[WPB-27953] Make scim error responses comply with RFC7644.

changelog.d/0-release-notes/WPB-27953-make-scim-error-responses-comply-with-rfc7644

@@ -0,0 +1,22 @@
+Make SCIM error responses comply with RFC7644.  Any code that processes SCIM error responses must be changed to follow the standard, instead of the previous Wire implementation.
+
+Previous schema (incompatible with RFC):
+
+```
+{
+  "code": 400,
+  "label": "scim-error",
+  "message": "{\"detail\":\"[...]\",\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:Error\"],\"scimType\":\"invalidValue\",\"status\":\"400\"}"
+}
+```
+
+New schema (RFC-compliant):
+
+```
+{
+  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
+  "status": "400"
+  "scimType": "invalidValue",
+  "detail": "[...]",
+}
+```

changelog.d/1-api-changes/WPB-27953-make-scim-error-responses-comply-with-rfc7644

@@ -0,0 +1 @@
+Make scim error responses comply with RFC7644.

services/spar/spar.cabal

@@ -530,6 +530,7 @@ test-suite spec
     Paths_spar
     Test.Spar.APISpec
     Test.Spar.DataSpec
+    Test.Spar.ErrorSpec
     Test.Spar.Intra.BrigSpec
     Test.Spar.Roundtrip.ByteString
     Test.Spar.Saml.IdPSpec

services/spar/src/Spar/Error.hs

@@ -135,7 +135,13 @@ sparToServerErrorWithLogging logger err = do
   pure errServant
 
 sparToServerError :: SparError -> ServerError
-sparToServerError = httpErrorToServerError . renderSparError
+-- SCIM errors have their own response format (RFC 7644, section 3.12): the body
+-- must be the bare SCIM error object.  Going through 'renderSparError' /
+-- 'httpErrorToServerError' would instead nest it into a wire-server 'Wai.Error'
+-- ('{"code":..,"label":"scim-error","message":<scim error as string>}'), so we
+-- render it directly here.
+sparToServerError (SAML.CustomError (SparScimError err)) = Scim.scimToServerError err
+sparToServerError err = httpErrorToServerError (renderSparError err)
 
 waiToServant :: Wai.Error -> ServerError
 waiToServant waierr =

services/spar/test-integration/Test/Spar/APISpec.hs

@@ -1369,15 +1369,23 @@ specProvisionScimAndSAMLUserWithRole = do
         pure $ u {Scim.roles = ["member", "admin"]}
       ScimT.createUser' tok scimUser !!! do
         const 400 === statusCode
-        const (Just "A user cannot have more than one role.") =~= responseBody
+        ScimT.mkScimErrorResp
+          (Just "A user cannot have more than one role.")
+          (Just "invalidValue")
+          "400"
+          === responseBody
     it "create user - fail if role name cannot be parsed correctly" $ do
       (tok, _) <- ScimT.registerIdPAndScimTokenWithMeta
       scimUser <- do
         u <- ScimT.randomScimUser
         pure $ u {Scim.roles = ["president"]}
       ScimT.createUser' tok scimUser !!! do
         const 400 === statusCode
-        const (Just "The role 'president' is not valid. Valid roles are owner, admin, member, partner.") =~= responseBody
+        ScimT.mkScimErrorResp
+          (Just "The role 'president' is not valid. Valid roles are owner, admin, member, partner.")
+          (Just "invalidValue")
+          "400"
+          === responseBody
     it "update user" $ do
       (tok, (owner, tid, _idp, (_, _privcreds))) <- ScimT.registerIdPAndScimTokenWithMeta
       scimUserWithDefaultRole <- ScimT.randomScimUser
@@ -1404,14 +1412,22 @@ specProvisionScimAndSAMLUserWithRole = do
       uid <- ScimT.scimUserId <$> ScimT.createUser tok scimUser
       ScimT.updateUser' tok uid (scimUser {Scim.roles = ["admin", "member"]}) !!! do
         const 400 === statusCode
-        const (Just "A user cannot have more than one role.") =~= responseBody
+        ScimT.mkScimErrorResp
+          (Just "A user cannot have more than one role.")
+          (Just "invalidValue")
+          "400"
+          === responseBody
     it "updated user - fail if role name cannot be parsed correctly" $ do
       (tok, _) <- ScimT.registerIdPAndScimTokenWithMeta
       scimUser <- ScimT.randomScimUser
       uid <- ScimT.scimUserId <$> ScimT.createUser tok scimUser
       ScimT.updateUser' tok uid (scimUser {Scim.roles = ["hamlet"]}) !!! do
         const 400 === statusCode
-        const (Just "The role 'hamlet' is not valid. Valid roles are owner, admin, member, partner.") =~= responseBody
+        ScimT.mkScimErrorResp
+          (Just "The role 'hamlet' is not valid. Valid roles are owner, admin, member, partner.")
+          (Just "invalidValue")
+          "400"
+          === responseBody
 
 specAux :: SpecWith TestEnv
 specAux = do