From 7a88c580368105258d5b702f41b322ee1b07997c Mon Sep 17 00:00:00 2001
From: Philipinho <16838612+Philipinho@users.noreply.github.com>
Date: Mon, 7 Jul 2025 23:57:04 -0700
Subject: [PATCH] patch scimmy

---
 apps/server/package.json   |  2 +-
 package.json               |  3 ++-
 patches/scimmy@1.3.5.patch | 23 +++++++++++++++++++++++
 pnpm-lock.yaml             |  9 ++++++---
 4 files changed, 32 insertions(+), 5 deletions(-)
 create mode 100644 patches/scimmy@1.3.5.patch

diff --git a/apps/server/package.json b/apps/server/package.json
index 375f8e10..44b2730c 100644
--- a/apps/server/package.json
+++ b/apps/server/package.json
@@ -80,7 +80,7 @@
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
     "sanitize-filename-ts": "^1.0.2",
-    "scimmy": "^1.3.5",
+    "scimmy": "1.3.5",
     "socket.io": "^4.8.1",
     "stripe": "^17.5.0",
     "tmp-promise": "^3.0.3",
diff --git a/package.json b/package.json
index ad7b07ca..7eb53208 100644
--- a/package.json
+++ b/package.json
@@ -90,7 +90,8 @@
   "packageManager": "pnpm@10.4.0",
   "pnpm": {
     "patchedDependencies": {
-      "react-arborist@3.4.0": "patches/react-arborist@3.4.0.patch"
+      "react-arborist@3.4.0": "patches/react-arborist@3.4.0.patch",
+      "scimmy@1.3.5": "patches/scimmy@1.3.5.patch"
     },
     "overrides": {
       "jsdom": "25.0.1"
diff --git a/patches/scimmy@1.3.5.patch b/patches/scimmy@1.3.5.patch
new file mode 100644
index 00000000..fd206034
--- /dev/null
+++ b/patches/scimmy@1.3.5.patch
@@ -0,0 +1,23 @@
+diff --git a/dist/cjs/lib/messages.cjs b/dist/cjs/lib/messages.cjs
+index e74b8f52137e3267f3d065c4210a1114c4f32dd1..5740606b18851c0ac4f55cfa333152359e0ad135 100644
+--- a/dist/cjs/lib/messages.cjs
++++ b/dist/cjs/lib/messages.cjs
+@@ -502,10 +502,15 @@ class PatchOp {
+                 }
+             }
+         }
+-        
++
++        /** Reason: Commented out to avoid failing patch requests when filters don't match.
++         * Some IdPs send patch paths like `addresses[type eq "work"].country` even if no such address exists. We can't always decide what the end user IdPs send.
++         * Since we manually control patch application, we safely ignore these cases.
++         * example error: "noTarget","detail":"Filter 'addresses[type eq \"work\"].country' does not match any values for 'add' op of operation 5 in PatchOp request body
++         */
+         // No targets, bail out!
+-        if (targets.length === 0 && op !== "remove")
+-            throw new lib_types.default.Error(400, "noTarget", `Filter '${path}' does not match any values for '${op}' op of operation ${index} in PatchOp request body`);
++        //  if (targets.length === 0 && op !== "remove")
++      //      throw new lib_types.default.Error(400, "noTarget", `Filter '${path}' does not match any values for '${op}' op of operation ${index} in PatchOp request body`);
+         
+         /**
+          * @typedef {Object} PatchOpDetails
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a281af6c..64f110fb 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -11,6 +11,9 @@ patchedDependencies:
   react-arborist@3.4.0:
     hash: 419b3b02e24afe928cc006a006f6e906666aff19aa6fd7daaa788ccc2202678a
     path: patches/react-arborist@3.4.0.patch
+  scimmy@1.3.5:
+    hash: 775d80f86830b2c5dd1a250c9802c10f8fc3da3c7898373de5aa0c23993d1673
+    path: patches/scimmy@1.3.5.patch
 
 importers:
 
@@ -553,8 +556,8 @@ importers:
         specifier: ^1.0.2
         version: 1.0.2
       scimmy:
-        specifier: ^1.3.5
-        version: 1.3.5
+        specifier: 1.3.5
+        version: 1.3.5(patch_hash=775d80f86830b2c5dd1a250c9802c10f8fc3da3c7898373de5aa0c23993d1673)
       socket.io:
         specifier: ^4.8.1
         version: 4.8.1
@@ -19121,7 +19124,7 @@ snapshots:
       ajv-formats: 2.1.1(ajv@8.12.0)
       ajv-keywords: 5.1.0(ajv@8.12.0)
 
-  scimmy@1.3.5: {}
+  scimmy@1.3.5(patch_hash=775d80f86830b2c5dd1a250c9802c10f8fc3da3c7898373de5aa0c23993d1673): {}
 
   secure-json-parse@3.0.2: {}