From 30a54fc1ebec46cb757ee4c03ae72822200e0499 Mon Sep 17 00:00:00 2001 From: Lars Date: Mon, 27 Jan 2025 18:30:27 +0100 Subject: [PATCH] fix: scim user query endpoint don't allow SortBy custom field (#9235) # Which Problems Are Solved - scim list users endpoint (`GET /scim/v2/{orgId}/Users`): handle unsupported `SortBy` columns correctly # How the Problems Are Solved - throw an error if sorting by an unsupported column is requested # Additional Context Part of #8140 --- internal/api/scim/integration_test/users_list_test.go | 8 ++++++++ internal/api/scim/resources/resource_list.go | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/internal/api/scim/integration_test/users_list_test.go b/internal/api/scim/integration_test/users_list_test.go index 19268880f..36dc96210 100644 --- a/internal/api/scim/integration_test/users_list_test.go +++ b/internal/api/scim/integration_test/users_list_test.go @@ -93,6 +93,14 @@ func TestListUser(t *testing.T) { wantErr: true, errorType: "invalidValue", }, + { + name: "custom sort field", + req: &scim.ListRequest{ + SortBy: gu.Ptr("externalid"), + }, + wantErr: true, + errorType: "invalidValue", + }, { name: "unknown filter field", req: &scim.ListRequest{ diff --git a/internal/api/scim/resources/resource_list.go b/internal/api/scim/resources/resource_list.go index aa790e44d..ebd648d7a 100644 --- a/internal/api/scim/resources/resource_list.go +++ b/internal/api/scim/resources/resource_list.go @@ -118,7 +118,7 @@ func (r *ListRequest) toSearchRequest(defaultSortCol query.Column, fieldPathColu if r.SortBy == "" { // set a default sort to ensure consistent results sr.SortingColumn = defaultSortCol - } else if sortCol, err := fieldPathColumnMapping.Resolve(r.SortBy); err != nil { + } else if sortCol, err := fieldPathColumnMapping.Resolve(r.SortBy); err != nil || sortCol.FieldType == filter.FieldTypeCustom { return sr, serrors.ThrowInvalidValue(zerrors.ThrowInvalidArgument(err, "SCIM-SRT1", "SortBy field is unknown or not supported")) } else { sr.SortingColumn = sortCol.Column