refactor(plugin-auth): derive the SCIM connection-id cap from SCIM_SERVICE_PRINCIPAL_PREFIX

.changeset/31033-scim-connection-id-cap-from-prefix.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+refactor(plugin-auth): the SCIM connection-id cap is derived from the exported service-principal prefix
+
+Clause-②: no
+Metadata-protocol: none
+
+`POST /api/v1/auth/admin/scim/mint-credential` refuses a `connectionId` longer than 246 characters so the connection's audit actor `svc:scim:CONNECTION_ID` fits the 255 characters of `sys_audit_log.actor`. That cap was computed from the prefix spelled out a second time; it now reads the length of `SCIM_SERVICE_PRINCIPAL_PREFIX`, the constant the actor label itself is built from, so the two can no longer drift apart. Nothing a caller sees changes: the cap is still 246, and the refusal is still `400 INVALID_REQUEST`.
+
+Exported (completing the record of the SCIM credential routes, whose release note names the routes only): two public `AuthManager` methods back them. `isScimWired()` answers whether the SCIM service provider is mounted on this deployment (the same decision that mounts `/scim/v2`), and `mintScimConnectionCredential(engine, input)` mints a connection bearer with the deployment's auth secret, the key the mounted SCIM verifier digests with.

packages/plugins/plugin-auth/src/scim-connection-admin.ts

@@ -67,6 +67,7 @@ import type { PlatformAdminActor } from './platform-admin-gate.js';
 import { readJsonRequestBody } from './request-json-body.js';
 import {
   SCIM_CREDENTIAL_OBJECT,
+  SCIM_SERVICE_PRINCIPAL_PREFIX,
   revokeScimConnectionCredential,
   type MintScimConnectionCredentialInput,
   type MintedScimConnectionCredential,
@@ -84,9 +85,11 @@ const MAX_TEXT = 255;
  * A write made by a SCIM connection is audited with the service actor
  * `svc:scim:<connectionId>` (#30960), and `sys_audit_log.actor` holds 255
  * characters, so a longer id would make that audit insert fail for every
- * request the connection makes. 255 minus the 9-character prefix.
+ * request the connection makes. 255 minus the 9-character prefix, read from
+ * {@link SCIM_SERVICE_PRINCIPAL_PREFIX} (the one spelling the actor label is
+ * built from) so the cap moves with the label it protects.
  */
-const MAX_SCIM_CONNECTION_ID = MAX_TEXT - 'svc:scim:'.length;
+const MAX_SCIM_CONNECTION_ID = MAX_TEXT - SCIM_SERVICE_PRINCIPAL_PREFIX.length;
 
 /** Execution context for the store reads and the audit write. */
 const SYSTEM_CTX = { isSystem: true } as const;