fix(okta): honour search and filter expressions on GET /api/v1/groups - #228
Closed
0xChathurinda wants to merge 1 commit into
Closed
fix(okta): honour search and filter expressions on GET /api/v1/groups#2280xChathurinda wants to merge 1 commit into
0xChathurinda wants to merge 1 commit into
Conversation
The groups list only narrowed on `q`; `search=profile.name eq "Everyone"` was ignored and returned the first page of every group, so a client looking a group up by exact name silently got the wrong one. Both `search` and `filter` now evaluate the SCIM-style expressions Okta documents for this endpoint: id, type, profile.name, profile.description, created, lastUpdated and lastMembershipUpdated with eq, ne, sw, co and pr, joined by `and`. An expression the evaluator does not understand is a 400 E0000031, as on Okta, rather than an unfiltered page that looks like a match.
Contributor
|
@0xChathurinda is attempting to deploy a commit to the Vercel Labs Team on Vercel. A member of the Team first needs to authorize it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GET /api/v1/groupsonly narrowed onq. Okta's documentedsearchparameter (profile.name eq "Everyone",profile.name sw "app_" and type eq "OKTA_GROUP") andfilterwere ignored, so a client that looks a group up by exact name got the first page of every group back and, if it takes the first result, the wrong group.This adds a small evaluator (
src/search.ts) for the SCIM-style expressions Okta accepts on this endpoint:id,type,profile.name,profile.description,created,lastUpdated,lastMembershipUpdatedeq,ne,sw,co,pr, combined withand400 E0000031 The search filter is invalidinstead of an unfiltered pageqkeeps working and composes withsearch/filter.Why
The Okta SDKs and most hand-written clients find a group by name with
search=profile.name eq "…". Against the emulator that call returned everything, which is a silent wrong answer rather than an error.Testing
src/__tests__/group-search.test.tscovers exact match,and,filter, the empty result,qcomposition, the 400 path, and the parser's operators and rejections.pnpm --filter @emulators/okta test,type-checkandlintpass. Package README and the web docs page mention the parameters.