Source: openagent-sdk/bridges/scim/rust/src/lib.rs. SHA-256: 67ea054f3b8534db37953673131ee30641cdcf2978c96438d9a814c5123bd6f5.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

mapping

openagent-scim

SCIM 2.0 provisioning bridge for OpenAgent — enterprise agent lifecycle management via RFC 7644.

This crate provides:

Trait definitions for the SCIM provisioner
SCIM resource types (User + Agent extension)
OAS Agent <-> SCIM User mapping functions

The TypeScript implementation (@openagentid/scim) is the primary SDK. This Rust crate provides trait definitions and reference types for Rust-native integrations.

pub mod mapping;

Source line: 15.

types

pub mod types;

Source line: 16.

::ScimError

Errors from the SCIM provisioner.

#[derive(Debug, thiserror::Error)]
pub enum ScimError {
    #[error("Agent not found: {did}")]
    NotFound { did: String },

    #[error("Agent already exists: {did}")]
    Conflict { did: String },

    #[error("Invalid input: {detail}")]
    InvalidInput { detail: String },

    #[error("Store error: {0}")]
    Store(String),

    #[error("Deprovisioning cascade error: {step} — {detail}")]
    CascadeError { step: String, detail: String },
}

Source line: 23.

::ScimResult

Result type for SCIM operations.

pub type ScimResult<T> = Result<T, ScimError>;

Source line: 41.

::AgentStore

Storage interface for agent records.

Implementations must return cloned/owned data — never hand out mutable references to internal state.

#[async_trait]
pub trait AgentStore: Send + Sync {
    async fn list(&self) -> ScimResult<Vec<AgentRecord>>;
    async fn find_by_did(&self, did: &str) -> ScimResult<Option<AgentRecord>>;
    async fn find_by_user_name(&self, user_name: &str) -> ScimResult<Option<AgentRecord>>;
    async fn find_by_external_id(&self, external_id: &str) -> ScimResult<Option<AgentRecord>>;
    async fn create(&self, record: AgentRecord) -> ScimResult<AgentRecord>;
    async fn update(&self, did: &str, record: AgentRecord) -> ScimResult<AgentRecord>;
    async fn delete(&self, did: &str) -> ScimResult<()>;
}

Source line: 48.

::DidRevoker

DID document revocation hook.

#[async_trait]
pub trait DidRevoker: Send + Sync {
    async fn revoke(&self, did: &str) -> ScimResult<()>;
}

Source line: 60.

::DelegationCascadeRevoker

Delegation tree cascade revocation hook.

#[async_trait]
pub trait DelegationCascadeRevoker: Send + Sync {
    async fn cascade_revoke(&self, did: &str) -> ScimResult<()>;
}

Source line: 66.

::ArsenalSessionInvalidator

Arsenal session invalidation hook.

#[async_trait]
pub trait ArsenalSessionInvalidator: Send + Sync {
    async fn invalidate_sessions(&self, did: &str) -> ScimResult<()>;
}

Source line: 72.

::AuditSink

Audit event sink.

#[async_trait]
pub trait AuditSink: Send + Sync {
    async fn emit(&self, event: AuditEvent) -> ScimResult<()>;
}

Source line: 78.

::ScimProvisioner

The SCIM provisioner trait — core lifecycle operations.

Implementations wire together storage, DID management, delegation cascade, Arsenal session control, and audit emission.

#[async_trait]
pub trait ScimProvisioner: Send + Sync {
    /// Create a new agent identity via SCIM.
    async fn create_agent(&self, params: CreateAgentParams) -> ScimResult<AgentRecord>;

    /// Replace an agent record (SCIM PUT).
    async fn replace_agent(
        &self,
        did: &str,
        params: CreateAgentParams,
    ) -> ScimResult<AgentRecord>;

    /// Partial update (SCIM PATCH). Receives the already-patched record.
    async fn update_agent(&self, did: &str, record: AgentRecord) -> ScimResult<AgentRecord>;

    /// Deprovision an agent — the killer feature.
    ///
    /// Execution order:
    /// 1. Revoke the agent's DID document
    /// 2. Cascade-revoke all delegation proofs
    /// 3. Invalidate all active Arsenal sessions
    /// 4. Delete the agent record from the store
    /// 5. Emit audit event
    async fn deprovision_agent(&self, did: &str) -> ScimResult<()>;

    /// Find agent by DID.
    async fn find_by_did(&self, did: &str) -> ScimResult<Option<AgentRecord>>;

    /// List all agents.
    async fn list_agents(&self) -> ScimResult<Vec<AgentRecord>>;
}

Source line: 87.

openagent-scim · crate