OIDC SSO SCIM 2.0 provisioning endpoint for enterprise user lifecycle

[thlpkee20-wq]

Description

Enterprises expect SCIM 2.0 for user provisioning and de-provisioning. Add /scim/v2/Users and /scim/v2/Groups with token auth and full CRUD wrapping our user repositories.

Requirements and context

• Must be secure, tested, and documented
• Should be efficient and easy to review
• Relevant code: src/auth/, user repositories
• SCIM token separate from OAuth token

Suggested execution

• Fork the repo and create a branch
• git checkout -b feat/scim-provisioning
• Implement changes
  • Add SCIM router
  • Wire filter/select query params
  • Emit per-op counters
• Validate security and correctness assumptions

Test and commit

• Run tests
  • npm test
• Cover edge cases
  • Deactivation preserves audit trail
• Include test output and notes

Example commit message

feat: SCIM 2.0 provisioning for enterprise SSO

Guidelines

• Minimum 95 percent test coverage
• Clear documentation
• Timeframe: 96 hours