test(scim): cover provisioning, the reconcile job, and group membership; say "token"

Provisioning use case (20), reconcile job (12), and the permission-group
add/remove primitives (13) now have tests that assert call arguments,
result fields, audit lists, and thrown status + scimType.

User-facing wording is "token", as every provider labels it (Okta API
Token, Entra Secret Token, OneLogin SCIM Bearer Token, JumpCloud Token
Key), and to keep clear of Sim's own connected-account credentials.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DGXcwsHzYGp6pUDWRtJKpz

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/scim.mdx

@@ -52,11 +52,11 @@ https://<your-sim-domain>/api/scim/v2
 </Step>
 
 <Step>
-### Issue a credential
+### Issue a token
 
-Choose whether the credential expires (never, 90 days, or a year) and select **Issue credential**. The token appears once — copy it straight into your provider.
+Choose whether the token expires (never, 90 days, or a year) and select **Issue token**. It appears once — copy it straight into your provider.
 
-Two credentials can be active at a time, so you can rotate without downtime: issue the new one, update your provider, confirm a sync succeeds, then revoke the old one.
+Two tokens can be active at a time, so you can rotate without downtime: issue the new one, update your provider, confirm a sync succeeds, then revoke the old one.
 </Step>
 
 <Step>
@@ -70,7 +70,7 @@ In your Okta app, open **Provisioning → Integration** and select **Configure A
 - **SCIM connector base URL**: `https://<your-sim-domain>/api/scim/v2`
 - **Unique identifier field for users**: `userName`
 - **Supported provisioning actions**: Push New Users, Push Profile Updates, Push Groups
-- **Authentication Mode**: HTTP Header, with your Sim credential as the token
+- **Authentication Mode**: HTTP Header, with your Sim token
 
 Select **Test API Credentials**, then save. Under **Provisioning → To App**, enable Create Users, Update User Attributes, and Deactivate Users.
 
@@ -82,7 +82,7 @@ Okta never deletes users over SCIM. Unassigning someone, or deactivating them in
 In your enterprise application, open **Provisioning** and set Provisioning Mode to **Automatic**.
 
 - **Tenant URL**: `https://<your-sim-domain>/api/scim/v2`
-- **Secret Token**: your Sim credential
+- **Secret Token**: your Sim token
 
 Select **Test Connection**, then save and start provisioning.
 
@@ -94,7 +94,7 @@ Entra runs an initial cycle over everyone in scope, then incremental cycles roug
 Add a **SCIM Provisioner with SAML** app.
 
 - **SCIM Base URL**: `https://<your-sim-domain>/api/scim/v2`
-- **SCIM Bearer Token**: your Sim credential
+- **SCIM Bearer Token**: your Sim token
 
 Enable provisioning and choose what happens when a user is removed. Suspend maps to a Sim suspension; Delete removes their membership.
 
@@ -104,7 +104,7 @@ Enable provisioning and choose what happens when a user is removed. Suspend maps
 Add a **Custom SCIM** identity management integration.
 
 - **Base URL**: `https://<your-sim-domain>/api/scim/v2`
-- **Token Key**: your Sim credential
+- **Token Key**: your Sim token
 
 Enable group sync if you plan to map groups.
 
@@ -154,7 +154,7 @@ Sim also re-applies every group mapping once an hour, so drift cannot persist. Y
 ## Reference
 
 - Base URL: `https://<your-sim-domain>/api/scim/v2`
-- Authentication: `Authorization: Bearer <credential>`
+- Authentication: `Authorization: Bearer <token>`
 - Resources: `/Users`, `/Groups`, plus `/ServiceProviderConfig`, `/ResourceTypes`, and `/Schemas`
 - Filters: `eq` only, up to ten terms joined with `and`. Users: `id`, `userName`, `externalId`, `emails.value` (also `emails[type eq "work"].value`), `active`. Groups: `id`, `displayName`, `externalId`
 - Limits: 1,500 requests per minute per connection, 1 MB per request, 5,000 members per group

apps/sim/ee/scim/components/scim-section.tsx

@@ -387,7 +387,7 @@ function ConnectionDetails({ organizationId, connection }: ConnectionDetailsProp
       })
       setIssuedSecret(result.secret)
     } catch (error) {
-      toast.error(getErrorMessage(error, 'Failed to issue credential'))
+      toast.error(getErrorMessage(error, 'Failed to issue token'))
     }
   }
 
@@ -396,9 +396,9 @@ function ConnectionDetails({ organizationId, connection }: ConnectionDetailsProp
     try {
       await revokeCredential.mutateAsync({ organizationId, credentialId: pendingRevoke.id })
       setPendingRevoke(null)
-      toast.success('Credential revoked')
+      toast.success('Token revoked')
     } catch (error) {
-      toast.error(getErrorMessage(error, 'Failed to revoke credential'))
+      toast.error(getErrorMessage(error, 'Failed to revoke token'))
     }
   }
 
@@ -457,12 +457,12 @@ function ConnectionDetails({ organizationId, connection }: ConnectionDetailsProp
       ))}
 
       <SettingRow
-        label='Credentials'
+        label='Tokens'
         description='The token is shown once. Two can be active at a time so you can rotate without downtime.'
       >
         <div className='flex flex-col gap-3'>
           {connection.credentials.length === 0 ? (
-            <SettingsEmptyState variant='inline'>No credentials yet.</SettingsEmptyState>
+            <SettingsEmptyState variant='inline'>No tokens yet.</SettingsEmptyState>
           ) : (
             connection.credentials.map((credential) => (
               <CredentialRow
@@ -474,7 +474,7 @@ function ConnectionDetails({ organizationId, connection }: ConnectionDetailsProp
           )}
           <div className='flex flex-wrap items-center gap-2'>
             <ChipSelect
-              aria-label='Credential expiry'
+              aria-label='Token expiry'
               align='start'
               value={credentialExpiry}
               onChange={(next) => setCredentialExpiry(next as CredentialExpiry)}
@@ -485,7 +485,7 @@ function ConnectionDetails({ organizationId, connection }: ConnectionDetailsProp
               onClick={handleIssue}
               disabled={issueCredential.isPending || connection.credentials.length >= 2}
             >
-              {issueCredential.isPending ? 'Issuing...' : 'Issue credential'}
+              {issueCredential.isPending ? 'Issuing...' : 'Issue token'}
             </Chip>
           </div>
         </div>
@@ -541,11 +541,11 @@ function ConnectionDetails({ organizationId, connection }: ConnectionDetailsProp
       <ChipConfirmModal
         open={pendingRevoke !== null}
         onOpenChange={(open) => !open && setPendingRevoke(null)}
-        title='Revoke credential'
+        title='Revoke token'
         text={[
           'Revoke ',
           { text: pendingRevoke?.tokenPrefix ?? '', bold: true },
-          '? Your identity provider stops syncing the moment it next uses this token. Issue a new credential first if you are rotating.',
+          '? Your identity provider stops syncing the moment it next uses this token. Issue a new token first if you are rotating.',
         ]}
         confirm={{
           label: 'Revoke',

apps/sim/ee/scim/lib/application/admin/credentials.ts

@@ -118,7 +118,7 @@ export const revokeScimCredential = defineAuthorizedScimAdminUseCase({
         connectionId: scimCredential.connectionId,
       })
 
-    if (!revoked) throw new OrchestrationError('not_found', 'Credential not found')
+    if (!revoked) throw new OrchestrationError('not_found', 'Token not found')
     return { success: true as const, revoked }
   },
   projectAudit: ({ result }) => ({

apps/sim/ee/scim/lib/application/authorized-scim-use-case.ts

@@ -82,7 +82,7 @@ async function loadActiveConnection(
     .limit(1)
 
   if (!row || row.status !== 'active') {
-    throw new ScimError(401, undefined, 'Invalid SCIM credential', {
+    throw new ScimError(401, undefined, 'Invalid SCIM token', {
       'WWW-Authenticate': 'Bearer realm="SCIM"',
     })
   }