn main() {
#[cfg(test)]
mod tests {
    use super::*;
    use scim_server::models::{User, Name, Email};

    #[tokio::test]
    async fn test_business_rule_validation() {
        let validator = BusinessRuleValidator::new();
        let context = ValidationContext::default();

        // Test valid user
        let mut user = User::default();
        user.username = Some("john.doe".to_string());
        user.external_id = Some("EMP123456".to_string());
        user.name = Some(Name {
            formatted: Some("John Doe".to_string()),
            family_name: Some("Doe".to_string()),
            given_name: Some("John".to_string()),
            ..Default::default()
        });
        user.emails = Some(vec![Email {
            value: "john.doe@company.com".to_string(),
            primary: Some(true),
            ..Default::default()
        }]);

        assert!(validator.validate_user(&user, &context).await.is_ok());

        // Test invalid employee ID
        user.external_id = Some("INVALID123".to_string());
        let result = validator.validate_user(&user, &context).await;
        assert!(result.is_err());
        assert_eq!(result.unwrap_err().code, "INVALID_EMPLOYEE_ID");
    }

    #[tokio::test]
    async fn test_password_policy() {
        let validator = BusinessRuleValidator::new();
        
        // Test weak password
        let weak_password = "password123";
        let result = validator.validate_password_policy(weak_password);
        assert!(result.is_err());

        // Test strong password
        let strong_password = "MySecure123!Password";
        let result = validator.validate_password_policy(strong_password);
        assert!(result.is_ok());
    }
}
}

Next Steps

• Advanced Validation - External system integration and complex logic
• Field-Level Validation - Granular attribute validation
• Configuration - Dynamic validation rules

Advanced Validation

This guide covers complex validation scenarios including external system integration, conditional validation, and sophisticated business logic that requires asynchronous operations or external dependencies.

External System Integration

HR System Validation

Validate users against external HR systems to ensure data consistency:

#![allow(unused)]
fn main() {
use scim_server::validation::{CustomValidator, ValidationContext, ValidationError};
use reqwest::Client;
use serde_json::json;
use std::time::Duration;
use async_trait::async_trait;

pub struct ExternalValidationService {
    http_client: Client,
    hr_system_url: String,
    compliance_service_url: String,
    api_key: String,
}

impl ExternalValidationService {
    pub fn new(hr_system_url: String, compliance_service_url: String, api_key: String) -> Self {
        Self {
            http_client: Client::new(),
            hr_system_url,
            compliance_service_url,
            api_key,
        }
    }
}

#[async_trait]
impl CustomValidator for ExternalValidationService {
    async fn validate_user(
        &self,
        user: &User,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Validate against HR system
        self.validate_against_hr_system(user).await?;
        
        // Validate compliance requirements
        self.validate_compliance_requirements(user, context).await?;
        
        // Validate security clearance if present
        if let Some(security_clearance) = self.extract_security_clearance(user) {
            self.validate_security_clearance(&security_clearance, user).await?;
        }
        
        Ok(())
    }

    async fn validate_group(
        &self,
        group: &Group,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Validate group against organizational structure
        self.validate_group_structure(group, context).await?;
        Ok(())
    }
}

impl ExternalValidationService {
    async fn validate_against_hr_system(&self, user: &User) -> Result<(), ValidationError> {
        if let Some(employee_number) = self.extract_employee_number(user) {
            let response = self.http_client
                .get(&format!("{}/employees/{}", self.hr_system_url, employee_number))
                .header("Authorization", format!("Bearer {}", self.api_key))
                .timeout(Duration::from_secs(5))
                .send()
                .await
                .map_err(|e| ValidationError::new(
                    "HR_SYSTEM_ERROR",
                    &format!("Failed to validate employee: {}", e),
                ))?;
            
            if response.status() == 404 {
                return Err(ValidationError::new(
                    "EMPLOYEE_NOT_FOUND",
                    "Employee not found in HR system",
                ).with_field("enterpriseUser:employeeNumber"));
            }
            
            if !response.status().is_success() {
                return Err(ValidationError::new(
                    "HR_SYSTEM_ERROR",
                    &format!("HR system returned status: {}", response.status()),
                ));
            }
            
            let hr_employee: HrEmployee = response.json().await
                .map_err(|e| ValidationError::new(
                    "HR_SYSTEM_ERROR",
                    &format!("Failed to parse HR response: {}", e),
                ))?;
            
            // Validate employee status
            if hr_employee.status != "ACTIVE" {
                return Err(ValidationError::new(
                    "EMPLOYEE_INACTIVE",
                    &format!("Employee status in HR system is: {}", hr_employee.status),
                ).with_field("active"));
            }
            
            // Validate department consistency
            if let Some(department) = self.extract_department(user) {
                if hr_employee.department != department {
                    return Err(ValidationError::new(
                        "DEPARTMENT_MISMATCH",
                        "Department does not match HR system",
                    ).with_field("enterpriseUser:department"));
                }
            }

            // Validate manager hierarchy
            if let Some(manager_id) = self.extract_manager_id(user) {
                if let Some(hr_manager_id) = hr_employee.manager_id {
                    if manager_id != hr_manager_id {
                        return Err(ValidationError::new(
                            "MANAGER_MISMATCH",
                            "Manager does not match HR system",
                        ).with_field("enterpriseUser:manager"));
                    }
                }
            }
        }
        
        Ok(())
    }
    
    async fn validate_compliance_requirements(
        &self,
        user: &User,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        let compliance_request = json!({
            "user_data": {
                "name": user.name,
                "emails": user.emails,
                "phone_numbers": user.phone_numbers,
                "addresses": user.addresses,
                "country": self.extract_country(user),
            },
            "tenant_id": context.tenant_id,
            "operation": context.operation,
        });
        
        let response = self.http_client
            .post(&format!("{}/validate", self.compliance_service_url))
            .header("Authorization", format!("Bearer {}", self.api_key))
            .json(&compliance_request)
            .timeout(Duration::from_secs(10))
            .send()
            .await
            .map_err(|e| ValidationError::new(
                "COMPLIANCE_SYSTEM_ERROR",
                &format!("Failed to validate compliance: {}", e),
            ))?;
        
        if !response.status().is_success() {
            return Err(ValidationError::new(
                "COMPLIANCE_SYSTEM_ERROR",
                &format!("Compliance service returned status: {}", response.status()),
            ));
        }
        
        let compliance_result: ComplianceValidationResult = response.json().await
            .map_err(|e| ValidationError::new(
                "COMPLIANCE_SYSTEM_ERROR",
                &format!("Failed to parse compliance response: {}", e),
            ))?;
        
        if !compliance_result.is_compliant {
            let violations = compliance_result.violations.join(", ");
            return Err(ValidationError::new(
                "COMPLIANCE_VIOLATION",
                &format!("Compliance violations: {}", violations),
            ));
        }
        
        Ok(())
    }
    
    async fn validate_security_clearance(
        &self,
        security_clearance: &str,
        user: &User,
    ) -> Result<(), ValidationError> {
        // Validate security clearance levels
        let valid_clearances = ["PUBLIC", "CONFIDENTIAL", "SECRET", "TOP_SECRET"];
        if !valid_clearances.contains(&security_clearance) {
            return Err(ValidationError::new(
                "INVALID_SECURITY_CLEARANCE",
                &format!("Invalid security clearance level: {}", security_clearance),
            ).with_field("enterpriseUser:securityClearance"));
        }
        
        // Validate clearance requirements based on department
        if let Some(department) = self.extract_department(user) {
            match department.as_str() {
                "Defense" | "Intelligence" => {
                    if security_clearance == "PUBLIC" {
                        return Err(ValidationError::new(
                            "INSUFFICIENT_CLEARANCE",
                            "Department requires minimum CONFIDENTIAL clearance",
                        ).with_field("enterpriseUser:securityClearance"));
                    }
                }
                "Research" => {
                    if !["CONFIDENTIAL", "SECRET", "TOP_SECRET"].contains(&security_clearance) {
                        return Err(ValidationError::new(
                            "INSUFFICIENT_CLEARANCE",
                            "Research department requires minimum CONFIDENTIAL clearance",
                        ).with_field("enterpriseUser:securityClearance"));
                    }
                }
                _ => {} // No special requirements
            }
        }
        
        Ok(())
    }

    async fn validate_group_structure(
        &self,
        group: &Group,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Validate against organizational chart
        let org_response = self.http_client
            .get(&format!("{}/organizational-chart/{}", self.hr_system_url, context.tenant_id))
            .header("Authorization", format!("Bearer {}", self.api_key))
            .send()
            .await
            .map_err(|e| ValidationError::new(
                "ORG_CHART_ERROR",
                &format!("Failed to fetch organizational chart: {}", e),
            ))?;

        let org_chart: OrganizationalChart = org_response.json().await
            .map_err(|e| ValidationError::new(
                "ORG_CHART_ERROR", 
                &format!("Failed to parse org chart: {}", e),
            ))?;

        // Validate group exists in org chart
        if !org_chart.groups.iter().any(|g| g.name == group.display_name) {
            return Err(ValidationError::new(
                "GROUP_NOT_IN_ORG_CHART",
                "Group does not exist in organizational chart",
            ).with_field("displayName"));
        }

        Ok(())
    }

    // Helper methods for extracting user attributes
    fn extract_employee_number(&self, user: &User) -> Option<String> {
        user.extension_attributes
            .as_ref()
            .and_then(|attrs| attrs.get("employeeNumber"))
            .and_then(|v| v.as_str())
            .map(|s| s.to_string())
    }

    fn extract_department(&self, user: &User) -> Option<String> {
        user.extension_attributes
            .as_ref()
            .and_then(|attrs| attrs.get("department"))
            .and_then(|v| v.as_str())
            .map(|s| s.to_string())
    }

    fn extract_manager_id(&self, user: &User) -> Option<String> {
        user.extension_attributes
            .as_ref()
            .and_then(|attrs| attrs.get("manager"))
            .and_then(|v| v.get("value"))
            .and_then(|v| v.as_str())
            .map(|s| s.to_string())
    }

    fn extract_security_clearance(&self, user: &User) -> Option<String> {
        user.extension_attributes
            .as_ref()
            .and_then(|attrs| attrs.get("securityClearance"))
            .and_then(|v| v.as_str())
            .map(|s| s.to_string())
    }

    fn extract_country(&self, user: &User) -> Option<String> {
        user.addresses
            .as_ref()
            .and_then(|addrs| addrs.first())
            .map(|addr| addr.country.clone())
            .unwrap_or_default()
    }
}

// Supporting types
#[derive(serde::Deserialize)]
struct HrEmployee {
    employee_id: String,
    status: String,
    department: String,
    manager_id: Option<String>,
    hire_date: String,
    termination_date: Option<String>,
}

#[derive(serde::Deserialize)]
struct ComplianceValidationResult {
    is_compliant: bool,
    violations: Vec<String>,
    severity: String,
}

#[derive(serde::Deserialize)]
struct OrganizationalChart {
    groups: Vec<OrgGroup>,
}

#[derive(serde::Deserialize)]
struct OrgGroup {
    name: String,
    parent: Option<String>,
    level: u32,
}
}

Conditional Validation

Implement validation rules that apply only under specific conditions:

#![allow(unused)]
fn main() {
use scim_server::validation::{CustomValidator, ValidationContext, ValidationError};
use std::collections::HashMap;

pub struct ConditionalValidator {
    rules: Vec<ConditionalRule>,
}

pub struct ConditionalRule {
    pub name: String,
    pub condition: fn(&User, &ValidationContext) -> bool,
    pub validator: fn(&User, &ValidationContext) -> Result<(), ValidationError>,
}

impl ConditionalValidator {
    pub fn new() -> Self {
        let mut rules = Vec::new();
        
        // Rule: Contractors must have end date
        rules.push(ConditionalRule {
            name: "contractor_end_date".to_string(),
            condition: |user, _| {
                user.extension_attributes
                    .as_ref()
                    .and_then(|attrs| attrs.get("userType"))
                    .and_then(|v| v.as_str()) == Some("Contractor")
            },
            validator: |user, _| {
                let has_end_date = user.extension_attributes
                    .as_ref()
                    .and_then(|attrs| attrs.get("employmentEndDate"))
                    .is_some();
                    
                if !has_end_date {
                    return Err(ValidationError::new(
                        "MISSING_END_DATE",
                        "Contractors must have an employment end date",
                    ).with_field("enterpriseUser:employmentEndDate"));
                }
                Ok(())
            },
        });
        
        // Rule: VIP users require additional security
        rules.push(ConditionalRule {
            name: "vip_security_requirements".to_string(),
            condition: |user, _| {
                user.extension_attributes
                    .as_ref()
                    .and_then(|attrs| attrs.get("vipStatus"))
                    .and_then(|v| v.as_bool())
                    .unwrap_or(false)
            },
            validator: |user, _| {
                // Check for required security attributes
                let security_attrs = ["securityClearance", "backgroundCheckDate", "securityTraining"];
                
                for attr in &security_attrs {
                    if !user.extension_attributes
                        .as_ref()
                        .map(|attrs| attrs.contains_key(*attr))
                        .unwrap_or(false) {
                        return Err(ValidationError::new(
                            "MISSING_VIP_SECURITY_ATTR",
                            &format!("VIP users must have {} attribute", attr),
                        ).with_field(&format!("enterpriseUser:{}", attr)));
                    }
                }
                Ok(())
            },
        });
        
        // Rule: Remote workers require specific equipment
        rules.push(ConditionalRule {
            name: "remote_worker_equipment".to_string(),
            condition: |user, _| {
                user.extension_attributes
                    .as_ref()
                    .and_then(|attrs| attrs.get("workLocation"))
                    .and_then(|v| v.as_str()) == Some("Remote")
            },
            validator: |user, _| {
                let required_equipment = ["laptop", "vpnAccess", "phoneStipend"];
                
                for equipment in &required_equipment {
                    if !user.extension_attributes
                        .as_ref()
                        .and_then(|attrs| attrs.get("equipment"))
                        .and_then(|v| v.as_array())
                        .map(|arr| arr.iter().any(|item| 
                            item.as_str().map(|s| s == *equipment).unwrap_or(false)
                        ))
                        .unwrap_or(false) {
                        return Err(ValidationError::new(
                            "MISSING_REMOTE_EQUIPMENT",
                            &format!("Remote workers must have {} assigned", equipment),
                        ).with_field("enterpriseUser:equipment"));
                    }
                }
                Ok(())
            },
        });

        Self { rules }
    }
}

#[async_trait]
impl CustomValidator for ConditionalValidator {
    async fn validate_user(
        &self,
        user: &User,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        for rule in &self.rules {
            if (rule.condition)(user, context) {
                (rule.validator)(user, context)?;
            }
        }
        
        Ok(())
    }

    async fn validate_group(
        &self,
        _group: &Group,
        _context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Groups don't typically need conditional validation
        Ok(())
    }
}
}

Async Workflow Integration

Integrate with approval workflows and external processes:

#![allow(unused)]
fn main() {
use scim_server::validation::{CustomValidator, ValidationContext, ValidationError};
use tokio::time::{sleep, Duration};

pub struct WorkflowValidator {
    workflow_client: WorkflowClient,
    approval_timeout: Duration,
}

impl WorkflowValidator {
    pub fn new(workflow_url: String, api_key: String) -> Self {
        Self {
            workflow_client: WorkflowClient::new(workflow_url, api_key),
            approval_timeout: Duration::from_secs(30),
        }
    }
}

#[async_trait]
impl CustomValidator for WorkflowValidator {
    async fn validate_user(
        &self,
        user: &User,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        match context.operation {
            Operation::Create => {
                // Check if user creation requires approval
                if self.requires_approval(user, context).await? {
                    self.validate_approval_exists(user, context).await?;
                }
            }
            Operation::Update => {
                // Check for sensitive attribute changes
                if self.has_sensitive_changes(user, context).await? {
                    self.validate_change_approval(user, context).await?;
                }
            }
            _ => {}
        }
        
        Ok(())
    }

    async fn validate_group(
        &self,
        group: &Group,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Group creation/modification might require approval for certain types
        if self.is_privileged_group(group) {
            self.validate_group_approval(group, context).await?;
        }
        
        Ok(())
    }
}

impl WorkflowValidator {
    async fn requires_approval(&self, user: &User, context: &ValidationContext) -> Result<bool, ValidationError> {
        // External users always require approval
        if self.is_external_user(user) {
            return Ok(true);
        }
        
        // High-privilege roles require approval
        if let Some(roles) = &user.roles {
            let privileged_roles = ["Admin", "Security", "HR"];
            if roles.iter().any(|role| privileged_roles.contains(&role.value.as_str())) {
                return Ok(true);
            }
        }
        
        // Users with high security clearance require approval
        if let Some(clearance) = user.extension_attributes
            .as_ref()
            .and_then(|attrs| attrs.get("securityClearance"))
            .and_then(|v| v.as_str()) {
            if ["SECRET", "TOP_SECRET"].contains(&clearance) {
                return Ok(true);
            }
        }
        
        Ok(false)
    }

    async fn validate_approval_exists(
        &self,
        user: &User,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        let approval_request = ApprovalRequest {
            request_type: "user_creation".to_string(),
            tenant_id: context.tenant_id.clone(),
            requester: context.authenticated_user.clone().unwrap_or_default(),
            subject: user.username.clone().unwrap_or_default(),
            details: serde_json::to_value(user).unwrap_or_default(),
        };

        let approval_status = self.workflow_client
            .check_approval_status(&approval_request)
            .await
            .map_err(|e| ValidationError::new(
                "WORKFLOW_ERROR",
                &format!("Failed to check approval status: {}", e),
            ))?;

        match approval_status.status.as_str() {
            "approved" => Ok(()),
            "pending" => {
                // Wait for approval with timeout
                self.wait_for_approval(&approval_request).await
            }
            "rejected" => {
                Err(ValidationError::new(
                    "APPROVAL_REJECTED",
                    &format!("User creation was rejected: {}", approval_status.reason.unwrap_or_default()),
                ))
            }
            _ => {
                // Create new approval request
                self.workflow_client
                    .create_approval_request(&approval_request)
                    .await
                    .map_err(|e| ValidationError::new(
                        "WORKFLOW_ERROR",
                        &format!("Failed to create approval request: {}", e),
                    ))?;
                
                Err(ValidationError::new(
                    "APPROVAL_PENDING",
                    "User creation requires approval. Request has been submitted.",
                ))
            }
        }
    }

    async fn wait_for_approval(&self, request: &ApprovalRequest) -> Result<(), ValidationError> {
        let mut attempts = 0;
        let max_attempts = (self.approval_timeout.as_secs() / 5) as usize; // Check every 5 seconds

        while attempts < max_attempts {
            sleep(Duration::from_secs(5)).await;
            
            let status = self.workflow_client
                .check_approval_status(request)
                .await
                .map_err(|e| ValidationError::new(
                    "WORKFLOW_ERROR",
                    &format!("Failed to check approval status: {}", e),
                ))?;

            match status.status.as_str() {
                "approved" => return Ok(()),
                "rejected" => return Err(ValidationError::new(
                    "APPROVAL_REJECTED",
                    &format!("Request was rejected: {}", status.reason.unwrap_or_default()),
                )),
                "pending" => {
                    attempts += 1;
                    continue;
                }
                _ => return Err(ValidationError::new(
                    "WORKFLOW_ERROR",
                    "Unexpected approval status",
                )),
            }
        }

        Err(ValidationError::new(
            "APPROVAL_TIMEOUT",
            "Approval request timed out",
        ))
    }

    async fn has_sensitive_changes(&self, user: &User, context: &ValidationContext) -> Result<bool, ValidationError> {
        // This would typically compare with the existing user record
        // For brevity, we'll assume sensitive attributes are being checked
        let sensitive_attributes = [
            "roles", "permissions", "securityClearance", 
            "department", "manager", "salary"
        ];
        
        // In a real implementation, you would fetch the existing user
        // and compare the attributes to detect changes
        Ok(true) // Simplified for example
    }

    async fn validate_change_approval(
        &self,
        user: &User,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Similar to validate_approval_exists but for user changes
        let approval_request = ApprovalRequest {
            request_type: "user_modification".to_string(),
            tenant_id: context.tenant_id.clone(),
            requester: context.authenticated_user.clone().unwrap_or_default(),
            subject: user.username.clone().unwrap_or_default(),
            details: serde_json::to_value(user).unwrap_or_default(),
        };

        // Check for existing approval or create new request
        self.validate_approval_exists(user, context).await
    }

    async fn validate_group_approval(
        &self,
        group: &Group,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        let approval_request = ApprovalRequest {
            request_type: "privileged_group_creation".to_string(),
            tenant_id: context.tenant_id.clone(),
            requester: context.authenticated_user.clone().unwrap_or_default(),
            subject: group.display_name.clone(),
            details: serde_json::to_value(group).unwrap_or_default(),
        };

        self.validate_approval_exists_for_group(group, &approval_request).await
    }

    async fn validate_approval_exists_for_group(
        &self,
        group: &Group,
        approval_request: &ApprovalRequest,
    ) -> Result<(), ValidationError> {
        // Similar logic to user approval validation
        let approval_status = self.workflow_client
            .check_approval_status(approval_request)
            .await
            .map_err(|e| ValidationError::new(
                "WORKFLOW_ERROR",
                &format!("Failed to check group approval status: {}", e),
            ))?;

        match approval_status.status.as_str() {
            "approved" => Ok(()),
            "pending" => self.wait_for_approval(approval_request).await,
            "rejected" => Err(ValidationError::new(
                "GROUP_APPROVAL_REJECTED",
                &format!("Group creation was rejected: {}", approval_status.reason.unwrap_or_default()),
            )),
            _ => {
                self.workflow_client
                    .create_approval_request(approval_request)
                    .await
                    .map_err(|e| ValidationError::new(
                        "WORKFLOW_ERROR",
                        &format!("Failed to create group approval request: {}", e),
                    ))?;
                
                Err(ValidationError::new(
                    "GROUP_APPROVAL_PENDING",
                    "Privileged group creation requires approval. Request has been submitted.",
                ))
            }
        }
    }

    fn is_external_user(&self, user: &User) -> bool {
        if let Some(emails) = &user.emails {
            return emails.iter().any(|email| {
                !email.value.ends_with("@company.com") && 
                !email.value.ends_with("@subsidiary.com")
            });
        }
        false
    }

    fn is_privileged_group(&self, group: &Group) -> bool {
        let privileged_patterns = ["admin", "security", "hr", "finance", "executive"];
        privileged_patterns.iter().any(|pattern| {
            group.display_name.to_lowercase().contains(pattern)
        })
    }
}

// Supporting types and client
struct WorkflowClient {
    base_url: String,
    api_key: String,
    client: reqwest::Client,
}

impl WorkflowClient {
    fn new(base_url: String, api_key: String) -> Self {
        Self {
            base_url,
            api_key,
            client: reqwest::Client::new(),
        }
    }

    async fn check_approval_status(&self, request: &ApprovalRequest) -> Result<ApprovalStatus, Box<dyn std::error::Error>> {
        let response = self.client
            .get(&format!("{}/approvals/{}", self.base_url, request.get_id()))
            .header("Authorization", format!("Bearer {}", self.api_key))
            .send()
            .await?;
        
        Ok(response.json().await?)
    }

    async fn create_approval_request(&self, request: &ApprovalRequest) -> Result<ApprovalStatus, Box<dyn std::error::Error>> {
        let response = self.client
            .post(&format!("{}/approvals", self.base_url))
            .header("Authorization", format!("Bearer {}", self.api_key))
            .json(request)
            .send()
            .await?;
        
        Ok(response.json().await?)
    }
}

#[derive(serde::Serialize, serde::Deserialize)]
struct ApprovalRequest {
    request_type: String,
    tenant_id: String,
    requester: String,
    subject: String,
    details: serde_json::Value,
}

impl ApprovalRequest {
    fn get_id(&self) -> String {
        // Generate ID based on request content
        format!("{}_{}_{}_{}", 
            self.request_type, 
            self.tenant_id, 
            self.requester, 
            self.subject
        )
    }
}

#[derive(serde::Deserialize)]
struct ApprovalStatus {
    status: String,
    reason: Option<String>,
    approved_by: Option<String>,
    approved_at: Option<String>,
}
}

Testing Advanced Validators

#![allow(unused)]
fn main() {
#[cfg(test)]
mod tests {
    use super::*;
    use tokio_test;
    use wiremock::{MockServer, Mock, ResponseTemplate};

    #[tokio::test]
    async fn test_external_validation_service() {
        // Setup mock HR system
        let mock_server = MockServer::start().await;
        
        Mock::given(wiremock::matchers::method("GET"))
            .and(wiremock::matchers::path("/employees/EMP123456"))
            .respond_with(ResponseTemplate::new(200).set_body_json(json!({
                "employee_id": "EMP123456",
                "status": "ACTIVE",
                "department": "Engineering",
                "manager_id": "MGR789"
            })))
            .mount(&mock_server)
            .await;

        let validator = ExternalValidationService::new(
            mock_server.uri(),
            "http://compliance.test".to_string(),
            "test-api-key".to_string(),
        );

        let mut user = User::default();
        user.extension_attributes = Some(serde_json::json!({
            "employeeNumber": "EMP123456",
            "department": "Engineering"
        }).as_object().unwrap().clone());

        let context = ValidationContext::default();
        let result = validator.validate_user(&user, &context).await;
        assert!(result.is_ok());
    }

    #[tokio::test]
    async fn test_conditional_validation() {
        let validator = ConditionalValidator::new();
        
        // Test contractor without end date
        let mut contractor = User::default();
        contractor.extension_attributes = Some(serde_json::json!({
            "userType": "Contractor"
        }).as_object().unwrap().clone());

        let context = ValidationContext::default();
        let result = validator.validate_user(&contractor, &context).await;
        assert!(result.is_err());
        assert_eq!(result.unwrap_err().code, "MISSING_END_DATE");

        // Test contractor with end date
        contractor.extension_attributes = Some(serde_json::json!({
            "userType": "Contractor",
            "employmentEndDate": "2024-12-31"
        }).as_object().unwrap().clone());

        let result = validator.validate_user(&contractor, &context).await;
        assert!(result.is_ok());
    }
}
}

Usage Examples

use scim_server::ScimServerBuilder;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let server = ScimServerBuilder::new()
        .with_provider(my_provider)
        .add_validator(ExternalValidationService::new(
            "https://hr.company.com/api".to_string(),
            "https://compliance.company.com/api".to_string(),
            std::env::var("API_KEY")?,
        ))
        .add_validator(ConditionalValidator::new())
        .add_validator(WorkflowValidator::new(
            "https://workflow.company.com/api".to_string(),
            std::env::var("WORKFLOW_API_KEY")?,
        ))
        .build();

    server.run().await?;
    Ok(())
}

Next Steps

• [Field-

Field-Level Validation

This guide covers granular validation at the field and attribute level, allowing you to implement custom validation logic for specific user attributes, custom extensions, and complex data types.

Custom Attribute Validators

The field-level validation system allows you to register validators for specific attributes:

#![allow(unused)]
fn main() {
use scim_server::validation::{FieldValidator, ValidationContext, ValidationError};
use std::collections::HashMap;
use regex::Regex;
use async_trait::async_trait;

pub struct CustomAttributeValidator {
    validators: HashMap<String, Box<dyn FieldValidator + Send + Sync>>,
}

#[async_trait]
pub trait FieldValidator {
    async fn validate(
        &self,
        field_name: &str,
        value: &serde_json::Value,
        context: &ValidationContext,
    ) -> Result<(), ValidationError>;
}

impl CustomAttributeValidator {
    pub fn new() -> Self {
        let mut validators = HashMap::new();
        
        // Phone number validator
        validators.insert(
            "phoneNumbers".to_string(),
            Box::new(PhoneNumberValidator::new()) as Box<dyn FieldValidator + Send + Sync>
        );
        
        // Social Security Number validator
        validators.insert(
            "enterpriseUser:ssn".to_string(),
            Box::new(SsnValidator::new()) as Box<dyn FieldValidator + Send + Sync>
        );
        
        // Employee ID validator
        validators.insert(
            "enterpriseUser:employeeNumber".to_string(),
            Box::new(EmployeeIdValidator::new()) as Box<dyn FieldValidator + Send + Sync>
        );
        
        // Custom business identifier validator
        validators.insert(
            "enterpriseUser:businessId".to_string(),
            Box::new(BusinessIdentifierValidator::new()) as Box<dyn FieldValidator + Send + Sync>
        );
        
        Self { validators }
    }
    
    pub async fn validate_field(
        &self,
        field_name: &str,
        value: &serde_json::Value,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        if let Some(validator) = self.validators.get(field_name) {
            validator.validate(field_name, value, context).await?;
        }
        
        Ok(())
    }
}
}

Phone Number Validation

Comprehensive phone number validation with international format support:

#![allow(unused)]
fn main() {
pub struct PhoneNumberValidator {
    allowed_countries: Vec<String>,
    phone_regex: Regex,
    external_validation_enabled: bool,
}

impl PhoneNumberValidator {
    pub fn new() -> Self {
        Self {
            allowed_countries: vec![
                "US".to_string(), 
                "CA".to_string(), 
                "GB".to_string(),
                "DE".to_string(),
                "FR".to_string(),
            ],
            phone_regex: Regex::new(r"^\+[1-9]\d{1,14}$").unwrap(),
            external_validation_enabled: true,
        }
    }
    
    pub fn with_allowed_countries(mut self, countries: Vec<String>) -> Self {
        self.allowed_countries = countries;
        self
    }
    
    pub fn disable_external_validation(mut self) -> Self {
        self.external_validation_enabled = false;
        self
    }
}

#[async_trait]
impl FieldValidator for PhoneNumberValidator {
    async fn validate(
        &self,
        field_name: &str,
        value: &serde_json::Value,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        if let Some(phone_numbers) = value.as_array() {
            for (index, phone_obj) in phone_numbers.iter().enumerate() {
                if let Some(phone_value) = phone_obj.get("value").and_then(|v| v.as_str()) {
                    self.validate_single_phone(phone_value, field_name, index).await?;
                }
            }
        } else if let Some(phone_value) = value.as_str() {
            // Handle direct string value
            self.validate_single_phone(phone_value, field_name, 0).await?;
        }
        
        Ok(())
    }
}

impl PhoneNumberValidator {
    async fn validate_single_phone(
        &self,
        phone_value: &str,
        field_name: &str,
        index: usize,
    ) -> Result<(), ValidationError> {
        let field_path = if field_name.contains("phoneNumbers") {
            format!("{}[{}].value", field_name, index)
        } else {
            field_name.to_string()
        };
        
        // Basic format validation
        if !self.phone_regex.is_match(phone_value) {
            return Err(ValidationError::new(
                "INVALID_PHONE_FORMAT",
                "Phone number must be in international format (+1234567890)",
            ).with_field(&field_path));
        }
        
        // Extract and validate country code
        let country_code = self.extract_country_code(phone_value)?;
        if !self.is_allowed_country_code(&country_code) {
            return Err(ValidationError::new(
                "INVALID_COUNTRY_CODE",
                &format!("Phone number country code '{}' is not allowed", country_code),
            ).with_field(&field_path));
        }
        
        // Validate phone number length for specific countries
        self.validate_country_specific_length(phone_value, &country_code, &field_path)?;
        
        // External validation if enabled
        if self.external_validation_enabled {
            self.validate_with_external_service(phone_value, &field_path).await?;
        }
        
        Ok(())
    }
    
    fn extract_country_code(&self, phone_value: &str) -> Result<String, ValidationError> {
        if phone_value.len() < 2 {
            return Err(ValidationError::new(
                "INVALID_PHONE_LENGTH",
                "Phone number too short",
            ));
        }
        
        // Common country codes
        for length in [1, 2, 3] {
            if phone_value.len() > length {
                let potential_code = &phone_value[1..=length];
                if self.is_valid_country_code(potential_code) {
                    return Ok(potential_code.to_string());
                }
            }
        }
        
        Err(ValidationError::new(
            "UNKNOWN_COUNTRY_CODE",
            "Unable to determine country code",
        ))
    }
    
    fn is_valid_country_code(&self, code: &str) -> bool {
        // Common country codes
        let valid_codes = [
            "1", "7", "20", "27", "30", "31", "32", "33", "34", "36", "39", "40", "41", 
            "43", "44", "45", "46", "47", "48", "49", "51", "52", "53", "54", "55", "56", 
            "57", "58", "60", "61", "62", "63", "64", "65", "66", "81", "82", "84", "86", 
            "90", "91", "92", "93", "94", "95", "98", "212", "213", "216", "218", "220", 
            "221", "222", "223", "224", "225", "226", "227", "228", "229", "230", "231", 
            "232", "233", "234", "235", "236", "237", "238", "239", "240", "241", "242", 
            "243", "244", "245", "246", "247", "248", "249", "250", "251", "252", "253", 
            "254", "255", "256", "257", "258", "260", "261", "262", "263", "264", "265", 
            "266", "267", "268", "269", "290", "291", "297", "298", "299", "350", "351", 
            "352", "353", "354", "355", "356", "357", "358", "359", "370", "371", "372", 
            "373", "374", "375", "376", "377", "378", "380", "381", "382", "383", "385", 
            "386", "387", "389", "420", "421", "423", "500", "501", "502", "503", "504", 
            "505", "506", "507", "508", "509", "590", "591", "592", "593", "594", "595", 
            "596", "597", "598", "599", "670", "672", "673", "674", "675", "676", "677", 
            "678", "679", "680", "681", "682", "683", "684", "685", "686", "687", "688", 
            "689", "690", "691", "692", "850", "852", "853", "855", "856", "880", "886", 
            "960", "961", "962", "963", "964", "965", "966", "967", "968", "970", "971", 
            "972", "973", "974", "975", "976", "977", "992", "993", "994", "995", "996", 
            "998"
        ];
        
        valid_codes.contains(&code)
    }
    
    fn is_allowed_country_code(&self, country_code: &str) -> bool {
        match country_code {
            "1" => self.allowed_countries.contains(&"US".to_string()) || 
                   self.allowed_countries.contains(&"CA".to_string()),
            "44" => self.allowed_countries.contains(&"GB".to_string()),
            "49" => self.allowed_countries.contains(&"DE".to_string()),
            "33" => self.allowed_countries.contains(&"FR".to_string()),
            _ => true, // Allow other countries by default
        }
    }
    
    fn validate_country_specific_length(
        &self,
        phone_value: &str,
        country_code: &str,
        field_path: &str,
    ) -> Result<(), ValidationError> {
        let expected_lengths = match country_code {
            "1" => vec![11], // US/Canada: +1 + 10 digits
            "44" => vec![13], // UK: +44 + 10-11 digits
            "49" => vec![12, 13], // Germany: +49 + 10-11 digits
            "33" => vec![12], // France: +33 + 9 digits
            _ => return Ok(()), // Skip validation for other countries
        };
        
        if !expected_lengths.contains(&phone_value.len()) {
            return Err(ValidationError::new(
                "INVALID_PHONE_LENGTH",
                &format!("Invalid phone number length for country code {}", country_code),
            ).with_field(field_path));
        }
        
        Ok(())
    }
    
    async fn validate_with_external_service(
        &self,
        phone_number: &str,
        field_path: &str,
    ) -> Result<(), ValidationError> {
        let client = reqwest::Client::new();
        let response = client
            .get(&format!("https://api.phonevalidation.com/validate/{}", phone_number))
            .timeout(std::time::Duration::from_secs(3))
            .send()
            .await
            .map_err(|_| ValidationError::new(
                "PHONE_VALIDATION_SERVICE_ERROR",
                "Unable to validate phone number with external service",
            ).with_field(field_path))?;
        
        if !response.status().is_success() {
            return Err(ValidationError::new(
                "INVALID_PHONE_NUMBER",
                "Phone number validation failed",
            ).with_field(field_path));
        }
        
        // Parse validation response
        let validation_result: PhoneValidationResult = response.json().await
            .map_err(|_| ValidationError::new(
                "PHONE_VALIDATION_PARSE_ERROR",
                "Failed to parse phone validation response",
            ).with_field(field_path))?;
        
        if !validation_result.is_valid {
            return Err(ValidationError::new(
                "INVALID_PHONE_NUMBER",
                &validation_result.reason.unwrap_or_else(|| "Phone number is invalid".to_string()),
            ).with_field(field_path));
        }
        
        Ok(())
    }
}

#[derive(serde::Deserialize)]
struct PhoneValidationResult {
    is_valid: bool,
    reason: Option<String>,
    carrier: Option<String>,
    line_type: Option<String>,
}
}

Social Security Number Validation

Comprehensive SSN validation with format and uniqueness checks:

#![allow(unused)]
fn main() {
pub struct SsnValidator {
    allow_itin: bool,
    check_uniqueness: bool,
}

impl SsnValidator {
    pub fn new() -> Self {
        Self {
            allow_itin: false,
            check_uniqueness: true,
        }
    }
    
    pub fn allow_itin(mut self, allow: bool) -> Self {
        self.allow_itin = allow;
        self
    }
    
    pub fn check_uniqueness(mut self, check: bool) -> Self {
        self.check_uniqueness = check;
        self
    }
    
    fn validate_ssn_format(&self, ssn: &str) -> Result<(), ValidationError> {
        // Remove hyphens and spaces
        let cleaned = ssn.replace(['-', ' '], "");
        
        // Must be exactly 9 digits
        if cleaned.len() != 9 || !cleaned.chars().all(|c| c.is_ascii_digit()) {
            return Err(ValidationError::new(
                "INVALID_SSN_FORMAT",
                "SSN must be 9 digits (XXX-XX-XXXX format)",
            ));
        }
        
        // Extract area, group, and serial numbers
        let area = &cleaned[0..3];
        let group = &cleaned[3..5];
        let serial = &cleaned[5..9];
        
        // Validate area number
        self.validate_area_number(area)?;
        
        // Validate group number
        self.validate_group_number(group)?;
        
        // Validate serial number
        self.validate_serial_number(serial)?;
        
        // Check for invalid patterns
        self.validate_patterns(&cleaned)?;
        
        Ok(())
    }
    
    fn validate_area_number(&self, area: &str) -> Result<(), ValidationError> {
        let area_num: u32 = area.parse().unwrap_or(0);
        
        // Invalid area numbers
        if area_num == 0 || area_num == 666 || area_num >= 900 {
            return Err(ValidationError::new(
                "INVALID_SSN_AREA",
                "Invalid SSN area number",
            ));
        }
        
        // Check if it's an ITIN (Individual Taxpayer Identification Number)
        if area_num >= 900 && area_num <= 999 {
            if !self.allow_itin {
                return Err(ValidationError::new(
                    "ITIN_NOT_ALLOWED",
                    "Individual Taxpayer Identification Numbers (ITIN) are not allowed",
                ));
            }
        }
        
        Ok(())
    }
    
    fn validate_group_number(&self, group: &str) -> Result<(), ValidationError> {
        let group_num: u32 = group.parse().unwrap_or(0);
        
        if group_num == 0 {
            return Err(ValidationError::new(
                "INVALID_SSN_GROUP",
                "Invalid SSN group number (cannot be 00)",
            ));
        }
        
        Ok(())
    }
    
    fn validate_serial_number(&self, serial: &str) -> Result<(), ValidationError> {
        let serial_num: u32 = serial.parse().unwrap_or(0);
        
        if serial_num == 0 {
            return Err(ValidationError::new(
                "INVALID_SSN_SERIAL",
                "Invalid SSN serial number (cannot be 0000)",
            ));
        }
        
        Ok(())
    }
    
    fn validate_patterns(&self, ssn: &str) -> Result<(), ValidationError> {
        // Invalid SSN patterns
        let invalid_patterns = [
            "000000000", "111111111", "222222222", "333333333",
            "444444444", "555555555", "666666666", "777777777",
            "888888888", "999999999", "123456789", "987654321"
        ];
        
        if invalid_patterns.contains(&ssn) {
            return Err(ValidationError::new(
                "INVALID_SSN_PATTERN",
                "SSN contains an invalid pattern",
            ));
        }
        
        // Check for consecutive digits
        if self.has_consecutive_pattern(ssn) {
            return Err(ValidationError::new(
                "INVALID_SSN_PATTERN",
                "SSN cannot contain repetitive patterns",
            ));
        }
        
        Ok(())
    }
    
    fn has_consecutive_pattern(&self, ssn: &str) -> bool {
        let chars: Vec<char> = ssn.chars().collect();
        
        // Check for all same digits
        if chars.iter().all(|&c| c == chars[0]) {
            return true;
        }
        
        // Check for ascending/descending sequences
        for window in chars.windows(3) {
            if window[0] as u8 + 1 == window[1] as u8 && window[1] as u8 + 1 == window[2] as u8 {
                return true; // Ascending sequence
            }
            if window[0] as u8 == window[1] as u8 + 1 && window[1] as u8 == window[2] as u8 + 1 {
                return true; // Descending sequence
            }
        }
        
        false
    }
}

#[async_trait]
impl FieldValidator for SsnValidator {
    async fn validate(
        &self,
        field_name: &str,
        value: &serde_json::Value,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        if let Some(ssn) = value.as_str() {
            // Validate format
            self.validate_ssn_format(ssn)
                .map_err(|mut e| {
                    e.field_path = Some(field_name.to_string());
                    e
                })?;
            
            // Check uniqueness if enabled
            if self.check_uniqueness {
                // Note: This would require access to the storage provider
                // In practice, you'd inject the storage provider into the validator
                if let Some(storage) = context.storage.as_ref() {
                    if storage.ssn_exists(&context.tenant_id, ssn).await.unwrap_or(false) {
                        return Err(ValidationError::new(
                            "SSN_ALREADY_EXISTS",
                            "Social Security Number is already in use",
                        ).with_field(field_name));
                    }
                }
            }
        }
        
        Ok(())
    }
}
}

Employee ID Validation

Custom business identifier validation:

#![allow(unused)]
fn main() {
pub struct EmployeeIdValidator {
    format_regex: Regex,
    department_prefixes: HashMap<String, String>,
    check_uniqueness: bool,
}

impl EmployeeIdValidator {
    pub fn new() -> Self {
        let mut department_prefixes = HashMap::new();
        department_prefixes.insert("Engineering".to_string(), "ENG".to_string());
        department_prefixes.insert("Sales".to_string(), "SAL".to_string());
        department_prefixes.insert("Marketing".to_string(), "MKT".to_string());
        department_prefixes.insert("HR".to_string(), "HRS".to_string());
        department_prefixes.insert("Finance".to_string(), "FIN".to_string());
        
        Self {
            format_regex: Regex::new(r"^[A-Z]{3}\d{5}$").unwrap(),
            department_prefixes,
            check_uniqueness: true,
        }
    }
    
    pub fn with_custom_format(mut self, regex: &str) -> Result<Self, regex::Error> {
        self.format_regex = Regex::new(regex)?;
        Ok(self)
    }
    
    fn validate_format(&self, employee_id: &str) -> Result<(), ValidationError> {
        if !self.format_regex.is_match(employee_id) {
            return Err(ValidationError::new(
                "INVALID_EMPLOYEE_ID_FORMAT",
                "Employee ID must follow format: 3 letters + 5 digits (e.g., ENG12345)",
            ));
        }
        
        Ok(())
    }
    
    fn validate_department_prefix(
        &self,
        employee_id: &str,
        user_department: Option<&str>,
    ) -> Result<(), ValidationError> {
        if let Some(department) = user_department {
            if let Some(expected_prefix) = self.department_prefixes.get(department) {
                let prefix = &employee_id[0..3];
                if prefix != expected_prefix {
                    return Err(ValidationError::new(
                        "EMPLOYEE_ID_DEPARTMENT_MISMATCH",
                        &format!(
                            "Employee ID prefix '{}' does not match department '{}' (expected '{}')",
                            prefix, department, expected_prefix
                        ),
                    ));
                }
            }
        }
        
        Ok(())
    }
    
    fn validate_sequence_number(&self, employee_id: &str) -> Result<(), ValidationError> {
        let sequence = &employee_id[3..8];
        let sequence_num: u32 = sequence.parse().unwrap_or(0);
        
        // Sequence number cannot be 00000
        if sequence_num == 0 {
            return Err(ValidationError::new(
                "INVALID_EMPLOYEE_ID_SEQUENCE",
                "Employee ID sequence number cannot be 00000",
            ));
        }
        
        // Validate reasonable range (e.g., 00001-99999)
        if sequence_num > 99999 {
            return Err(ValidationError::new(
                "INVALID_EMPLOYEE_ID_SEQUENCE",
                "Employee ID sequence number must be between 00001 and 99999",
            ));
        }
        
        Ok(())
    }
}

#[async_trait]
impl FieldValidator for EmployeeIdValidator {
    async fn validate(
        &self,
        field_name: &str,
        value: &serde_json::Value,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        if let Some(employee_id) = value.as_str() {
            // Validate format
            self.validate_format(employee_id)
                .map_err(|mut e| {
                    e.field_path = Some(field_name.to_string());
                    e
                })?;
            
            // Validate sequence number
            self.validate_sequence_number(employee_id)
                .map_err(|mut e| {
                    e.field_path = Some(field_name.to_string());
                    e
                })?;
            
            // Validate department prefix if user has department info
            if let Some(user_data) = context.additional_data.get("user") {
                if let Some(department) = user_data.get("department").and_then(|v| v.as_str()) {
                    self.validate_department_prefix(employee_id, Some(department))
                        .map_err(|mut e| {
                            e.field_path = Some(field_name.to_string());
                            e
                        })?;
                }
            }
            
            // Check uniqueness
            if self.check_uniqueness {
                if let Some(storage) = context.storage.as_ref() {
                    if storage.employee_id_exists(&context.tenant_id, employee_id).await.unwrap_or(false) {
                        return Err(ValidationError::new(
                            "EMPLOYEE_ID_ALREADY_EXISTS",
                            "Employee ID is already in use",
                        ).with_field(field_name));
                    }
                }
            }
        }
        
        Ok(())
    }
}
}

Credit Card Validation (for Financial Applications)

If your application handles financial data:

#![allow(unused)]
fn main() {
pub struct CreditCardValidator {
    allowed_types: Vec<CreditCardType>,
    validate_luhn: bool,
}

#[derive(Debug, Clone, PartialEq)]
pub enum CreditCardType {
    Visa,
    MasterCard,
    AmericanExpress,
    Discover,
    DinersClub,
    JCB,
}

impl CreditCardValidator {
    pub fn new() -> Self {
        Self {
            allowed_types: vec![
                CreditCardType::Visa,
                CreditCardType::MasterCard,
                CreditCardType::AmericanExpress,
            ],
            validate_luhn: true,
        }
    }
    
    pub fn with_allowed_types(mut self, types: Vec<CreditCardType>) -> Self {
        self.allowed_types = types;
        self
    }
    
    fn detect_card_type(&self, number: &str) -> Option<CreditCardType> {
        match number {
            n if n.starts_with('4') => Some(CreditCardType::Visa),
            n if n.starts_with("51") || n.starts_with("52") || n.starts_with("53") || 
                 n.starts_with("54") || n.starts_with("55") => Some(CreditCardType::MasterCard),
            n if n.starts_with("34") || n.starts_with("37") => Some(CreditCardType::AmericanExpress),
            n if n.starts_with("6011") || n.starts_with("65") => Some(CreditCardType::Discover),
            n if n.starts_with("300") || n.starts_with("301") || n.starts_with("302") ||
                 n.starts_with("303") || n.starts_with("36") || n.starts_with("38") => Some(CreditCardType::DinersClub),
            n if n.starts_with("35") => Some(CreditCardType::JCB),
            _ => None,
        }
    }
    
    fn validate_luhn_algorithm(&self, number: &str) -> bool {
        let digits: Vec<u32> = number.chars()
            .filter_map(|c| c.to_digit(10))
            .collect();
        
        if digits.is_empty() {
            return false;
        }
        
        let checksum = digits.iter()
            .rev()
            .enumerate()
            .map(|(i, &digit)| {
                if i % 2 == 1 {
                    let doubled = digit * 2;
                    if doubled > 9 { doubled - 9 } else { doubled }
                } else {
                    digit
                }
            })
            .sum::<u32>();
        
        checksum % 10 == 0
    }
    
    fn validate_length(&self, number: &str, card_type: &CreditCardType) -> bool {
        match card_type {
            CreditCardType::Visa => number.len() == 13 || number.len() == 16 || number.len() == 19,
            CreditCardType::MasterCard => number.len() == 16,
            CreditCardType::AmericanExpress => number.len() == 15,
            CreditCardType::Discover => number.len() == 16,
            CreditCardType::DinersClub => number.len() == 14,
            CreditCardType::JCB => number.len() == 15 || number.len() == 16,
        }
    }
}

#[async_trait]
impl FieldValidator for CreditCardValidator {
    async fn validate(
        &self,
        field_name: &str,
        value: &serde_json::Value,
        _context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        if let Some(card_number) = value.as_str() {
            // Remove spaces and hyphens
            let cleaned_number = card_number.replace([' ', '-'], "");
            
            // Validate format (digits only)
            if !cleaned_number.chars().all(|c| c.is_ascii_digit()) {
                return Err(ValidationError::new(
                    "INVALID_CREDIT_CARD_FORMAT",
                    "Credit card number must contain only digits",
                ).with_field(field_name));
            }
            
            // Detect card type
            let card_type = self.detect_card_type(&cleaned_number)
                .ok_or_else(|| ValidationError::new(
                    "UNSUPPORTED_CREDIT_CARD_TYPE",
                    "Unsupported credit card type",
                ).with_field(field_name))?;
            
            // Check if card type is allowed
            if !self.allowed_types.contains(&card_type) {
                return Err(ValidationError::new(
                    "CREDIT_CARD_TYPE_NOT_ALLOWED",
                    &format!("Credit card type {:?} is not allowed", card_type),
                ).with_field(field_name));
            }
            
            // Validate length for card type
            if !self.validate_length(&cleaned_number, &card_type) {
                return Err(ValidationError::new(
                    "INVALID_CREDIT_CARD_LENGTH",
                    &format!("Invalid length for {:?} credit card", card_type),
                ).with_field(field_name));
            }
            
            // Validate using Luhn algorithm
            if self.validate_luhn && !self.validate_luhn_algorithm(&cleaned_number) {
                return Err(ValidationError::new(
                    "INVALID_CREDIT_CARD_CHECKSUM",
                    "Credit card number failed checksum validation",
                ).with_field(field_name));
            }
        }
        
        Ok(())
    }
}
}

Integration with Custom Validators

Use field-level validators within your main custom validators:

#![allow(unused)]
fn main() {
use scim_server::validation::{CustomValidator, ValidationContext, ValidationError};

pub struct ComprehensiveUserValidator {
    field_validator: CustomAttributeValidator,
}

impl ComprehensiveUserValidator {
    pub fn new() -> Self {
        Self {
            field_validator: CustomAttributeValidator::new(),
        }
    }
}

#[async_trait]
impl CustomValidator for ComprehensiveUserValidator {
    async fn validate_user(
        &self,
        user: &User,
        context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Validate phone numbers
        if let Some(phone_numbers) = &user.phone_numbers {
            let phone_value = serde_json::to_value(phone_numbers).unwrap();
            self.field_validator
                .validate_field("phoneNumbers", &phone_value, context)
                .await?;
        }
        
        // Validate enterprise extensions
        if let Some(enterprise_ext) = &user.extension_attributes {
            for (key, value) in enterprise_ext {
                let field_name = format!("enterpriseUser:{}", key);
                self.field_validator
                    .validate_field(&field_name, value, context)
                    .await?;
}

Validation Configuration

This guide covers configurable validation rules that can be dynamically managed and applied at runtime. Instead of hardcoding validation logic, you can define rules through configuration that can be updated without code changes.

Configuration-Driven Validation

Validation Configuration Structure

#![allow(unused)]
fn main() {
use scim_server::validation::{ValidationConfig, ValidationRule, RuleEngine};
use serde::{Deserialize, Serialize};
use std::collections::HashMap;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ValidationConfig {
    pub tenant_id: String,
    pub rules: Vec<ValidationRule>,
    pub external_validators: Vec<ExternalValidatorConfig>,
    pub field_validators: HashMap<String, FieldValidatorConfig>,
    pub global_settings: GlobalValidationSettings,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ValidationRule {
    pub id: String,
    pub name: String,
    pub description: String,
    pub enabled: bool,
    pub severity: ValidationSeverity,
    pub resource_types: Vec<String>, // ["User", "Group"]
    pub operations: Vec<String>,     // ["create", "update", "patch"]
    pub conditions: Vec<RuleCondition>,
    pub actions: Vec<ValidationAction>,
    pub priority: u32,
    pub tags: Vec<String>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum ValidationSeverity {
    Error,   // Blocks the operation
    Warning, // Logs but allows operation
    Info,    // Informational only
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RuleCondition {
    pub field: String,
    pub operator: ConditionOperator,
    pub value: serde_json::Value,
    pub case_sensitive: bool,
    pub negate: bool, // NOT condition
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum ConditionOperator {
    Equals,
    NotEquals,
    Contains,
    StartsWith,
    EndsWith,
    Regex,
    Length,
    GreaterThan,
    LessThan,
    In,
    NotIn,
    Exists,
    NotExists,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum ValidationAction {
    Block { message: String },
    Warn { message: String },
    Log { level: String, message: String },
    Transform { field: String, transformation: String },
    Notify { recipients: Vec<String>, template: String },
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct GlobalValidationSettings {
    pub max_validation_time_ms: u64,
    pub fail_fast: bool,
    pub enable_external_validation: bool,
    pub cache_validation_results: bool,
    pub cache_ttl_seconds: u64,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ExternalValidatorConfig {
    pub name: String,
    pub url: String,
    pub timeout_ms: u64,
    pub retry_count: u32,
    pub headers: HashMap<String, String>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct FieldValidatorConfig {
    pub validator_type: String,
    pub config: serde_json::Value,
    pub enabled: bool,
}
}

Rule Engine Implementation

Core Rule Engine

#![allow(unused)]
fn main() {
use async_trait::async_trait;
use std::time::{Duration, Instant};
use tokio::time::timeout;

pub struct RuleEngine {
    config: ValidationConfig,
    cache: Option<ValidationCache>,
}

impl RuleEngine {
    pub fn new(config: ValidationConfig) -> Self {
        let cache = if config.global_settings.cache_validation_results {
            Some(ValidationCache::new(
                Duration::from_secs(config.global_settings.cache_ttl_seconds)
            ))
        } else {
            None
        };

        Self { config, cache }
    }

    pub async fn validate_resource(
        &self,
        resource: &dyn ScimResource,
        context: &ValidationContext,
    ) -> Result<ValidationResult, ValidationError> {
        let start_time = Instant::now();
        let max_duration = Duration::from_millis(self.config.global_settings.max_validation_time_ms);

        // Check cache first
        if let Some(cache) = &self.cache {
            if let Some(cached_result) = cache.get(resource, context).await {
                return Ok(cached_result);
            }
        }

        // Run validation with timeout
        let validation_future = self.validate_internal(resource, context);
        let result = timeout(max_duration, validation_future)
            .await
            .map_err(|_| ValidationError::new(
                "VALIDATION_TIMEOUT",
                "Validation exceeded maximum allowed time",
            ))??;

        // Cache successful results
        if let Some(cache) = &self.cache {
            if result.is_valid() {
                cache.put(resource, context, &result).await;
            }
        }

        Ok(result)
    }

    async fn validate_internal(
        &self,
        resource: &dyn ScimResource,
        context: &ValidationContext,
    ) -> Result<ValidationResult, ValidationError> {
        let mut validation_result = ValidationResult::new();
        let applicable_rules = self.get_applicable_rules(resource, context);

        for rule in applicable_rules {
            if !rule.enabled {
                continue;
            }

            match self.evaluate_rule(rule, resource, context).await {
                Ok(rule_result) => {
                    validation_result.merge(rule_result);
                    
                    // Fail fast if enabled and we have errors
                    if self.config.global_settings.fail_fast && !validation_result.errors.is_empty() {
                        break;
                    }
                }
                Err(e) => {
                    validation_result.add_error(e);
                    if self.config.global_settings.fail_fast {
                        break;
                    }
                }
            }
        }

        Ok(validation_result)
    }

    fn get_applicable_rules(
        &self,
        resource: &dyn ScimResource,
        context: &ValidationContext,
    ) -> Vec<&ValidationRule> {
        let mut applicable_rules: Vec<&ValidationRule> = self.config.rules
            .iter()
            .filter(|rule| {
                // Filter by resource type
                rule.resource_types.is_empty() || 
                rule.resource_types.contains(&resource.resource_type())
            })
            .filter(|rule| {
                // Filter by operation
                rule.operations.is_empty() || 
                rule.operations.contains(&context.operation.to_string())
            })
            .collect();

        // Sort by priority (higher priority first)
        applicable_rules.sort_by(|a, b| b.priority.cmp(&a.priority));
        applicable_rules
    }

    async fn evaluate_rule(
        &self,
        rule: &ValidationRule,
        resource: &dyn ScimResource,
        context: &ValidationContext,
    ) -> Result<ValidationResult, ValidationError> {
        let mut rule_result = ValidationResult::new();

        // Evaluate all conditions (AND logic)
        let conditions_met = self.evaluate_conditions(&rule.conditions, resource, context).await?;

        if conditions_met {
            // Execute actions
            for action in &rule.actions {
                self.execute_action(action, rule, resource, context, &mut rule_result).await?;
            }
        }

        Ok(rule_result)
    }

    async fn evaluate_conditions(
        &self,
        conditions: &[RuleCondition],
        resource: &dyn ScimResource,
        context: &ValidationContext,
    ) -> Result<bool, ValidationError> {
        for condition in conditions {
            let condition_met = self.evaluate_condition(condition, resource, context).await?;
            let final_result = if condition.negate { !condition_met } else { condition_met };
            
            if !final_result {
                return Ok(false); // AND logic - all conditions must be true
            }
        }
        
        Ok(true)
    }

    async fn evaluate_condition(
        &self,
        condition: &RuleCondition,
        resource: &dyn ScimResource,
        _context: &ValidationContext,
    ) -> Result<bool, ValidationError> {
        let field_value = self.extract_field_value(&condition.field, resource)?;

        match &condition.operator {
            ConditionOperator::Equals => {
                Ok(self.compare_values(&field_value, &condition.value, condition.case_sensitive))
            }
            ConditionOperator::NotEquals => {
                Ok(!self.compare_values(&field_value, &condition.value, condition.case_sensitive))
            }
            ConditionOperator::Contains => {
                self.evaluate_contains(&field_value, &condition.value, condition.case_sensitive)
            }
            ConditionOperator::StartsWith => {
                self.evaluate_starts_with(&field_value, &condition.value, condition.case_sensitive)
            }
            ConditionOperator::EndsWith => {
                self.evaluate_ends_with(&field_value, &condition.value, condition.case_sensitive)
            }
            ConditionOperator::Regex => {
                self.evaluate_regex(&field_value, &condition.value)
            }
            ConditionOperator::Length => {
                self.evaluate_length(&field_value, &condition.value)
            }
            ConditionOperator::GreaterThan => {
                self.evaluate_greater_than(&field_value, &condition.value)
            }
            ConditionOperator::LessThan => {
                self.evaluate_less_than(&field_value, &condition.value)
            }
            ConditionOperator::In => {
                self.evaluate_in(&field_value, &condition.value, condition.case_sensitive)
            }
            ConditionOperator::NotIn => {
                Ok(!self.evaluate_in(&field_value, &condition.value, condition.case_sensitive)?)
            }
            ConditionOperator::Exists => {
                Ok(!field_value.is_null())
            }
            ConditionOperator::NotExists => {
                Ok(field_value.is_null())
            }
        }
    }

    fn extract_field_value(
        &self,
        field_path: &str,
        resource: &dyn ScimResource,
    ) -> Result<serde_json::Value, ValidationError> {
        let resource_json = serde_json::to_value(resource)
            .map_err(|e| ValidationError::new(
                "FIELD_EXTRACTION_ERROR",
                &format!("Failed to serialize resource: {}", e),
            ))?;

        self.extract_nested_value(&resource_json, field_path)
    }

    fn extract_nested_value(
        &self,
        value: &serde_json::Value,
        path: &str,
    ) -> Result<serde_json::Value, ValidationError> {
        let parts: Vec<&str> = path.split('.').collect();
        let mut current = value;

        for part in parts {
            // Handle array access like "emails[0].value"
            if let Some(bracket_pos) = part.find('[') {
                let field_name = &part[..bracket_pos];
                let index_part = &part[bracket_pos + 1..part.len() - 1];
                let index: usize = index_part.parse()
                    .map_err(|_| ValidationError::new(
                        "INVALID_ARRAY_INDEX",
                        &format!("Invalid array index: {}", index_part),
                    ))?;

                current = current.get(field_name)
                    .and_then(|v| v.as_array())
                    .and_then(|arr| arr.get(index))
                    .unwrap_or(&serde_json::Value::Null);
            } else {
                current = current.get(part).unwrap_or(&serde_json::Value::Null);
            }
        }

        Ok(current.clone())
    }

    // Condition evaluation helper methods
    fn compare_values(
        &self,
        field_value: &serde_json::Value,
        condition_value: &serde_json::Value,
        case_sensitive: bool,
    ) -> bool {
        if !case_sensitive {
            if let (Some(field_str), Some(condition_str)) = (field_value.as_str(), condition_value.as_str()) {
                return field_str.to_lowercase() == condition_str.to_lowercase();
            }
        }
        field_value == condition_value
    }

    fn evaluate_contains(
        &self,
        field_value: &serde_json::Value,
        condition_value: &serde_json::Value,
        case_sensitive: bool,
    ) -> Result<bool, ValidationError> {
        if let (Some(field_str), Some(condition_str)) = (field_value.as_str(), condition_value.as_str()) {
            if case_sensitive {
                Ok(field_str.contains(condition_str))
            } else {
                Ok(field_str.to_lowercase().contains(&condition_str.to_lowercase()))
            }
        } else {
            Ok(false)
        }
    }

    fn evaluate_starts_with(
        &self,
        field_value: &serde_json::Value,
        condition_value: &serde_json::Value,
        case_sensitive: bool,
    ) -> Result<bool, ValidationError> {
        if let (Some(field_str), Some(condition_str)) = (field_value.as_str(), condition_value.as_str()) {
            if case_sensitive {
                Ok(field_str.starts_with(condition_str))
            } else {
                Ok(field_str.to_lowercase().starts_with(&condition_str.to_lowercase()))
            }
        } else {
            Ok(false)
        }
    }

    fn evaluate_ends_with(
        &self,
        field_value: &serde_json::Value,
        condition_value: &serde_json::Value,
        case_sensitive: bool,
    ) -> Result<bool, ValidationError> {
        if let (Some(field_str), Some(condition_str)) = (field_value.as_str(), condition_value.as_str()) {
            if case_sensitive {
                Ok(field_str.ends_with(condition_str))
            } else {
                Ok(field_str.to_lowercase().ends_with(&condition_str.to_lowercase()))
            }
        } else {
            Ok(false)
        }
    }

    fn evaluate_regex(
        &self,
        field_value: &serde_json::Value,
        condition_value: &serde_json::Value,
    ) -> Result<bool, ValidationError> {
        if let (Some(field_str), Some(pattern_str)) = (field_value.as_str(), condition_value.as_str()) {
            let regex = regex::Regex::new(pattern_str)
                .map_err(|e| ValidationError::new(
                    "INVALID_REGEX",
                    &format!("Invalid regex pattern: {}", e),
                ))?;
            Ok(regex.is_match(field_str))
        } else {
            Ok(false)
        }
    }

    fn evaluate_length(
        &self,
        field_value: &serde_json::Value,
        condition_value: &serde_json::Value,
    ) -> Result<bool, ValidationError> {
        let field_length = match field_value {
            serde_json::Value::String(s) => s.len(),
            serde_json::Value::Array(arr) => arr.len(),
            _ => return Ok(false),
        };

        if let Some(expected_length) = condition_value.as_u64() {
            Ok(field_length == expected_length as usize)
        } else {
            Ok(false)
        }
    }

    fn evaluate_greater_than(
        &self,
        field_value: &serde_json::Value,
        condition_value: &serde_json::Value,
    ) -> Result<bool, ValidationError> {
        match (field_value.as_f64(), condition_value.as_f64()) {
            (Some(field_num), Some(condition_num)) => Ok(field_num > condition_num),
            _ => Ok(false),
        }
    }

    fn evaluate_less_than(
        &self,
        field_value: &serde_json::Value,
        condition_value: &serde_json::Value,
    ) -> Result<bool, ValidationError> {
        match (field_value.as_f64(), condition_value.as_f64()) {
            (Some(field_num), Some(condition_num)) => Ok(field_num < condition_num),
            _ => Ok(false),
        }
    }

    fn evaluate_in(
        &self,
        field_value: &serde_json::Value,
        condition_value: &serde_json::Value,
        case_sensitive: bool,
    ) -> Result<bool, ValidationError> {
        if let Some(values_array) = condition_value.as_array() {
            for value in values_array {
                if self.compare_values(field_value, value, case_sensitive) {
                    return Ok(true);
                }
            }
        }
        Ok(false)
    }

    async fn execute_action(
        &self,
        action: &ValidationAction,
        rule: &ValidationRule,
        resource: &dyn ScimResource,
        context: &ValidationContext,
        result: &mut ValidationResult,
    ) -> Result<(), ValidationError> {
        match action {
            ValidationAction::Block { message } => {
                let error = ValidationError::new(
                    &format!("RULE_VIOLATION_{}", rule.id.to_uppercase()),
                    message,
                ).with_severity(ValidationSeverity::Error);
                result.add_error(error);
            }
            ValidationAction::Warn { message } => {
                let warning = ValidationError::new(
                    &format!("RULE_WARNING_{}", rule.id.to_uppercase()),
                    message,
                ).with_severity(ValidationSeverity::Warning);
                result.add_warning(warning);
            }
            ValidationAction::Log { level, message } => {
                self.log_validation_event(level, message, rule, resource, context).await;
            }
            ValidationAction::Transform { field, transformation } => {
                // Transform actions would modify the resource
                // This is advanced functionality that requires careful implementation
                self.apply_transformation(field, transformation, resource, result).await?;
            }
            ValidationAction::Notify { recipients, template } => {
                self.send_notification(recipients, template, rule, resource, context).await?;
            }
        }
        Ok(())
    }

    async fn log_validation_event(
        &self,
        level: &str,
        message: &str,
        rule: &ValidationRule,
        resource: &dyn ScimResource,
        context: &ValidationContext,
    ) {
        // Implementation would depend on your logging system
        match level {
            "error" => log::error!("Validation rule '{}': {} (resource: {}, tenant: {})", 
                rule.name, message, resource.id().unwrap_or("unknown"), context.tenant_id),
            "warn" => log::warn!("Validation rule '{}': {} (resource: {}, tenant: {})", 
                rule.name, message, resource.id().unwrap_or("unknown"), context.tenant_id),
            "info" => log::info!("Validation rule '{}': {} (resource: {}, tenant: {})", 
                rule.name, message, resource.id().unwrap_or("unknown"), context.tenant_id),
            _ => log::debug!("Validation rule '{}': {} (resource: {}, tenant: {})", 
                rule.name, message, resource.id().unwrap_or("unknown"), context.tenant_id),
        }
    }

    async fn apply_transformation(
        &self,
        _field: &str,
        _transformation: &str,
        _resource: &dyn ScimResource,
        _result: &mut ValidationResult,
    ) -> Result<(), ValidationError> {
        // Transformation implementation would be complex and resource-specific
        // For now, we'll just log that a transformation was requested
        log::info!("Transformation requested but not implemented");
        Ok(())
    }

    async fn send_notification(
        &self,
        _recipients: &[String],
        _template: &str,
        _rule: &ValidationRule,
        _resource: &dyn ScimResource,
        _context: &ValidationContext,
    ) -> Result<(), ValidationError> {
        // Notification implementation would depend on your notification system
        log::info!("Notification requested but not implemented");
        Ok(())
    }
}
}

Configuration Examples

Sample Validation Configuration

# validation-config.yaml
tenant_id: "company-123"

global_settings:
  max_validation_time_ms: 5000
  fail_fast: false
  enable_external_validation: true
  cache_validation_results: true
  cache_ttl_seconds: 300

rules:
  - id: "email_domain_check"
    name: "Email Domain Validation"
    description: "Ensure users have company email domains"
    enabled: true
    severity: "Error"
    resource_types: ["User"]
    operations: ["create", "update"]
    priority: 100
    conditions:
      - field: "emails[0].value"
        operator: "Regex"
        value: ".*@(company\\.com|subsidiary\\.com)$"
        case_sensitive: false
        negate: false
    actions:
      - Block:
          message: "Users must have a company email address (@company.com or @subsidiary.com)"

  - id: "manager_hierarchy_check"
    name: "Manager Hierarchy Validation"
    description: "Prevent circular manager relationships"
    enabled: true
    severity: "Error"
    resource_types: ["User"]
    operations: ["update", "patch"]
    priority: 90
    conditions:
      - field: "enterpriseUser.manager.value"
        operator: "Exists"
        value: null
        case_sensitive: false
        negate: false
    actions:
      - Block:
          message: "Manager assignment would create a circular reference"
      - Log:
          level: "warn"
          message: "Attempted circular manager assignment detected"

  - id: "contractor_end_date"
    name: "Contractor End Date Required"
    description: "Contractors must have employment end date"
    enabled: true
    severity: "Error"
    resource_types: ["User"]
    operations: ["create", "update"]
    priority: 80
    conditions:
      - field: "enterpriseUser.employeeType"
        operator: "Equals"
        value: "Contractor"
        case_sensitive: false
        negate: false
      - field: "enterpriseUser.employmentEndDate"
        operator: "NotExists"
        value: null
        case_sensitive: false
        negate: false
    actions:
      - Block:
          message: "Contractors must have an employment end date specified"

  - id: "vip_user_notification"
    name: "VIP User Notification"
    description: "Notify security team when VIP users are modified"
    enabled: true
    severity: "Info"
    resource_types: ["User"]
    operations: ["create", "update", "delete"]
    priority: 50
    conditions:
      - field: "enterpriseUser.vipStatus"
        operator: "Equals"
        value: true
        case_sensitive: false
        negate: false
    actions:
      - Log:
          level: "info"
          message: "VIP user account modified"
      - Notify:
          recipients: ["security@company.com", "compliance@company.com"]
          template: "vip_user_modification"

  - id: "username_format"
    name: "Username Format Validation"
    description: "Enforce username format standards"
    enabled: true
    severity: "Warning"
    resource_types: ["User"]
    operations: ["create", "update"]
    priority: 70
    conditions:
      - field: "userName"
        operator: "Regex"
        value: "^[a-z]+\\.[a-z]+$"
        case_sensitive: false
        negate: true
    actions:
      - Warn:
          message: "Username should follow format: firstname.lastname (lowercase, no numbers or special characters)"

field_validators:
  phoneNumbers:
    validator_type: "PhoneNumberValidator"
    enabled: true
    config:
      allowed_countries: ["US", "CA", "GB"]
      external_validation: true

  "enterpriseUser:ssn":
    validator_type: "SsnValidator"
    enabled: true
    config:
      allow_itin: false
      check_uniqueness: true

external_validators:
  - name: "hr_system"
    url: "https://hr.company.com/api/validate"
    timeout_ms: 3000
    retry_count: 2
    headers:
      Authorization: "Bearer ${HR_API_TOKEN}"
      Content-Type: "application/json"

Loading Configuration

#![allow(unused)]
fn main() {
use serde_yaml;
use std::fs;

pub struct ConfigurationLoader;

impl ConfigurationLoader {
    pub fn load_from_file(file_path: &str) -> Result<ValidationConfig, Box<dyn std::error::Error>> {
        let config_content = fs::read_to_string(file_path)?;
        let config: ValidationConfig = serde_yaml::from_str(&config_content)?;
        Ok(config)
    }

    pub fn load_from_env() -> Result<ValidationConfig, Box<dyn std::error::Error>> {
        let config_path = std::env::var("VALIDATION_CONFIG_PATH")
            .unwrap_or_else(|_| "validation-config.yaml".to_string());
        Self::load_from_file(&config_path)
    }

    pub async fn load_from_database(
        tenant_id: &str,
        storage: &dyn StorageProvider,
    ) -> Result<ValidationConfig, Box<dyn std::error::Error>> {
        // Load configuration from database
        let config_json = storage.get_tenant_config(tenant_id, "validation").await?;
        let config: ValidationConfig = serde_json::from_str(&config_json)?;
        Ok(config)
    }
}
}

Dynamic Rule Management

Rule Management API

#![allow(unused)]
fn main() {
use scim_server::validation::{ValidationConfig, ValidationRule, RuleEngine};

pub struct ValidationRuleManager {
    storage: Box<dyn StorageProvider>,
    rule_engines: std::sync::RwLock<HashMap<String, RuleEngine>>, // tenant_id -> RuleEngine
}

impl ValidationRuleManager {
    pub fn new(storage: Box<dyn StorageProvider>) -> Self {
        Self {
            storage,
            rule_engines: std::sync::RwLock::new(HashMap::new()),
        }
    }

    pub async fn add_rule(
        &self,
        tenant_id: &str,
        rule: ValidationRule,
    ) -> Result<(), ValidationError> {
        // Validate rule configuration
        self.validate_rule_config(&rule)?;

        // Save to storage
        self.storage.save_validation_rule(tenant_id, &rule).await?;

        // Reload configuration for tenant
        self.reload_tenant_config(tenant_id).await?;

        Ok(())
    }

    pub async fn update_rule(
        &self,
        tenant_id: &str,
        rule_id: &str,
        updated_rule: ValidationRule,
    ) -> Result<(), ValidationError> {
        if updated_rule.id != rule_id {
            return Err(ValidationError::new(
                "RULE_ID_MISMATCH",
                "Rule ID in path does not match rule ID in body",
            ));
        }

        self.validate_rule_config(&updated_rule)?;
        self.storage.update_validation_rule(tenant_id, &updated_rule).await?;
        self.reload_tenant_config(tenant_id).await?;

        Ok(())
    }

    pub async fn delete_rule(
        &self,
        tenant_id: &str,
        rule_id: &str,
    ) -> Result<(), ValidationError> {
        self.storage.delete_validation_rule(tenant_id, rule_id).await?;
        self.reload_tenant_config(tenant_id).await?;
        Ok(())
    }

    pub async fn toggle_rule(
        &self,
        tenant_id: &str,
        rule_id: &str,
        enabled: bool,
    ) -> Result<(), ValidationError> {
        self.storage.toggle_validation_rule(tenant_id, rule_id, enabled).await?;
        self.reload_tenant_config(tenant_id).await?;
        Ok(())
    }

    pub async fn get_rule_engine(&self, tenant_id: &str) -> Result<RuleEngine, ValidationError> {
        // Check if we have a cached rule engine
        {
            let engines = self.rule_engines.read().unwrap();
            if let Some(engine) = engines.get(tenant_id) {
                return Ok(engine.clone());
            }
        }

        // Load configuration and create new engine
        let config = self.load_tenant_config(tenant_id).await?;
        let engine = RuleEngine::new(config);

        // Cache the engine
        {
            let mut engines = self.rule_engines.write().unwrap();
            engines.insert(tenant_id.to_string(), engine.clone());
        }

        Ok(engine)
    }

    async fn reload_tenant_config(&self, tenant_id: &str) -> Result<(), ValidationError> {
        let config = self.load_tenant_config(tenant_id).await?;
        let engine = RuleEngine::new(config);

        let mut engines = self.rule_engines.write().unwrap();
        engines.insert(tenant_id.to_string(), engine);

        Ok(())
    }

    async fn load_tenant_config(&self, tenant_id: &str) -> Result<ValidationConfig, ValidationError> {
        self.storage.get_validation_config(tenant_id).await
            .map_err(|e| ValidationError::new(
                "CONFIG_LOAD_ERROR",
                &format!("Failed to load validation config: {}", e),
            ))
    }

    fn validate_rule_config(&self, rule: &ValidationRule) -> Result<(), ValidationError> {
        // Validate rule ID
        if rule.id.is_empty() {
            return Err(ValidationError::new(
                "INVALID_RULE_ID",
                "Rule ID cannot be empty",
            ));
        }

        // Validate conditions
        for condition in &rule.conditions {
            if condition.field.is_empty() {
                return Err(ValidationError::new(
                    "INVALID_CONDITION_FIELD",
                    "Condition field cannot be empty",
                ));
            }

            // Validate regex patterns
            if matches!(condition.operator, ConditionOperator::Regex) {
                if let Some(pattern) = condition.value.as_str() {
                    regex::Regex::new(pattern).map_err(|e| ValidationError::new(
                        "INVALID_REGEX_PATTERN",
                        &format!("Invalid regex pattern: {}", e),
                    ))?;
                }
            }
        }

        // Validate actions
        if rule.actions.is_empty() {
            return Err(ValidationError::new(
                "NO_ACTIONS_DEFINED",
                "Rule must have at least one action",
            ));
        }

        Ok(())
    }
}
}

Usage Examples

Basic Usage

use scim_server::validation::{ValidationRuleManager, RuleEngine};

#[tokio::main]
async fn main() -> Result<(), Box

Provider Architecture

This document explains the two-layer architecture of the SCIM Server library and how storage and resource providers work together.

Overview

The SCIM Server uses a clean separation between storage concerns and SCIM protocol logic through two main abstractions:

┌─────────────────────────────────────────────┐
│                SCIM Server                  │
├─────────────────────────────────────────────┤
│           ResourceProvider Layer            │
│  (SCIM protocol logic, validation, etc.)   │
├─────────────────────────────────────────────┤
│           StorageProvider Layer             │
│    (Pure data persistence operations)      │
└─────────────────────────────────────────────┘

Two-Layer Architecture

StorageProvider Layer (Low-Level)

The StorageProvider trait defines pure data persistence operations that are protocol-agnostic:

#![allow(unused)]
fn main() {
pub trait StorageProvider: Send + Sync {
    type Error: std::error::Error + Send + Sync + 'static;

    // Core operations
    async fn put(&self, key: StorageKey, data: Value) -> Result<Value, Self::Error>;
    async fn get(&self, key: StorageKey) -> Result<Option<Value>, Self::Error>;
    async fn delete(&self, key: StorageKey) -> Result<bool, Self::Error>;
    
    // Query operations
    async fn list(&self, prefix: StoragePrefix, offset: usize, limit: usize) 
        -> Result<Vec<(StorageKey, Value)>, Self::Error>;
    async fn find_by_attribute(&self, prefix: StoragePrefix, attribute: &str, value: &str) 
        -> Result<Vec<(StorageKey, Value)>, Self::Error>;
    async fn exists(&self, key: StorageKey) -> Result<bool, Self::Error>;
    async fn count(&self, prefix: StoragePrefix) -> Result<usize, Self::Error>;
}
}

Responsibilities:

• Pure PUT/GET/DELETE operations on JSON data
• Tenant isolation through hierarchical keys
• Basic querying and filtering
• Data persistence and retrieval

Not Responsible For:

• SCIM metadata generation (timestamps, versions, etc.)
• SCIM validation rules
• Business logic (limits, permissions, etc.)
• Protocol-specific transformations

ResourceProvider Layer (High-Level)

The ResourceProvider trait defines SCIM-aware operations:

#![allow(unused)]
fn main() {
pub trait ResourceProvider: Send + Sync {
    type Error: std::error::Error + Send + Sync + 'static;

    // SCIM operations
    async fn create_resource(&self, resource_type: &str, data: Value, context: &RequestContext) 
        -> Result<Resource, Self::Error>;
    async fn get_resource(&self, resource_type: &str, id: &str, context: &RequestContext) 
        -> Result<Option<Resource>, Self::Error>;
    async fn update_resource(&self, resource_type: &str, id: &str, data: Value, context: &RequestContext) 
        -> Result<Resource, Self::Error>;
    async fn delete_resource(&self, resource_type: &str, id: &str, context: &RequestContext) 
        -> Result<bool, Self::Error>;
    async fn list_resources(&self, resource_type: &str, query: Option<ListQuery>, context: &RequestContext) 
        -> Result<Vec<Resource>, Self::Error>;
    async fn find_resource_by_attribute(&self, resource_type: &str, attribute: &str, value: &Value, context: &RequestContext) 
        -> Result<Option<Resource>, Self::Error>;
    async fn patch_resource(&self, resource_type: &str, id: &str, patch: Value, context: &RequestContext) 
        -> Result<Resource, Self::Error>;
}
}

Responsibilities:

• SCIM metadata generation (timestamps, ETags, versions)
• SCIM validation and business rules
• Request context handling (tenant isolation)
• Resource type management
• Patch operation processing
• Error translation from storage to SCIM errors

Key Design Principles

1. Separation of Concerns

Storage Layer handles "where" and "how" data is stored:

• Database connections
• File systems
• Memory structures
• Indexing and optimization

Resource Layer handles "what" the data means:

• SCIM protocol compliance
• Resource validation
• Metadata management
• Business logic

2. PUT/GET/DELETE Model

The storage layer uses a simple model where CREATE and UPDATE are both PUT operations:

#![allow(unused)]
fn main() {
// Both create and update use the same operation
let stored = storage.put(key, data).await?;
}

The distinction between "create" vs "update" is business logic that belongs in the ResourceProvider layer.

3. Tenant Isolation

All storage operations are scoped by tenant through the StorageKey structure:

#![allow(unused)]
fn main() {
pub struct StorageKey {
    tenant_id: String,      // "tenant-1" or "default"
    resource_type: String,  // "User", "Group", etc.
    resource_id: String,    // "user-123"
}
}

This provides natural tenant isolation without requiring complex tenant management systems.

4. Context-Driven Operations

The ResourceProvider uses RequestContext to determine operational mode:

#![allow(unused)]
fn main() {
// Single-tenant operation
let context = RequestContext::with_generated_id();

// Multi-tenant operation  
let tenant_context = TenantContext::new("tenant-1".to_string(), "client-1".to_string());
let context = RequestContext::with_tenant_generated_id(tenant_context);
}

Implementation Patterns

Standard Provider Pattern

The most common pattern is using StandardResourceProvider with a pluggable storage backend:

#![allow(unused)]
fn main() {
use scim_server::{
    providers::StandardResourceProvider,
    storage::InMemoryStorage,
};

// Create storage backend
let storage = InMemoryStorage::new();

// Create resource provider with storage
let provider = StandardResourceProvider::new(storage);
}

Direct Implementation Pattern

For simple use cases, you can implement ResourceProvider directly:

#![allow(unused)]
fn main() {
use scim_server::{
    providers::InMemoryProvider,
    resource::ResourceProvider,
};

// Direct implementation (deprecated in favor of StandardResourceProvider)
let provider = InMemoryProvider::new();
}

Available Implementations

Storage Providers

1. InMemoryStorage

   • Thread-safe in-memory storage using HashMap
   • Suitable for testing and development
   • No persistence across restarts

2. Custom Storage (implement StorageProvider)

   • Database backends (PostgreSQL, MySQL, etc.)
   • File-based storage
   • Cloud storage systems
   • Distributed storage systems

Resource Providers

1. StandardResourceProvider

   • Production-ready implementation
   • Works with any StorageProvider
   • Full SCIM protocol support
   • Automatic tenant isolation

2. InMemoryProvider (Legacy)

   • Direct in-memory implementation
   • Deprecated in favor of StandardResourceProvider + InMemoryStorage
   • Maintained for backward compatibility

1. HTTP Request → SCIM Server
2. SCIM Server → ResourceProvider.create_resource()
3. ResourceProvider:
   - Validates SCIM data
   - Generates metadata (timestamps, ETag)
   - Determines tenant from RequestContext
   - Creates StorageKey
4. ResourceProvider → StorageProvider.put()
5. StorageProvider:
   - Stores JSON data at key
   - Returns stored data
6. ResourceProvider:
   - Creates Resource from stored data
   - Returns Resource to SCIM Server
7. SCIM Server → HTTP Response

#![allow(unused)]
fn main() {
pub enum StorageError {
    NotFound(String),
    Conflict(String),
    Internal(String),
    // ...
}
}

#![allow(unused)]
fn main() {
// Each provider defines its own error type
impl From<StorageError> for MyProviderError {
    fn from(storage_error: StorageError) -> Self {
        // Transform storage errors to provider errors
    }
}
}

Storage Layout:
├── tenant-1/
│   ├── User/
│   │   ├── user-123 → {user data}
│   │   └── user-456 → {user data}
│   └── Group/
│       └── group-789 → {group data}
├── tenant-2/
│   ├── User/
│   │   └── user-123 → {different user data}
│   └── Group/
└── default/  (single-tenant mode)
    ├── User/
    └── Group/

#![allow(unused)]
fn main() {
fn effective_tenant_id(context: &RequestContext) -> &str {
    context.tenant_context
        .as_ref()
        .map(|tc| tc.tenant_id.as_str())
        .unwrap_or("default")
}
}

#![allow(unused)]
fn main() {
#[tokio::test]
async fn test_storage_operations() {
    let storage = MyStorage::new();
    let key = StorageKey::new("tenant1", "User", "123");
    let data = json!({"userName": "test"});
    
    // Test put/get/delete cycle
    storage.put(key.clone(), data.clone()).await.unwrap();
    let retrieved = storage.get(key.clone()).await.unwrap();
    assert_eq!(retrieved, Some(data));
}
}

#![allow(unused)]
fn main() {
#[tokio::test]
async fn test_full_stack() {
    let storage = InMemoryStorage::new();
    let provider = StandardResourceProvider::new(storage);
    let context = RequestContext::with_generated_id();
    
    let user = provider.create_resource(
        "User",
        json!({"userName": "test"}),
        &context,
    ).await.unwrap();
    
    assert!(user.get_id().is_some());
}
}

#![allow(unused)]
fn main() {
struct MyDatabaseStorage {
    pool: ConnectionPool,
}

impl StorageProvider for MyDatabaseStorage {
    type Error = MyStorageError;
    
    async fn put(&self, key: StorageKey, data: Value) -> Result<Value, Self::Error> {
        // Database-specific implementation
    }
    
    // ... implement other methods
}
}

#![allow(unused)]
fn main() {
struct CustomResourceProvider<S> {
    storage: S,
    validator: CustomValidator,
}

impl<S: StorageProvider> ResourceProvider for CustomResourceProvider<S> {
    type Error = CustomProviderError;
    
    async fn create_resource(&self, resource_type: &str, data: Value, context: &RequestContext) -> Result<Resource, Self::Error> {
        // Custom validation and processing
        self.validator.validate(&data)?;
        
        // Delegate to storage
        let key = self.build_key(resource_type, context);
        let stored = self.storage.put(key, data).await?;
        
        // Custom post-processing
        Ok(Resource::from_json(resource_type.to_string(), stored)?)
    }
}
}

use scim_server::{
    providers::StandardResourceProvider,
    storage::InMemoryStorage,
    resource::{RequestContext, ResourceProvider},
};
use serde_json::json;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Create storage backend
    let storage = InMemoryStorage::new();
    
    // Create provider with storage
    let provider = StandardResourceProvider::new(storage);
    
    // Create a user
    let context = RequestContext::with_generated_id();
    let user = provider.create_resource(
        "User",
        json!({
            "userName": "john.doe",
            "displayName": "John Doe",
            "emails": [{
                "value": "john@example.com",
                "primary": true
            }]
        }),
        &context,
    ).await?;
    
    println!("Created user: {}", user.get_id().unwrap());
    Ok(())
}

use scim_server::{
    providers::StandardResourceProvider,
    storage::InMemoryStorage,
    resource::{RequestContext, TenantContext, ResourceProvider},
};
use serde_json::json;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let storage = InMemoryStorage::new();
    let provider = StandardResourceProvider::new(storage);
    
    // Create tenant context
    let tenant_context = TenantContext::new(
        "tenant-1".to_string(),
        "client-1".to_string(),
    );
    let context = RequestContext::with_tenant_generated_id(tenant_context);
    
    // Create user in specific tenant
    let user = provider.create_resource(
        "User",
        json!({
            "userName": "alice@tenant1.com",
            "displayName": "Alice"
        }),
        &context,
    ).await?;
    
    // Users are automatically isolated by tenant
    println!("Created user in tenant-1: {}", user.get_id().unwrap());
    Ok(())
}

#![allow(unused)]
fn main() {
use scim_server::storage::{StorageProvider, StorageKey, StoragePrefix, StorageError};
use serde_json::Value;
use std::collections::HashMap;
use std::sync::Arc;
use tokio::sync::RwLock;

#[derive(Clone)]
pub struct CustomStorage {
    data: Arc<RwLock<HashMap<String, Value>>>,
}

impl CustomStorage {
    pub fn new() -> Self {
        Self {
            data: Arc::new(RwLock::new(HashMap::new())),
        }
    }
    
    fn key_string(key: &StorageKey) -> String {
        format!("{}/{}/{}", key.tenant_id(), key.resource_type(), key.resource_id())
    }
}

impl StorageProvider for CustomStorage {
    type Error = StorageError;
    
    async fn put(&self, key: StorageKey, data: Value) -> Result<Value, Self::Error> {
        let key_str = Self::key_string(&key);
        let mut store = self.data.write().await;
        store.insert(key_str, data.clone());
        Ok(data)
    }
    
    async fn get(&self, key: StorageKey) -> Result<Option<Value>, Self::Error> {
        let key_str = Self::key_string(&key);
        let store = self.data.read().await;
        Ok(store.get(&key_str).cloned())
    }
    
    async fn delete(&self, key: StorageKey) -> Result<bool, Self::Error> {
        let key_str = Self::key_string(&key);
        let mut store = self.data.write().await;
        Ok(store.remove(&key_str).is_some())
    }
    
    async fn list(
        &self,
        prefix: StoragePrefix,
        offset: usize,
        limit: usize,
    ) -> Result<Vec<(StorageKey, Value)>, Self::Error> {
        let prefix_str = format!("{}/{}/", prefix.tenant_id(), prefix.resource_type());
        let store = self.data.read().await;
        
        let mut results: Vec<_> = store
            .iter()
            .filter(|(k, _)| k.starts_with(&prefix_str))
            .skip(offset)
            .take(limit)
            .map(|(k, v)| {
                let parts: Vec<&str> = k.split('/').collect();
                let key = StorageKey::new(&parts[0], &parts[1], &parts[2]);
                (key, v.clone())
            })
            .collect();
            
        // Sort for consistent ordering
        results.sort_by(|a, b| a.0.resource_id().cmp(b.0.resource_id()));
        Ok(results)
    }
    
    async fn find_by_attribute(
        &self,
        prefix: StoragePrefix,
        attribute: &str,
        value: &str,
    ) -> Result<Vec<(StorageKey, Value)>, Self::Error> {
        let prefix_str = format!("{}/{}/", prefix.tenant_id(), prefix.resource_type());
        let store = self.data.read().await;
        
        let results: Vec<_> = store
            .iter()
            .filter(|(k, v)| {
                k.starts_with(&prefix_str) && 
                self.matches_attribute(v, attribute, value)
            })
            .map(|(k, v)| {
                let parts: Vec<&str> = k.split('/').collect();
                let key = StorageKey::new(&parts[0], &parts[1], &parts[2]);
                (key, v.clone())
            })
            .collect();
            
        Ok(results)
    }
    
    async fn exists(&self, key: StorageKey) -> Result<bool, Self::Error> {
        let key_str = Self::key_string(&key);
        let store = self.data.read().await;
        Ok(store.contains_key(&key_str))
    }
    
    async fn count(&self, prefix: StoragePrefix) -> Result<usize, Self::Error> {
        let prefix_str = format!("{}/{}/", prefix.tenant_id(), prefix.resource_type());
        let store = self.data.read().await;
        let count = store.keys().filter(|k| k.starts_with(&prefix_str)).count();
        Ok(count)
    }
}

impl CustomStorage {
    fn matches_attribute(&self, data: &Value, attribute: &str, value: &str) -> bool {
        // Simple attribute matching - you can extend this for nested attributes
        if let Some(attr_value) = data.get(attribute) {
            if let Some(string_value) = attr_value.as_str() {
                return string_value == value;
            }
        }
        false
    }
}
}

use scim_server::providers::StandardResourceProvider;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Use your custom storage
    let storage = CustomStorage::new();
    let provider = StandardResourceProvider::new(storage);
    
    // Now you can use the provider normally
    let context = RequestContext::with_generated_id();
    let user = provider.create_resource(
        "User",
        json!({"userName": "test@example.com"}),
        &context,
    ).await?;
    
    println!("User created with custom storage!");
    Ok(())
}

#![allow(unused)]
fn main() {
use sqlx::{PgPool, Row};
use scim_server::storage::{StorageProvider, StorageKey, StoragePrefix, StorageError};
use serde_json::Value;

#[derive(Clone)]
pub struct PostgresStorage {
    pool: PgPool,
}

impl PostgresStorage {
    pub fn new(pool: PgPool) -> Self {
        Self { pool }
    }
}

impl StorageProvider for PostgresStorage {
    type Error = StorageError;
    
    async fn put(&self, key: StorageKey, data: Value) -> Result<Value, Self::Error> {
        sqlx::query!(
            r#"
            INSERT INTO scim_resources (tenant_id, resource_type, resource_id, data)
            VALUES ($1, $2, $3, $4)
            ON CONFLICT (tenant_id, resource_type, resource_id)
            DO UPDATE SET data = $4, updated_at = NOW()
            "#,
            key.tenant_id(),
            key.resource_type(),
            key.resource_id(),
            data
        )
        .execute(&self.pool)
        .await
        .map_err(|e| StorageError::Internal(e.to_string()))?;
        
        Ok(data)
    }
    
    async fn get(&self, key: StorageKey) -> Result<Option<Value>, Self::Error> {
        let row = sqlx::query!(
            "SELECT data FROM scim_resources WHERE tenant_id = $1 AND resource_type = $2 AND resource_id = $3",
            key.tenant_id(),
            key.resource_type(),
            key.resource_id()
        )
        .fetch_optional(&self.pool)
        .await
        .map_err(|e| StorageError::Internal(e.to_string()))?;
        
        Ok(row.map(|r| r.data))
    }
    
    async fn delete(&self, key: StorageKey) -> Result<bool, Self::Error> {
        let result = sqlx::query!(
            "DELETE FROM scim_resources WHERE tenant_id = $1 AND resource_type = $2 AND resource_id = $3",
            key.tenant_id(),
            key.resource_type(),
            key.resource_id()
        )
        .execute(&self.pool)
        .await
        .map_err(|e| StorageError::Internal(e.to_string()))?;
        
        Ok(result.rows_affected() > 0)
    }
    
    // ... implement other methods
}
}

#![allow(unused)]
fn main() {
use scim_server::storage::StorageError;

// For not found errors
return Err(StorageError::NotFound("Resource not found".to_string()));

// For constraint violations
return Err(StorageError::Conflict("Duplicate key".to_string()));

// For internal errors
return Err(StorageError::Internal(database_error.to_string()));
}

#![allow(unused)]
fn main() {
#[cfg(test)]
mod tests {
    use super::*;
    use scim_server::storage::{StorageKey, StoragePrefix};
    use serde_json::json;
    
    #[tokio::test]
    async fn test_basic_operations() {
        let storage = CustomStorage::new();
        let key = StorageKey::new("tenant1", "User", "123");
        let data = json!({"userName": "test"});
        
        // Test put
        let stored = storage.put(key.clone(), data.clone()).await.unwrap();
        assert_eq!(stored, data);
        
        // Test get
        let retrieved = storage.get(key.clone()).await.unwrap();
        assert_eq!(retrieved, Some(data));
        
        // Test exists
        let exists = storage.exists(key.clone()).await.unwrap();
        assert!(exists);
        
        // Test delete
        let deleted = storage.delete(key.clone()).await.unwrap();
        assert!(deleted);
        
        // Verify deletion
        let after_delete = storage.get(key).await.unwrap();
        assert_eq!(after_delete, None);
    }
    
    #[tokio::test]
    async fn test_tenant_isolation() {
        let storage = CustomStorage::new();
        
        let tenant1_key = StorageKey::new("tenant1", "User", "123");
        let tenant2_key = StorageKey::new("tenant2", "User", "123");
        
        let data1 = json!({"userName": "user1"});
        let data2 = json!({"userName": "user2"});
        
        storage.put(tenant1_key.clone(), data1.clone()).await.unwrap();
        storage.put(tenant2_key.clone(), data2.clone()).await.unwrap();
        
        // Verify isolation
        let retrieved1 = storage.get(tenant1_key).await.unwrap();
        let retrieved2 = storage.get(tenant2_key).await.unwrap();
        
        assert_eq!(retrieved1, Some(data1));
        assert_eq!(retrieved2, Some(data2));
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::{
    providers::StandardResourceProvider,
    storage::InMemoryStorage,
    resource::{RequestContext, ResourceProvider},
};

let storage = InMemoryStorage::new();
let provider = StandardResourceProvider::new(storage);
let context = RequestContext::with_generated_id();

// Create a resource - ETag is automatically generated
let user = provider.create_resource(
    "User",
    json!({
        "userName": "alice@example.com",
        "displayName": "Alice Smith"
    }),
    &context,
).await?;

// The resource now has an ETag in its metadata
println!("ETag: {}", user.get_version().unwrap());
}

#![allow(unused)]
fn main() {
use scim_server::resource::version::{ConditionalResult, ScimVersion};

// Get the current resource with its ETag
let current_user = provider.get_resource("User", "user-123", &context)
    .await?
    .ok_or("User not found")?;

let current_etag = current_user.get_version().unwrap();

// Attempt conditional update
let updated_data = json!({
    "id": "user-123",
    "userName": "alice@example.com",
    "displayName": "Alice Updated"
});

match provider.conditional_update(
    "User",
    "user-123", 
    updated_data,
    &ScimVersion::from_etag(current_etag),
    &context,
).await? {
    ConditionalResult::Success(updated_user) => {
        println!("Update successful: {}", updated_user.get_version().unwrap());
    }
    ConditionalResult::Conflict(conflict) => {
        println!("Version conflict: expected {}, got {}", 
                 conflict.expected_version, 
                 conflict.current_version);
        // Handle conflict - retry, merge, or report error
    }
}
}

#![allow(unused)]
fn main() {
// Delete only if the version matches
match provider.conditional_delete(
    "User",
    "user-123",
    &ScimVersion::from_etag("W/\"abc123\""),
    &context,
).await? {
    ConditionalResult::Success(was_deleted) => {
        if was_deleted {
            println!("User deleted successfully");
        } else {
            println!("User was already deleted");
        }
    }
    ConditionalResult::Conflict(conflict) => {
        println!("Cannot delete: version mismatch");
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::resource::version::VersionCondition;

// If-Match: update only if ETag matches
let condition = VersionCondition::IfMatch(ScimVersion::from_etag("W/\"abc123\""));

// If-None-Match: update only if ETag doesn't match  
let condition = VersionCondition::IfNoneMatch(ScimVersion::from_etag("W/\"xyz789\""));

// Apply condition to update
let result = provider.conditional_update_with_condition(
    "User",
    "user-123",
    updated_data,
    condition,
    &context,
).await?;
}

#![allow(unused)]
fn main() {
use scim_server::resource::version::VersionedResource;

// Create versioned resource
let versioned_user = provider.create_versioned_resource(
    "User",
    user_data,
    &context,
).await?;

println!("Resource version: {}", versioned_user.version);
println!("Created at: {}", versioned_user.resource.get_created().unwrap());
println!("Last modified: {}", versioned_user.resource.get_last_modified().unwrap());

// Get resource with version info
let versioned = provider.get_versioned_resource("User", "user-123", &context).await?;
if let Some(v) = versioned {
    println!("Current version: {}", v.version);
    println!("Resource data: {}", serde_json::to_string_pretty(&v.resource)?);
}
}

#![allow(unused)]
fn main() {
use scim_server::resource::version::VersionHistory;

// Providers can optionally implement version history
pub struct VersionedStorageProvider<S> {
    inner: S,
    version_store: VersionHistory,
}

impl<S: StorageProvider> VersionedStorageProvider<S> {
    async fn get_resource_history(
        &self,
        resource_type: &str,
        id: &str,
        context: &RequestContext,
    ) -> Result<Vec<VersionedResource>, Self::Error> {
        // Return all versions of the resource
        self.version_store.get_history(resource_type, id, context).await
    }
    
    async fn get_resource_at_version(
        &self,
        resource_type: &str,
        id: &str,
        version: &ScimVersion,
        context: &RequestContext,
    ) -> Result<Option<Resource>, Self::Error> {
        // Get resource at specific version
        self.version_store.get_at_version(resource_type, id, version, context).await
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::{ResourceProvider, RequestContext, ConditionalResult};
use futures::future::try_join_all;
use serde_json::json;

// Process multiple user creations
async fn create_multiple_users(
    provider: &impl ResourceProvider,
    tenant_id: &str,
    users_data: Vec<serde_json::Value>
) -> Result<Vec<ScimUser>, Box<dyn std::error::Error>> {
    let context = RequestContext::new("batch-create", None);
    let mut results = Vec::new();
    
    // Sequential processing (safest approach)
    for user_data in users_data {
        let user = provider.create_resource("User", user_data, &context).await?;
        results.push(user);
    }
    
    Ok(results)
}

// Parallel processing (for independent operations)
async fn create_users_parallel(
    provider: &impl ResourceProvider,
    tenant_id: &str,
    users_data: Vec<serde_json::Value>
) -> Result<Vec<ScimUser>, Box<dyn std::error::Error>> {
    let context = RequestContext::new("parallel-create", None);
    
    let futures: Vec<_> = users_data.into_iter()
        .map(|data| provider.create_resource("User", data, &context))
        .collect();
    
    let results = try_join_all(futures).await?;
    Ok(results)
}

// Mixed operations with error handling
async fn process_mixed_operations(
    provider: &impl ResourceProvider,
    tenant_id: &str,
) -> Result<Vec<String>, Box<dyn std::error::Error>> {
    let context = RequestContext::new("mixed-ops", None);
    let mut results = Vec::new();
    
    // Create a new user
    let user_data = json!({
        "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
        "userName": "alice@example.com",
        "displayName": "Alice Smith"
    });
    
    match provider.create_resource("User", user_data, &context).await {
        Ok(user) => {
            let user_id = user.id().unwrap().to_string();
            results.push(format!("Created user: {}", user_id));
            
            // Update the user
            let update_data = json!({
                "displayName": "Alice Johnson"
            });
            
            match provider.update_resource("User", &user_id, update_data, &context).await {
                Ok(_) => results.push(format!("Updated user: {}", user_id)),
                Err(e) => results.push(format!("Failed to update user {}: {}", user_id, e)),
            }
        }
        Err(e) => results.push(format!("Failed to create user: {}", e)),
    }
    
    Ok(results)
}
}

#![allow(unused)]
fn main() {
use scim_server::{ResourceProvider, RequestContext};

struct Operation {
    operation_type: String,
    resource_type: String,
    resource_id: Option<String>,
    data: serde_json::Value,
}

struct CompensatingAction {
    action: String,
    resource_type: String,
    resource_id: String,
}

async fn execute_with_compensation(
    provider: &impl ResourceProvider,
    tenant_id: &str,
    operations: Vec<Operation>
) -> Result<Vec<String>, Box<dyn std::error::Error>> {
    let context = RequestContext::new("compensating-ops", None);
    let mut completed = Vec::new();
    let mut compensations = Vec::new();
    
    for op in operations {
        let result = match op.operation_type.as_str() {
            "CREATE" => {
                match provider.create_resource(&op.resource_type, op.data, &context).await {
                    Ok(resource) => {
                        let id = resource.id().unwrap().to_string();
                        compensations.push(CompensatingAction {
                            action: "DELETE".to_string(),
                            resource_type: op.resource_type.clone(),
                            resource_id: id.clone(),
                        });
                        Ok(format!("Created {}: {}", op.resource_type, id))
                    }
                    Err(e) => Err(e.into())
                }
            }
            "UPDATE" => {
                let id = op.resource_id.unwrap();
                match provider.update_resource(&op.resource_type, &id, op.data, &context).await {
                    Ok(_) => Ok(format!("Updated {}: {}", op.resource_type, id)),
                    Err(e) => Err(e.into())
                }
            }
            _ => Err("Unsupported operation".into())
        };
        
        match result {
            Ok(msg) => completed.push(msg),
            Err(e) => {
                // Rollback completed operations
                for compensation in compensations.iter().rev() {
                    if compensation.action == "DELETE" {
                        let _ = provider.delete_resource(
                            &compensation.resource_type, 
                            &compensation.resource_id, 
                            &context
                        ).await;
                    }
                }
                return Err(e);
            }
        }
    }
    
    Ok(completed)
}
}

#![allow(unused)]
fn main() {
use std::collections::HashMap;

// Batch retrieval pattern
async fn get_multiple_users_by_ids(
    provider: &impl ResourceProvider,
    tenant_id: &str,
    user_ids: Vec<String>
) -> Result<HashMap<String, ScimUser>, Box<dyn std::error::Error>> {
    let context = RequestContext::new("batch-get", None);
    let mut users = HashMap::new();
    
    // For now, individual requests (until batch APIs are implemented)
    for user_id in user_ids {
        match provider.get_resource("User", &user_id, &context).await {
            Ok(Some(user)) => {
                users.insert(user_id, user);
            }
            Ok(None) => {
                // User not found, skip
            }
            Err(e) => {
                eprintln!("Failed to get user {}: {}", user_id, e);
                // Continue with other users
            }
        }
    }
    
    Ok(users)
}
}

#![allow(unused)]
fn main() {
use sqlx::{Pool, Postgres};
use std::time::Duration;

pub struct OptimizedPostgresStorage {
    pool: Pool<Postgres>,
}

impl OptimizedPostgresStorage {
    pub async fn new(database_url: &str) -> Result<Self, sqlx::Error> {
        let pool = sqlx::postgres::PgPoolOptions::new()
            .max_connections(100)
            .min_connections(10)
            .max_lifetime(Duration::from_secs(1800))  // 30 minutes
            .idle_timeout(Duration::from_secs(600))   // 10 minutes
            .acquire_timeout(Duration::from_secs(30))
            .test_before_acquire(true)
            .connect(database_url)
            .await?;
            
        Ok(Self { pool })
    }
}
}

#![allow(unused)]
fn main() {
use tokio::sync::RwLock;
use std::collections::HashMap;
use std::time::{Duration, Instant};

pub struct CachedStorage<S> {
    inner: S,
    cache: Arc<RwLock<HashMap<String, CachedEntry>>>,
    ttl: Duration,
}

struct CachedEntry {
    value: Value,
    inserted_at: Instant,
}

impl<S: StorageProvider> CachedStorage<S> {
    pub fn new(inner: S, ttl: Duration) -> Self {
        Self {
            inner,
            cache: Arc::new(RwLock::new(HashMap::new())),
            ttl,
        }
    }
    
    fn cache_key(&self, key: &StorageKey) -> String {
        format!("{}/{}/{}", key.tenant_id(), key.resource_type(), key.resource_id())
    }
    
    async fn cleanup_expired(&self) {
        let mut cache = self.cache.write().await;
        let now = Instant::now();
        cache.retain(|_, entry| now.duration_since(entry.inserted_at) < self.ttl);
    }
}

impl<S: StorageProvider> StorageProvider for CachedStorage<S> {
    type Error = S::Error;
    
    async fn get(&self, key: StorageKey) -> Result<Option<Value>, Self::Error> {
        let cache_key = self.cache_key(&key);
        
        // Check cache first
        {
            let cache = self.cache.read().await;
            if let Some(entry) = cache.get(&cache_key) {
                let age = Instant::now().duration_since(entry.inserted_at);
                if age < self.ttl {
                    return Ok(Some(entry.value.clone()));
                }
            }
        }
        
        // Cache miss - get from storage
        let result = self.inner.get(key).await?;
        
        // Update cache
        if let Some(ref value) = result {
            let mut cache = self.cache.write().await;
            cache.insert(cache_key, CachedEntry {
                value: value.clone(),
                inserted_at: Instant::now(),
            });
        }
        
        Ok(result)
    }
    
    async fn put(&self, key: StorageKey, data: Value) -> Result<Value, Self::Error> {
        let result = self.inner.put(key.clone(), data).await?;
        
        // Update cache
        let cache_key = self.cache_key(&key);
        let mut cache = self.cache.write().await;
        cache.insert(cache_key, CachedEntry {
            value: result.clone(),
            inserted_at: Instant::now(),
        });
        
        Ok(result)
    }
    
    async fn delete(&self, key: StorageKey) -> Result<bool, Self::Error> {
        let result = self.inner.delete(key.clone()).await?;
        
        // Remove from cache
        let cache_key = self.cache_key(&key);
        let mut cache = self.cache.write().await;
        cache.remove(&cache_key);
        
        Ok(result)
    }
    
    // Implement other methods...
}
}

#![allow(unused)]
fn main() {
use std::collections::BTreeMap;

pub struct IndexedStorage<S> {
    inner: S,
    // Index: (tenant, resource_type, attribute) -> (value -> resource_ids)
    attribute_index: Arc<RwLock<BTreeMap<String, BTreeMap<String, HashSet<String>>>>>,
}

impl<S: StorageProvider> IndexedStorage<S> {
    pub fn new(inner: S) -> Self {
        Self {
            inner,
            attribute_index: Arc::new(RwLock::new(BTreeMap::new())),
        }
    }
    
    fn index_key(&self, prefix: &StoragePrefix, attribute: &str) -> String {
        format!("{}/{}#{}", prefix.tenant_id(), prefix.resource_type(), attribute)
    }
    
    async fn update_index(&self, key: &StorageKey, data: &Value) {
        let mut index = self.attribute_index.write().await;
        
        // Index common searchable attributes
        let searchable_attributes = ["userName", "displayName", "email.value"];
        
        for attr in &searchable_attributes {
            if let Some(attr_value) = self.extract_attribute_value(data, attr) {
                let index_key = self.index_key(
                    &StorageKey::prefix(key.tenant_id(), key.resource_type()),
                    attr
                );
                
                let value_index = index.entry(index_key).or_insert_with(BTreeMap::new);
                let resource_set = value_index.entry(attr_value).or_insert_with(HashSet::new);
                resource_set.insert(key.resource_id().to_string());
            }
        }
    }
    
    fn extract_attribute_value(&self, data: &Value, attribute: &str) -> Option<String> {
        // Simple attribute extraction - can be enhanced for nested attributes
        data.get(attribute)?.as_str().map(|s| s.to_string())
    }
}

impl<S: StorageProvider> StorageProvider for IndexedStorage<S> {
    type Error = S::Error;
    
    async fn find_by_attribute(
        &self,
        prefix: StoragePrefix,
        attribute: &str,
        value: &str,
    ) -> Result<Vec<(StorageKey, Value)>, Self::Error> {
        let index_key = self.index_key(&prefix, attribute);
        
        // Try index first
        {
            let index = self.attribute_index.read().await;
            if let Some(value_index) = index.get(&index_key) {
                if let Some(resource_ids) = value_index.get(value) {
                    // Found in index - get the resources
                    let mut results = Vec::new();
                    for resource_id in resource_ids {
                        let key = StorageKey::new(
                            prefix.tenant_id(),
                            prefix.resource_type(),
                            resource_id
                        );
                        if let Some(data) = self.inner.get(key.clone()).await? {
                            results.push((key, data));
                        }
                    }
                    return Ok(results);
                }
            }
        }
        
        // Fallback to full scan
        self.inner.find_by_attribute(prefix, attribute, value).await
    }
    
    async fn put(&self, key: StorageKey, data: Value) -> Result<Value, Self::Error> {
        let result = self.inner.put(key.clone(), data.clone()).await?;
        
        // Update indexes
        self.update_index(&key, &result).await;
        
        Ok(result)
    }
    
    // Implement other methods with index maintenance...
}
}

#![allow(unused)]
fn main() {
use serde_json::Value;

pub trait ResourceValidator: Send + Sync {
    type Error: std::error::Error + Send + Sync + 'static;
    
    async fn validate_resource(
        &self,
        resource_type: &str,
        data: &Value,
        context: &RequestContext,
    ) -> Result<(), Self::Error>;
    
    async fn validate_update(
        &self,
        resource_type: &str,
        id: &str,
        current: &Value,
        updated: &Value,
        context: &RequestContext,
    ) -> Result<(), Self::Error>;
}

pub struct SchemaValidator {
    schemas: HashMap<String, ResourceSchema>,
}

impl ResourceValidator for SchemaValidator {
    type Error = ValidationError;
    
    async fn validate_resource(
        &self,
        resource_type: &str,
        data: &Value,
        context: &RequestContext,
    ) -> Result<(), Self::Error> {
        let schema = self.schemas.get(resource_type)
            .ok_or_else(|| ValidationError::UnknownResourceType(resource_type.to_string()))?;
        
        // Validate required fields
        for required_field in &schema.required_fields {
            if !data.get(required_field).is_some() {
                return Err(ValidationError::MissingRequiredField(required_field.clone()));
            }
        }
        
        // Validate field types and constraints
        for (field_name, field_schema) in &schema.fields {
            if let Some(field_value) = data.get(field_name) {
                self.validate_field(field_value, field_schema)?;
            }
        }
        
        // Custom business rules
        self.validate_business_rules(resource_type, data, context).await?;
        
        Ok(())
    }
    
    async fn validate_update(
        &self,
        resource_type: &str,
        id: &str,
        current: &Value,
        updated: &Value,
        context: &RequestContext,
    ) -> Result<(), Self::Error> {
        // First validate the updated resource
        self.validate_resource(resource_type, updated, context).await?;
        
        // Check immutable fields
        let schema = self.schemas.get(resource_type).unwrap();
        for immutable_field in &schema.immutable_fields {
            let current_value = current.get(immutable_field);
            let updated_value = updated.get(immutable_field);
            
            if current_value != updated_value {
                return Err(ValidationError::ImmutableFieldModified(immutable_field.clone()));
            }
        }
        
        Ok(())
    }
}

pub struct ValidatingResourceProvider<P, V> {
    inner: P,
    validator: V,
}

impl<P: ResourceProvider, V: ResourceValidator> ResourceProvider for ValidatingResourceProvider<P, V> {
    type Error = CombinedError<P::Error, V::Error>;
    
    async fn create_resource(
        &self,
        resource_type: &str,
        data: Value,
        context: &RequestContext,
    ) -> Result<Resource, Self::Error> {
        // Validate before creation
        self.validator.validate_resource(resource_type, &data, context)
            .await
            .map_err(CombinedError::ValidationError)?;
        
        // Delegate to inner provider
        self.inner.create_resource(resource_type, data, context)
            .await
            .map_err(CombinedError::ProviderError)
    }
    
    async fn update_resource(
        &self,
        resource_type: &str,
        id: &str,
        data: Value,
        context: &RequestContext,
    ) -> Result<Resource, Self::Error> {
        // Get current resource for validation
        let current = self.inner.get_resource(resource_type, id, context)
            .await
            .map_err(CombinedError::ProviderError)?
            .ok_or_else(|| CombinedError::ProviderError(/* NotFound error */))?;
        
        // Validate the update
        self.validator.validate_update(resource_type, id, current.data(), &data, context)
            .await
            .map_err(CombinedError::ValidationError)?;
        
        // Perform update
        self.inner.update_resource(resource_type, id, data, context)
            .await
            .map_err(CombinedError::ProviderError)
    }
    
    // Implement other methods...
}
}

#![allow(unused)]
fn main() {
use tracing::{info, warn, error, instrument, Span};
use std::time::Instant;

pub struct InstrumentedProvider<P> {
    inner: P,
    metrics: Arc<ProviderMetrics>,
}

pub struct ProviderMetrics {
    pub operation_counter: metrics::Counter,
    pub operation_duration: metrics::Histogram,
    pub error_counter: metrics::Counter,
    pub active_operations: metrics::Gauge,
}

impl<P: ResourceProvider> InstrumentedProvider<P> {
    pub fn new(inner: P, metrics: Arc<ProviderMetrics>) -> Self {
        Self { inner, metrics }
    }
}

impl<P: ResourceProvider> ResourceProvider for InstrumentedProvider<P> {
    type Error = P::Error;
    
    #[instrument(skip(self, data, context), fields(
        resource_type = resource_type,
        tenant_id = context.tenant_context.as_ref().map(|t| t.tenant_id.as_str()),
        operation = "create"
    ))]
    async fn create_resource(
        &self,
        resource_type: &str,
        data: Value,
        context: &RequestContext,
    ) -> Result<Resource, Self::Error> {
        let start = Instant::now();
        let _guard = self.metrics.active_operations.increment();
        
        info!("Creating resource");
        
        let result = self.inner.create_resource(resource_type, data, context).await;
        
        let duration = start.elapsed();
        
        match &result {
            Ok(resource) => {
                info!(
                    resource_id = resource.get_id().unwrap_or("unknown"),
                    duration_ms = duration.as_millis(),
                    "Resource created successfully"
                );
                
                self.metrics.operation_counter
                    .with_labels(&[("operation", "create"), ("status", "success")])
                    .increment();
            }
            Err(e) => {
                error!(
                    error = %e,
                    duration_ms = duration.as_millis(),
                    "Failed to create resource"
                );
                
                self.metrics.operation_counter
                    .with_labels(&[("operation", "create"), ("status", "error")])
                    .increment();
                    
                self.metrics.error_counter
                    .with_labels(&[("operation", "create")])
                    .increment();
            }
        }
        
        self.metrics.operation_duration
            .with_labels(&[("operation", "create")])
            .observe(duration.as_secs_f64());
        
        result
    }
    
    // Similar instrumentation for other methods...
}
}

#![allow(unused)]
fn main() {
use serde::{Serialize, Deserialize};
use std::time::{Duration, SystemTime};

#[derive(Debug, Serialize, Deserialize)]
pub struct HealthStatus {
    pub status: HealthState,
    pub version: String,
    pub uptime: Duration,
    pub checks: Vec<HealthCheck>,
}

#[derive(Debug, Serialize, Deserialize)]
pub enum HealthState {
    Healthy,
    Degraded,
    Unhealthy,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct HealthCheck {
    pub name: String,
    pub status: HealthState,
    pub duration: Duration,
    pub message: Option<String>,
}

pub trait HealthProvider {
    async fn health_check(&self) -> Result<HealthStatus, Box<dyn std::error::Error>>;
}

impl<S: StorageProvider> HealthProvider for StandardResourceProvider<S> {
    async fn health_check(&self) -> Result<HealthStatus, Box<dyn std::error::Error>> {
        let start_time = SystemTime::now();
        let mut checks = Vec::new();
        
        // Check storage connectivity
        let storage_check_start = Instant::now();
        let storage_status = match self.test_storage_connectivity().await {
            Ok(_) => HealthState::Healthy,
            Err(e) => {
                checks.push(HealthCheck {
                    name: "storage".to_string(),
                    status: HealthState::Unhealthy,
                    duration: storage_check_start.elapsed(),
                    message: Some(e.to_string()),
                });
                HealthState::Unhealthy
            }
        };
        
        if matches!(storage_status, HealthState::Healthy) {
            checks.push(HealthCheck {
                name: "storage".to_string(),
                status: HealthState::Healthy,
                duration: storage_check_start.elapsed(),
                message: None,
            });
        }
        
        // Check resource operations
        let ops_check_start = Instant::now();
        let ops_status = match self.test_basic_operations().await {
            Ok(_) => HealthState::Healthy,
            Err(e) => {
                checks.push(HealthCheck {
                    name: "operations".to_string(),
                    status: HealthState::Unhealthy,
                    duration: ops_check_start.elapsed(),
                    message: Some(e.to_string()),
                });
                HealthState::Unhealthy
            }
        };
        
        if matches!(ops_status, HealthState::Healthy) {
            checks.push(HealthCheck {
                name: "operations".to_string(),
                status: HealthState::Healthy,
                duration: ops_check_start.elapsed(),
                message: None,
            });
        }
        
        // Determine overall status
        let overall_status = if checks.iter().any(|c| matches!(c.status, HealthState::Unhealthy)) {
            HealthState::Unhealthy
        } else if checks.iter().any(|c| matches!(c.status, HealthState::Degraded)) {
            HealthState::Degraded
        } else {
            HealthState::Healthy
        };
        
        Ok(HealthStatus {
            status: overall_status,
            version: env!("CARGO_PKG_VERSION").to_string(),
            uptime: start_time.elapsed().unwrap_or(Duration::ZERO),
            checks,
        })
    }
}
}

#![allow(unused)]
fn main() {
#[derive(Debug, thiserror::Error)]
pub enum AdvancedProviderError {
    #[error("Storage error: {0}")]
    Storage(#[from] StorageError),
    
    #[error("Validation error: {0}")]
    Validation(#[from] ValidationError),
    
    #[error("Version conflict: expected {expected}, got {current}")]
    VersionConflict { expected: String, current: String },
    
    #[error("Rate limit exceeded: {limit} requests per {window:?}")]
    RateLimitExceeded { limit: u32, window: Duration },
    
    #[error("Quota exceeded: {current}/{limit} resources")]
    QuotaExceeded { current: usize, limit: usize },
    
    #[error("Circuit breaker open: {service}")]
    CircuitBreakerOpen { service: String },
}

// Implement recovery strategies
impl AdvancedProviderError {
    pub fn is_retryable(&self) -> bool {
        matches!(self, 
            Self::Storage(StorageError::Internal(_)) |
            Self::CircuitBreakerOpen { .. }
        )
    }
    
    pub fn retry_delay(&self) -> Option<Duration> {
        match self {
            Self::RateLimitExceeded { window, .. } => Some(*window),
            Self::CircuitBreakerOpen { .. } => Some(Duration::from_secs(5)),
            _ => None,
        }
    }
}
}

#![allow(unused)]
fn main() {
#[derive(Debug, Deserialize)]
pub struct AdvancedProviderConfig {
    pub storage: StorageConfig,
    pub caching: Option<CacheConfig>,
    pub validation: ValidationConfig,
    pub performance: PerformanceConfig,
    pub monitoring: MonitoringConfig,
}

#[derive(Debug, Deserialize)]
pub struct CacheConfig {
    pub enabled: bool,
    pub ttl_seconds: u64,
    pub max_entries: usize,
}

#[derive(Debug, Deserialize)]
pub struct PerformanceConfig {
    pub bulk_batch_size: usize,
    pub connection_pool_size: u32,
    pub query_timeout_seconds: u64,
}

#[derive(Debug, Deserialize)]
pub struct MonitoringConfig {
    pub enable_metrics: bool,
    pub enable_tracing: bool,
    pub health_check_interval_seconds: u64,
}

// Factory function
pub async fn create_advanced_provider(
    config: AdvancedProviderConfig,
) -> Result<Box<dyn ResourceProvider<Error = AdvancedProviderError>>, ConfigError> {
    // Create storage layer
    let storage = create_storage_provider(&config.storage).await?;
    
    // Add caching if configured
    let storage: Box<dyn StorageProvider<Error = StorageError>> = if let Some(cache_config) = config.caching {
        if cache_config.enabled {
            Box::new(CachedStorage::new(
                storage,
                Duration::from_secs(cache_config.ttl_seconds),
            ))
        } else {
            storage
        }
    } else {
        storage
    };
    
    // Create resource provider
    let provider = StandardResourceProvider::new(storage);
    
    // Add validation layer
    let validator = create_validator(&config.validation)?;
    let provider = ValidatingResourceProvider::new(provider, validator);
}

#![allow(unused)]
fn main() {
#[cfg(test)]
mod storage_tests {
    use super::*;
    use scim_server::storage::{StorageProvider, StorageKey, StoragePrefix, StorageError};
    use serde_json::json;
    use tokio_test;

    async fn test_storage_crud<S: StorageProvider>(storage: S) 
    where 
        S::Error: std::fmt::Debug,
    {
        let key = StorageKey::new("test-tenant", "User", "user-123");
        let data = json!({
            "userName": "alice@example.com",
            "displayName": "Alice Smith"
        });

        // Test put operation
        let stored = storage.put(key.clone(), data.clone()).await.unwrap();
        assert_eq!(stored, data);

        // Test get operation
        let retrieved = storage.get(key.clone()).await.unwrap();
        assert_eq!(retrieved, Some(data.clone()));

        // Test exists operation
        let exists = storage.exists(key.clone()).await.unwrap();
        assert!(exists);

        // Test delete operation
        let deleted = storage.delete(key.clone()).await.unwrap();
        assert!(deleted);

        // Verify deletion
        let after_delete = storage.get(key.clone()).await.unwrap();
        assert_eq!(after_delete, None);

        // Test delete non-existent
        let not_deleted = storage.delete(key).await.unwrap();
        assert!(!not_deleted);
    }

    #[tokio::test]
    async fn test_inmemory_storage_crud() {
        let storage = InMemoryStorage::new();
        test_storage_crud(storage).await;
    }

    #[tokio::test]
    async fn test_custom_storage_crud() {
        let storage = MyCustomStorage::new();
        test_storage_crud(storage).await;
    }
}
}

#![allow(unused)]
fn main() {
#[tokio::test]
async fn test_tenant_isolation() {
    let storage = InMemoryStorage::new();
    
    // Create resources in different tenants
    let tenant1_key = StorageKey::new("tenant-1", "User", "user-123");
    let tenant2_key = StorageKey::new("tenant-2", "User", "user-123");
    
    let tenant1_data = json!({"userName": "alice@tenant1.com"});
    let tenant2_data = json!({"userName": "alice@tenant2.com"});
    
    storage.put(tenant1_key.clone(), tenant1_data.clone()).await.unwrap();
    storage.put(tenant2_key.clone(), tenant2_data.clone()).await.unwrap();
    
    // Verify isolation - same resource ID but different tenants
    let retrieved1 = storage.get(tenant1_key).await.unwrap();
    let retrieved2 = storage.get(tenant2_key).await.unwrap();
    
    assert_eq!(retrieved1, Some(tenant1_data));
    assert_eq!(retrieved2, Some(tenant2_data));
    
    // Verify list operations are also isolated
    let prefix1 = StorageKey::prefix("tenant-1", "User");
    let prefix2 = StorageKey::prefix("tenant-2", "User");
    
    let list1 = storage.list(prefix1, 0, 100).await.unwrap();
    let list2 = storage.list(prefix2, 0, 100).await.unwrap();
    
    assert_eq!(list1.len(), 1);
    assert_eq!(list2.len(), 1);
    assert_ne!(list1[0].1, list2[0].1); // Different data
}
}

#![allow(unused)]
fn main() {
#[tokio::test]
async fn test_list_operations() {
    let storage = InMemoryStorage::new();
    let prefix = StorageKey::prefix("tenant-1", "User");
    
    // Create multiple resources
    for i in 1..=10 {
        let key = StorageKey::new("tenant-1", "User", &format!("user-{:03}", i));
        let data = json!({
            "userName": format!("user{}@example.com", i),
            "displayName": format!("User {}", i)
        });
        storage.put(key, data).await.unwrap();
    }
    
    // Test list all
    let all_users = storage.list(prefix.clone(), 0, 100).await.unwrap();
    assert_eq!(all_users.len(), 10);
    
    // Test pagination
    let page1 = storage.list(prefix.clone(), 0, 3).await.unwrap();
    let page2 = storage.list(prefix.clone(), 3, 3).await.unwrap();
    let page3 = storage.list(prefix.clone(), 6, 3).await.unwrap();
    let page4 = storage.list(prefix.clone(), 9, 3).await.unwrap();
    
    assert_eq!(page1.len(), 3);
    assert_eq!(page2.len(), 3);
    assert_eq!(page3.len(), 3);
    assert_eq!(page4.len(), 1);
    
    // Verify no overlap between pages
    let all_ids: HashSet<_> = page1.iter().chain(&page2).chain(&page3).chain(&page4)
        .map(|(key, _)| key.resource_id())
        .collect();
    assert_eq!(all_ids.len(), 10);
}

#[tokio::test]
async fn test_find_by_attribute() {
    let storage = InMemoryStorage::new();
    let prefix = StorageKey::prefix("tenant-1", "User");
    
    // Create test users
    let users = vec![
        ("user-1", "alice@example.com", "Alice Smith"),
        ("user-2", "bob@example.com", "Bob Jones"),
        ("user-3", "alice@company.com", "Alice Johnson"),
    ];
    
    for (id, username, display_name) in users {
        let key = StorageKey::new("tenant-1", "User", id);
        let data = json!({
            "userName": username,
            "displayName": display_name
        });
        storage.put(key, data).await.unwrap();
    }
    
    // Test exact match
    let alice_users = storage.find_by_attribute(
        prefix.clone(),
        "userName",
        "alice@example.com"
    ).await.unwrap();
    assert_eq!(alice_users.len(), 1);
    assert_eq!(alice_users[0].0.resource_id(), "user-1");
    
    // Test no matches
    let no_matches = storage.find_by_attribute(
        prefix.clone(),
        "userName",
        "nonexistent@example.com"
    ).await.unwrap();
    assert_eq!(no_matches.len(), 0);
}
}

#![allow(unused)]
fn main() {
use std::sync::Arc;
use tokio::task::JoinSet;

#[tokio::test]
async fn test_concurrent_access() {
    let storage = Arc::new(InMemoryStorage::new());
    let mut join_set = JoinSet::new();
    
    // Spawn multiple concurrent operations
    for i in 0..10 {
        let storage_clone = Arc::clone(&storage);
        join_set.spawn(async move {
            let key = StorageKey::new("tenant-1", "User", &format!("user-{}", i));
            let data = json!({
                "userName": format!("user{}@example.com", i),
                "displayName": format!("User {}", i)
            });
            
            // Perform multiple operations
            storage_clone.put(key.clone(), data.clone()).await.unwrap();
            let retrieved = storage_clone.get(key.clone()).await.unwrap();
            assert_eq!(retrieved, Some(data));
            
            storage_clone.delete(key).await.unwrap()
        });
    }
    
    // Wait for all operations to complete
    while let Some(result) = join_set.join_next().await {
        result.unwrap(); // Panic if any task failed
    }
    
    // Verify final state
    let prefix = StorageKey::prefix("tenant-1", "User");
    let remaining = storage.list(prefix, 0, 100).await.unwrap();
    assert_eq!(remaining.len(), 0);
}
}

#![allow(unused)]
fn main() {
#[tokio::test]
async fn test_error_handling() {
    let storage = InMemoryStorage::new();
    
    // Test get non-existent resource
    let key = StorageKey::new("tenant-1", "User", "non-existent");
    let result = storage.get(key.clone()).await.unwrap();
    assert_eq!(result, None);
    
    // Test delete non-existent resource
    let deleted = storage.delete(key).await.unwrap();
    assert!(!deleted);
    
    // Test invalid operations (implementation specific)
    // For example, if your storage has size limits:
    // let large_data = json!({"data": "x".repeat(1_000_000)});
    // let result = storage.put(key, large_data).await;
    // assert!(result.is_err());
}
}

#![allow(unused)]
fn main() {
#[cfg(test)]
mod resource_provider_tests {
    use super::*;
    use scim_server::{
        providers::StandardResourceProvider,
        storage::InMemoryStorage,
        resource::{RequestContext, TenantContext, ResourceProvider},
    };
    use serde_json::json;

    #[tokio::test]
    async fn test_resource_metadata_generation() {
        let storage = InMemoryStorage::new();
        let provider = StandardResourceProvider::new(storage);
        let context = RequestContext::with_generated_id();
        
        let user_data = json!({
            "userName": "alice@example.com",
            "displayName": "Alice Smith"
        });
        
        let user = provider.create_resource("User", user_data, &context).await.unwrap();
        
        // Verify SCIM metadata is generated
        assert!(user.get_id().is_some());
        assert!(user.get_created().is_some());
        assert!(user.get_last_modified().is_some());
        assert!(user.get_version().is_some());
        assert_eq!(user.get_username().unwrap(), "alice@example.com");
    }

    #[tokio::test]
    async fn test_tenant_context_handling() {
        let storage = InMemoryStorage::new();
        let provider = StandardResourceProvider::new(storage);
        
        // Single-tenant context
        let single_context = RequestContext::with_generated_id();
        
        // Multi-tenant context
        let tenant_context = TenantContext::new("tenant-1".to_string(), "client-1".to_string());
        let multi_context = RequestContext::with_tenant_generated_id(tenant_context);
        
        let user_data = json!({
            "userName": "alice@example.com",
            "displayName": "Alice Smith"
        });
        
        // Create users in different contexts
        let single_user = provider.create_resource("User", user_data.clone(), &single_context).await.unwrap();
        let multi_user = provider.create_resource("User", user_data, &multi_context).await.unwrap();
        
        // Verify they are isolated
        let single_list = provider.list_resources("User", None, &single_context).await.unwrap();
        let multi_list = provider.list_resources("User", None, &multi_context).await.unwrap();
        
        assert_eq!(single_list.len(), 1);
        assert_eq!(multi_list.len(), 1);
        assert_ne!(single_user.get_id(), multi_user.get_id());
    }

    #[tokio::test]
    async fn test_duplicate_username_handling() {
        let storage = InMemoryStorage::new();
        let provider = StandardResourceProvider::new(storage);
        let context = RequestContext::with_generated_id();
        
        let user_data = json!({
            "userName": "alice@example.com",
            "displayName": "Alice Smith"
        });
        
        // Create first user
        let user1 = provider.create_resource("User", user_data.clone(), &context).await.unwrap();
        
        // Try to create duplicate username
        let result = provider.create_resource("User", user_data, &context).await;
        
        // Should fail with conflict
        assert!(result.is_err());
    }
}
}

#![allow(unused)]
fn main() {
#[tokio::test]
async fn test_conditional_operations() {
    let storage = InMemoryStorage::new();
    let provider = StandardResourceProvider::new(storage);
    let context = RequestContext::with_generated_id();
    
    // Create a user
    let user_data = json!({
        "userName": "alice@example.com",
        "displayName": "Alice Smith"
    });
    
    let user = provider.create_resource("User", user_data, &context).await.unwrap();
    let user_id = user.get_id().unwrap();
    let version = user.get_version().unwrap();
    
    // Test successful conditional update
    let updated_data = json!({
        "id": user_id,
        "userName": "alice@example.com",
        "displayName": "Alice Updated"
    });
    
    let result = provider.conditional_update(
        "User",
        user_id,
        updated_data,
        &ScimVersion::from_etag(version),
        &context,
    ).await.unwrap();
    
    match result {
        ConditionalResult::Success(updated_user) => {
            assert_eq!(updated_user.get_display_name().unwrap(), "Alice Updated");
            assert_ne!(updated_user.get_version().unwrap(), version); // Version should change
        }
        ConditionalResult::Conflict(_) => panic!("Should not have conflict"),
    }
    
    // Test conditional update with wrong version (should conflict)
    let wrong_version_data = json!({
        "id": user_id,
        "userName": "alice@example.com",
        "displayName": "Alice Wrong Version"
    });
    
    let conflict_result = provider.conditional_update(
        "User",
        user_id,
        wrong_version_data,
        &ScimVersion::from_etag(version), // Old version
        &context,
    ).await.unwrap();
    
    match conflict_result {
        ConditionalResult::Success(_) => panic!("Should have conflict"),
        ConditionalResult::Conflict(conflict) => {
            assert_eq!(conflict.expected_version, version);
            assert_ne!(conflict.current_version, version);
        }
    }
}
}

#![allow(unused)]
fn main() {
#[tokio::test]
async fn test_full_scim_workflow() {
    let storage = InMemoryStorage::new();
    let provider = StandardResourceProvider::new(storage);
    let context = RequestContext::with_generated_id();
    
    // Create user
    let create_data = json!({
        "userName": "alice@example.com",
        "name": {
            "givenName": "Alice",
            "familyName": "Smith"
        },
        "emails": [{
            "value": "alice@example.com",
            "primary": true
        }]
    });
    
    let user = provider.create_resource("User", create_data, &context).await.unwrap();
    let user_id = user.get_id().unwrap();
    
    // Read user
    let retrieved = provider.get_resource("User", user_id, &context).await.unwrap();
    assert!(retrieved.is_some());
    let retrieved_user = retrieved.unwrap();
    assert_eq!(retrieved_user.get_username().unwrap(), "alice@example.com");
    
    // Update user
    let update_data = json!({
        "id": user_id,
        "userName": "alice@example.com",
        "name": {
            "givenName": "Alice",
            "familyName": "Johnson"
        },
        "emails": [{
            "value": "alice@example.com",
            "primary": true
        }]
    });
    
    let updated_user = provider.update_resource("User", user_id, update_data, &context).await.unwrap();
    assert_eq!(updated_user.get_family_name().unwrap(), "Johnson");
    
    // List users
    let users = provider.list_resources("User", None, &context).await.unwrap();
    assert_eq!(users.len(), 1);
    
    // Search user
    let found = provider.find_resource_by_attribute(
        "User",
        "userName",
        &json!("alice@example.com"),
        &context,
    ).await.unwrap();
    assert!(found.is_some());
    
    // Delete user
    let deleted = provider.delete_resource("User", user_id, &context).await.unwrap();
    assert!(deleted);
    
    // Verify deletion
    let after_delete = provider.get_resource("User", user_id, &context).await.unwrap();
    assert!(after_delete.is_none());
}
}

#![allow(unused)]
fn main() {
#[tokio::test]
async fn test_multi_tenant_integration() {
    let storage = InMemoryStorage::new();
    let provider = StandardResourceProvider::new(storage);
    
    // Create contexts for different tenants
    let tenant1_context = RequestContext::with_tenant_generated_id(
        TenantContext::new("tenant-1".to_string(), "client-1".to_string())
    );
    let tenant2_context = RequestContext::with_tenant_generated_id(
        TenantContext::new("tenant-2".to_string(), "client-2".to_string())
    );
    
    // Create users in different tenants
    let user_data = json!({
        "userName": "alice@example.com",
        "displayName": "Alice Smith"
    });
    
    let tenant1_user = provider.create_resource("User", user_data.clone(), &tenant1_context).await.unwrap();
    let tenant2_user = provider.create_resource("User", user_data, &tenant2_context).await.unwrap();
    
    // Verify isolation
    let tenant1_users = provider.list_resources("User", None, &tenant1_context).await.unwrap();
    let tenant2_users = provider.list_resources("User", None, &tenant2_context).await.unwrap();
    
    assert_eq!(tenant1_users.len(), 1);
    assert_eq!(tenant2_users.len(), 1);
    assert_ne!(tenant1_user.get_id(), tenant2_user.get_id());
    
    // Verify cross-tenant access fails
    let cross_access = provider.get_resource(
        "User",
        tenant1_user.get_id().unwrap(),
        &tenant2_context,
    ).await.unwrap();
    assert!(cross_access.is_none()); // Should not find user from different tenant
}
}

#![allow(unused)]
fn main() {
use std::time::Instant;
use tokio::task::JoinSet;

#[tokio::test]
async fn test_provider_performance() {
    let storage = InMemoryStorage::new();
    let provider = Arc::new(StandardResourceProvider::new(storage));
    
    let num_operations = 1000;
    let num_concurrent = 10;
    
    let start = Instant::now();
    let mut join_set = JoinSet::new();
    
    for batch in 0..num_concurrent {
        let provider_clone = Arc::clone(&provider);
        join_set.spawn(async move {
            let context = RequestContext::with_generated_id();
            
            for i in 0..(num_operations / num_concurrent) {
                let user_id = format!("user-{}-{}", batch, i);
                let user_data = json!({
                    "userName": format!("{}@example.com", user_id),
                    "displayName": format!("User {}", user_id)
                });
                
                // Create, read, update, delete cycle
                let user = provider_clone.create_resource("User", user_data, &context).await.unwrap();
                let id = user.get_id().unwrap();
                
                let retrieved = provider_clone.get_resource("User", id, &context).await.unwrap();
                assert!(retrieved.is_some());
                
                let updated_data = json!({
                    "id": id,
                    "userName": format!("{}@example.com", user_id),
                    "displayName": format!("Updated User {}", user_id)
                });
                
                let updated = provider_clone.update_resource("User", id, updated_data, &context).await.unwrap();
                assert_eq!(updated.get_display_name().unwrap(), format!("Updated User {}", user_id));
                
                let deleted = provider_clone.delete_resource("User", id, &context).await.unwrap();
                assert!(deleted);
            }
        });
    }
    
    // Wait for all operations to complete
    while let Some(result) = join_set.join_next().await {
        result.unwrap();
    }
    
    let duration = start.elapsed();
    let ops_per_second = (num_operations * 4) as f64 / duration.as_secs_f64(); // 4 ops per iteration
    
    println!("Completed {} operations in {:?}", num_operations * 4, duration);
    println!("Performance: {:.2} operations/second", ops_per_second);
    
    // Assert minimum performance threshold (adjust based on requirements)
    assert!(ops_per_second > 100.0, "Performance below threshold: {:.2} ops/sec", ops_per_second);
}
}

#![allow(unused)]
fn main() {
#[tokio::test]
async fn test_memory_usage() {
    let storage = InMemoryStorage::new();
    let provider = StandardResourceProvider::new(storage.clone());
    let context = RequestContext::with_generated_id();
    
    // Create many resources
    let num_resources = 10000;
    for i in 0..num_resources {
        let user_data = json!({
            "userName": format!("user{}@example.com", i),
            "displayName": format!("User {}", i)
        });
        
        provider.create_resource("User", user_data, &context).await.unwrap();
    }
    
    // Check storage stats
    let stats = storage.stats().await;
    assert_eq!(stats.total_resources, num_resources);
    assert_eq!(stats.tenant_count, 1); // All in default tenant
    
    // Delete all resources
    let users = provider.list_resources("User", None, &context).await.unwrap();
    for user in users {
        provider.delete_resource("User", user.get_id().unwrap(), &context).await.unwrap();
    }
    
    // Verify cleanup
    let final_stats = storage.stats().await;
    assert_eq!(final_stats.total_resources, 0);
}
}

#![allow(unused)]
fn main() {
pub mod test_utils {
    use super::*;
    use serde_json::{json, Value};
    use uuid::Uuid;

    pub fn random_tenant_id() -> String {
        format!("test-tenant-{}", Uuid::new_v4())
    }

    pub fn sample_user_data(username: &str) -> Value {
        json!({
            "userName": username,
            "name": {
                "givenName": "Test",
                "familyName": "User"
            },
            "displayName": format!("Test User {}", username),
            "emails": [{
                "value": username,
                "primary": true
            }]
        })
    }

    pub fn sample_group_data(name: &str) -> Value {
        json!({
            "displayName": name,
            "members": []
        })
    }

    pub async fn create_test_provider() -> StandardResourceProvider<InMemoryStorage> {
        let storage = InMemoryStorage::new();
        StandardResourceProvider::new(storage)
    }

    pub async fn setup_test_data(
        provider: &StandardResourceProvider<InMemoryStorage>,
        context: &RequestContext,
    ) -> Vec<String> {
        let mut user_ids = Vec::new();
        
        for i in 1..=5 {
            let username = format!("testuser{}@example.com", i);
            let user_data = sample_user_data(&username);
            
            let user = provider.create_resource("User", user_data, context).await.unwrap();
            user_ids.push(user.get_id().unwrap().to_string());
        }
        
        user_ids
    }
}

// Usage in tests
#[tokio::test]
async fn test_with_utilities() {
    let provider = test_utils::create_test_provider().await;
    let context = RequestContext::with_generated_id();
    
    let user_ids = test_utils::setup_test_data(&provider, &context).await;
    assert_eq!(user_ids.len(), 5);
    
    // Your test logic here...
}
}

#![allow(unused)]
fn main() {
use proptest::prelude::*;

proptest! {
    #[test]
    fn test_resource_id_roundtrip(
        tenant_id in "[a-zA-Z0-9-]{1,50}",
        resource_type in "[a-zA-Z]{1,20}",
        resource_id in "[a-zA-Z0-9-]{1,50}"
    ) {
        tokio_test::block_on(async {
            let storage = InMemoryStorage::new();
            let key = StorageKey::new(&tenant_id, &resource_type, &resource_id);
            let data = json!({"test": "data"});
            
            let stored = storage.put(key.clone(), data.clone()).await.unwrap();
            let retrieved = storage.get(key).await.unwrap();
            
            prop_assert_eq!(retrieved, Some(stored));
        });
    }
}
}

name: Provider Tests

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        rust: [stable, beta, nightly]
        
    steps:
    - uses: actions/checkout@v3
    
    - name: Install Rust
      uses: actions-rs/toolchain@v1
      with:
        toolchain: ${{ matrix.rust }}
        override: true
        components: rustfmt, clippy
        
    - name: Cache dependencies
      uses: actions/cache@v3
      with:
        path: |
          ~/.cargo/registry
          ~/.cargo/git
          target
        key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
        
    - name: Run tests
      run: cargo test --all-features
      
    - name: Run storage provider tests
      run: cargo test storage::tests --all-features
      
    - name: Run resource provider tests  
      run: cargo test providers::tests --all-features
      
    - name: Run integration tests
      run: cargo test integration --all-features
      
    - name: Check formatting
      run: cargo fmt -- --check
      
    - name: Run clippy
      run: cargo clippy -- -D warnings

urn:ietf:params:scim:schemas:core:2.0:User

urn:ietf:params:scim:schemas:core:2.0:Group

urn:ietf:params:scim:schemas:extension:enterprise:2.0:User

#![allow(unused)]
fn main() {
use scim_server::schema::{SchemaDefinition, AttributeDefinition};
use serde::{Serialize, Deserialize};

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SchemaDefinition {
    pub id: String,                              // Schema URI
    pub name: String,                            // Human-readable name
    pub description: String,                     // Schema description
    pub attributes: Vec<AttributeDefinition>,    // Attribute definitions
    pub meta: SchemaMeta,                        // Metadata
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SchemaMeta {
    pub resource_type: String,
    pub location: String,
    pub created: DateTime<Utc>,
    pub last_modified: DateTime<Utc>,
    pub version: String,
}
}

#![allow(unused)]
fn main() {
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AttributeDefinition {
    pub name: String,                    // Attribute name
    pub attribute_type: AttributeType,   // Data type
    pub multi_valued: bool,              // Can have multiple values
    pub description: String,             // Human-readable description
    pub required: bool,                  // Must be present
    pub case_exact: bool,                // Case-sensitive comparison
    pub mutability: Mutability,          // When attribute can be modified
    pub returned: Returned,              // When attribute is returned
    pub uniqueness: Uniqueness,          // Uniqueness constraint
    pub reference_types: Option<Vec<String>>, // For reference attributes
    pub canonical_values: Option<Vec<String>>, // Predefined valid values
    pub sub_attributes: Option<Vec<AttributeDefinition>>, // For complex types
}
}

#![allow(unused)]
fn main() {
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum AttributeType {
    String,    // Text data
    Boolean,   // True/false values
    Decimal,   // Floating-point numbers
    Integer,   // Whole numbers
    DateTime,  // ISO 8601 date-time
    Binary,    // Base64-encoded binary data
    Reference, // Reference to another resource
    Complex,   // Nested object with sub-attributes
}
}

#![allow(unused)]
fn main() {
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum Mutability {
    ReadOnly,   // Cannot be modified by client
    ReadWrite,  // Can be read and written
    Immutable,  // Can only be set during creation
    WriteOnly,  // Can be written but not read (e.g., passwords)
}
}

#![allow(unused)]
fn main() {
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum Returned {
    Always,  // Always returned
    Never,   // Never returned (e.g., passwords)
    Default, // Returned by default
    Request, // Only returned when explicitly requested
}
}

#![allow(unused)]
fn main() {
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum Uniqueness {
    None,   // No uniqueness constraint
    Server, // Unique within the server
    Global, // Globally unique
}
}

#![allow(unused)]
fn main() {
use scim_server::schema::SchemaRegistry;
use std::collections::HashMap;

pub struct SchemaRegistry {
    schemas: HashMap<String, SchemaDefinition>,
    resource_schemas: HashMap<String, Vec<String>>, // resource_type -> schema_uris
}

impl SchemaRegistry {
    pub fn new() -> Self {
        let mut registry = Self {
            schemas: HashMap::new(),
            resource_schemas: HashMap::new(),
        };
        
        // Register core schemas
        registry.register_core_schemas();
        registry
    }
    
    pub fn register_schema(&mut self, schema: SchemaDefinition) -> Result<(), SchemaError> {
        // Validate schema definition
        self.validate_schema(&schema)?;
        
        // Store schema
        self.schemas.insert(schema.id.clone(), schema);
        Ok(())
    }
    
    pub fn get_schema(&self, schema_uri: &str) -> Option<&SchemaDefinition> {
        self.schemas.get(schema_uri)
    }
    
    pub fn get_resource_schemas(&self, resource_type: &str) -> Vec<&SchemaDefinition> {
        if let Some(schema_uris) = self.resource_schemas.get(resource_type) {
            schema_uris.iter()
                .filter_map(|uri| self.schemas.get(uri))
                .collect()
        } else {
            Vec::new()
        }
    }
    
    pub fn validate_resource(
        &self,
        resource: &serde_json::Value,
        schemas: &[String],
    ) -> Result<(), ValidationError> {
        for schema_uri in schemas {
            if let Some(schema) = self.get_schema(schema_uri) {
                self.validate_against_schema(resource, schema)?;
            } else {
                return Err(ValidationError::UnknownSchema(schema_uri.clone()));
            }
        }
        Ok(())
    }
    
    fn register_core_schemas(&mut self) {
        // Register User schema
        let user_schema = self.create_user_schema();
        self.schemas.insert(user_schema.id.clone(), user_schema);
        
        // Register Group schema
        let group_schema = self.create_group_schema();
        self.schemas.insert(group_schema.id.clone(), group_schema);
        
        // Register Enterprise User extension
        let enterprise_schema = self.create_enterprise_user_schema();
        self.schemas.insert(enterprise_schema.id.clone(), enterprise_schema);
        
        // Map resource types to schemas
        self.resource_schemas.insert(
            "User".to_string(),
            vec![
                "urn:ietf:params:scim:schemas:core:2.0:User".to_string(),
                "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User".to_string(),
            ]
        );
        
        self.resource_schemas.insert(
            "Group".to_string(),
            vec!["urn:ietf:params:scim:schemas:core:2.0:Group".to_string()]
        );
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::ScimServer;

async fn get_user_schema(server: &ScimServer) -> Result<SchemaDefinition, ScimError> {
    let registry = server.schema_registry();
    let schema = registry.get_schema("urn:ietf:params:scim:schemas:core:2.0:User")
        .ok_or(ScimError::SchemaNotFound)?;
    Ok(schema.clone())
}

async fn list_all_schemas(server: &ScimServer) -> Vec<SchemaDefinition> {
    let registry = server.schema_registry();
    registry.list_schemas()
}
}

#![allow(unused)]
fn main() {
use scim_server::models::User;
use serde_json;

async fn validate_user(
    registry: &SchemaRegistry,
    user: &User,
) -> Result<(), ValidationError> {
    let user_json = serde_json::to_value(user)?;
    
    registry.validate_resource(
        &user_json,
        &user.schemas,
    )
}
}

#![allow(unused)]
fn main() {
pub struct SchemaVersion {
    pub major: u32,
    pub minor: u32,
    pub patch: u32,
}

impl SchemaVersion {
    pub fn new(major: u32, minor: u32, patch: u32) -> Self {
        Self { major, minor, patch }
    }
    
    pub fn is_compatible_with(&self, other: &SchemaVersion) -> bool {
        // Same major version is compatible
        self.major == other.major
    }
}

// Schema URI with version
// urn:company:schemas:extension:employee:1.0:User
}

#![allow(unused)]
fn main() {
pub trait SchemaMigration {
    fn migrate(&self, from: &SchemaVersion, to: &SchemaVersion, data: &mut serde_json::Value) -> Result<(), MigrationError>;
    fn supports_migration(&self, from: &SchemaVersion, to: &SchemaVersion) -> bool;
}

pub struct SchemaEvolutionManager {
    migrations: Vec<Box<dyn SchemaMigration>>,
}

impl SchemaEvolutionManager {
    pub fn migrate_data(
        &self,
        data: &mut serde_json::Value,
        from_version: &SchemaVersion,
        to_version: &SchemaVersion,
    ) -> Result<(), MigrationError> {
        for migration in &self.migrations {
            if migration.supports_migration(from_version, to_version) {
                migration.migrate(from_version, to_version, data)?;
                break;
            }
        }
        Ok(())
    }
}
}

#![allow(unused)]
fn main() {
#[derive(Debug, thiserror::Error)]
pub enum SchemaError {
    #[error("Schema validation failed: {0}")]
    ValidationFailed(String),
    
    #[error("Unknown schema: {0}")]
    UnknownSchema(String),
    
    #[error("Schema conflict: {0}")]
    SchemaConflict(String),
    
    #[error("Invalid attribute definition: {0}")]
    InvalidAttribute(String),
    
    #[error("Schema version incompatible: {0}")]
    VersionIncompatible(String),
}
}

#![allow(unused)]
fn main() {
use scim_server::models::{Meta, Resource};
use serde::{Deserialize, Serialize};
use chrono::{DateTime, Utc};

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Device {
    pub id: Option<String>,
    pub schemas: Vec<String>,
    pub device_name: String,
    pub device_type: DeviceType,
    pub serial_number: Option<String>,
    pub manufacturer: Option<String>,
    pub model: Option<String>,
    pub operating_system: Option<OperatingSystem>,
    pub owner: Option<DeviceOwner>,
    pub location: Option<DeviceLocation>,
    pub network_info: Option<NetworkInfo>,
    pub security_info: Option<DeviceSecurityInfo>,
    pub active: Option<bool>,
    pub meta: Option<Meta>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum DeviceType {
    Laptop,
    Desktop,
    Tablet,
    Phone,
    Server,
    Printer,
    Other(String),
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct OperatingSystem {
    pub name: String,
    pub version: String,
    pub architecture: Option<String>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DeviceOwner {
    pub user_id: String,
    pub user_name: Option<String>,
    pub assignment_date: Option<DateTime<Utc>>,
    pub assignment_type: AssignmentType,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum AssignmentType {
    Personal,
    Shared,
    Pool,
}
}

#![allow(unused)]
fn main() {
use scim_server::schema::{SchemaDefinition, AttributeDefinition, AttributeType};

pub fn create_device_schema() -> SchemaDefinition {
    SchemaDefinition {
        id: "urn:company:schemas:core:2.0:Device".to_string(),
        name: "Device".to_string(),
        description: "Device resource schema".to_string(),
        attributes: vec![
            AttributeDefinition {
                name: "deviceName".to_string(),
                attribute_type: AttributeType::String,
                multi_valued: false,
                description: "The name of the device".to_string(),
                required: true,
                case_exact: false,
                mutability: Mutability::ReadWrite,
                returned: Returned::Always,
                uniqueness: Uniqueness::None,
                reference_types: None,
                canonical_values: None,
                sub_attributes: None,
            },
            AttributeDefinition {
                name: "deviceType".to_string(),
                attribute_type: AttributeType::String,
                multi_valued: false,
                description: "The type of device".to_string(),
                required: true,
                case_exact: false,
                mutability: Mutability::ReadWrite,
                returned: Returned::Always,
                uniqueness: Uniqueness::None,
                reference_types: None,
                canonical_values: Some(vec![
                    "Laptop".to_string(),
                    "Desktop".to_string(),
                    "Tablet".to_string(),
                    "Phone".to_string(),
                    "Server".to_string(),
                    "Printer".to_string(),
                    "Other".to_string(),
                ]),
                sub_attributes: None,
            },
            // Add more attributes...
        ],
        meta: SchemaMeta {
            resource_type: "Schema".to_string(),
            location: "/Schemas/urn:company:schemas:core:2.0:Device".to_string(),
            created: Utc::now(),
            last_modified: Utc::now(),
            version: "1.0".to_string(),
        },
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::storage::StorageProvider;
use async_trait::async_trait;

#[async_trait]
pub trait DeviceStorageProvider: StorageProvider {
    async fn create_device(
        &self,
        tenant_id: &str,
        device: Device,
    ) -> Result<Device, StorageError>;
    
    async fn get_device(
        &self,
        tenant_id: &str,
        device_id: &str,
    ) -> Result<Device, StorageError>;
    
    async fn update_device(
        &self,
        tenant_id: &str,
        device_id: &str,
        device: Device,
        version: Option<&str>,
    ) -> Result<Device, StorageError>;
    
    async fn delete_device(
        &self,
        tenant_id: &str,
        device_id: &str,
        version: Option<&str>,
    ) -> Result<(), StorageError>;
    
    async fn list_devices(
        &self,
        tenant_id: &str,
        sort_by: Option<&str>,
        sort_order: Option<SortOrder>,
        start_index: Option<usize>,
        count: Option<usize>,
    ) -> Result<ListResponse<Device>, StorageError>;
    
    // Helper methods for common filtering patterns
    async fn find_devices_by_type(
        &self,
        tenant_id: &str,
        device_type: &DeviceType,
    ) -> Result<Vec<Device>, StorageError>;
    
    async fn find_devices_by_status(
        &self,
        tenant_id: &str,
        status: &DeviceStatus,
    ) -> Result<Vec<Device>, StorageError>;
}
}

#![allow(unused)]
fn main() {
use scim_server::handlers::{ResourceHandler, ScimHandler};
use axum::{Json, Path, Query};

pub struct DeviceHandler<T: DeviceStorageProvider> {
    storage: T,
    validator: DeviceValidator,
}

impl<T: DeviceStorageProvider> DeviceHandler<T> {
    pub fn new(storage: T) -> Self {
        Self {
            storage,
            validator: DeviceValidator::new(),
        }
    }
}

#[async_trait]
impl<T: DeviceStorageProvider> ResourceHandler<Device> for DeviceHandler<T> {
    async fn create(
        &self,
        tenant_id: &str,
        device: Device,
    ) -> Result<Device, ScimError> {
        // Validate device
        self.validator.validate_create(&device)?;
        
        // Create in storage
        let created_device = self.storage.create_device(tenant_id, device).await?;
        
        Ok(created_device)
    }
    
    async fn get(
        &self,
        tenant_id: &str,
        device_id: &str,
    ) -> Result<Device, ScimError> {
        self.storage.get_device(tenant_id, device_id).await
            .map_err(|e| e.into())
    }
    
    async fn update(
        &self,
        tenant_id: &str,
        device_id: &str,
        device: Device,
        version: Option<&str>,
    ) -> Result<Device, ScimError> {
        // Validate update
        self.validator.validate_update(&device)?;
        
        // Update in storage
        let updated_device = self.storage.update_device(
            tenant_id,
            device_id,
            device,
            version,
        ).await?;
        
        Ok(updated_device)
    }
    
    async fn delete(
        &self,
        tenant_id: &str,
        device_id: &str,
        version: Option<&str>,
    ) -> Result<(), ScimError> {
        self.storage.delete_device(tenant_id, device_id, version).await
            .map_err(|e| e.into())
    }
    
    async fn list(
        &self,
        tenant_id: &str,
        sort_by: Option<&str>,
        sort_order: Option<SortOrder>,
        start_index: Option<usize>,
        count: Option<usize>,
    ) -> Result<ListResponse<Device>, ScimError> {
        self.storage.list_devices(
            tenant_id,
            sort_by,
            sort_order,
            start_index,
            count,
        ).await.map_err(|e| e.into())
    }
    
    // Implement specific search methods for common patterns
    async fn search_by_type(
        &self,
        tenant_id: &str,
        device_type: &DeviceType,
    ) -> Result<Vec<Device>, ScimError> {
        self.storage.find_devices_by_type(tenant_id, device_type)
            .await
            .map_err(|e| e.into())
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::ScimServerBuilder;

let server = ScimServerBuilder::new()
    .with_provider(storage_provider)
    .register_resource_type::<Device>("Device", device_handler)
    .register_schema(create_device_schema())
    .add_endpoint("/Devices", device_routes())
    .build();
}

#![allow(unused)]
fn main() {
use scim_server::{Schema, Attribute, AttributeType};
use serde::{Deserialize, Serialize};

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct EnterpriseUser {
    #[serde(rename = "employeeNumber")]
    pub employee_number: Option<String>,
    
    #[serde(rename = "costCenter")]
    pub cost_center: Option<String>,
    
    pub organization: Option<String>,
    pub division: Option<String>,
    pub department: Option<String>,
    pub manager: Option<Manager>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Manager {
    pub value: String,           // Manager's user ID
    #[serde(rename = "$ref")]
    pub reference: Option<String>, // URI reference to manager
    #[serde(rename = "displayName")]
    pub display_name: Option<String>,
}
}

#![allow(unused)]
fn main() {
use scim_server::schema::{SchemaBuilder, AttributeBuilder};

pub fn create_custom_extension() -> Schema {
    SchemaBuilder::new()
        .id("urn:company:scim:schemas:extension:employee:2.0")
        .name("Employee Extension")
        .description("Custom attributes for employee data")
        .add_attribute(
            AttributeBuilder::new()
                .name("badgeNumber")
                .type_(AttributeType::String)
                .description("Employee badge number")
                .required(false)
                .case_exact(true)
                .build()
        )
        .add_attribute(
            AttributeBuilder::new()
                .name("startDate")
                .type_(AttributeType::DateTime)
                .description("Employee start date")
                .required(false)
                .build()
        )
        .add_attribute(
            AttributeBuilder::new()
                .name("clearanceLevel")
                .type_(AttributeType::String)
                .description("Security clearance level")
                .required(false)
                .canonical_values(vec!["PUBLIC", "CONFIDENTIAL", "SECRET", "TOP_SECRET"])
                .build()
        )
        .build()
}
}

#![allow(unused)]
fn main() {
use serde_json::json;

let extended_user = json!({
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User",
        "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",
        "urn:company:scim:schemas:extension:employee:2.0"
    ],
    "userName": "john.doe@company.com",
    "name": {
        "givenName": "John",
        "familyName": "Doe"
    },
    "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
        "employeeNumber": "12345",
        "department": "Engineering",
        "manager": {
            "value": "manager-uuid",
            "displayName": "Jane Smith"
        }
    },
    "urn:company:scim:schemas:extension:employee:2.0": {
        "badgeNumber": "BADGE-12345",
        "startDate": "2024-01-15T00:00:00Z",
        "clearanceLevel": "CONFIDENTIAL"
    }
});
}

#![allow(unused)]
fn main() {
use scim_server::SchemaRegistry;

fn register_extensions(registry: &mut SchemaRegistry) {
    // Register enterprise extension
    registry.register_extension(
        "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",
        create_enterprise_extension()
    );
    
    // Register custom extension
    registry.register_extension(
        "urn:company:scim:schemas:extension:employee:2.0",
        create_custom_extension()
    );
}
}

#![allow(unused)]
fn main() {
use scim_server::{Schema, ValidationError, ValidationResult};
use serde_json::Value;

pub struct SchemaValidator {
    schemas: HashMap<String, Schema>,
}

impl SchemaValidator {
    pub fn validate_resource(
        &self,
        resource: &Value,
        resource_type: &str,
    ) -> ValidationResult {
        let schemas = self.extract_schemas(resource)?;
        
        for schema_id in schemas {
            let schema = self.schemas.get(&schema_id)
                .ok_or_else(|| ValidationError::UnknownSchema(schema_id.clone()))?;
            
            self.validate_against_schema(resource, schema)?;
        }
        
        Ok(())
    }
    
    fn validate_against_schema(
        &self,
        resource: &Value,
        schema: &Schema,
    ) -> ValidationResult {
        for attribute in schema.attributes() {
            self.validate_attribute(resource, attribute)?;
        }
        Ok(())
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::schema::{Attribute, AttributeType, Mutability};

impl SchemaValidator {
    fn validate_attribute(
        &self,
        resource: &Value,
        attribute: &Attribute,
    ) -> ValidationResult {
        let value = resource.get(attribute.name());
        
        // Check required attributes
        if attribute.required() && value.is_none() {
            return Err(ValidationError::MissingRequired(attribute.name().to_string()));
        }
        
        if let Some(value) = value {
            // Type validation
            self.validate_type(value, attribute.type_())?;
            
            // Constraints validation
            if let Some(canonical_values) = attribute.canonical_values() {
                self.validate_canonical_values(value, canonical_values)?;
            }
            
            // Custom validation rules
            self.validate_custom_rules(value, attribute)?;
        }
        
        Ok(())
    }
    
    fn validate_type(&self, value: &Value, expected_type: AttributeType) -> ValidationResult {
        match expected_type {
            AttributeType::String => {
                if !value.is_string() {
                    return Err(ValidationError::TypeMismatch {
                        expected: "string".to_string(),
                        actual: value.clone(),
                    });
                }
            },
            AttributeType::Boolean => {
                if !value.is_boolean() {
                    return Err(ValidationError::TypeMismatch {
                        expected: "boolean".to_string(),
                        actual: value.clone(),
                    });
                }
            },
            AttributeType::Integer => {
                if !value.is_i64() {
                    return Err(ValidationError::TypeMismatch {
                        expected: "integer".to_string(),
                        actual: value.clone(),
                    });
                }
            },
            // TODO: Add other type validations
        }
        Ok(())
    }
}
}

#![allow(unused)]
fn main() {
#[derive(Debug)]
pub enum ValidationError {
    MissingRequired(String),
    TypeMismatch {
        expected: String,
        actual: Value,
    },
    InvalidValue {
        field: String,
        value: Value,
        reason: String,
    },
    UnknownSchema(String),
    CustomRule {
        rule: String,
        message: String,
    },
}

impl std::fmt::Display for ValidationError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            ValidationError::MissingRequired(field) => {
                write!(f, "Missing required field: {}", field)
            },
            ValidationError::TypeMismatch { expected, actual } => {
                write!(f, "Type mismatch: expected {}, got {:?}", expected, actual)
            },
            ValidationError::InvalidValue { field, value, reason } => {
                write!(f, "Invalid value for {}: {:?} ({})", field, value, reason)
            },
            ValidationError::UnknownSchema(schema) => {
                write!(f, "Unknown schema: {}", schema)
            },
            ValidationError::CustomRule { rule, message } => {
                write!(f, "Custom rule '{}' failed: {}", rule, message)
            },
        }
    }
}
}

#![allow(unused)]
fn main() {
impl ResourceProvider for ValidatedProvider {
    async fn create_resource(
        &self,
        resource_type: &str,
        data: Value,
        context: &RequestContext,
    ) -> Result<ScimResource, ProviderError> {
        // Validate before creating
        self.validator.validate_resource(&data, resource_type)
            .map_err(|e| ProviderError::ValidationFailed(e))?;
        
        // Proceed with creation
        self.inner.create_resource(resource_type, data, context).await
    }
}
}

#![allow(unused)]
fn main() {
#[cfg(test)]
mod tests {
    use super::*;
    
    #[test]
    fn test_required_field_validation() {
        // TODO: Test required field validation
    }
    
    #[test]
    fn test_type_validation() {
        // TODO: Test type validation
    }
    
    #[test]
    fn test_custom_rules() {
        // TODO: Test custom validation rules
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::concurrency::{ETagManager, VersionControl};
use scim_server::models::{User, Meta};
use chrono::Utc;

pub struct ETagManager {
    hash_algorithm: HashAlgorithm,
    weak_etags: bool,
}

impl ETagManager {
    pub fn new() -> Self {
        Self {
            hash_algorithm: HashAlgorithm::Sha256,
            weak_etags: true, // SCIM typically uses weak ETags
        }
    }

    pub fn generate_etag(&self, resource: &dyn Resource) -> String {
        let content = self.serialize_for_etag(resource);
        let hash = self.calculate_hash(&content);
        let timestamp = Utc::now().timestamp_millis();
        
        if self.weak_etags {
            format!("W/\"{}-{}\"", hash, timestamp)
        } else {
            format!("\"{}-{}\"", hash, timestamp)
        }
    }

    pub fn parse_etag(&self, etag: &str) -> Result<ETagInfo, ETagError> {
        let is_weak = etag.starts_with("W/");
        let tag_value = if is_weak {
            &etag[3..etag.len()-1] // Remove W/" and "
        } else {
            &etag[1..etag.len()-1] // Remove " and "
        };

        let parts: Vec<&str> = tag_value.split('-').collect();
        if parts.len() != 2 {
            return Err(ETagError::InvalidFormat);
        }

        Ok(ETagInfo {
            hash: parts[0].to_string(),
            timestamp: parts[1].parse()?,
            is_weak,
        })
    }
}

pub struct ETagInfo {
    pub hash: String,
    pub timestamp: i64,
    pub is_weak: bool,
}
}

#![allow(unused)]
fn main() {
#[derive(Debug, Clone)]
pub struct ConditionalRequest {
    pub if_match: Option<String>,
    pub if_none_match: Option<String>,
    pub if_modified_since: Option<DateTime<Utc>>,
    pub if_unmodified_since: Option<DateTime<Utc>>,
}

impl ConditionalRequest {
    pub fn from_headers(headers: &HeaderMap) -> Self {
        Self {
            if_match: headers.get("If-Match")
                .and_then(|v| v.to_str().ok())
                .map(|s| s.to_string()),
            if_none_match: headers.get("If-None-Match")
                .and_then(|v| v.to_str().ok())
                .map(|s| s.to_string()),
            if_modified_since: headers.get("If-Modified-Since")
                .and_then(|v| v.to_str().ok())
                .and_then(|s| DateTime::parse_from_rfc2822(s).ok())
                .map(|dt| dt.with_timezone(&Utc)),
            if_unmodified_since: headers.get("If-Unmodified-Since")
                .and_then(|v| v.to_str().ok())
                .and_then(|s| DateTime::parse_from_rfc2822(s).ok())
                .map(|dt| dt.with_timezone(&Utc)),
        }
    }
}
}

#![allow(unused)]
fn main() {
pub struct OptimisticConcurrencyManager {
    etag_manager: ETagManager,
    conflict_resolver: Box<dyn ConflictResolver>,
}

impl OptimisticConcurrencyManager {
    pub async fn update_resource<T: Resource>(
        &self,
        storage: &dyn StorageProvider,
        tenant_id: &str,
        resource_id: &str,
        updated_resource: T,
        conditions: &ConditionalRequest,
    ) -> Result<T, ConcurrencyError> {
        // Get current resource
        let current = storage.get_resource(tenant_id, resource_id).await?;
        
        // Validate conditions
        self.validate_conditions(&current, conditions)?;
        
        // Attempt update
        match storage.update_resource(tenant_id, resource_id, updated_resource).await {
            Ok(result) => Ok(result),
            Err(StorageError::VersionMismatch) => {
                // Handle conflict
                self.handle_version_conflict(storage, tenant_id, resource_id, updated_resource).await
            }
            Err(e) => Err(ConcurrencyError::StorageError(e)),
        }
    }

    fn validate_conditions(
        &self,
        resource: &dyn Resource,
        conditions: &ConditionalRequest,
    ) -> Result<(), ConcurrencyError> {
        // Validate If-Match
        if let Some(if_match) = &conditions.if_match {
            let current_etag = resource.get_etag();
            if !self.etags_match(if_match, &current_etag) {
                return Err(ConcurrencyError::PreconditionFailed("If-Match failed".to_string()));
            }
        }

        // Validate If-None-Match
        if let Some(if_none_match) = &conditions.if_none_match {
            let current_etag = resource.get_etag();
            if self.etags_match(if_none_match, &current_etag) {
                return Err(ConcurrencyError::NotModified);
            }
        }

        // Validate If-Unmodified-Since
        if let Some(if_unmodified_since) = conditions.if_unmodified_since {
            if let Some(last_modified) = resource.get_last_modified() {
                if last_modified > if_unmodified_since {
                    return Err(ConcurrencyError::PreconditionFailed("Resource was modified".to_string()));
                }
            }
        }

        Ok(())
    }
}
}

#![allow(unused)]
fn main() {
pub trait LockManager: Send + Sync {
    async fn acquire_lock(&self, resource_id: &str, lock_type: LockType, timeout: Duration) -> Result<Lock, LockError>;
    async fn release_lock(&self, lock: Lock) -> Result<(), LockError>;
    async fn extend_lock(&self, lock: &mut Lock, duration: Duration) -> Result<(), LockError>;
}

#[derive(Debug, Clone)]
pub enum LockType {
    Shared,    // Multiple readers
    Exclusive, // Single writer
}

pub struct Lock {
    pub id: String,
    pub resource_id: String,
    pub lock_type: LockType,
    pub acquired_at: DateTime<Utc>,
    pub expires_at: DateTime<Utc>,
    pub owner: String,
}

pub struct PessimisticConcurrencyManager {
    lock_manager: Box<dyn LockManager>,
    default_timeout: Duration,
}

impl PessimisticConcurrencyManager {
    pub async fn with_exclusive_lock<T, F, Fut>(
        &self,
        resource_id: &str,
        operation: F,
    ) -> Result<T, ConcurrencyError>
    where
        F: FnOnce() -> Fut,
        Fut: Future<Output = Result<T, ConcurrencyError>>,
    {
        let lock = self.lock_manager
            .acquire_lock(resource_id, LockType::Exclusive, self.default_timeout)
            .await?;

        let result = operation().await;

        self.lock_manager.release_lock(lock).await?;
        result
    }
}
}

#![allow(unused)]
fn main() {
pub struct HybridConcurrencyManager {
    optimistic: OptimisticConcurrencyManager,
    pessimistic: PessimisticConcurrencyManager,
    conflict_threshold: usize,
    conflict_tracker: ConflictTracker,
}

impl HybridConcurrencyManager {
    pub async fn update_resource<T: Resource>(
        &self,
        resource_id: &str,
        update_fn: impl FnOnce(&T) -> Result<T, ConcurrencyError>,
    ) -> Result<T, ConcurrencyError> {
        let conflict_count = self.conflict_tracker.get_recent_conflicts(resource_id).await;
        
        if conflict_count > self.conflict_threshold {
            // High contention - use pessimistic locking
            self.pessimistic.with_exclusive_lock(resource_id, || async {
                // Perform update within lock
                self.optimistic.update_resource(resource_id, update_fn).await
            }).await
        } else {
            // Low contention - use optimistic approach
            match self.optimistic.update_resource(resource_id, update_fn).await {
                Ok(result) => Ok(result),
                Err(ConcurrencyError::VersionMismatch) => {
                    // Record conflict and retry with lock
                    self.conflict_tracker.record_conflict(resource_id).await;
                    self.pessimistic.with_exclusive_lock(resource_id, || async {
                        self.optimistic.update_resource(resource_id, update_fn).await
                    }).await
                }
                Err(e) => Err(e),
            }
        }
    }
}
}

#![allow(unused)]
fn main() {
use redis::{Client, Commands};

pub struct RedisLockManager {
    client: Client,
    lock_prefix: String,
    default_ttl: Duration,
}

impl RedisLockManager {
    pub fn new(redis_url: &str) -> Result<Self, LockError> {
        Ok(Self {
            client: Client::open(redis_url)?,
            lock_prefix: "scim:lock:".to_string(),
            default_ttl: Duration::from_secs(30),
        })
    }

    fn lock_key(&self, resource_id: &str) -> String {
        format!("{}{}", self.lock_prefix, resource_id)
    }
}

#[async_trait]
impl LockManager for RedisLockManager {
    async fn acquire_lock(
        &self,
        resource_id: &str,
        lock_type: LockType,
        timeout: Duration,
    ) -> Result<Lock, LockError> {
        let mut conn = self.client.get_async_connection().await?;
        let lock_key = self.lock_key(resource_id);
        let lock_value = uuid::Uuid::new_v4().to_string();
        let ttl_seconds = self.default_ttl.as_secs() as usize;

        let start = Instant::now();
        
        loop {
            // Try to acquire lock using SET NX EX
            let result: Option<String> = conn.set_nx_ex(&lock_key, &lock_value, ttl_seconds).await?;
            
            if result.is_some() {
                return Ok(Lock {
                    id: lock_value,
                    resource_id: resource_id.to_string(),
                    lock_type,
                    acquired_at: Utc::now(),
                    expires_at: Utc::now() + chrono::Duration::from_std(self.default_ttl).unwrap(),
                    owner: "current_process".to_string(),
                });
            }

            if start.elapsed() >= timeout {
                return Err(LockError::Timeout);
            }

            tokio::time::sleep(Duration::from_millis(50)).await;
        }
    }

    async fn release_lock(&self, lock: Lock) -> Result<(), LockError> {
        let mut conn = self.client.get_async_connection().await?;
        let lock_key = self.lock_key(&lock.resource_id);

        // Use Lua script for atomic check-and-delete
        let script = r#"
            if redis.call("GET", KEYS[1]) == ARGV[1] then
                return redis.call("DEL", KEYS[1])
            else
                return 0
            end
        "#;

        let result: i32 = redis::Script::new(script)
            .key(&lock_key)
            .arg(&lock.id)
            .invoke_async(&mut conn)
            .await?;

        if result == 1 {
            Ok(())
        } else {
            Err(LockError::LockNotFound)
        }
    }
}
}

#![allow(unused)]
fn main() {
#[derive(Debug, thiserror::Error)]
pub enum ConcurrencyError {
    #[error("Version mismatch detected")]
    VersionMismatch,
    
    #[error("Precondition failed: {0}")]
    PreconditionFailed(String),
    
    #[error("Resource not modified")]
    NotModified,
    
    #[error("Lock acquisition failed: {0}")]
    LockFailed(String),
    
    #[error("Lock timeout exceeded")]
    LockTimeout,
    
    #[error("Deadlock detected")]
    Deadlock,
    
    #[error("Conflict resolution failed: {0}")]
    ConflictResolutionFailed(String),
    
    #[error("Storage error: {0}")]
    StorageError(#[from] StorageError),
}

impl From<ConcurrencyError> for ScimError {
    fn from(error: ConcurrencyError) -> Self {
        match error {
            ConcurrencyError::VersionMismatch => ScimError::PreconditionFailed,
            ConcurrencyError::PreconditionFailed(_) => ScimError::PreconditionFailed,
            ConcurrencyError::NotModified => ScimError::NotModified,
            ConcurrencyError::LockTimeout => ScimError::TooManyRequests,
            _ => ScimError::InternalServerError,
        }
    }
}
}

#![allow(unused)]
fn main() {
pub struct OptimizedETagManager {
    cache: Arc<RwLock<LruCache<String, String>>>,
    hash_cache_size: usize,
}

impl OptimizedETagManager {
    pub fn generate_etag_cached(&self, resource: &dyn Resource) -> String {
        let resource_key = format!("{}:{}", resource.get_type(), resource.get_id());
        
        // Check cache first
        {
            let cache = self.cache.read().unwrap();
            if let Some(cached_etag) = cache.peek(&resource_key) {
                // Verify resource hasn't changed
                if self.resource_unchanged(resource, cached_etag) {
                    return cached_etag.clone();
                }
            }
        }
        
        // Generate new ETag
        let new_etag = self.generate_fresh_etag(resource);
        
        // Update cache
        {
            let mut cache = self.cache.write().unwrap();
            cache.put(resource_key, new_etag.clone());
        }
        
        new_etag
    }
}
}

#![allow(unused)]
fn main() {
use std::collections::hash_map::DefaultHasher;
use std::hash::{Hash, Hasher};
use chrono::{DateTime, Utc};

#[derive(Debug, Clone)]
pub struct ETag {
    value: String,
    weak: bool,
}

impl ETag {
    pub fn from_content(content: &[u8]) -> Self {
        let mut hasher = DefaultHasher::new();
        content.hash(&mut hasher);
        let hash = hasher.finish();
        
        ETag {
            value: format!("\"{}\"", hash),
            weak: false,
        }
    }
    
    pub fn from_timestamp(timestamp: DateTime<Utc>) -> Self {
        ETag {
            value: format!("\"{}\"", timestamp.timestamp()),
            weak: true,
        }
    }
    
    pub fn weak() -> Self {
        ETag {
            value: format!("\"{}\"", uuid::Uuid::new_v4()),
            weak: true,
        }
    }
}
}

-- Add versioning columns to resource tables
ALTER TABLE users ADD COLUMN version INTEGER DEFAULT 1;
ALTER TABLE users ADD COLUMN etag VARCHAR(64);
ALTER TABLE users ADD COLUMN last_modified TIMESTAMPTZ DEFAULT NOW();

-- Create index for efficient lookups
CREATE INDEX idx_users_etag ON users(tenant_id, id, etag);

#![allow(unused)]
fn main() {
impl ResourceProvider for DatabaseProvider {
    async fn conditional_update(
        &self,
        resource_type: &str,
        id: &str,
        data: serde_json::Value,
        expected_etag: &ETag,
        context: &RequestContext,
    ) -> Result<ConditionalResult<VersionedResource>, ProviderError> {
        let mut tx = self.pool.begin().await?;
        
        // Check current version
        let current = sqlx::query!(
            "SELECT etag, version FROM users WHERE tenant_id = $1 AND id = $2",
            context.tenant_id(),
            id
        )
        .fetch_optional(&mut *tx)
        .await?;
        
        let Some(current) = current else {
            return Ok(ConditionalResult::NotFound);
        };
        
        // Verify ETag matches
        if current.etag != expected_etag.value() {
            return Ok(ConditionalResult::VersionMismatch(VersionConflict {
                resource_id: id.to_string(),
                expected_version: expected_etag.clone(),
                current_version: ETag::from_str(&current.etag)?,
            }));
        }
        
        // Update with new version
        let new_version = current.version + 1;
        let new_etag = ETag::from_content(&serde_json::to_vec(&data)?);
        
        sqlx::query!(
            "UPDATE users SET data = $1, version = $2, etag = $3, last_modified = NOW() 
             WHERE tenant_id = $4 AND id = $5",
            data,
            new_version,
            new_etag.value(),
            context.tenant_id(),
            id
        )
        .execute(&mut *tx)
        .await?;
        
        tx.commit().await?;
        
        let updated = self.get_resource(resource_type, id, context).await?
            .ok_or(ProviderError::NotFound)?;
            
        Ok(ConditionalResult::Success(VersionedResource::new(updated, new_etag)))
    }
}
}

#![allow(unused)]
fn main() {
use axum::http::HeaderMap;

fn extract_if_match(headers: &HeaderMap) -> Option<ETag> {
    headers.get("If-Match")
        .and_then(|h| h.to_str().ok())
        .and_then(|s| ETag::from_str(s).ok())
}

fn extract_if_none_match(headers: &HeaderMap) -> Option<ETag> {
    headers.get("If-None-Match")
        .and_then(|h| h.to_str().ok())
        .and_then(|s| ETag::from_str(s).ok())
}
}

#![allow(unused)]
fn main() {
use axum::response::{Response, IntoResponse};
use axum::http::{StatusCode, HeaderValue};

fn add_etag_header(mut response: Response, etag: &ETag) -> Response {
    response.headers_mut().insert(
        "ETag",
        HeaderValue::from_str(etag.value()).unwrap()
    );
    response
}

fn not_modified_response(etag: &ETag) -> impl IntoResponse {
    let mut response = Response::new("".into());
    *response.status_mut() = StatusCode::NOT_MODIFIED;
    add_etag_header(response, etag)
}
}

#![allow(unused)]
fn main() {
#[cfg(test)]
mod tests {
    use super::*;
    
    #[tokio::test]
    async fn test_conditional_update_success() {
        // TODO: Implement comprehensive test cases
    }
    
    #[tokio::test]
    async fn test_version_mismatch() {
        // TODO: Test conflict detection
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::{ConditionalResult, ETag};

async fn update_user_with_conflict_detection(
    provider: &impl ResourceProvider,
    user_id: &str,
    data: serde_json::Value,
    expected_etag: &ETag,
) -> Result<ScimUser, ConflictError> {
    let context = RequestContext::new("update", None);
    
    match provider.conditional_update("User", user_id, data, expected_etag, &context).await? {
        ConditionalResult::Success(user) => Ok(user),
        ConditionalResult::VersionMismatch(conflict) => {
            Err(ConflictError::VersionMismatch {
                expected: expected_etag.clone(),
                current: conflict.current_version,
                resource_id: user_id.to_string(),
            })
        },
        ConditionalResult::NotFound => Err(ConflictError::ResourceNotFound),
    }
}
}

#![allow(unused)]
fn main() {
// Simple approach: retry with latest version
async fn retry_with_latest(
    provider: &impl ResourceProvider,
    user_id: &str,
    data: serde_json::Value,
) -> Result<ScimUser, Box<dyn std::error::Error>> {
    let context = RequestContext::new("retry", None);
    
    // Get current version
    let current = provider.get_resource("User", user_id, &context).await?
        .ok_or("User not found")?;
    
    // Apply update with current version
    provider.update_resource("User", user_id, data, &context).await
}
}

#![allow(unused)]
fn main() {
#[derive(Debug)]
pub enum ConflictError {
    VersionMismatch {
        expected: ETag,
        current: ETag,
        resource_id: String,
    },
    ResourceNotFound,
    MergeConflict {
        field: String,
        local_value: serde_json::Value,
        remote_value: serde_json::Value,
    },
}

impl std::fmt::Display for ConflictError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            ConflictError::VersionMismatch { expected, current, resource_id } => {
                write!(f, "Version conflict on {}: expected {}, got {}", 
                       resource_id, expected, current)
            },
            ConflictError::ResourceNotFound => write!(f, "Resource not found"),
            ConflictError::MergeConflict { field, .. } => {
                write!(f, "Merge conflict in field: {}", field)
            },
        }
    }
}
}

# Create a test project
cargo new scim-test
cd scim-test

# Add the new version
cargo add scim-server@0.3.2

# Test your existing code
cargo build
cargo test

# Instead of 0.3.0 → 0.3.2 directly
cargo add scim-server@0.3.1  # First step
cargo build && cargo test     # Verify
cargo add scim-server@0.3.2  # Second step
cargo build && cargo test     # Verify

#![allow(unused)]
fn main() {
// Example backup before migration
async fn backup_before_migration() -> Result<(), Box<dyn std::error::Error>> {
    let provider = get_production_provider().await?;
    let context = RequestContext::new("migration", None);
    
    // Backup all users
    let users = provider.list_resources("User", None, &context).await?;
    let backup_file = format!("users_backup_{}.json", chrono::Utc::now().format("%Y%m%d_%H%M%S"));
    std::fs::write(backup_file, serde_json::to_string_pretty(&users)?)?;
    
    // Backup all groups
    let groups = provider.list_resources("Group", None, &context).await?;
    let backup_file = format!("groups_backup_{}.json", chrono::Utc::now().format("%Y%m%d_%H%M%S"));
    std::fs::write(backup_file, serde_json::to_string_pretty(&groups)?)?;
    
    Ok(())
}
}

# Check for outdated dependencies
cargo outdated

# Update to latest compatible versions
cargo update

# Update to specific version
cargo add scim-server@latest

#![allow(unused)]
fn main() {
// Example: Adopting ETag concurrency control
impl MyApplication {
    // Phase 1: Add version checking without enforcement
    async fn soft_version_check(&self, id: &str, expected_version: Option<&str>) -> bool {
        if let Some(version) = expected_version {
            // Log version mismatches but don't fail
            match self.provider.get_versioned_resource("User", id, &self.context).await {
                Ok(Some(resource)) => {
                    if resource.version().as_str() != version {
                        warn!("Version mismatch detected for user {}: expected {}, got {}", 
                              id, version, resource.version());
                        return false;
                    }
                },
                _ => return false,
            }
        }
        true
    }
    
    // Phase 2: Enforce version checking
    async fn strict_version_check(&self, id: &str, expected_version: &str) -> Result<(), AppError> {
        // Now fail on version mismatches
        // Implementation...
    }
}
}

#![allow(unused)]
fn main() {
// migration_helper.rs
use scim_server::*;

pub struct MigrationHelper {
    old_provider: Box<dyn ResourceProvider>,
    new_provider: Box<dyn ResourceProvider>,
}

impl MigrationHelper {
    pub async fn verify_compatibility(&self) -> Result<(), MigrationError> {
        // Verify that existing code still works
        let context = RequestContext::new("migration_test", None);
        
        // Test basic operations
        let test_user = serde_json::json!({
            "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
            "userName": "migration.test@example.com"
        });
        
        // This should work across all 0.3.x versions
        let created = self.new_provider.create_resource("User", test_user, &context).await?;
        let retrieved = self.new_provider.get_resource("User", &created.id().unwrap(), &context).await?;
        self.new_provider.delete_resource("User", &created.id().unwrap(), &context).await?;
        
        println!("✅ Migration compatibility verified");
        Ok(())
    }
}
}

#![allow(unused)]
fn main() {
// Check if port is already in use
use tokio::net::TcpListener;

// This will fail if port is occupied
let listener = TcpListener::bind("0.0.0.0:3000").await?;
}

#![allow(unused)]
fn main() {
// Try a different port
let listener = TcpListener::bind("0.0.0.0:3001").await?;
}

# Find process using port 3000
lsof -i :3000
# Kill the process
kill -9 <PID>

#![allow(unused)]
fn main() {
// For local development
let listener = TcpListener::bind("127.0.0.1:3000").await?;

// For production (all interfaces)
let listener = TcpListener::bind("0.0.0.0:3000").await?;
}

#![allow(unused)]
fn main() {
use scim_server::DatabaseProvider;

// Add connection retry logic
async fn connect_with_retry(url: &str, max_retries: u32) -> Result<DatabaseProvider, Error> {
    let mut attempts = 0;
    
    loop {
        match DatabaseProvider::new(url).await {
            Ok(provider) => return Ok(provider),
            Err(e) if attempts < max_retries => {
                attempts += 1;
                println!("Connection attempt {} failed: {}. Retrying in 5 seconds...", attempts, e);
                tokio::time::sleep(Duration::from_secs(5)).await;
            },
            Err(e) => return Err(e.into()),
        }
    }
}
}

#![allow(unused)]
fn main() {
// PostgreSQL
"postgresql://username:password@localhost:5432/scim_db"

// SQLite
"sqlite:./scim.db"
"sqlite::memory:" // For testing

// MySQL
"mysql://username:password@localhost:3306/scim_db"
}

#![allow(unused)]
fn main() {
async fn debug_auth_middleware(
    headers: HeaderMap,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    // Log all headers for debugging
    for (name, value) in headers.iter() {
        println!("Header: {} = {:?}", name, value);
    }
    
    // Check for Authorization header
    if let Some(auth_header) = headers.get("Authorization") {
        println!("Auth header found: {:?}", auth_header);
    } else {
        println!("No Authorization header found");
        return Err(StatusCode::UNAUTHORIZED);
    }
    
    Ok(next.run(request).await)
}
}

#![allow(unused)]
fn main() {
// Problem: Missing Bearer prefix
// Wrong: "abc123def456"
// Correct: "Bearer abc123def456"

// Problem: Expired tokens
let now = chrono::Utc::now().timestamp() as usize;
if token_claims.exp < now {
    return Err(StatusCode::UNAUTHORIZED);
}

// Problem: Incorrect Base64 encoding for Basic auth
use base64::{Engine as _, engine::general_purpose};
let encoded = general_purpose::STANDARD.encode("username:password");
println!("Correct Basic auth: Basic {}", encoded);
}

#![allow(unused)]
fn main() {
fn debug_permissions(user_perms: &[String], required_perm: &str) -> bool {
    println!("User permissions: {:?}", user_perms);
    println!("Required permission: {}", required_perm);
    
    let has_permission = user_perms.contains(&required_perm.to_string());
    println!("Permission granted: {}", has_permission);
    
    has_permission
}
}

#![allow(unused)]
fn main() {
// Make sure you're using the correct tenant ID
let user = provider.get_user("correct-tenant-id", &user_id).await?;

// Debug tenant data
let all_tenants = provider.list_all_tenants().await?;
println!("Available tenants: {:?}", all_tenants);
}

#![allow(unused)]
fn main() {
// UUIDs are case-sensitive
let user_id = "2819c223-7f76-453a-919d-413861904646"; // Correct
let user_id = "2819C223-7F76-453A-919D-413861904646"; // Wrong case

// Check if resource exists
if let Some(user) = provider.get_user(tenant_id, user_id).await? {
    println!("User found: {}", user.username());
} else {
    println!("User not found with ID: {}", user_id);
    
    // List all users to debug
    let all_users = provider.list_users(tenant_id, &ListOptions::default()).await?;
    for user in all_users.resources {
        println!("Existing user: {} ({})", user.username(), user.id());
    }
}
}

#![allow(unused)]
fn main() {
// Debug uniqueness violations
match provider.create_user(tenant_id, user).await {
    Err(ProviderError::Conflict(msg)) => {
        println!("Conflict detected: {}", msg);
        
        // Check for existing username
        if let Some(existing) = provider.find_user_by_username(tenant_id, &user.username()).await? {
            println!("User with username '{}' already exists: {}", user.username(), existing.id());
        }
        
        // Check for existing email
        if let Some(email) = user.primary_email() {
            if let Some(existing) = provider.find_user_by_email(tenant_id, email).await? {
                println!("User with email '{}' already exists: {}", email, existing.id());
            }
        }
    },
    Ok(created_user) => println!("User created successfully: {}", created_user.id()),
    Err(e) => println!("Unexpected error: {}", e),
}
}

#![allow(unused)]
fn main() {
// Always fetch latest version before update
let mut user = provider.get_user(tenant_id, user_id).await?
    .ok_or("User not found")?;

println!("Current user version: {}", user.meta().version);

// Make your changes
user.set_given_name("Updated Name");

// Update with current version
match provider.update_user(tenant_id, user).await {
    Ok(updated_user) => {
        println!("Update successful. New version: {}", updated_user.meta().version);
    },
    Err(ProviderError::VersionConflict { current_version, provided_version }) => {
        println!("Version conflict: expected {}, got {}", current_version, provided_version);
        
        // Retry with fresh data
        let fresh_user = provider.get_user(tenant_id, user_id).await?;
        // Apply changes to fresh user and retry
    },
    Err(e) => println!("Update failed: {}", e),
}
}

#![allow(unused)]
fn main() {
use serde_json;

// Test JSON deserialization
let json_str = r#"{"invalid": "json"}"#;
match serde_json::from_str::<ScimUser>(json_str) {
    Ok(user) => println!("User parsed successfully"),
    Err(e) => {
        println!("JSON parsing failed: {}", e);
        println!("Error location: line {}, column {}", e.line(), e.column());
    }
}
}

#![allow(unused)]
fn main() {
// Check for missing required fields
match ScimUser::builder()
    .username("test@example.com")
    // Missing other required fields
    .build() 
{
    Ok(user) => println!("User created: {}", user.id()),
    Err(ValidationError::RequiredField(field)) => {
        println!("Missing required field: {}", field);
    },
    Err(e) => println!("Validation error: {}", e),
}
}

#![allow(unused)]
fn main() {
// Check schema compliance
let user = ScimUser::builder()
    .username("test@example.com")
    .given_name("Test")
    .family_name("User")
    .build()?;

// Validate against schema
match schema_registry.validate_user(&user) {
    Ok(_) => println!("User is valid according to schema"),
    Err(ValidationError::SchemaViolation { field, message }) => {
        println!("Schema violation in field '{}': {}", field, message);
    },
    Err(e) => println!("Validation error: {}", e),
}
}

use tracing::{info, warn, error, debug};
use tracing_subscriber::{EnvFilter, fmt};

// Set up comprehensive logging
fn setup_logging() {
    let filter = EnvFilter::from_default_env()
        .add_directive("scim_server=debug".parse().unwrap())
        .add_directive("sqlx=info".parse().unwrap())
        .add_directive("hyper=info".parse().unwrap());

    fmt()
        .with_env_filter(filter)
        .with_target(true)
        .with_thread_ids(true)
        .with_file(true)
        .with_line_number(true)
        .init();
}

// Use in your application
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    setup_logging();
    
    info!("Starting SCIM server");
    
    // Your application code...
    
    Ok(())
}

# Enable debug logging
export RUST_LOG=scim_server=debug,sqlx=info

# Enable trace-level logging (very verbose)
export RUST_LOG=scim_server=trace

# Log only errors
export RUST_LOG=scim_server=error

#![allow(unused)]
fn main() {
use axum::{
    body::Body,
    extract::Request,
    middleware::Next,
    response::Response,
};

async fn debug_middleware(
    request: Request,
    next: Next,
) -> Response {
    let method = request.method().clone();
    let uri = request.uri().clone();
    let headers = request.headers().clone();
    
    // Log request
    debug!("Incoming request: {} {}", method, uri);
    for (name, value) in headers.iter() {
        debug!("Request header: {}: {:?}", name, value);
    }
    
    let start = std::time::Instant::now();
    let response = next.run(request).await;
    let duration = start.elapsed();
    
    // Log response
    debug!(
        "Response: {} {} - {} in {:?}",
        method,
        uri,
        response.status(),
        duration
    );
    
    response
}

// Add to your router
let app = Router::new()
    .nest("/scim/v2", scim_routes())
    .layer(middleware::from_fn(debug_middleware));
}

#![allow(unused)]
fn main() {
// Enable SQL query logging for sqlx
use sqlx::postgres::PgPoolOptions;

let pool = PgPoolOptions::new()
    .max_connections(10)
    .connect(&database_url)
    .await?;

// Queries will be logged when RUST_LOG includes sqlx=debug
}

#![allow(unused)]
fn main() {
// For InMemoryProvider, add debugging methods
impl InMemoryProvider {
    pub async fn debug_state(&self) {
        let users = self.users.read().await;
        let groups = self.groups.read().await;
        
        println!("=== Provider State Debug ===");
        for (tenant_id, tenant_users) in users.iter() {
            println!("Tenant '{}' has {} users:", tenant_id, tenant_users.len());
            for (user_id, user) in tenant_users.iter() {
                println!("  User: {} ({})", user.username(), user_id);
            }
        }
        
        for (tenant_id, tenant_groups) in groups.iter() {
            println!("Tenant '{}' has {} groups:", tenant_id, tenant_groups.len());
            for (group_id, group) in tenant_groups.iter() {
                println!("  Group: {} ({}) with {} members", 
                         group.display_name(), group_id, group.members().len());
            }
        }
        println!("=== End Debug ===");
    }
}

// Use in your code
provider.debug_state().await;
}

#![allow(unused)]
fn main() {
use std::time::Instant;

async fn timed_query<T, F, Fut>(operation: F) -> Result<T, Error>
where
    F: FnOnce() -> Fut,
    Fut: Future<Output = Result<T, Error>>,
{
    let start = Instant::now();
    let result = operation().await;
    let duration = start.elapsed();
    
    if duration > Duration::from_millis(100) {
        warn!("Slow query detected: {:?}", duration);
    }
    
    result
}

// Usage
let users = timed_query(|| provider.list_users(tenant_id, &options)).await?;
}

#![allow(unused)]
fn main() {
// Current approach: Load all users then filter in memory
// Note: Database-level filtering is not yet implemented
let all_users = provider.list_users(tenant_id, &ListOptions::default()).await?;
let filtered: Vec<_> = all_users.resources.into_iter()
    .filter(|u| u.department() == Some("Engineering"))
    .collect();

// For large datasets, consider implementing pagination
let options = ListOptions::builder()
    .count(Some(50))  // Limit results
    .start_index(Some(1))
    .build();
let paginated_users = provider.list_users(tenant_id, &options).await?;
}

#![allow(unused)]
fn main() {
use sysinfo::{System, SystemExt};

fn log_memory_usage() {
    let mut system = System::new_all();
    system.refresh_memory();
    
    let used = system.used_memory();
    let total = system.total_memory();
    let percentage = (used as f64 / total as f64) * 100.0;
    
    info!("Memory usage: {} MB / {} MB ({:.1}%)", 
          used / 1024 / 1024, 
          total / 1024 / 1024, 
          percentage);
}

// Check periodically
tokio::spawn(async {
    loop {
        log_memory_usage();
        tokio::time::sleep(Duration::from_secs(60)).await;
    }
});
}

#![allow(unused)]
fn main() {
// Use pagination for large datasets
let mut start_index = 1;
let page_size = 100;

loop {
    let options = ListOptions::builder()
        .start_index(start_index)
        .count(page_size)
        .build();
    
    let page = provider.list_users(tenant_id, &options).await?;
    
    // Process page
    for user in page.resources {
        process_user(user).await?;
    }
    
    // Check if we're done
    if page.resources.len() < page_size {
        break;
    }
    
    start_index += page_size;
}
}

#![allow(unused)]
fn main() {
use axum::{response::Json, http::StatusCode};
use serde_json::json;

async fn health_check(
    State(state): State<AppState>,
) -> Result<Json<serde_json::Value>, StatusCode> {
    // Check provider health
    let provider_health = state.provider.health_check().await
        .map_err(|_| StatusCode::SERVICE_UNAVAILABLE)?;
    
    // Check database connectivity
    let db_status = match state.provider.get_user("health-check", "non-existent").await {
        Ok(None) | Err(ProviderError::NotFound { .. }) => "healthy",
        Err(_) => "unhealthy",
    };
    
    let response = json!({
        "status": "healthy",
        "timestamp": chrono::Utc::now(),
        "version": env!("CARGO_PKG_VERSION"),
        "components": {
            "provider": provider_health.status,
            "database": db_status
        }
    });
    
    Ok(Json(response))
}

// Add to router
let app = Router::new()
    .route("/health", get(health_check))
    .nest("/scim/v2", scim_routes());
}

#![allow(unused)]
fn main() {
use std::sync::atomic::{AtomicU64, Ordering};
use std::sync::Arc;

#[derive(Clone)]
struct Metrics {
    requests_total: Arc<AtomicU64>,
    requests_errors: Arc<AtomicU64>,
    users_created: Arc<AtomicU64>,
    users_updated: Arc<AtomicU64>,
}

impl Metrics {
    fn new() -> Self {
        Self {
            requests_total: Arc::new(AtomicU64::new(0)),
            requests_errors: Arc::new(AtomicU64::new(0)),
            users_created: Arc::new(AtomicU64::new(0)),
            users_updated: Arc::new(AtomicU64::new(0)),
        }
    }
    
    fn increment_requests(&self) {
        self.requests_total.fetch_add(1, Ordering::Relaxed);
    }
    
    fn increment_errors(&self) {
        self.requests_errors.fetch_add(1, Ordering::Relaxed);
    }
}

async fn metrics_endpoint(
    State(metrics): State<Metrics>,
) -> Json<serde_json::Value> {
    Json(json!({
        "requests_total": metrics.requests_total.load(Ordering::Relaxed),
        "requests_errors": metrics.requests_errors.load(Ordering::Relaxed),
        "users_created": metrics.users_created.load(Ordering::Relaxed),
        "users_updated": metrics.users_updated.load(Ordering::Relaxed),
    }))
}
}

#![allow(unused)]
fn main() {
#[cfg(test)]
mod tests {
    use super::*;
    use tokio_test;
    
    #[tokio::test]
    async fn debug_user_creation() {
        // Enable logging in tests
        let _ = tracing_subscriber::fmt::try_init();
        
        let provider = InMemoryProvider::new();
        let tenant_id = "test-tenant";
        
        // Create test user
        let user = ScimUser::builder()
            .username("test@example.com")
            .given_name("Test")
            .family_name("User")
            .build()
            .unwrap();
        
        println!("Creating user: {:?}", user);
        
        let created = provider.create_user(tenant_id, user).await.unwrap();
        
        println!("Created user with ID: {}", created.id());
        
        // Verify creation
        let fetched = provider.get_user(tenant_id, created.id()).await.unwrap();
        assert!(fetched.is_some());
        
        println!("Test passed: user creation and retrieval");
    }
}
}

#![allow(unused)]
fn main() {
// Create test helper functions
pub async fn setup_test_server() -> (TestServer, String) {
    let provider = InMemoryProvider::new();
    let scim_server = ScimServer::builder()
        .provider(provider)
        .build();
    
    let app = create_app(scim_server);
    let server = TestServer::new(app).unwrap();
    let tenant_id = "test-tenant".to_string();
    
    (server, tenant_id)
}

pub fn create_test_user() -> ScimUser {
    ScimUser::builder()
        .username("test@example.com")
        .given_name("Test")
        .family_name("User")
        .email("test@example.com")
        .active(true)
        .build()
        .unwrap()
}

#[tokio::test]
async fn integration_test_user_lifecycle() {
    let (server, tenant_id) = setup_test_server().await;
    let user = create_test_user();
    
    // Create user
    let response = server
        .post(&format!("/scim/v2/{}/Users", tenant_id))
        .json(&user)
        .await;
    
    assert_eq!(response.status_code(), 201);
    
    let created_user: ScimUser = response.json();
    println!("Created user: {}", created_user.id());
    
    // Get user
    let response = server
        .get(&format!("/scim/v2/{}/Users/{}", tenant_id, created_user.id()))
        .await;
    
    assert_eq!(response.status_code(), 200);
    
    // Update user
    let mut updated_user = created_user.clone();
    updated_user.set_given_name("Updated");
    
    let response = server
        .put(&format!("/scim/v2/{}/Users/{}", tenant_id, created_user.id()))
        .json(&updated_user)
        .await;
    
    assert_eq!(response.status_code(), 200);
    
    // Delete user
    let response = server
        .delete(&format!("/scim/v2/{}/Users/{}", tenant_id, created_user.id()))
        .await;
    
    assert_eq!(response.status_code(), 204);
}
}

#![allow(unused)]
fn main() {
// Version information
println!("SCIM Server version: {}", env!("CARGO_PKG_VERSION"));
println!("Rust version: {}", env!("RUSTC_VERSION"));

// System information
use sysinfo::{System, SystemExt};
let mut system = System::new_all();
system.refresh_all();
println!("OS: {} {}", system.name().unwrap_or("Unknown"), system.os_version().unwrap_or("Unknown"));
println!("Total memory: {} MB", system.total_memory() / 1024 / 1024);

// Configuration
println!("Database URL: {}", env::var("DATABASE_URL").unwrap_or("Not set".to_string()));
println!("Log level: {}", env::var("RUST_LOG").unwrap_or("Not set".to_string()));
}

# Set maximum verbosity
export RUST_LOG=trace

# Run with backtrace
export RUST_BACKTRACE=full

# Run your application
cargo run

// Create the smallest possible example that reproduces the issue
use scim_server::{ScimServer, InMemoryProvider, ScimUser};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let provider = InMemoryProvider::new();
    let scim_server = ScimServer::builder().provider(provider).build();
    
    // Minimal reproduction of your issue
    let user = ScimUser::builder()
        .username("test@example.com")
        .build()?;
    
    let result = scim_server.create_user("tenant-1", user).await;
    println!("Result: {:?}", result);
    
    Ok(())
}

                    Internet
                       |
                  [Load Balancer]
                   /     |     \
            [SCIM-1] [SCIM-2] [SCIM-3]
                   \     |     /
                  [Database Cluster]
                       |
                   [Redis Cache]

FROM rust:1.75 as builder

WORKDIR /app
COPY Cargo.toml Cargo.lock ./
COPY src ./src

# Build optimized release binary
RUN cargo build --release

FROM debian:bookworm-slim

# Install runtime dependencies
RUN apt-get update && apt-get install -y \
    ca-certificates \
    libssl3 \
    && rm -rf /var/lib/apt/lists/*

# Create non-root user
RUN useradd -r -s /bin/false scim

WORKDIR /app
COPY --from=builder /app/target/release/scim-server .

# Set ownership and permissions
RUN chown scim:scim /app/scim-server
USER scim

EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
  CMD curl -f http://localhost:3000/health || exit 1

CMD ["./scim-server"]

version: '3.8'

services:
  scim-server:
    build: .
    ports:
      - "3000:3000"
    environment:
      - DATABASE_URL=postgresql://scim:${POSTGRES_PASSWORD}@postgres:5432/scim
      - REDIS_URL=redis://redis:6379
      - RUST_LOG=info
      - JWT_SECRET=${JWT_SECRET}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    deploy:
      replicas: 3
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.5'
          memory: 256M
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3

  postgres:
    image: postgres:15
    environment:
      - POSTGRES_DB=scim
      - POSTGRES_USER=scim
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U scim"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    command: redis-server --appendonly yes
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
      - ./ssl:/etc/nginx/ssl
    depends_on:
      - scim-server

volumes:
  postgres_data:
  redis_data:

apiVersion: v1
kind: Namespace
metadata:
  name: scim-server

apiVersion: v1
kind: ConfigMap
metadata:
  name: scim-config
  namespace: scim-server
data:
  RUST_LOG: "info"
  SERVER_HOST: "0.0.0.0"
  SERVER_PORT: "3000"

apiVersion: v1
kind: Secret
metadata:
  name: scim-secrets
  namespace: scim-server
type: Opaque
data:
  DATABASE_URL: <base64-encoded-database-url>
  JWT_SECRET: <base64-encoded-jwt-secret>
  REDIS_URL: <base64-encoded-redis-url>

apiVersion: apps/v1
kind: Deployment
metadata:
  name: scim-server
  namespace: scim-server
spec:
  replicas: 3
  selector:
    matchLabels:
      app: scim-server
  template:
    metadata:
      labels:
        app: scim-server
    spec:
      containers:
      - name: scim-server
        image: your-registry/scim-server:latest
        ports:
        - containerPort: 3000
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: scim-secrets
              key: DATABASE_URL
        - name: JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: scim-secrets
              key: JWT_SECRET
        - name: REDIS_URL
          valueFrom:
            secretKeyRef:
              name: scim-secrets
              key: REDIS_URL
        envFrom:
        - configMapRef:
            name: scim-config
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 3000
          initialDelaySeconds: 5
          periodSeconds: 5
        securityContext:
          runAsNonRoot: true
          runAsUser: 1000
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true

apiVersion: v1
kind: Service
metadata:
  name: scim-server-service
  namespace: scim-server
spec:
  selector:
    app: scim-server
  ports:
  - port: 80
    targetPort: 3000
  type: ClusterIP

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: scim-server-ingress
  namespace: scim-server
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/use-regex: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - scim.yourdomain.com
    secretName: scim-tls-secret
  rules:
  - host: scim.yourdomain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: scim-server-service
            port:
              number: 80

#![allow(unused)]
fn main() {
use sqlx::postgres::PgPoolOptions;
use std::time::Duration;

pub async fn create_db_pool(database_url: &str) -> Result<sqlx::PgPool, sqlx::Error> {
    PgPoolOptions::new()
        .max_connections(20)          // Maximum connections in pool
        .min_connections(5)           // Minimum connections to maintain
        .acquire_timeout(Duration::from_secs(30))
        .idle_timeout(Duration::from_secs(600))
        .max_lifetime(Duration::from_secs(1800))
        .test_before_acquire(true)    // Test connections before use
        .connect(database_url)
        .await
}
}

-- init.sql
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";

-- Users table
CREATE TABLE users (
    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
    tenant_id VARCHAR(255) NOT NULL,
    username VARCHAR(255) NOT NULL,
    given_name VARCHAR(255),
    family_name VARCHAR(255),
    email VARCHAR(255),
    active BOOLEAN NOT NULL DEFAULT true,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    version INTEGER NOT NULL DEFAULT 1,
    data JSONB NOT NULL,
    
    UNIQUE(tenant_id, username),
    UNIQUE(tenant_id, email)
);

-- Groups table
CREATE TABLE groups (
    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
    tenant_id VARCHAR(255) NOT NULL,
    display_name VARCHAR(255) NOT NULL,
    description TEXT,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    version INTEGER NOT NULL DEFAULT 1,
    data JSONB NOT NULL,
    
    UNIQUE(tenant_id, display_name)
);

-- Group memberships
CREATE TABLE group_memberships (
    group_id UUID REFERENCES groups(id) ON DELETE CASCADE,
    user_id UUID REFERENCES users(id) ON DELETE CASCADE,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    
    PRIMARY KEY(group_id, user_id)
);

-- Indexes for performance
CREATE INDEX idx_users_tenant_id ON users(tenant_id);
CREATE INDEX idx_users_username ON users(tenant_id, username);
CREATE INDEX idx_users_email ON users(tenant_id, email);
CREATE INDEX idx_users_active ON users(tenant_id, active);
CREATE INDEX idx_users_updated_at ON users(updated_at);

CREATE INDEX idx_groups_tenant_id ON groups(tenant_id);
CREATE INDEX idx_groups_display_name ON groups(tenant_id, display_name);

CREATE INDEX idx_group_memberships_user_id ON group_memberships(user_id);

-- JSONB indexes for advanced querying
CREATE INDEX idx_users_data_gin ON users USING GIN(data);
CREATE INDEX idx_groups_data_gin ON groups USING GIN(data);

# redis.conf
bind 0.0.0.0
port 6379
timeout 300
tcp-keepalive 60

# Memory management
maxmemory 1gb
maxmemory-policy allkeys-lru

# Persistence
save 900 1
save 300 10
save 60 10000

# Security
requirepass your-redis-password

upstream scim_backend {
    least_conn;
    server scim-server-1:3000 weight=1 max_fails=3 fail_timeout=30s;
    server scim-server-2:3000 weight=1 max_fails=3 fail_timeout=30s;
    server scim-server-3:3000 weight=1 max_fails=3 fail_timeout=30s;
}

server {
    listen 80;
    server_name scim.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name scim.yourdomain.com;

    # SSL configuration
    ssl_certificate /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options DENY always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Rate limiting
    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
    limit_req zone=api burst=20 nodelay;

    location / {
        proxy_pass http://scim_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
        
        # Timeouts
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }

    # Health check endpoint
    location /health {
        access_log off;
        proxy_pass http://scim_backend;
    }
}

# Server configuration
SERVER_HOST=0.0.0.0
SERVER_PORT=3000
RUST_LOG=info

# Database
DATABASE_URL=postgresql://scim:${POSTGRES_PASSWORD}@postgres-cluster:5432/scim?sslmode=require
DATABASE_MAX_CONNECTIONS=20
DATABASE_MIN_CONNECTIONS=5

# Redis
REDIS_URL=redis://:${REDIS_PASSWORD}@redis-cluster:6379
REDIS_MAX_CONNECTIONS=10

# Security
JWT_SECRET=${JWT_SECRET}
ENCRYPTION_KEY=${ENCRYPTION_KEY}
TLS_CERT_PATH=/etc/ssl/certs/scim.crt
TLS_KEY_PATH=/etc/ssl/private/scim.key

# Observability
METRICS_ENABLED=true
TRACING_ENABLED=true
JAEGER_ENDPOINT=http://jaeger:14268/api/traces

# Performance
CACHE_TTL=300
MAX_REQUEST_SIZE=1048576
WORKER_THREADS=4

#![allow(unused)]
fn main() {
use axum::{response::Json, http::StatusCode};
use serde_json::json;

#[derive(Clone)]
pub struct HealthChecker {
    db_pool: sqlx::PgPool,
    redis_client: redis::Client,
}

impl HealthChecker {
    pub async fn check_all(&self) -> Result<HealthStatus, HealthError> {
        let mut checks = Vec::new();
        
        // Database health
        let db_health = self.check_database().await;
        checks.push(("database", db_health.is_ok()));
        
        // Redis health
        let redis_health = self.check_redis().await;
        checks.push(("redis", redis_health.is_ok()));
        
        // Memory usage
        let memory_health = self.check_memory().await;
        checks.push(("memory", memory_health.is_ok()));
        
        let all_healthy = checks.iter().all(|(_, healthy)| *healthy);
        
        Ok(HealthStatus {
            status: if all_healthy { "healthy" } else { "unhealthy" },
            checks,
            timestamp: chrono::Utc::now(),
        })
    }
    
    async fn check_database(&self) -> Result<(), HealthError> {
        sqlx::query("SELECT 1")
            .fetch_one(&self.db_pool)
            .await
            .map_err(|e| HealthError::Database(e.to_string()))?;
        Ok(())
    }
    
    async fn check_redis(&self) -> Result<(), HealthError> {
        let mut conn = self.redis_client
            .get_async_connection()
            .await
            .map_err(|e| HealthError::Redis(e.to_string()))?;
            
        redis::cmd("PING")
            .query_async(&mut conn)
            .await
            .map_err(|e| HealthError::Redis(e.to_string()))?;
        Ok(())
    }
    
    async fn check_memory(&self) -> Result<(), HealthError> {
        use sysinfo::{System, SystemExt};
        let mut system = System::new_all();
        system.refresh_memory();
        
        let used_percentage = (system.used_memory() as f64 / system.total_memory() as f64) * 100.0;
        
        if used_percentage > 90.0 {
            return Err(HealthError::Memory(format!("Memory usage too high: {:.1}%", used_percentage)));
        }
        
        Ok(())
    }
}

pub async fn health_endpoint(
    State(health_checker): State<HealthChecker>,
) -> Result<Json<serde_json::Value>, StatusCode> {
    match health_checker.check_all().await {
        Ok(status) => {
            let status_code = if status.status == "healthy" {
                StatusCode::OK
            } else {
                StatusCode::SERVICE_UNAVAILABLE
            };
            
            Ok(Json(json!(status)))
        },
        Err(_) => Err(StatusCode::INTERNAL_SERVER_ERROR),
    }
}
}

#![allow(unused)]
fn main() {
use prometheus::{Counter, Histogram, Gauge, Registry, Encoder, TextEncoder};
use std::sync::Arc;

#[derive(Clone)]
pub struct Metrics {
    registry: Arc<Registry>,
    http_requests_total: Counter,
    http_request_duration: Histogram,
    active_connections: Gauge,
    users_total: Gauge,
    groups_total: Gauge,
}

impl Metrics {
    pub fn new() -> Result<Self, prometheus::Error> {
        let registry = Arc::new(Registry::new());
        
        let http_requests_total = Counter::new(
            "http_requests_total",
            "Total number of HTTP requests"
        )?;
        
        let http_request_duration = Histogram::with_opts(
            prometheus::HistogramOpts::new(
                "http_request_duration_seconds",
                "HTTP request duration in seconds"
            ).buckets(vec![0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1.0, 2.5, 5.0, 10.0])
        )?;
        
        let active_connections = Gauge::new(
            "active_connections",
            "Number of active connections"
        )?;
        
        let users_total = Gauge::new(
            "users_total",
            "Total number of users"
        )?;
        
        let groups_total = Gauge::new(
            "groups_total",
            "Total number of groups"
        )?;
        
        registry.register(Box::new(http_requests_total.clone()))?;
        registry.register(Box::new(http_request_duration.clone()))?;
        registry.register(Box::new(active_connections.clone()))?;
        registry.register(Box::new(users_total.clone()))?;
        registry.register(Box::new(groups_total.clone()))?;
        
        Ok(Self {
            registry,
            http_requests_total,
            http_request_duration,
            active_connections,
            users_total,
            groups_total,
        })
    }
    
    pub fn record_request(&self, duration: f64) {
        self.http_requests_total.inc();
        self.http_request_duration.observe(duration);
    }
    
    pub async fn metrics_handler(&self) -> Result<String, Box<dyn std::error::Error>> {
        let encoder = TextEncoder::new();
        let metric_families = self.registry.gather();
        let mut buffer = Vec::new();
        encoder.encode(&metric_families, &mut buffer)?;
        Ok(String::from_utf8(buffer)?)
    }
}
}

#![allow(unused)]
fn main() {
use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
use tracing_appender::rolling::{RollingFileAppender, Rotation};

pub fn setup_logging() -> Result<(), Box<dyn std::error::Error>> {
    let file_appender = RollingFileAppender::new(
        Rotation::daily(),
        "/var/log/scim-server",
        "app.log"
    );
    
    let (non_blocking, _guard) = tracing_appender::non_blocking(file_appender);
    
    tracing_subscriber::registry()
        .with(
            tracing_subscriber::EnvFilter::try_from_default_env()
                .unwrap_or_else(|_| "scim_server=info,sqlx=warn".into())
        )
        .with(tracing_subscriber::fmt::layer().with_writer(std::io::stdout))
        .with(tracing_subscriber::fmt::layer().with_writer(non_blocking))
        .init();
    
    Ok(())
}
}

#![allow(unused)]
fn main() {
// Connection pool configuration
let db_pool = PgPoolOptions::new()
    .max_connections(20)
    .min_connections(5)
    .acquire_timeout(Duration::from_secs(30))
    .connect(&database_url)
    .await?;

// Redis connection pool
let redis_pool = deadpool_redis::Config::from_url(&redis_url)
    .create_pool(Some(deadpool_redis::Runtime::Tokio1))?;

// Implement caching layer
#[derive(Clone)]
pub struct CachedProvider {
    inner: DatabaseProvider,
    cache: deadpool_redis::Pool,
    cache_ttl: Duration,
}

impl CachedProvider {
    async fn get_user_cached(&self, tenant_id: &str, user_id: &str) -> Result<Option<ScimUser>, ProviderError> {
        let cache_key = format!("user:{}:{}", tenant_id, user_id);
        
        // Try cache first
        if let Ok(mut conn) = self.cache.get().await {
            if let Ok(cached) = redis::cmd("GET").arg(&cache_key).query_async::<_, String>(&mut conn).await {
                if let Ok(user) = serde_json::from_str::<ScimUser>(&cached) {
                    return Ok(Some(user));
                }
            }
        }
        
        // Fallback to database
        let user = self.inner.get_user(tenant_id, user_id).await?;
        
        // Cache the result
        if let (Some(ref user), Ok(mut conn)) = (&user, self.cache.get().await) {
            if let Ok(serialized) = serde_json::to_string(user) {
                let _: Result<(), _> = redis::cmd("SETEX")
                    .arg(&cache_key)
                    .arg(self.cache_ttl.as_secs())
                    .arg(serialized)
                    .query_async(&mut conn)
                    .await;
            }
        }
        
        Ok(user)
    }
}
}

-- Analyze query performance
EXPLAIN ANALYZE SELECT * FROM users WHERE tenant_id = 'tenant-1' AND active = true;

-- Create partial indexes for common queries
CREATE INDEX CONCURRENTLY idx_users_active_by_tenant 
ON users(tenant_id, username) 
WHERE active = true;

-- Optimize JSONB queries
CREATE INDEX CONCURRENTLY idx_users_department 
ON users USING GIN ((data->'department'));

-- Partition large tables by tenant
CREATE TABLE users_partitioned (
    LIKE users INCLUDING ALL
) PARTITION BY HASH (tenant_id);

CREATE TABLE users_part_0 PARTITION OF users_partitioned
FOR VALUES WITH (modulus 4, remainder 0);

CREATE TABLE users_part_1 PARTITION OF users_partitioned
FOR VALUES WITH (modulus 4, remainder 1);

-- Regular maintenance
CREATE OR REPLACE FUNCTION maintain_database()
RETURNS void AS $$
BEGIN
    -- Update statistics
    ANALYZE;
    
    -- Rebuild indexes if needed
    REINDEX INDEX CONCURRENTLY idx_users_tenant_id;
    
    -- Clean up old data
    DELETE FROM audit_logs WHERE created_at < NOW() - INTERVAL '90 days';
END;
$$ LANGUAGE plpgsql;

-- Schedule maintenance
SELECT cron.schedule('database-maintenance', '0 2 * * 0', 'SELECT maintain_database();');

#!/bin/bash
# backup.sh

set -e

BACKUP_DIR="/backups"
DB_NAME="scim"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
BACKUP_FILE="${BACKUP_DIR}/scim_backup_${TIMESTAMP}.sql"

# Create backup directory
mkdir -p $BACKUP_DIR

# Perform backup
pg_dump \
    --host=$DB_HOST \
    --port=$DB_PORT \
    --username=$DB_USER \
    --dbname=$DB_NAME \
    --format=custom \
    --compress=9 \
    --file=$BACKUP_FILE

# Encrypt backup
gpg --symmetric --cipher-algo AES256 --output $BACKUP_FILE.gpg $BACKUP_FILE
rm $BACKUP_FILE

# Upload to S3
aws s3 cp $BACKUP_FILE.gpg s3://scim-backups/daily/

# Clean up old local backups (keep 7 days)
find $BACKUP_DIR -name "scim_backup_*.sql.gpg" -mtime +7 -delete

# Clean up old S3 backups (keep 30 days)
aws s3 ls s3://scim-backups/daily/ | grep "scim_backup_" | head -n -30 | awk '{print $4}' | xargs -I {} aws s3 rm s3://scim-backups/daily/{}

#!/bin/bash
# test-restore.sh

BACKUP_FILE=$1
TEST_DB="scim_restore_test"

# Create test database
createdb $TEST_DB

# Restore backup
pg_restore \
    --host=$DB_HOST \
    --port=$DB_PORT \
    --username=$DB_USER \
    --dbname=$TEST_DB \
    --clean \
    --if-exists \
    $BACKUP_FILE

# Run validation queries
psql -d $TEST_DB -c "SELECT COUNT(*) FROM users;"
psql -d $TEST_DB -c "SELECT COUNT(*) FROM groups;"

# Clean up
dropdb $TEST_DB

echo "Restore test completed successfully"

name: Deploy to Production

on:
  push:
    branches: [main]
    tags: ['v*']

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
    - uses: actions/checkout@v4
    - uses: actions-rs/toolchain@v1
      with:
        toolchain: stable
    - uses: actions-rs/cargo@v1
      with:
        command: test

  build-and-push:
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      
    - name: Log in to Registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
        
    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        
    - name: Build and push
      uses: docker/build-push-action@v5
      with:
        context: .
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}

  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
    - name: Deploy to Kubernetes
      uses: azure/k8s-deploy@v1
      with:
        manifests: |
          k8s/deployment.yaml
          k8s/service.yaml
          k8s/ingress.yaml
        images: |
          ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main
        kubectl-version: 'latest'

# Pod Security Policy
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: scim-server-psp
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'

# Network Policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: scim-server-netpol
  namespace: scim-server
spec:
  podSelector:
    matchLabels:
      app: scim-server
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
    ports:
    - protocol: TCP
      port: 3000
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: database
    ports:
    - protocol: TCP
      port: 5432
  - to:
    - namespaceSelector:
        matchLabels:
          name: redis
    ports:
    - protocol: TCP
      port: 6379

#![allow(unused)]
fn main() {
use scim_server::auth::{AuthConfig, JwtConfig};

let jwt_config = JwtConfig::builder()
    .issuer("https://trusted-auth-provider.com")
    .audience("scim-api")
    .public_key_url("https://trusted-auth-provider.com/.well-known/jwks.json")
    .algorithm("RS256") // Use asymmetric algorithms
    .clock_skew_seconds(60) // Allow for clock drift
    .cache_public_keys(true)
    .key_refresh_interval_seconds(3600) // Refresh keys hourly
    .validate_not_before(true)
    .validate_expiration(true)
    .build()?;

let auth_config = AuthConfig::builder()
    .jwt_config(jwt_config)
    .require_scope("scim:write") // Require specific scopes
    .build()?;
}

#![allow(unused)]
fn main() {
use scim_server::auth::{BearerTokenValidator, TokenValidationError};

#[async_trait]
impl BearerTokenValidator for CustomTokenValidator {
    async fn validate_token(&self, token: &str) -> Result<AuthContext, TokenValidationError> {
        // Implement secure token validation
        let validation_result = self.introspect_token(token).await?;
        
        if !validation_result.active {
            return Err(TokenValidationError::TokenInactive);
        }
        
        if validation_result.expires_at < Utc::now() {
            return Err(TokenValidationError::TokenExpired);
        }
        
        // Validate required scopes
        if !validation_result.scopes.contains(&"scim:read".to_string()) {
            return Err(TokenValidationError::InsufficientScope);
        }
        
        Ok(AuthContext {
            user_id: validation_result.user_id,
            tenant_id: validation_result.tenant_id,
            scopes: validation_result.scopes,
            roles: validation_result.roles,
        })
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::auth::{AuthMiddleware, RequiredScope};

// Define fine-grained scopes
const SCIM_READ: &str = "scim:read";
const SCIM_WRITE: &str = "scim:write";
const SCIM_DELETE: &str = "scim:delete";
const SCIM_ADMIN: &str = "scim:admin";

// Apply scope requirements to endpoints
app.route("/Users", get(list_users).with(RequiredScope::new(SCIM_READ)))
   .route("/Users", post(create_user).with(RequiredScope::new(SCIM_WRITE)))
   .route("/Users/:id", delete(delete_user).with(RequiredScope::new(SCIM_DELETE)));
}

#![allow(unused)]
fn main() {
use oauth2::introspection::{IntrospectionRequest, IntrospectionResponse};

async fn introspect_token(token: &str) -> Result<IntrospectionResponse, AuthError> {
    let client = reqwest::Client::new();
    let response = client
        .post("https://auth-server.com/oauth2/introspect")
        .form(&[
            ("token", token),
            ("token_type_hint", "access_token"),
        ])
        .basic_auth(&client_id, Some(&client_secret))
        .timeout(Duration::from_secs(5)) // Short timeout
        .send()
        .await?;
    
    let introspection: IntrospectionResponse = response.json().await?;
    Ok(introspection)
}
}

#![allow(unused)]
fn main() {
use scim_server::auth::{Role, Permission, AuthContext};

#[derive(Debug, Clone)]
pub enum Permission {
    ReadUsers,
    WriteUsers,
    DeleteUsers,
    ReadGroups,
    WriteGroups,
    DeleteGroups,
    ManageTenants,
    ViewAuditLogs,
}

#[derive(Debug, Clone)]
pub struct Role {
    pub name: String,
    pub permissions: Vec<Permission>,
    pub tenant_scope: Option<String>, // None for global roles
}

// Define roles
let user_reader = Role {
    name: "user_reader".to_string(),
    permissions: vec![Permission::ReadUsers],
    tenant_scope: Some("tenant_123".to_string()),
};

let admin = Role {
    name: "admin".to_string(),
    permissions: vec![
        Permission::ReadUsers,
        Permission::WriteUsers,
        Permission::DeleteUsers,
        Permission::ReadGroups,
        Permission::WriteGroups,
        Permission::DeleteGroups,
    ],
    tenant_scope: None, // Global admin
};

// Authorization middleware
async fn authorize_request(
    auth_context: &AuthContext,
    required_permission: Permission,
    resource_tenant: Option<&str>,
) -> Result<(), AuthError> {
    for role in &auth_context.roles {
        if role.permissions.contains(&required_permission) {
            // Check tenant scope
            match (&role.tenant_scope, resource_tenant) {
                (None, _) => return Ok(()), // Global role
                (Some(role_tenant), Some(resource_tenant)) if role_tenant == resource_tenant => {
                    return Ok(());
                }
                _ => continue,
            }
        }
    }
    Err(AuthError::InsufficientPermissions)
}
}

#![allow(unused)]
fn main() {
use scim_server::security::{AttributeFilter, SecurityContext};

#[derive(Debug)]
pub struct AttributeFilter {
    readable_attributes: HashSet<String>,
    writable_attributes: HashSet<String>,
    tenant_id: Option<String>,
    user_roles: Vec<String>,
}

impl AttributeFilter {
    pub fn filter_response(&self, mut user: User) -> User {
        // Remove sensitive attributes based on permissions
        if !self.user_roles.contains(&"admin".to_string()) {
            user.password = None;
            user.security_question = None;
        }
        
        // Remove PII for limited roles
        if !self.user_roles.contains(&"pii_reader".to_string()) {
            user.social_security_number = None;
            user.date_of_birth = None;
        }
        
        user
    }
    
    pub fn validate_write_permissions(&self, patch_ops: &[PatchOp]) -> Result<(), AuthError> {
        for op in patch_ops {
            let attribute = extract_attribute_from_path(&op.path);
            if !self.writable_attributes.contains(attribute) {
                return Err(AuthError::AttributeNotWritable(attribute.to_string()));
            }
        }
        Ok(())
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::encryption::{EncryptionProvider, AesGcmProvider};

// Configure encryption for sensitive fields
let encryption_config = EncryptionConfig::builder()
    .provider(AesGcmProvider::new(&encryption_key)?)
    .encrypt_fields(vec![
        "password",
        "socialSecurityNumber",
        "bankAccountNumber",
        "personalEmail",
    ])
    .encryption_algorithm("AES-256-GCM")
    .key_rotation_days(90)
    .build()?;

// Automatic encryption/decryption
#[derive(Serialize, Deserialize)]
pub struct User {
    pub id: String,
    pub user_name: String,
    
    #[serde(with = "encrypted_field")]
    pub password: Option<String>,
    
    #[serde(with = "encrypted_field")]
    pub social_security_number: Option<String>,
    
    pub meta: Meta,
}
}

#![allow(unused)]
fn main() {
use scim_server::tls::{TlsConfig, TlsVersion, CipherSuite};

let tls_config = TlsConfig::builder()
    .certificate_file("/etc/ssl/certs/server.crt")
    .private_key_file("/etc/ssl/private/server.key")
    .ca_certificate_file("/etc/ssl/certs/ca.crt")
    .min_tls_version(TlsVersion::V1_2)
    .max_tls_version(TlsVersion::V1_3)
    .require_client_cert(false)
    .cipher_suites(vec![
        CipherSuite::TLS_AES_256_GCM_SHA384,
        CipherSuite::TLS_CHACHA20_POLY1305_SHA256,
        CipherSuite::TLS_AES_128_GCM_SHA256,
    ])
    .verify_hostname(true)
    .build()?;
}

#![allow(unused)]
fn main() {
use scim_server::privacy::{DataMasker, MaskingRule};

#[derive(Debug)]
pub struct DataMasker {
    rules: Vec<MaskingRule>,
}

impl DataMasker {
    pub fn mask_user_for_logging(&self, user: &User) -> User {
        let mut masked_user = user.clone();
        
        // Mask email
        if let Some(email) = &masked_user.user_name {
            masked_user.user_name = Some(self.mask_email(email));
        }
        
        // Remove sensitive fields entirely
        masked_user.password = None;
        masked_user.social_security_number = None;
        
        // Mask phone numbers
        for phone in &mut masked_user.phone_numbers {
            phone.value = self.mask_phone(&phone.value);
        }
        
        masked_user
    }
    
    fn mask_email(&self, email: &str) -> String {
        if let Some(at_pos) = email.find('@') {
            let (local, domain) = email.split_at(at_pos);
            if local.len() > 2 {
                format!("{}***@{}", &local[..2], &domain[1..])
            } else {
                format!("***@{}", &domain[1..])
            }
        } else {
            "***".to_string()
        }
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::validation::{SchemaValidator, ValidationError};

#[derive(Debug)]
pub struct SecureValidator {
    max_string_length: usize,
    max_array_size: usize,
    allowed_schemas: HashSet<String>,
    dangerous_patterns: Vec<Regex>,
}

impl SecureValidator {
    pub fn validate_user_input(&self, user: &User) -> Result<(), ValidationError> {
        // Check schema allowlist
        for schema in &user.schemas {
            if !self.allowed_schemas.contains(schema) {
                return Err(ValidationError::UnknownSchema(schema.clone()));
            }
        }
        
        // Validate string lengths
        if let Some(username) = &user.user_name {
            if username.len() > self.max_string_length {
                return Err(ValidationError::StringTooLong("userName".to_string()));
            }
            self.check_dangerous_patterns(username, "userName")?;
        }
        
        // Validate array sizes
        if user.emails.len() > self.max_array_size {
            return Err(ValidationError::ArrayTooLarge("emails".to_string()));
        }
        
        // Validate email formats
        for email in &user.emails {
            self.validate_email(&email.value)?;
        }
        
        Ok(())
    }
    
    fn check_dangerous_patterns(&self, input: &str, field: &str) -> Result<(), ValidationError> {
        for pattern in &self.dangerous_patterns {
            if pattern.is_match(input) {
                warn!("Dangerous pattern detected in field {}: {}", field, input);
                return Err(ValidationError::DangerousInput(field.to_string()));
            }
        }
        Ok(())
    }
    
    fn validate_email(&self, email: &str) -> Result<(), ValidationError> {
        // Strict email validation
        let email_regex = Regex::new(r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$").unwrap();
        if !email_regex.is_match(email) {
            return Err(ValidationError::InvalidEmail(email.to_string()));
        }
        
        // Check for suspicious patterns
        if email.contains("..") || email.starts_with('.') || email.ends_with('.') {
            return Err(ValidationError::SuspiciousEmail(email.to_string()));
        }
        
        Ok(())
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::storage::{QueryBuilder, Parameter};

// Always use parameterized queries for safe filtering
pub async fn find_users_by_criteria(
    &self,
    tenant_id: &str,
    department: Option<&str>,
    active: Option<bool>,
) -> Result<Vec<User>, StorageError> {
    let mut query_builder = QueryBuilder::new();
    let mut params = Vec::new();
    
    // Build parameterized query
    query_builder.add("SELECT * FROM users WHERE tenant_id = ?");
    params.push(Parameter::String(tenant_id.to_string()));
    
    // Add safe criteria parameters
    if let Some(dept) = department {
        query_builder.add(" AND department = ?");
        params.push(Parameter::String(dept.to_string()));
    }
    
    if let Some(is_active) = active {
        query_builder.add(" AND active = ?");
        params.push(Parameter::Bool(is_active));
    }
    
    let query = query_builder.build();
    self.execute_query(&query, &params).await
}

// Safe query building with attribute validation
fn build_search_query(&self, criteria: &SearchCriteria) -> Result<(String, Vec<Parameter>), FilterError> {
    let mut query = String::from("SELECT * FROM users WHERE tenant_id = ?");
    let mut params = vec![Parameter::String(criteria.tenant_id.clone())];
    
    // Validate and add safe search criteria
    if let Some(username) = &criteria.username {
        if self.is_valid_attribute("userName") {
            query.push_str(" AND username = ?");
            params.push(Parameter::String(username.clone()));
        } else {
            return Err(FilterError::InvalidAttribute("userName"));
        }
    }
    
    if let Some(email) = &criteria.email {
        if self.is_valid_attribute("emails.value") {
            query.push_str(" AND email = ?");
            params.push(Parameter::String(email.clone()));
        } else {
            return Err(FilterError::InvalidAttribute("emails.value"));
        }
    }
    
    Ok((query, params))
}
}
}

#![allow(unused)]
fn main() {
use scim_server::json::{SafeJsonParser, JsonValidationError};

pub struct SafeJsonParser {
    max_depth: usize,
    max_object_size: usize,
    max_string_length: usize,
    forbidden_keys: HashSet<String>,
}

impl SafeJsonParser {
    pub fn parse_user(&self, json: &str) -> Result<User, JsonValidationError> {
        // Parse with size limits
        let value: serde_json::Value = serde_json::from_str(json)
            .map_err(|e| JsonValidationError::ParseError(e.to_string()))?;
        
        // Validate structure
        self.validate_json_structure(&value, 0)?;
        
        // Convert to User struct with validation
        let user: User = serde_json::from_value(value)
            .map_err(|e| JsonValidationError::DeserializationError(e.to_string()))?;
        
        Ok(user)
    }
    
    fn validate_json_structure(&self, value: &serde_json::Value, depth: usize) -> Result<(), JsonValidationError> {
        if depth > self.max_depth {
            return Err(JsonValidationError::TooDeep);
        }
        
        match value {
            serde_json::Value::Object(obj) => {
                if obj.len() > self.max_object_size {
                    return Err(JsonValidationError::ObjectTooLarge);
                }
                
                for (key, val) in obj {
                    if self.forbidden_keys.contains(key) {
                        return Err(JsonValidationError::ForbiddenKey(key.clone()));
                    }
                    self.validate_json_structure(val, depth + 1)?;
                }
            }
            serde_json::Value::Array(arr) => {
                for item in arr {
                    self.validate_json_structure(item, depth + 1)?;
                }
            }
            serde_json::Value::String(s) => {
                if s.len() > self.max_string_length {
                    return Err(JsonValidationError::StringTooLong);
                }
            }
            _ => {}
        }
        
        Ok(())
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::rate_limit::{RateLimiter, RateLimitConfig, RateLimitError};

#[derive(Debug)]
pub struct SecurityRateLimiter {
    global_limiter: RateLimiter,
    tenant_limiters: DashMap<String, RateLimiter>,
    ip_limiters: DashMap<IpAddr, RateLimiter>,
}

impl SecurityRateLimiter {
    pub async fn check_rate_limits(
        &self,
        ip: IpAddr,
        tenant_id: Option<&str>,
        endpoint: &str,
    ) -> Result<(), RateLimitError> {
        // Check global rate limit (most permissive)
        self.global_limiter.check_rate_limit("global", 10000, 3600).await?;
        
        // Check IP-based rate limit (stricter)
        let ip_key = ip.to_string();
        if let Some(ip_limiter) = self.ip_limiters.get(&ip) {
            ip_limiter.check_rate_limit(&ip_key, 1000, 3600).await?;
        }
        
        // Check tenant-specific rate limit
        if let Some(tenant_id) = tenant_id {
            if let Some(tenant_limiter) = self.tenant_limiters.get(tenant_id) {
                tenant_limiter.check_rate_limit(tenant_id, 5000, 3600).await?;
            }
        }
        
        // Check endpoint-specific limits
        match endpoint {
            "/Users" => self.check_user_endpoint_limits(ip, tenant_id).await?,
            "/Bulk" => self.check_bulk_endpoint_limits(ip, tenant_id).await?,
            _ => {}
        }
        
        Ok(())
    }
    
    async fn check_bulk_endpoint_limits(
        &self,
        ip: IpAddr,
        tenant_id: Option<&str>,
    ) -> Result<(), RateLimitError> {
        // Bulk operations are more expensive, so stricter limits
        let bulk_limiter = self.ip_limiters.entry(ip).or_insert_with(|| {
            RateLimiter::new(RateLimitConfig::new(10, 3600)) // 10 per hour
        });
        
        bulk_limiter.check_rate_limit(&format!("bulk:{}", ip), 10, 3600).await
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::cors::{CorsConfig, CorsMiddleware};

let cors_config = CorsConfig::builder()
    .allowed_origins(vec![
        "https://app.company.com".to_string(),
        "https://admin.company.com".to_string(),
    ]) // Never use "*" in production
    .allowed_methods(vec!["GET", "POST", "PUT", "PATCH", "DELETE"])
    .allowed_headers(vec![
        "Authorization",
        "Content-Type",
        "X-Tenant-ID",
        "If-Match",
        "If-None-Match",
    ])
    .expose_headers(vec!["ETag", "Location"])
    .allow_credentials(true)
    .max_age(3600)
    .vary_header(true) // Important for caching security
    .build()?;
}

#![allow(unused)]
fn main() {
use scim_server::network::{IpFilter, IpFilterConfig};

let ip_filter_config = IpFilterConfig::builder()
    .allowed_cidrs(vec![
        "10.0.0.0/8".parse()?,      // Internal network
        "172.16.0.0/12".parse()?,   // Private network
        "203.0.113.0/24".parse()?,  // Specific public range
    ])
    .blocked_cidrs(vec![
        "192.168.1.100/32".parse()?, // Known malicious IP
    ])
    .enable_geoblocking(true)
    .allowed_countries(vec!["US", "CA", "GB"])
    .build()?;

// Apply IP filtering middleware
async fn ip_filter_middleware(
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    req: Request<Body>,
    next: Next<Body>,
) -> Result<Response<Body>, StatusCode> {
    let ip = addr.ip();
    
    if !ip_filter_config.is_allowed(ip).await? {
        warn!("Blocked request from IP: {}", ip);
        return Err(StatusCode::FORBIDDEN);
    }
    
    Ok(next.run(req).await)
}
}

#![allow(unused)]
fn main() {
use scim_server::audit::{AuditLogger, AuditEvent, AuditLevel};

#[derive(Debug, Serialize)]
pub struct AuditEvent {
    pub timestamp: DateTime<Utc>,
    pub event_type: String,
    pub actor: ActorInfo,
    pub resource: ResourceInfo,
    pub tenant_id: Option<String>,
    pub ip_address: IpAddr,
    pub user_agent: Option<String>,
    pub result: OperationResult,
    pub details: serde_json::Value,
}

impl AuditLogger {
    pub async fn log_user_access(&self, event: UserAccessEvent) {
        let audit_event = AuditEvent {
            timestamp: Utc::now(),
            event_type: "user_access".to_string(),
            actor: ActorInfo {
                user_id: event.actor_id,
                auth_method: event.auth_method,
                scopes: event.scopes,
            },
            resource: ResourceInfo {
                resource_type: "User".to_string(),
                resource_id: event.user_id.clone(),
                operation: event.operation,
            },
            tenant_id: event.tenant_id,
            ip_address: event.ip_address,
            user_agent: event.user_agent,
            result: event.result,
            details: json!({
                "user_id": event.user_id,
                "fields_accessed": event.fields_accessed,
                "response_size": event.response_size,
            }),
        };
        
        // Log to multiple destinations
        self.log_to_file(&audit_event).await;
        self.log_to_siem(&audit_event).await;
        self.log_to_database(&audit_event).await;
        
        // Trigger alerts for sensitive operations
        if event.operation == "delete" || event.fields_accessed.contains(&"password".to_string()) {
            self.trigger_security_alert(&audit_event).await;
        }
    }
    
    pub async fn log_authentication_event(&self, event: AuthEvent) {
        let audit_event = AuditEvent {
            timestamp: Utc::now(),
            event_type: match event.result {
                AuthResult::Success => "auth_success".to_string(),
                AuthResult::Failure => "auth_failure".to_string(),
            },
            actor: ActorInfo {
                user_id: event.user_id.clone(),
                auth_method: event.auth_method,
                scopes: vec![],
            },
            resource: ResourceInfo {
                resource_type: "Authentication".to_string(),
                resource_id: "system".to_string(),
                operation: "authenticate".to_string(),
            },
            tenant_id: event.tenant_id,
            ip_address: event.ip_address,
            user_agent: event.user_agent,
            result: match event.result {
                AuthResult::Success => OperationResult::Success,
                AuthResult::Failure => OperationResult::Failure,
            },
            details: json!({
                "auth_method": event.auth_method,
                "failure_reason": event.failure_reason,
                "token_claims": event.token_claims,
            }),
        };
        
        self.log_to_security_log(&audit_event).await;
        
        // Detect brute force attacks
        if matches!(event.result, AuthResult::Failure) {
            self.check_for_brute_force(event.ip_address, event.user_id).await;
        }
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::monitoring::{SecurityMonitor, ThreatDetector};

pub struct SecurityMonitor {
    threat_detector: ThreatDetector,
    alert_manager: AlertManager,
    metrics_collector: MetricsCollector,
}

impl SecurityMonitor {
    pub async fn analyze_request_patterns(&self) {
        // Detect unusual access patterns
        let patterns = self.threat_detector.analyze_recent_requests().await;
        
        for pattern in patterns {
            match pattern.threat_level {
                ThreatLevel::High => {
                    self.alert_manager.send_immediate_alert(pattern).await;
                    self.auto_block_suspicious_ips(pattern.source_ips).await;
                }
                ThreatLevel::Medium => {
                    self.alert_manager.send_alert(pattern).await;
                    self.increase_monitoring(pattern.source_ips).await;
                }
                ThreatLevel::Low => {
                    self.log_suspicious_activity(pattern).await;
                }
            }
        }
    }
    
    pub async fn detect_data_exfiltration(&self) {
        // Monitor for unusual data access patterns
        let access_patterns = self.metrics_collector
            .get_recent_access_patterns(Duration::hours(1))
            .await;
        
        for pattern in access_patterns {
            // Large number of user records accessed by single user
            if pattern.resources_accessed > 1000 && pattern.time_span < Duration::minutes(10) {
                self.alert_manager.send_data_exfiltration_alert(&pattern).await;
            }
            
            // Access to sensitive fields by non-admin users
            if pattern.sensitive_fields_accessed > 0 && !pattern.is_admin_user {
                self.alert_manager.send_privilege_escalation_alert(&pattern).await;
            }
        }
    }
}
}

# Use minimal base image
FROM gcr.io/distroless/cc-debian12:latest

# Don't run as root
USER 65534:65534

# Copy only necessary files
COPY --from=builder /app/target/release/scim-server /scim-server
COPY --from=builder /app/config/ /config/

# Set secure file permissions
USER root
RUN chmod 500 /scim-server && \
    chmod -R 400 /config/
USER 65534:65534

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD ["/scim-server", "health-check"]

# Expose only necessary port
EXPOSE 8080

ENTRYPOINT ["/scim-server"]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: scim-server
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        runAsGroup: 65534
        fsGroup: 65534
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: scim-server
        image: scim-server:latest
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 65534
          capabilities:
            drop:
            - ALL
        resources:
          limits:
            memory: "1Gi"
            cpu: "500m"
          requests:
            memory: "512Mi"
            cpu: "250m"
        env:
        - name: SCIM_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: scim-secrets
              key: db-password
        - name: SCIM_JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: scim-secrets
              key: jwt-secret
        volumeMounts:
        - name: config
          mountPath: /config
          readOnly: true
        - name: tmp
          mountPath: /tmp
        livenessProbe:
          httpGet:
            path: /health/live
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /health/ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
      volumes:
      - name: config
        configMap:
          name: scim-config
          defaultMode: 0400
      - name: tmp
        emptyDir: {}
---
apiVersion: v1
kind: NetworkPolicy
metadata:
  name: scim-server-netpol
spec:
  podSelector:
    matchLabels:
      app: scim-server
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-system
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: database
    ports:
    - protocol: TCP
      port: 5432
  - to: []
    ports:
    - protocol: TCP
      port: 443  # HTTPS only

#![allow(unused)]
fn main() {
use scim_server::config::SecurityConfig;

fn load_secure_config() -> Result<SecurityConfig, ConfigError> {
    let config = SecurityConfig::builder()
        // Disable debug features in production
        .debug_mode(false)
        .detailed_errors(false)
        
        // Enable all security features
        .require_https(true)
        .strict_transport_security(true)
        .content_security_policy(true)
        .x_frame_options("DENY")
        .x_content_type_options(true)
        .referrer_policy("strict-origin-when-cross-origin")
        
        // Security headers
        .hsts_max_age(31536000) // 1 year
        .hsts_include_subdomains(true)
        .hsts_preload(true)
        
        // Rate limiting
        .enable_rate_limiting(true)
        .default_rate_limit(1000) // per hour
        .burst_rate_limit(100)
        
        // Input validation
        .max_request_size(1048576) // 1MB
        .max_json_depth(10)
        .enable_strict_validation(true)
        
        // Audit logging
        .enable_audit_logging(true)
        .audit_log_level("INFO")
        .audit_destinations(vec!["file", "syslog", "webhook"])
        
        .build()
}
}

#![allow(unused)]
fn main() {
use scim_server::privacy::{GdprCompliance, DataSubjectRequest, LegalBasis};

#[derive(Debug)]
pub struct GdprCompliance {
    data_controller: String,
    data_processor: Option<String>,
    legal_basis: LegalBasis,
    retention_policy: RetentionPolicy,
}

impl GdprCompliance {
    pub async fn handle_data_subject_request(
        &self,
        request: DataSubjectRequest,
    ) -> Result<DataSubjectResponse, GdprError> {
        match request.request_type {
            RequestType::Access => self.handle_access_request(request).await,
            RequestType::Rectification => self.handle_rectification_request(request).await,
            RequestType::Erasure => self.handle_erasure_request(request).await,
            RequestType::Portability => self.handle_portability_request(request).await,
            RequestType::Restriction => self.handle_restriction_request(request).await,
        }
    }
    
    async fn handle_erasure_request(
        &self,
        request: DataSubjectRequest,
    ) -> Result<DataSubjectResponse, GdprError> {
        // Verify identity
        self.verify_data_subject_identity(&request).await?;
        
        // Check for legal obligations that prevent erasure
        if self.has_legal_obligation_to_retain(&request.subject_id).await? {
            return Err(GdprError::ErasureNotPermitted(
                "Data retention required by law".to_string()
            ));
        }
        
        // Perform cascading deletion
        self.delete_user_data(&request.subject_id).await?;
        self.delete_audit_logs(&request.subject_id).await?;
        self.notify_third_parties(&request.subject_id).await?;
        
        // Log the erasure
        self.audit_logger.log_erasure(&request).await;
        
        Ok(DataSubjectResponse {
            request_id: request.id,
            status: "completed".to_string(),
            completion_date: Utc::now(),
        })
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::compliance::{Soc2Controls, ControlObjective};

pub struct Soc2Controls {
    security_controls: Vec<SecurityControl>,
    availability_controls: Vec<AvailabilityControl>,
    confidentiality_controls: Vec<ConfidentialityControl>,
}

impl Soc2Controls {
    pub fn implement_cc6_1_logical_access(&self) -> Result<(), ComplianceError> {
        // CC6.1: Logical and physical access controls
        
        // Multi-factor authentication
        self.enforce_mfa_for_admin_access()?;
        
        // Principle of least privilege
        self.implement_rbac_controls()?;
        
        // Access reviews
        self.schedule_quarterly_access_reviews()?;
        
        // Segregation of duties
        self.enforce_segregation_of_duties()?;
        
        Ok(())
    }
    
    pub fn implement_cc7_1_system_monitoring(&self) -> Result<(), ComplianceError> {
        // CC7.1: System monitoring
        
        // Comprehensive logging
        self.enable_comprehensive_audit_logging()?;
        
        // Real-time monitoring
        self.implement_real_time_alerting()?;
        
        // Log integrity
        self.implement_log_integrity_controls()?;
        
        // Incident response
        self.implement_incident_response_procedures()?;
        
        Ok(())
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::security::{IncidentDetector, SecurityIncident, IncidentSeverity};

pub struct IncidentDetector {
    anomaly_detector: AnomalyDetector,
    threat_intelligence: ThreatIntelligence,
    correlation_engine: CorrelationEngine,
}

impl IncidentDetector {
    pub async fn analyze_security_events(&self) -> Vec<SecurityIncident> {
        let mut incidents = Vec::new();
        
        // Detect authentication anomalies
        let auth_anomalies = self.detect_authentication_anomalies().await;
        for anomaly in auth_anomalies {
            incidents.push(SecurityIncident {
                id: Uuid::new_v4(),
                incident_type: IncidentType::AuthenticationAnomaly,
                severity: self.calculate_severity(&anomaly),
                description: anomaly.description,
                affected_resources: anomaly.affected_resources,
                indicators: anomaly.indicators,
                timestamp: Utc::now(),
            });
        }
        
        // Detect data access anomalies
        let data_anomalies = self.detect_data_access_anomalies().await;
        for anomaly in data_anomalies {
            incidents.push(SecurityIncident {
                id: Uuid::new_v4(),
                incident_type: IncidentType::DataAccessAnomaly,
                severity: IncidentSeverity::High,
                description: format!("Unusual data access pattern: {}", anomaly.pattern),
                affected_resources: anomaly.resources,
                indicators: anomaly.indicators,
                timestamp: Utc::now(),
            });
        }
        
        incidents
    }
    
    async fn detect_authentication_anomalies(&self) -> Vec<AuthenticationAnomaly> {
        let mut anomalies = Vec::new();
        
        // Detect brute force attacks
        let failed_logins = self.get_recent_failed_logins(Duration::hours(1)).await;
        let grouped_by_ip = self.group_by_ip(failed_logins);
        
        for (ip, attempts) in grouped_by_ip {
            if attempts.len() > 50 {
                anomalies.push(AuthenticationAnomaly {
                    anomaly_type: AnomalyType::BruteForce,
                    source_ip: ip,
                    description: format!("Brute force attack detected: {} failed attempts", attempts.len()),
                    affected_resources: attempts.into_iter().map(|a| a.target_user).collect(),
                    indicators: vec![
                        format!("source_ip: {}", ip),
                        format!("attempt_count: {}", attempts.len()),
                    ],
                });
            }
        }
        
        // Detect impossible travel
        let successful_logins = self.get_recent_successful_logins(Duration::hours(24)).await;
        let travel_anomalies = self.detect_impossible_travel(successful_logins).await;
        anomalies.extend(travel_anomalies);
        
        anomalies
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::security::{AutomatedResponse, ResponseAction};

pub struct AutomatedResponse {
    action_executor: ActionExecutor,
    notification_service: NotificationService,
    escalation_rules: Vec<EscalationRule>,
}

impl AutomatedResponse {
    pub async fn respond_to_incident(&self, incident: &SecurityIncident) {
        match incident.severity {
            IncidentSeverity::Critical => {
                self.execute_critical_response(incident).await;
            }
            IncidentSeverity::High => {
                self.execute_high_severity_response(incident).await;
            }
            IncidentSeverity::Medium => {
                self.execute_medium_severity_response(incident).await;
            }
            IncidentSeverity::Low => {
                self.execute_low_severity_response(incident).await;
            }
        }
    }
    
    async fn execute_critical_response(&self, incident: &SecurityIncident) {
        // Immediate blocking
        if let Some(source_ip) = self.extract_source_ip(incident) {
            self.action_executor.block_ip_address(source_ip).await;
        }
        
        // Disable compromised accounts
        for resource in &incident.affected_resources {
            if resource.resource_type == "User" {
                self.action_executor.disable_user_account(&resource.id).await;
            }
        }
        
        // Immediate notifications
        self.notification_service.send_critical_alert(incident).await;
        self.notification_service.notify_security_team(incident).await;
        self.notification_service.notify_management(incident).await;
        
        // Initiate incident response process
        self.initiate_incident_response_process(incident).await;
    }
    
    async fn initiate_incident_response_process(&self, incident: &SecurityIncident) {
        // Create incident ticket
        let ticket = self.create_incident_ticket(incident).await;
        
        // Preserve evidence
        self.preserve_digital_evidence(incident).await;
        
        // Notify external parties if required
        if self.requires_external_notification(incident) {
            self.notify_authorities(incident).await;
            self.notify_customers(incident).await;
        }
        
        // Start forensic analysis
        self.start_forensic_analysis(incident).await;
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::testing::{PenetrationTest, VulnerabilityScanner};

pub struct SecurityTestSuite {
    vulnerability_scanner: VulnerabilityScanner,
    penetration_tester: PenetrationTest,
    compliance_checker: ComplianceChecker,
}

impl SecurityTestSuite {
    pub async fn run_security_tests(&self) -> SecurityTestReport {
        let mut report = SecurityTestReport::new();
        
        // Vulnerability scanning
        let vulnerabilities = self.vulnerability_scanner.scan().await;
        report.add_vulnerabilities(vulnerabilities);
        
        // Authentication testing
        let auth_tests = self.test_authentication_security().await;
        report.add_test_results("authentication", auth_tests);
        
        // Authorization testing
        let authz_tests = self.test_authorization_security().await;
        report.add_test_results("authorization", authz_tests);
        
        // Input validation testing
        let input_tests = self.test_input_validation().await;
        report.add_test_results("input_validation", input_tests);
        
        // Network security testing
        let network_tests = self.test_network_security().await;
        report.add_test_results("network_security", network_tests);
        
        report
    }
    
    async fn test_authentication_security(&self) -> Vec<TestResult> {
        vec![
            self.test_jwt_validation().await,
            self.test_token_expiration().await,
            self.test_brute_force_protection().await,
            self.test_session_management().await,
        ]
    }
    
    async fn test_jwt_validation(&self) -> TestResult {
        let test_cases = vec![
            ("Invalid signature", "invalid_jwt_token"),
            ("Expired token", self.create_expired_jwt()),
            ("Wrong audience", self.create_wrong_audience_jwt()),
            ("Missing required claims", self.create_incomplete_jwt()),
        ];
        
        for (test_name, token) in test_cases {
            let result = self.make_authenticated_request(token).await;
            if result.status() != 401 {
                return TestResult::Failed(format!("JWT validation failed for: {}", test_name));
            }
        }
        
        TestResult::Passed("JWT validation working correctly".to_string())
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::metrics::{MetricsConfig, MetricsCollector, PrometheusExporter};

let metrics_config = MetricsConfig::builder()
    .enable_http_metrics(true)
    .enable_business_metrics(true)
    .enable_system_metrics(true)
    .prometheus_endpoint("/metrics")
    .collection_interval_seconds(15)
    .histogram_buckets(vec![0.001, 0.01, 0.1, 1.0, 10.0])
    .build()?;

let metrics_collector = MetricsCollector::new(metrics_config);
let server = ScimServer::new(storage)
    .with_metrics(metrics_collector)
    .await?;
}

#![allow(unused)]
fn main() {
use scim_server::metrics::{Counter, Histogram, Gauge, MetricRegistry};

pub struct CustomMetrics {
    tenant_provisioning_duration: Histogram,
    active_sessions: Gauge,
    password_reset_requests: Counter,
    data_sync_errors: Counter,
}

impl CustomMetrics {
    pub fn new(registry: &MetricRegistry) -> Self {
        Self {
            tenant_provisioning_duration: registry.register_histogram(
                "scim_tenant_provisioning_duration_seconds",
                "Time to provision new tenant",
                vec!["tenant_type"]
            ),
            active_sessions: registry.register_gauge(
                "scim_active_sessions",
                "Number of active user sessions",
                vec!["tenant_id"]
            ),
            password_reset_requests: registry.register_counter(
                "scim_password_reset_requests_total",
                "Password reset requests",
                vec!["tenant_id", "method"]
            ),
            data_sync_errors: registry.register_counter(
                "scim_data_sync_errors_total",
                "Data synchronization errors",
                vec!["source_system", "error_type"]
            ),
        }
    }
    
    pub fn record_tenant_provisioning(&self, tenant_type: &str, duration: Duration) {
        self.tenant_provisioning_duration
            .with_label_values(&[tenant_type])
            .observe(duration.as_secs_f64());
    }
    
    pub fn update_active_sessions(&self, tenant_id: &str, count: i64) {
        self.active_sessions
            .with_label_values(&[tenant_id])
            .set(count as f64);
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::logging::{LoggingConfig, LogFormat, LogLevel};
use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};

let logging_config = LoggingConfig::builder()
    .level(LogLevel::Info)
    .format(LogFormat::Json)
    .enable_spans(true)
    .enable_events(true)
    .fields(vec![
        "timestamp".to_string(),
        "level".to_string(),
        "target".to_string(),
        "message".to_string(),
        "tenant_id".to_string(),
        "user_id".to_string(),
        "request_id".to_string(),
        "operation".to_string(),
        "resource_type".to_string(),
        "duration_ms".to_string(),
    ])
    .exclude_fields(vec!["password".to_string(), "token".to_string()])
    .max_log_level_per_module(HashMap::from([
        ("scim_server::auth".to_string(), LogLevel::Debug),
        ("sqlx".to_string(), LogLevel::Warn),
    ]))
    .build()?;

// Initialize structured logging
tracing_subscriber::registry()
    .with(
        tracing_subscriber::EnvFilter::try_from_default_env()
            .unwrap_or_else(|_| "scim_server=info".into())
    )
    .with(
        tracing_subscriber::fmt::layer()
            .json()
            .with_current_span(false)
            .with_span_list(true)
            .with_target(true)
            .with_thread_ids(true)
            .with_thread_names(true)
    )
    .init();
}

#![allow(unused)]
fn main() {
use tracing::{info, warn, error, debug, Span};
use tracing_futures::Instrument;

// Create request-scoped spans
#[tracing::instrument(
    name = "create_user",
    skip(user_data),
    fields(
        tenant_id = %tenant_id,
        user_name = %user_data.user_name.as_deref().unwrap_or("unknown"),
        operation = "create_user"
    )
)]
pub async fn create_user(
    tenant_id: &str,
    user_data: CreateUserRequest,
) -> Result<User, ScimError> {
    let span = Span::current();
    
    // Add dynamic fields to the span
    span.record("user_id", &tracing::field::display(&user_data.id));
    
    info!("Starting user creation");
    
    // Validate input
    match validate_user_data(&user_data).await {
        Ok(_) => debug!("User data validation passed"),
        Err(e) => {
            warn!(error = %e, "User data validation failed");
            return Err(ScimError::ValidationError(e));
        }
    }
    
    // Create user in storage
    let start_time = Instant::now();
    let user = match storage.create_user(tenant_id, user_data).await {
        Ok(user) => {
            let duration = start_time.elapsed();
            info!(
                duration_ms = duration.as_millis(),
                user_id = %user.id,
                "User created successfully"
            );
            user
        }
        Err(e) => {
            error!(
                error = %e,
                duration_ms = start_time.elapsed().as_millis(),
                "Failed to create user"
            );
            return Err(e);
        }
    };
    
    // Log business event
    info!(
        event_type = "user_created",
        user_id = %user.id,
        tenant_id = %tenant_id,
        user_name = %user.user_name,
        active = user.active,
        "User creation completed"
    );
    
    Ok(user)
}
}

#![allow(unused)]
fn main() {
use scim_server::audit::{AuditLogger, AuditEvent, AuditLevel};
use serde_json::json;

pub struct AuditLogger {
    logger: tracing::Span,
    config: AuditConfig,
}

impl AuditLogger {
    pub async fn log_user_operation(&self, event: UserOperationEvent) {
        let audit_event = AuditEvent {
            timestamp: Utc::now(),
            event_type: "user_operation".to_string(),
            actor: ActorInfo {
                user_id: event.actor_id.clone(),
                session_id: event.session_id.clone(),
                ip_address: event.ip_address,
                user_agent: event.user_agent.clone(),
            },
            resource: ResourceInfo {
                resource_type: "User".to_string(),
                resource_id: event.user_id.clone(),
                tenant_id: event.tenant_id.clone(),
            },
            operation: OperationInfo {
                operation_type: event.operation.clone(),
                method: event.http_method.clone(),
                endpoint: event.endpoint.clone(),
                success: event.success,
                error_message: event.error_message.clone(),
            },
            details: json!({
                "user_id": event.user_id,
                "fields_modified": event.fields_modified,
                "before_values": event.before_values,
                "after_values": event.after_values,
                "request_size": event.request_size,
                "response_size": event.response_size,
            }),
        };
        
        // Log to structured log
        info!(
            target: "audit",
            event_type = %audit_event.event_type,
            actor_id = %audit_event.actor.user_id,
            resource_type = %audit_event.resource.resource_type,
            resource_id = %audit_event.resource.resource_id,
            tenant_id = %audit_event.resource.tenant_id,
            operation = %audit_event.operation.operation_type,
            success = audit_event.operation.success,
            ip_address = %audit_event.actor.ip_address,
            user_agent = %audit_event.actor.user_agent.as_deref().unwrap_or("unknown"),
            "{}", serde_json::to_string(&audit_event.details).unwrap_or_default()
        );
        
        // Send to external audit system
        if let Some(webhook_url) = &self.config.audit_webhook_url {
            self.send_to_webhook(webhook_url, &audit_event).await;
        }
        
        // Store in database for compliance
        if self.config.store_in_database {
            self.store_audit_event(&audit_event).await;
        }
    }
    
    pub async fn log_authentication_event(&self, event: AuthenticationEvent) {
        info!(
            target: "audit.auth",
            event_type = "authentication",
            user_id = %event.user_id.as_deref().unwrap_or("unknown"),
            tenant_id = %event.tenant_id.as_deref().unwrap_or("unknown"),
            auth_method = %event.auth_method,
            success = event.success,
            failure_reason = %event.failure_reason.as_deref().unwrap_or(""),
            ip_address = %event.ip_address,
            user_agent = %event.user_agent.as_deref().unwrap_or("unknown"),
            session_id = %event.session_id.as_deref().unwrap_or(""),
            "Authentication attempt"
        );
        
        // Increment authentication metrics
        if event.success {
            self.metrics.authentication_success.inc();
        } else {
            self.metrics.authentication_failure.inc();
        }
    }
}
}

#![allow(unused)]
fn main() {
use opentelemetry::{global, trace::TracerProvider, KeyValue};
use opentelemetry_otlp::WithExportConfig;
use tracing_opentelemetry::OpenTelemetryLayer;

pub async fn setup_tracing() -> Result<(), Box<dyn std::error::Error>> {
    // Configure OpenTelemetry exporter
    let tracer = opentelemetry_otlp::new_pipeline()
        .tracing()
        .with_exporter(
            opentelemetry_otlp::new_exporter()
                .tonic()
                .with_endpoint("http://jaeger:14268/api/traces")
        )
        .with_trace_config(
            opentelemetry::sdk::trace::config()
                .with_sampler(opentelemetry::sdk::trace::Sampler::TraceIdRatioBased(0.1))
                .with_resource(opentelemetry::sdk::Resource::new(vec![
                    KeyValue::new("service.name", "scim-server"),
                    KeyValue::new("service.version", env!("CARGO_PKG_VERSION")),
                    KeyValue::new("deployment.environment", "production"),
                ]))
        )
        .install_batch(opentelemetry::runtime::Tokio)?;
    
    // Create tracing subscriber with OpenTelemetry layer
    tracing_subscriber::registry()
        .with(tracing_subscriber::EnvFilter::new("scim_server=info"))
        .with(tracing_subscriber::fmt::layer())
        .with(OpenTelemetryLayer::new(tracer))
        .init();
    
    Ok(())
}
}

#![allow(unused)]
fn main() {
use tracing::{instrument, Span};
use opentelemetry::trace::{TraceContextExt, Tracer};

#[instrument(
    name = "scim.user.create",
    skip(storage, user_data),
    fields(
        scim.tenant_id = %tenant_id,
        scim.operation = "create",
        scim.resource_type = "User",
        user.name = %user_data.user_name.as_deref().unwrap_or("unknown"),
        otel.kind = "server"
    )
)]
pub async fn create_user_with_tracing(
    storage: &dyn StorageProvider,
    tenant_id: &str,
    user_data: CreateUserRequest,
) -> Result<User, ScimError> {
    let span = Span::current();
    let cx = span.context();
    
    // Add custom attributes
    if let Some(trace_id) = cx.span().span_context().trace_id().to_string() {
        span.record("trace_id", &tracing::field::display(&trace_id));
    }
    
    // Validate user data (child span)
    validate_user_data(&user_data)
        .instrument(tracing::info_span!("scim.validation", validation.type = "user"))
        .await?;
    
    // Check uniqueness (child span)
    check_user_uniqueness(storage, tenant_id, &user_data.user_name)
        .instrument(tracing::info_span!(
            "scim.uniqueness_check",
            db.operation = "select",
            user.name = %user_data.user_name
        ))
        .await?;
    
    // Create user in storage (child span)
    let user = storage
        .create_user(tenant_id, user_data)
        .instrument(tracing::info_span!(
            "scim.storage.create",
            db.operation = "insert",
            db.table = "users"
        ))
        .await?;
    
    // Record successful creation
    span.record("user.id", &tracing::field::display(&user.id));
    span.record("scim.status", "success");
    
    Ok(user)
}
}

#![allow(unused)]
fn main() {
use scim_server::health::{HealthChecker, HealthStatus, HealthCheckResult};

pub struct HealthChecker {
    storage: Arc<dyn StorageProvider>,
    auth_service: Arc<dyn AuthService>,
    cache: Option<Arc<dyn CacheProvider>>,
    config: HealthCheckConfig,
}

impl HealthChecker {
    pub async fn check_health(&self) -> HealthCheckResult {
        let mut checks = Vec::new();
        
        // Overall health check
        checks.push(self.check_application_health().await);
        
        // Storage health
        checks.push(self.check_storage_health().await);
        
        // Authentication service health
        checks.push(self.check_auth_service_health().await);
        
        // Cache health (if configured)
        if let Some(cache) = &self.cache {
            checks.push(self.check_cache_health(cache).await);
        }
        
        // External dependencies
        checks.push(self.check_external_dependencies().await);
        
        let overall_status = if checks.iter().all(|c| c.status == HealthStatus::Healthy) {
            HealthStatus::Healthy
        } else if checks.iter().any(|c| c.status == HealthStatus::Critical) {
            HealthStatus::Critical
        } else {
            HealthStatus::Degraded
        };
        
        HealthCheckResult {
            status: overall_status,
            timestamp: Utc::now(),
            checks,
            version: env!("CARGO_PKG_VERSION").to_string(),
            uptime_seconds: self.get_uptime_seconds(),
        }
    }
    
    async fn check_storage_health(&self) -> HealthCheck {
        let start_time = Instant::now();
        
        match timeout(Duration::from_secs(5), self.storage.health_check()).await {
            Ok(Ok(_)) => HealthCheck {
                name: "storage".to_string(),
                status: HealthStatus::Healthy,
                response_time_ms: start_time.elapsed().as_millis() as u64,
                message: Some("Storage is responsive".to_string()),
                details: None,
            },
            Ok(Err(e)) => HealthCheck {
                name: "storage".to_string(),
                status: HealthStatus::Critical,
                response_time_ms: start_time.elapsed().as_millis() as u64,
                message: Some(format!("Storage error: {}", e)),
                details: Some(json!({
                    "error_type": "storage_error",
                    "error_details": e.to_string()
                })),
            },
            Err(_) => HealthCheck {
                name: "storage".to_string(),
                status: HealthStatus::Critical,
                response_time_ms: 5000,
                message: Some("Storage health check timeout".to_string()),
                details: Some(json!({
                    "error_type": "timeout",
                    "timeout_seconds": 5
                })),
            },
        }
    }
    
    async fn check_application_health(&self) -> HealthCheck {
        let mut details = serde_json::Map::new();
        
        // Check memory usage
        let memory_usage = self.get_memory_usage();
        details.insert("memory_usage_mb".to_string(), json!(memory_usage));
        
        // Check CPU usage
        let cpu_usage = self.get_cpu_usage().await;
        details.insert("cpu_usage_percent".to_string(), json!(cpu_usage));
        
        // Check active connections
        let active_connections = self.get_active_connections();
        details.insert("active_connections".to_string(), json!(active_connections));
        
        // Determine status based on resource usage
        let status = if memory_usage > 90.0 || cpu_usage > 95.0 {
            HealthStatus::Critical
        } else if memory_usage > 80.0 || cpu_usage > 85.0 {
            HealthStatus::Degraded
        } else {
            HealthStatus::Healthy
        };
        
        HealthCheck {
            name: "application".to_string(),
            status,
            response_time_ms: 0,
            message: Some("Application resource usage check".to_string()),
            details: Some(json!(details)),
        }
    }
}

// Health check endpoints
async fn health_live() -> Result<Json<HealthCheckResult>, StatusCode> {
    // Simple liveness check
    Ok(Json(HealthCheckResult {
        status: HealthStatus::Healthy,
        timestamp: Utc::now(),
        checks: vec![],
        version: env!("CARGO_PKG_VERSION").to_string(),
        uptime_seconds: get_uptime_seconds(),
    }))
}

async fn health_ready(
    State(health_checker): State<Arc<HealthChecker>>,
) -> Result<Json<HealthCheckResult>, StatusCode> {
    let result = health_checker.check_health().await;
    
    match result.status {
        HealthStatus::Healthy => Ok(Json(result)),
        HealthStatus::Degraded => {
            warn!("Health check returned degraded status: {:?}", result);
            Ok(Json(result))
        }
        HealthStatus::Critical => {
            error!("Health check returned critical status: {:?}", result);
            Err(StatusCode::SERVICE_UNAVAILABLE)
        }
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::alerting::{AlertManager, AlertRule, AlertSeverity, AlertChannel};

pub struct AlertManager {
    rules: Vec<AlertRule>,
    channels: Vec<AlertChannel>,
    metrics_client: MetricsClient,
}

impl AlertManager {
    pub fn new() -> Self {
        let rules = vec![
            // High error rate
            AlertRule {
                name: "high_error_rate".to_string(),
                description: "HTTP error rate above 5%".to_string(),
                query: "rate(scim_http_requests_total{status_code=~'5..'}[5m]) / rate(scim_http_requests_total[5m]) > 0.05".to_string(),
                severity: AlertSeverity::Critical,
                for_duration: Duration::from_secs(300), // 5 minutes
                labels: HashMap::from([
                    ("service".to_string(), "scim-server".to_string()),
                    ("type".to_string(), "error_rate".to_string()),
                ]),
            },
            
            // High response time
            AlertRule {
                name: "high_response_time".to_string(),
                description: "95th percentile response time above 1 second".to_string(),
                query: "histogram_quantile(0.95, rate(scim_http_request_duration_seconds_bucket[5m])) > 1.0".to_string(),
                severity: AlertSeverity::Warning,
                for_duration: Duration::from_secs(600), // 10 minutes
                labels: HashMap::from([
                    ("service".to_string(), "scim-server".to_string()),
                    ("type".to_string(), "performance".to_string()),
                ]),
            },
            
            // Database connection issues
            AlertRule {
                name: "database_connection_exhaustion".to_string(),
                description: "Database connection pool nearly exhausted".to_string(),
                query: "scim_database_connections_active / (scim_database_connections_active + scim_database_connections_idle) > 0.9".to_string(),
                severity: AlertSeverity::Warning,
                for_duration: Duration::from_secs(120), // 2 minutes
                labels: HashMap::from([
                    ("service".to_string(), "scim-server".to_string()),
                    ("type".to_string(), "database".to_string()),
                ]),
            },
            
            // Authentication failures
            AlertRule {
                name: "high_auth_failure_rate".to_string(),
                description: "Authentication failure rate above 10%".to_string(),
                query: "rate(scim_authentication_attempts_total{result='failure'}[5m]) / rate(scim_authentication_attempts_total[5m]) > 0.1".to_string(),
                severity: AlertSeverity::Critical,
                for_duration: Duration::from_secs(180), // 3 minutes
                labels: HashMap::from([
                    ("service".to_string(), "scim-server".to_string()),
                    ("type".to_string(), "security".to_string()),
                ]),
            },
            
            // Memory usage
            AlertRule {
                name: "high_memory_usage".to_string(),
                description: "Memory usage above 85%".to_string(),
                query: "scim_memory_usage_bytes{type='heap'} / scim_memory_usage_bytes{type='total'} > 0.85".to_string(),
                severity: AlertSeverity::Warning,
                for_duration: Duration::from_secs(600), // 10 minutes
                labels: HashMap::from([
                    ("service".to_string(), "scim-server".to_string()),
                    ("type".to_string(), "resource".to_string()),
                ]),
            },
        ];
        
        let channels = vec![
            AlertChannel::Slack {
                webhook_url: std::env::var("SLACK_WEBHOOK_URL").unwrap(),
                channel: "#alerts".to_string(),
                username: "SCIM Monitor".to_string(),
            },
            AlertChannel::PagerDuty {
                integration_key: std::env::var("PAGERDUTY_INTEGRATION_KEY").unwrap(),
            },
            AlertChannel::Email {
                smtp_server: "smtp.company.com".to_string(),
                recipients: vec![
                    "oncall@company.com".to_string(),
                    "devops@company.com".to_string(),
                ],
            },
        ];
        
        Self {
            rules,
            channels,
            metrics_client: MetricsClient::new(),
        }
    }
    
    pub async fn check_alerts(&self) {
        for rule in &self.rules {
            match self.evaluate_rule(rule).await {
                Ok(Some(alert)) => {
                    info!("Alert triggered: {}", alert.name);
                    self.send_alert(&alert).await;
                }
                Ok(None) => {
                    debug!("Alert rule {} is not triggered", rule.name);
                }
                Err(e) => {
                    error!("Failed to evaluate alert rule {}: {}", rule.name, e);
                }
            }
        }
    }
    
    async fn send_alert(&self, alert: &Alert) {
        for channel in &self.channels {
            match channel {
                AlertChannel::Slack { webhook_url, .. } => {
                    self.send_slack_alert(webhook_url, alert).await;
                }
                AlertChannel::PagerDuty { integration_key } => {
                    if alert.severity == AlertSeverity::Critical {
                        self.send_pagerduty_alert(integration_key, alert).await;
                    }
                }
                AlertChannel::Email { recipients, .. } => {
                    self.send_email_alert(recipients, alert).await;
                }
            }
        }
    }
}
}

{
  "dashboard": {
    "title": "SCIM Server Monitoring",
    "tags": ["scim", "identity", "monitoring"],
    "timezone": "UTC",
    "panels": [
      {
        "title": "Request Rate",
        "type": "graph",
        "targets": [
          {
            "expr": "rate(scim_http_requests_total[5m])",
            "legendFormat": "{{method}} {{endpoint}}"
          }
        ],
        "yAxes": [
          {
            "label": "Requests/sec"
          }
        ]
      },
      {
        "title": "Error Rate",
        "type": "graph",
        "targets": [
          {
            "expr": "rate(scim_http_requests_total{status_code=~'4..|5..'}[5m]) / rate(scim_http_requests_total[5m])",
            "legendFormat": "Error Rate"
          }
        ],
        "yAxes": [
          {
            "label": "Error Rate (%)",
            "max": 1,
            "min": 0
          }
        ],
        "alert": {
          "conditions": [
            {
              "query": {
                "queryType": "",
                "refId": "A"
              },
              "reducer": {
                "type": "last",
                "params": []
              },
              "evaluator": {
                "params": [0.05],
                "type": "gt"
              }
            }
          ],
          "executionErrorState": "alerting",
          "for": "5m",
          "frequency": "10s",
          "handler": 1,
          "name": "High Error Rate",
          "noDataState": "no_data",
          "notifications": []
        }
      },
      {
        "title": "Response Time",
        "type": "graph",
        "targets": [
          {
            "expr": "histogram_quantile(0.50, rate(scim_http_request_duration_seconds_bucket[5m]))",
            "legendFormat": "50th percentile"
          },
          {
            "expr": "histogram_quantile(0.95, rate(scim_http_request_duration_seconds_bucket[5m]))",
            "legendFormat": "95th percentile"
          },
          {
            "expr": "histogram_quantile(0.99, rate(scim_http_request_duration_seconds_bucket[5m]))",
            "legendFormat": "99th percentile"
          }
        ]
      },
      {
        "title": "Active Users by Tenant",
        "type": "piechart",
        "targets": [
          {
            "expr": "scim_users_total{active='true'}",
            "legendFormat": "{{tenant_id}}"
          }
        ]
      },
      {
        "title": "Database Connections",
        "type": "graph",
        "targets": [
          {
            "expr": "scim_database_connections_active",
            "legendFormat": "Active"
          },
          {
            "expr": "scim_database_connections_idle",
            "legendFormat": "Idle"
          }
        ]
      },
      {
        "title": "Authentication Methods",
        "type": "piechart",
        "targets": [
          {
            "expr": "increase(scim_authentication_attempts_total{result='success'}[1h])",
            "legendFormat": "{{method}}"
          }
        ]
      },
      {
        "title": "Cache Hit Rate",
        "type": "stat",
        "targets": [
          {
            "expr": "rate(scim_cache_hits_total[5m]) / (rate(scim_cache_hits_total[5m]) + rate(scim_cache_misses_total[5m]))",
            "legendFormat": "Hit Rate"
          }
        ],
        "fieldConfig": {
          "defaults": {
            "unit": "percentunit",
            "min": 0,
            "max": 1
          }
        }
      }
    ],
    "time": {
      "from": "now-1h",
      "to": "now"
    },
    "refresh": "30s"
  }
}

{
  "dashboard": {
    "title": "SCIM Business Metrics",
    "panels": [
      {
        "title": "User Growth by Tenant",
        "type": "graph",
        "targets": [
          {
            "expr": "increase(scim_users_total[24h])",
            "legendFormat": "{{tenant_id}}"
          }
        ]
      },
      {
        "title": "Most Active Operations",
        "type": "table",
        "targets": [
          {
            "expr": "topk(10, increase(scim_operations_total[1h]))",
            "legendFormat": "{{operation}} - {{resource_type}}"
          }
        ]
      },
      {
        "title": "Tenant Resource Usage",
        "type": "heatmap",
        "targets": [
          {
            "expr": "scim_users_total + scim_groups_total",
            "legendFormat": "{{tenant_id}}"
          }
        ]
      }
    ]
  }
}

# Filebeat configuration
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/scim-server/*.log
  fields:
    service: scim-server
    environment: production
  fields_under_root: true
  multiline.pattern: '^\d{4}-\d{2}-\d{2}'
  multiline.negate: true
  multiline.match: after

output.elasticsearch:
  hosts: ["elasticsearch:9200"]
  template.settings:
    index.number_of_shards: 1
    index.number_of_replicas: 1

processors:
- add_host_metadata:
    when.not.contains.tags: forwarded
- decode_json_fields:
    fields: ["message"]
    target: "json"
    overwrite_keys: true

# Logstash pipeline configuration
input {
  beats {
    port => 5044
  }
}

filter {
  if [service] == "scim-server" {
    json {
      source => "message"
    }
    
    # Parse timestamp
    date {
      match => [ "timestamp", "ISO8601" ]
    }
    
    # Extract tenant information
    if [tenant_id] {
      mutate {
        add_field => { "[@metadata][tenant]" => "%{tenant_id}" }
      }
    }
    
    # Classify log types
    if [target] == "audit" {
      mutate {
        add_tag => [ "audit" ]
        add_field => { "log_type" => "audit" }
      }
    } else if [level] == "ERROR" {
      mutate {
        add_tag => [ "error" ]
        add_field => { "log_type" => "error" }
      }
    }
    
    # Sanitize sensitive data
    mutate {
      remove_field => [ "password", "token", "authorization" ]
    }
  }
}

output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    index => "scim-server-%{+YYYY.MM.dd}"
    template_overwrite => true
    template_pattern => "scim-server-*"
    template => "/etc/logstash/templates/scim-server.json"
  }
}

{
  "objects": [
    {
      "id": "scim-error-analysis",
      "type": "visualization",
      "attributes": {
        "title": "Error Analysis",
        "visState": {
          "type": "histogram",
          "params": {
            "grid": { "categoryLines": false, "style": { "color": "#eee" } },
            "categoryAxes": [{ "id": "CategoryAxis-1", "type": "category", "position": "bottom", "show": true, "style": {}, "scale": { "type": "linear" }, "labels": { "show": true, "truncate": 100 }, "title": {} }],
            "valueAxes": [{ "id": "ValueAxis-1", "name": "LeftAxis-1", "type": "value", "position": "left", "show": true, "style": {}, "scale": { "type": "linear", "mode": "normal" }, "labels": { "show": true, "rotate": 0, "filter": false, "truncate": 100 }, "title": { "text": "Count" } }]
          },
          "aggs": [
            { "id": "1", "enabled": true, "type": "count", "schema": "metric", "params": {} },
            { "id": "2", "enabled": true, "type": "terms", "schema": "segment", "params": { "field": "error_type.keyword", "size": 10, "order": "desc", "orderBy": "1" } }
          ]
        },
        "uiStateJSON": "{}",
        "description": "",
        "version": 1,
        "kibanaSavedObjectMeta": {
          "searchSourceJSON": {
            "index": "scim-server-*",
            "query": {
              "match": { "level": "ERROR" }
            }
          }
        }
      }
    }
  ]
}

#![allow(unused)]
fn main() {
use scim_server::apm::{ApmAgent, TransactionType, SpanType};

pub struct ApmAgent {
    elastic_apm: elastic_apm::Agent,
    config: ApmConfig,
}

impl ApmAgent {
    pub async fn trace_operation<F, T>(
        &self,
        operation_name: &str,
        transaction_type: TransactionType,
        operation: F,
    ) -> Result<T, Box<dyn std::error::Error>>
    where
        F: Future<Output = Result<T, Box<dyn std::error::Error>>>,
    {
        let transaction = self.elastic_apm.begin_transaction(
            operation_name,
            transaction_type.as_str(),
        );
        
        let start_time = Instant::now();
        let result = operation.await;
        let duration = start_time.elapsed();
        
        match &result {
            Ok(_) => {
                transaction.set_result("success");
                transaction.set_outcome(elastic_apm::Outcome::Success);
            }
            Err(e) => {
                transaction.set_result("error");
                transaction.set_outcome(elastic_apm::Outcome::Failure);
                transaction.capture_error(e);
            }
        }
        
        transaction.set_custom_context("performance", json!({
            "duration_ms": duration.as_millis(),
            "operation": operation_name,
        }));
        
        transaction.end();
        result
    }
    
    pub fn create_span<F, T>(
        &self,
        span_name: &str,
        span_type: SpanType,
        operation: F,
    ) -> T
    where
        F: FnOnce() -> T,
    {
        let span = self.elastic_apm.begin_span(span_name, span_type.as_str());
        let result = operation();
        span.end();
        result
    }
}

// Usage in request handlers
#[axum::debug_handler]
async fn create_user_handler(
    State(app_state): State<AppState>,
    Json(user_data): Json<CreateUserRequest>,
) -> Result<Json<User>, ScimError> {
    app_state.apm.trace_operation(
        "create_user",
        TransactionType::Request,
        async {
            let user = app_state.scim_server
                .create_user(&user_data.tenant_id, user_data)
                .await?;
            Ok(Json(user))
        }
    ).await
}
}

#![allow(unused)]
fn main() {
use sqlx::{query, Pool, Postgres};
use tracing::{instrument, Span};

pub struct DatabaseMonitor {
    pool: Pool<Postgres>,
    metrics: DatabaseMetrics,
}

impl DatabaseMonitor {
    #[instrument(skip(self, query_str, params))]
    pub async fn execute_monitored_query<T>(
        &self,
        query_str: &str,
        params: &[&dyn sqlx::Type<Postgres>],
    ) -> Result<T, sqlx::Error>
    where
        T: for<'r> sqlx::FromRow<'r, sqlx::postgres::PgRow> + Send + Unpin,
    {
        let span = Span::current();
        let start_time = Instant::now();
        
        // Record query details (sanitized)
        span.record("db.statement", &sanitize_query(query_str));
        span.record("db.operation", &extract_operation(query_str));
        
        // Execute query
        let result = sqlx::query_as::<_, T>(query_str)
            .fetch_all(&self.pool)
            .await;
        
        let duration = start_time.elapsed();
        
        // Record metrics
        match &result {
            Ok(rows) => {
                span.record("db.rows_affected", &rows.len());
                span.record("db.duration_ms", &duration.as_millis());
                self.metrics.query_duration.observe(duration.as_secs_f64());
                self.metrics.query_success.inc();
            }
            Err(e) => {
                span.record("db.error", &e.to_string());
                span.record("db.duration_ms", &duration.as_millis());
                self.metrics.query_errors.inc();
                warn!("Database query failed: {}", e);
            }
        }
        
        // Alert on slow queries
        if duration > Duration::from_millis(1000) {
            warn!(
                duration_ms = duration.as_millis(),
                query = sanitize_query(query_str),
                "Slow database query detected"
            );
        }
        
        result
    }
}

fn sanitize_query(query: &str) -> String {
    // Remove sensitive data from query for logging
    query
        .replace(|c: char| c.is_numeric(), "?")
        .replace("'.*?'", "'?'")
}
}

#![allow(unused)]
fn main() {
use uuid::Uuid;
use tracing_subscriber::layer::SubscriberExt;

// Request correlation
#[derive(Clone)]
pub struct RequestContext {
    pub request_id: Uuid,
    pub tenant_id: Option<String>,
    pub user_id: Option<String>,
    pub session_id: Option<String>,
    pub ip_address: IpAddr,
    pub user_agent: Option<String>,
}

impl RequestContext {
    pub fn new(headers: &HeaderMap, remote_addr: SocketAddr) -> Self {
        let request_id = headers
            .get("x-request-id")
            .and_then(|h| h.to_str().ok())
            .and_then(|s| Uuid::parse_str(s).ok())
            .unwrap_or_else(Uuid::new_v4);
        
        Self {
            request_id,
            tenant_id: headers.get("x-tenant-id")
                .and_then(|h| h.to_str().ok())
                .map(String::from),
            user_id: None, // Set after authentication
            session_id: None, // Set after authentication
            ip_address: remote_addr.ip(),
            user_agent: headers.get("user-agent")
                .and_then(|h| h.to_str().ok())
                .map(String::from),
        }
    }
    
    pub fn create_span(&self, operation: &str) -> tracing::Span {
        tracing::info_span!(
            "scim_operation",
            operation = operation,
            request_id = %self.request_id,
            tenant_id = %self.tenant_id.as_deref().unwrap_or("unknown"),
            user_id = %self.user_id.as_deref().unwrap_or("anonymous"),
            ip_address = %self.ip_address,
        )
    }
}

// Middleware for request correlation
pub async fn correlation_middleware(
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    mut req: Request<Body>,
    next: Next<Body>,
) -> Response<Body> {
    let context = RequestContext::new(req.headers(), addr);
    
    // Add context to request extensions
    req.extensions_mut().insert(context.clone());
    
    // Create request span
    let span = context.create_span("http_request");
    let _guard = span.enter();
    
    // Add request ID to response headers
    let mut response = next.run(req).await;
    response.headers_mut().insert(
        "x-request-id",
        HeaderValue::from_str(&context.request_id.to_string()).unwrap(),
    );
    
    response
}
}

#![allow(unused)]
fn main() {
use sentry::{ClientOptions, integrations::tracing::EventFilter};

pub fn setup_error_tracking() -> Result<(), Box<dyn std::error::Error>> {
    let _guard = sentry::init((
        std::env::var("SENTRY_DSN")?,
        ClientOptions {
            release: Some(env!("CARGO_PKG_VERSION").into()),
            environment: Some(std::env::var("ENVIRONMENT").unwrap_or("unknown".into()).into()),
            sample_rate: 1.0,
            traces_sample_rate: 0.1,
            ..Default::default()
        },
    ));
    
    // Configure tracing integration
    tracing_subscriber::registry()
        .with(tracing_subscriber::EnvFilter::new("scim_server=info"))
        .with(tracing_subscriber::fmt::layer())
        .with(sentry_tracing::layer().event_filter(|md| {
            match md.level() {
                &tracing::Level::ERROR => EventFilter::Event,
                &tracing::Level::WARN => EventFilter::Breadcrumb,
                _ => EventFilter::Ignore,
            }
        }))
        .init();
    
    Ok(())
}

// Custom error reporting
pub async fn report_error(
    error: &dyn std::error::Error,
    context: &RequestContext,
    additional_data: Option<serde_json::Value>,
) {
    sentry::with_scope(|scope| {
        scope.set_tag("request_id", &context.request_id.to_string());
        scope.set_tag("tenant_id", context.tenant_id.as_deref().unwrap_or("unknown"));
        scope.set_user(Some(sentry::User {
            id: context.user_id.clone(),
            ip_address: Some(context.ip_address.to_string()),
            ..Default::default()
        }));
        
        if let Some(data) = additional_data {
            scope.set_context("additional_data", sentry::protocol::Context::Other(data.into()));
        }
        
        sentry::capture_error(error);
    });
}
}

https://your-server.com/scim/v2/{tenant-id}/{resource-type}

POST /scim/v2/{tenant-id}/Users
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "alice@example.com",
  "name": {
    "givenName": "Alice",
    "familyName": "Johnson"
  },
  "emails": [
    {
      "value": "alice@example.com",
      "type": "work",
      "primary": true
    }
  ],
  "active": true
}

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "id": "2819c223-7f76-453a-919d-413861904646",
  "userName": "alice@example.com",
  "name": {
    "givenName": "Alice",
    "familyName": "Johnson"
  },
  "emails": [
    {
      "value": "alice@example.com",
      "type": "work",
      "primary": true
    }
  ],
  "active": true,
  "meta": {
    "resourceType": "User",
    "created": "2023-12-01T10:30:00Z",
    "lastModified": "2023-12-01T10:30:00Z",
    "version": "W/\"1\"",
    "location": "https://api.example.com/scim/v2/tenant-1/Users/2819c223-7f76-453a-919d-413861904646"
  }
}

GET /scim/v2/{tenant-id}/Users/{id}

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "id": "2819c223-7f76-453a-919d-413861904646",
  "userName": "alice@example.com",
  "name": {
    "givenName": "Alice", 
    "familyName": "Johnson"
  },
  "emails": [
    {
      "value": "alice@example.com",
      "type": "work",
      "primary": true
    }
  ],
  "active": true,
  "meta": {
    "resourceType": "User",
    "created": "2023-12-01T10:30:00Z",
    "lastModified": "2023-12-01T15:45:00Z",
    "version": "W/\"3\"",
    "location": "https://api.example.com/scim/v2/tenant-1/Users/2819c223-7f76-453a-919d-413861904646"
  }
}

PUT /scim/v2/{tenant-id}/Users/{id}
Content-Type: application/scim+json
If-Match: W/"3"

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "id": "2819c223-7f76-453a-919d-413861904646",
  "userName": "alice@example.com",
  "name": {
    "givenName": "Alice",
    "familyName": "Smith"
  },
  "emails": [
    {
      "value": "alice@example.com",
      "type": "work",
      "primary": true
    }
  ],
  "active": true,
  "meta": {
    "version": "W/\"3\""
  }
}

PATCH /scim/v2/{tenant-id}/Users/{id}
Content-Type: application/scim+json
If-Match: W/"3"

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    {
      "op": "replace",
      "path": "name.familyName",
      "value": "Smith"
    },
    {
      "op": "add",
      "path": "emails",
      "value": {
        "value": "alice.personal@example.com",
        "type": "home"
      }
    }
  ]
}

DELETE /scim/v2/{tenant-id}/Users/{id}
If-Match: W/"3"

GET /scim/v2/{tenant-id}/Users

# Filter by email
GET /scim/v2/tenant-1/Users?filter=emails.value eq "alice@example.com"

# Sort by last modified
GET /scim/v2/tenant-1/Users?sortBy=meta.lastModified&sortOrder=descending

# Pagination
GET /scim/v2/tenant-1/Users?startIndex=51&count=50

# Select specific attributes
GET /scim/v2/tenant-1/Users?attributes=userName,emails,active

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
  "totalResults": 150,
  "startIndex": 1,
  "itemsPerPage": 50,
  "Resources": [
    {
      "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
      "id": "2819c223-7f76-453a-919d-413861904646",
      "userName": "alice@example.com",
      "name": {
        "givenName": "Alice",
        "familyName": "Johnson"
      },
      "active": true,
      "meta": {
        "resourceType": "User",
        "created": "2023-12-01T10:30:00Z",
        "lastModified": "2023-12-01T15:45:00Z",
        "version": "W/\"3\""
      }
    }
  ]
}

POST /scim/v2/{tenant-id}/Groups
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
  "displayName": "Engineering Team",
  "members": [
    {
      "value": "2819c223-7f76-453a-919d-413861904646",
      "$ref": "../Users/2819c223-7f76-453a-919d-413861904646",
      "type": "User",
      "display": "Alice Johnson"
    }
  ]
}

GET /scim/v2/{tenant-id}/Groups/{id}

PUT /scim/v2/{tenant-id}/Groups/{id}
PATCH /scim/v2/{tenant-id}/Groups/{id}

DELETE /scim/v2/{tenant-id}/Groups/{id}

GET /scim/v2/{tenant-id}/Groups

GET /scim/v2/{tenant-id}/ServiceProviderConfig

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],
  "documentationUri": "https://docs.example.com/scim",
  "patch": {
    "supported": true
  },
  "bulk": {
    "supported": true,
    "maxOperations": 1000,
    "maxPayloadSize": 1048576
  },
  "filter": {
    "supported": true,
    "maxResults": 1000
  },
  "changePassword": {
    "supported": false
  },
  "sort": {
    "supported": true
  },
  "etag": {
    "supported": true
  },
  "authenticationSchemes": [
    {
      "name": "OAuth Bearer Token",
      "description": "Authentication scheme using the OAuth Bearer Token Standard",
      "specUri": "http://www.rfc-editor.org/info/rfc6750",
      "documentationUri": "https://docs.example.com/auth",
      "type": "oauthbearertoken",
      "primary": true
    }
  ],
  "meta": {
    "resourceType": "ServiceProviderConfig",
    "created": "2023-12-01T00:00:00Z",
    "lastModified": "2023-12-01T00:00:00Z",
    "version": "W/\"1\""
  }
}

GET /scim/v2/{tenant-id}/ResourceTypes

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
  "totalResults": 2,
  "startIndex": 1,
  "itemsPerPage": 2,
  "Resources": [
    {
      "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
      "id": "User",
      "name": "User",
      "endpoint": "/Users",
      "description": "User Account",
      "schema": "urn:ietf:params:scim:schemas:core:2.0:User",
      "schemaExtensions": [
        {
          "schema": "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",
          "required": false
        }
      ],
      "meta": {
        "resourceType": "ResourceType",
        "created": "2023-12-01T00:00:00Z",
        "lastModified": "2023-12-01T00:00:00Z",
        "version": "W/\"1\""
      }
    },
    {
      "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
      "id": "Group",
      "name": "Group",
      "endpoint": "/Groups",
      "description": "Group",
      "schema": "urn:ietf:params:scim:schemas:core:2.0:Group",
      "meta": {
        "resourceType": "ResourceType",
        "created": "2023-12-01T00:00:00Z",
        "lastModified": "2023-12-01T00:00:00Z",
        "version": "W/\"1\""
      }
    }
  ]
}

GET /scim/v2/{tenant-id}/Schemas

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
  "totalResults": 3,
  "startIndex": 1,
  "itemsPerPage": 3,
  "Resources": [
    {
      "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Schema"],
      "id": "urn:ietf:params:scim:schemas:core:2.0:User",
      "name": "User",
      "description": "User Account",
      "attributes": [
        {
          "name": "userName",
          "type": "string",
          "multiValued": false,
          "description": "Unique identifier for the User",
          "required": true,
          "caseExact": false,
          "mutability": "readWrite",
          "returned": "default",
          "uniqueness": "server"
        }
      ],
      "meta": {
        "resourceType": "Schema",
        "created": "2023-12-01T00:00:00Z",
        "lastModified": "2023-12-01T00:00:00Z",
        "version": "W/\"1\""
      }
    }
  ]
}

POST /scim/v2/{tenant-id}/Bulk
Content-Type: application/scim+json

POST /scim/v2/{tenant-id}/Users
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "alice@example.com",
  "name": {
    "givenName": "Alice",
    "familyName": "Johnson"
  }
}

POST /scim/v2/{tenant-id}/Users
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "bob@example.com",
  "name": {
    "givenName": "Bob",
    "familyName": "Smith"
  }
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:BulkRequest"],
  "Operations": [
    {
      "method": "POST",
      "path": "/Users",
      "bulkId": "qwerty",
      "data": {
        "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
        "userName": "alice@example.com"
      }
    }
  ]
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:BulkResponse"],
  "Operations": [
    {
      "method": "POST",
      "path": "/Users",
      "bulkId": "qwerty",
      "status": "201",
      "location": "https://api.example.com/scim/v2/tenant-1/Users/92b725cd-9465-4e7d-8c16-01f8e146b87a",
      "response": {
        "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
        "id": "92b725cd-9465-4e7d-8c16-01f8e146b87a",
        "userName": "alice@example.com",
        "name": {
          "givenName": "Alice",
          "familyName": "Johnson"
        },
        "meta": {
          "resourceType": "User",
          "created": "2023-12-01T16:30:00Z",
          "lastModified": "2023-12-01T16:30:00Z",
          "version": "W/\"1\""
        }
      }
    },
    {
      "method": "POST",
      "path": "/Groups",
      "bulkId": "ytrewq",
      "status": "201",
      "location": "https://api.example.com/scim/v2/tenant-1/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",
      "response": {
        "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
        "id": "e9e30dba-f08f-4109-8486-d5c6a331660a",
        "displayName": "Administrators",
        "members": [
          {
            "value": "92b725cd-9465-4e7d-8c16-01f8e146b87a",
            "$ref": "../Users/92b725cd-9465-4e7d-8c16-01f8e146b87a",
            "type": "User",
            "display": "Alice Johnson"
          }
        ],
        "meta": {
          "resourceType": "Group",
          "created": "2023-12-01T16:30:00Z",
          "lastModified": "2023-12-01T16:30:00Z",
          "version": "W/\"1\""
        }
      }
    }
  ]
}

# Exact match
GET /Users?filter=userName eq "alice@example.com"

# Contains
GET /Users?filter=name.givenName co "Ali"

# Starts with
GET /Users?filter=userName sw "alice"

# Date comparison
GET /Users?filter=meta.lastModified gt "2023-01-01T00:00:00Z"

# Present check
GET /Users?filter=emails pr

# Complex expressions
GET /Users?filter=active eq true and (emails.type eq "work" or emails.type eq "primary")

# Nested attributes
GET /Users?filter=emails[type eq "work" and primary eq true].value eq "alice@work.com"

GET /Users?filter=(name.givenName eq "Alice" or name.givenName eq "Bob") and active eq true

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "scimType": "invalidFilter",
  "detail": "The specified filter syntax is invalid: unexpected token 'eq' at position 5"
}

# Custom Device resource
GET /scim/v2/{tenant-id}/Devices
POST /scim/v2/{tenant-id}/Devices
GET /scim/v2/{tenant-id}/Devices/{id}
PUT /scim/v2/{tenant-id}/Devices/{id}
PATCH /scim/v2/{tenant-id}/Devices/{id}
DELETE /scim/v2/{tenant-id}/Devices/{id}

HTTP/1.1 429 Too Many Requests
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1699123200

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "429",
  "detail": "Rate limit exceeded. Try again in 60 seconds."
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "scimType": "invalidFilter",
  "detail": "The specified filter syntax is invalid: unexpected token 'and' at position 15"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "scimType": "invalidSyntax",
  "detail": "Request body contains invalid JSON: expected ',' or '}' at line 3 column 15"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "401",
  "detail": "Authentication required: missing or invalid Authorization header"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "403",
  "detail": "Insufficient permissions: cannot modify users in tenant 'production'"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "404",
  "detail": "User with ID '123e4567-e89b-12d3-a456-426614174000' not found"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "409",
  "scimType": "uniqueness",
  "detail": "User with userName 'jdoe@example.com' already exists"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "412",
  "detail": "Resource was modified: expected ETag 'W/\"abc123\"' but found 'W/\"def456\"'"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "413",
  "detail": "Request body size 5242880 bytes exceeds maximum allowed size of 1048576 bytes"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "429",
  "detail": "Rate limit exceeded: maximum 100 requests per minute, retry after 60 seconds"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "500",
  "detail": "Internal server error: database connection timeout"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "501",
  "detail": "Bulk operations are not supported by this provider"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "503",
  "detail": "Service temporarily unavailable: scheduled maintenance in progress"
}

# Invalid operator
filter=userName xyz "john"

# Missing quotes
filter=userName eq john@example.com

# Unknown attribute
filter=unknownField eq "value"

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "scimType": "invalidFilter",
  "detail": "Invalid filter expression: unknown operator 'xyz' at position 9"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "scimType": "tooMany",
  "detail": "Query returned 50000 results, maximum allowed is 10000. Use pagination or add filters."
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "409",
  "scimType": "uniqueness",
  "detail": "Email address 'user@example.com' is already in use by another user"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "scimType": "mutability",
  "detail": "Attribute 'id' is immutable and cannot be modified"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "scimType": "invalidSyntax",
  "detail": "Invalid JSON syntax: unexpected token '}' at line 5 column 1"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "scimType": "invalidPath",
  "detail": "Invalid patch path: 'emails[type eq \"work\"].value' - array filter not supported"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "scimType": "invalidValue",
  "detail": "Invalid email format: 'not-an-email' is not a valid email address"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "412",
  "scimType": "invalidVers",
  "detail": "Version conflict in bulk operation: resource was modified"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "403",
  "scimType": "sensitive",
  "detail": "Cannot retrieve sensitive attribute: password"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "404",
  "detail": "Tenant 'acme-corp' not found"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "500",
  "detail": "Provider error: database connection failed"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "scimType": "invalidValue",
  "detail": "Custom validation failed: employee ID must be 6 digits"
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "scimType": "invalidSyntax",
  "detail": "JSON parsing error: missing field 'userName' at line 3"
}

#![allow(unused)]
fn main() {
use scim_server::{ScimError, ScimResult};

async fn handle_user_creation(user_data: Value) -> ScimResult<User> {
    match create_user(user_data).await {
        Ok(user) => Ok(user),
        Err(ScimError::ValidationError { field, message }) => {
            Err(ScimError::BadRequest {
                scim_type: Some("invalidValue".to_string()),
                detail: format!("Validation failed for field '{}': {}", field, message),
            })
        },
        Err(ScimError::UniqueConstraintViolation { field, value }) => {
            Err(ScimError::Conflict {
                scim_type: Some("uniqueness".to_string()),
                detail: format!("Value '{}' for field '{}' already exists", value, field),
            })
        },
        Err(e) => Err(e), // Re-throw other errors
    }
}
}

async function createUser(userData) {
    try {
        const response = await fetch('/Users', {
            method: 'POST',
            headers: { 'Content-Type': 'application/scim+json' },
            body: JSON.stringify(userData)
        });
        
        if (!response.ok) {
            const error = await response.json();
            
            switch (response.status) {
                case 400:
                    if (error.scimType === 'invalidValue') {
                        throw new ValidationError(error.detail);
                    }
                    throw new BadRequestError(error.detail);
                    
                case 409:
                    if (error.scimType === 'uniqueness') {
                        throw new DuplicateError(error.detail);
                    }
                    throw new ConflictError(error.detail);
                    
                case 429:
                    // Implement exponential backoff
                    await sleep(getRetryDelay());
                    return createUser(userData);
                    
                default:
                    throw new ScimError(response.status, error.detail);
            }
        }
        
        return response.json();
    } catch (error) {
        console.error('User creation failed:', error);
        throw error;
    }
}

#![allow(unused)]
fn main() {
use tracing::{error, warn, debug};

// In your error handler
match result {
    Err(ScimError::ValidationError { field, message }) => {
        warn!("Validation error for field '{}': {}", field, message);
        // Return user-friendly error
    },
    Err(ScimError::ProviderError(e)) => {
        error!("Provider error: {:?}", e);
        // Return generic error message
    },
    _ => {}
}
}

#![allow(unused)]
fn main() {
#[tokio::test]
async fn test_error_responses() {
    let server = test_server().await;
    
    // Test validation error
    let response = server
        .post("/Users")
        .json(&json!({"userName": ""})) // Invalid empty username
        .await;
        
    assert_eq!(response.status(), 400);
    
    let error: ScimError = response.json().await;
    assert_eq!(error.scim_type, Some("invalidValue".to_string()));
    assert!(error.detail.contains("userName"));
}
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:BulkResponse"],
  "Operations": [
    {
      "method": "POST",
      "bulkId": "user1",
      "location": "/Users/123",
      "status": "201"
    },
    {
      "method": "POST", 
      "bulkId": "user2",
      "status": "409",
      "response": {
        "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
        "status": "409",
        "scimType": "uniqueness",
        "detail": "userName 'duplicate@example.com' already exists"
      }
    }
  ]
}

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "404",
  "detail": "Resource not found in tenant 'customer-a'. Verify tenant context and resource ID."
}

#![allow(unused)]
fn main() {
use scim_server::{ScimServer, ServerConfig};

let config = ServerConfig::builder()
    .bind_address("0.0.0.0:8080")
    .max_connections(1000)
    .request_timeout_ms(30000)
    .enable_cors(true)
    .build()?;

let server = ScimServer::with_config(storage, config).await?;
}

export SCIM_BIND_ADDRESS="0.0.0.0:8080"
export SCIM_MAX_CONNECTIONS=2000
export SCIM_REQUEST_TIMEOUT_MS=45000
export SCIM_ENABLE_CORS=true
export SCIM_CORS_ORIGINS="https://app.example.com,https://admin.example.com"
export SCIM_MAX_REQUEST_SIZE=2097152

[server]
bind_address = "0.0.0.0:8080"
max_connections = 1000
request_timeout_ms = 30000
keep_alive_timeout_ms = 60000
max_request_size = 1048576
enable_cors = true
cors_origins = ["https://app.example.com"]
enable_compression = true
thread_pool_size = 8

[logging]
level = "info"
format = "json"
file_path = "/var/log/scim-server.log"
max_file_size = "100MB"
max_files = 10

[security]
require_https = true
allowed_auth_methods = ["bearer", "basic"]
token_validation_endpoint = "https://auth.example.com/validate"

#![allow(unused)]
fn main() {
use scim_server::config::load_config;

let config = load_config("scim-config.toml")?;
let server = ScimServer::with_config(storage, config).await?;
}

#![allow(unused)]
fn main() {
use scim_server::storage::{InMemoryStorage, InMemoryConfig};

let config = InMemoryConfig::builder()
    .initial_capacity(10000)
    .enable_persistence(true)
    .persistence_file("/data/scim-backup.json")
    .backup_interval_ms(300000) // 5 minutes
    .build()?;

let storage = InMemoryStorage::with_config(config)?;
}

#![allow(unused)]
fn main() {
use scim_server::storage::{DatabaseStorage, DatabaseConfig};

let config = DatabaseConfig::builder()
    .connection_url("postgresql://user:pass@localhost/scim")
    .max_connections(20)
    .connection_timeout_ms(5000)
    .idle_timeout_ms(600000)
    .enable_ssl(true)
    .migration_auto_run(true)
    .build()?;

let storage = DatabaseStorage::with_config(config).await?;
}

#![allow(unused)]
fn main() {
use scim_server::storage::{StorageProvider, ProviderConfig};

#[derive(Debug, Clone)]
pub struct CustomConfig {
    pub api_endpoint: String,
    pub api_key: String,
    pub timeout_ms: u64,
    pub retry_attempts: u32,
}

impl ProviderConfig for CustomConfig {
    fn validate(&self) -> Result<(), ConfigError> {
        if self.api_endpoint.is_empty() {
            return Err(ConfigError::MissingRequired("api_endpoint"));
        }
        if self.timeout_ms == 0 {
            return Err(ConfigError::InvalidValue("timeout_ms must be > 0"));
        }
        Ok(())
    }
}
}

#![allow(unused)]
fn main() {
use scim_server::{MultiTenantConfig, TenantConfig};

let tenant_config = TenantConfig::builder()
    .tenant_id("acme-corp")
    .display_name("ACME Corporation")
    .max_users(5000)
    .max_groups(500)
    .storage_isolation_level("strict")
    .custom_schemas(vec!["urn:acme:schemas:employee"])
    .rate_limit_per_minute(1000)
    .enable_bulk_operations(true)
    .data_retention_days(2555) // 7 years
    .build()?;

let multi_tenant_config = MultiTenantConfig::builder()
    .default_tenant_config(tenant_config)
    .tenant_resolver("header") // "header", "subdomain", "path"
    .tenant_header_name("X-Tenant-ID")
    .enable_tenant_creation(false)
    .build()?;
}

#![allow(unused)]
fn main() {
// Header-based tenant resolution
let config = MultiTenantConfig::builder()
    .tenant_resolver("header")
    .tenant_header_name("X-Tenant-ID")
    .build()?;

// Subdomain-based tenant resolution  
let config = MultiTenantConfig::builder()
    .tenant_resolver("subdomain")
    .subdomain_pattern("{tenant}.api.example.com")
    .build()?;

// Path-based tenant resolution
let config = MultiTenantConfig::builder()
    .tenant_resolver("path")
    .path_pattern("/tenants/{tenant}/scim")
    .build()?;
}

#![allow(unused)]
fn main() {
use scim_server::auth::{AuthConfig, AuthMethod};

let auth_config = AuthConfig::builder()
    .enabled_methods(vec![AuthMethod::Bearer, AuthMethod::Basic])
    .bearer_token_validation("jwt") // "jwt", "opaque", "custom"
    .jwt_issuer("https://auth.example.com")
    .jwt_audience("scim-api")
    .jwt_public_key_url("https://auth.example.com/.well-known/jwks.json")
    .basic_auth_realm("SCIM API")
    .token_cache_ttl_ms(300000) // 5 minutes
    .enable_token_introspection(true)
    .introspection_endpoint("https://auth.example.com/introspect")
    .build()?;
}