fix(scim): second audit round — bugs, abstractions, tests

Findings from a full code review of the SCIM surface and a regression
review of the shared primitives it extracted:

- attributes/excludedAttributes projection no longer fails response
  validation (Entra excludes groups on every page); projected attributes
  are optional in the response contract
- defaultWorkspaceGrants are checked against the organization, closing a
  cross-tenant workspace grant
- User PUT/PATCH serialize on the organization/user advisory locks instead
  of a scim_user row lock that inverted lock order against projection
- PATCH add emails keeps the existing primary; canonical nested name and
  enterprise objects are accepted in a path-less replace
- A group mapped to the org admin role skips the owner instead of failing
  the sync; a withdrawal that cannot hand ownership on is retried next pass
- Relinking a recreated identity syncs the account's email and name
- disableJit is enforced at SSO admission rather than flipped once on the
  provider; reconcile refuses a disabled connection clearly
- Conflicts that are not duplicates no longer carry scimType uniqueness
- Workspace revocation hands the workspace to its billed account first,
  matching the members route
- Batch invitations return 403 for a managed member; role change maps a
  lock timeout to 409; managed-membership locking is inert with the flag off
- Settings routes' all-members conflict rule ignores explicit-mode groups
- Admin wrapper projects audit like the directory wrapper; admin use cases
  split into connection, credentials, mappings
- Pure grant resolution/diff extracted; group list N+1 removed; no-op group
  writes skipped; roster shows directory deactivation
- Tests: grants, authentication, identity resolution, lifecycle primitives,
  projection-vs-contract, email add, canonical nesting (139 SCIM tests)
- Dead code removed; unrelated sandbox bundle churn reverted

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/scim.mdx

@@ -149,13 +149,13 @@ Sim also re-applies every group mapping on a schedule, so drift cannot persist.
 - Base URL: `https://<your-sim-domain>/api/scim/v2`
 - Authentication: `Authorization: Bearer <credential>`
 - Resources: `/Users`, `/Groups`, plus `/ServiceProviderConfig`, `/ResourceTypes`, and `/Schemas`
-- Filters: `eq`, joined with `and`, on `userName`, `externalId`, `emails.value`, and `displayName`
+- Filters: `eq`, joined with `and`, on `id`, `userName`, `externalId`, `emails.value`, `active`, and `displayName`
 - Page size: up to 100 per request
 
 <FAQ items={[
   {
     question: "What happens to someone's workflows when they are deactivated?",
-    answer: "Nothing. A deactivation blocks sign-in and stops their API keys, and leaves every workspace, workflow, and credential they own exactly as it was. Reactivating them restores access. Only a removal — which your provider sends explicitly — reassigns what they owned."
+    answer: "Nothing. A deactivation blocks sign-in and stops their API keys, and leaves every workspace, workflow, and credential they own exactly as it was. Reactivating them restores access. Only a removal — which your provider sends explicitly — reassigns what they owned. A deactivated member also keeps their seat until they are removed."
   },
   {
     question: "Can the directory provision someone outside our verified domains?",

apps/sim/app/api/organizations/[id]/members/[memberId]/route.ts

@@ -19,6 +19,7 @@ import { reconcileOrganizationSeats } from '@/lib/billing/organizations/seats'
 import { ForbiddenOperationError } from '@/lib/core/application'
 import { OrchestrationError, statusForOrchestrationError } from '@/lib/core/orchestration/types'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { isRetryableTransactionError } from '@/lib/db/transaction'
 import { changeMemberRoleTx } from '@/lib/organizations/members/lifecycle'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { assertMembershipNotScimManaged } from '@/lib/scim/managed-membership'
@@ -220,7 +221,6 @@ export const PUT = withRouteHandler(
       await assertMembershipNotScimManaged({
         organizationId,
         userId: memberId,
-        action: 'change-role',
       })
 
       /**
@@ -292,6 +292,13 @@ export const PUT = withRouteHandler(
           { status: statusForOrchestrationError(error.code) }
         )
       }
+      /** The role change now serializes on the organization lock; a timeout is "retry", not a fault. */
+      if (isRetryableTransactionError(error)) {
+        return NextResponse.json(
+          { error: 'The organization is busy; retry in a moment' },
+          { status: 409 }
+        )
+      }
 
       logger.error('Failed to update organization member role', {
         organizationId: (await context.params).id,

apps/sim/app/api/organizations/[id]/permission-groups/[groupId]/members/route.ts

@@ -281,7 +281,7 @@ export const DELETE = withRouteHandler(
           throw new Error('MEMBER_NOT_FOUND')
         }
 
-        if (!lockedGroup.isDefault) {
+        if (!lockedGroup.isDefault && lockedGroup.membershipMode === 'inherit') {
           const [memberCountRow] = await tx
             .select({ value: count() })
             .from(permissionGroupMember)

apps/sim/app/api/organizations/[id]/permission-groups/utils.ts

@@ -58,6 +58,7 @@ export async function loadGroupInOrganization(
       createdAt: permissionGroup.createdAt,
       updatedAt: permissionGroup.updatedAt,
       isDefault: permissionGroup.isDefault,
+      membershipMode: permissionGroup.membershipMode,
     })
     .from(permissionGroup)
     .where(and(eq(permissionGroup.id, groupId), eq(permissionGroup.organizationId, organizationId)))
@@ -209,7 +210,8 @@ export interface AllMembersConflict {
  * all-members group already targeting one of those workspaces, or `null`. Two
  * all-members groups on one workspace would both claim everyone there, so this
  * is rejected at assignment time. The candidate group (`excludeGroupId`) is
- * ignored.
+ * ignored, and so is any group in `explicit` membership mode: empty, it governs
+ * nobody rather than everyone, so it cannot collide.
  */
 export async function findAllMembersWorkspaceConflict(
   params: { organizationId: string; excludeGroupId: string; workspaceIds: string[] },
@@ -234,6 +236,7 @@ export async function findAllMembersWorkspaceConflict(
       and(
         eq(permissionGroup.organizationId, organizationId),
         eq(permissionGroup.isDefault, false),
+        eq(permissionGroup.membershipMode, 'inherit'),
         ne(permissionGroup.id, excludeGroupId),
         inArray(permissionGroupWorkspace.workspaceId, workspaceIds),
         sql`not exists (

apps/sim/app/api/organizations/[id]/roster/route.test.ts

@@ -57,6 +57,7 @@ const MEMBER_ROWS = [
     userName: 'Admin User',
     userEmail: 'admin@example.com',
     userImage: null,
+    userSuspendedAt: null,
   },
   {
     memberId: 'member-reader',
@@ -66,6 +67,7 @@ const MEMBER_ROWS = [
     userName: 'Reader User',
     userEmail: 'reader@example.com',
     userImage: 'https://example.com/reader.png',
+    userSuspendedAt: null,
   },
 ]
 
@@ -118,6 +120,7 @@ describe('GET /api/organizations/[id]/roster', () => {
             name: 'Admin User',
             email: 'admin@example.com',
             image: null,
+            suspendedAt: null,
             workspaces: [],
           },
           {
@@ -128,6 +131,7 @@ describe('GET /api/organizations/[id]/roster', () => {
             name: 'Reader User',
             email: 'reader@example.com',
             image: 'https://example.com/reader.png',
+            suspendedAt: null,
             workspaces: [],
           },
         ],
@@ -167,6 +171,7 @@ describe('GET /api/organizations/[id]/roster', () => {
         userName: 'External User',
         userEmail: 'external@example.com',
         userImage: null,
+        userSuspendedAt: null,
         workspaceId: 'workspace-1',
         permission: 'read',
         createdAt: new Date('2026-03-01T00:00:00.000Z'),

apps/sim/app/api/organizations/[id]/roster/route.ts

@@ -83,6 +83,7 @@ export const GET = withRouteHandler(
           userName: user.name,
           userEmail: user.email,
           userImage: user.image,
+          userSuspendedAt: user.suspendedAt,
         })
         .from(member)
         .innerJoin(user, eq(member.userId, user.id))
@@ -96,6 +97,7 @@ export const GET = withRouteHandler(
         name: row.userName,
         email: row.userEmail,
         image: row.userImage,
+        suspendedAt: row.userSuspendedAt?.toISOString() ?? null,
         workspaces: [] as RosterWorkspaceAccess[],
       }))
 
@@ -189,6 +191,7 @@ export const GET = withRouteHandler(
                 userName: user.name,
                 userEmail: user.email,
                 userImage: user.image,
+                userSuspendedAt: user.suspendedAt,
                 workspaceId: permissions.entityId,
                 permission: permissions.permissionType,
                 createdAt: permissions.createdAt,
@@ -218,6 +221,7 @@ export const GET = withRouteHandler(
           name: string
           email: string
           image: string | null
+          suspendedAt: string | null
           workspaces: RosterWorkspaceAccess[]
         }
       >()
@@ -247,6 +251,7 @@ export const GET = withRouteHandler(
           name: row.userName,
           email: row.userEmail,
           image: row.userImage,
+          suspendedAt: row.userSuspendedAt?.toISOString() ?? null,
           workspaces: [workspaceAccess],
         })
       }

apps/sim/app/api/organizations/[id]/scim/activity/route.ts

@@ -5,7 +5,7 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { listScimActivity } from '@/lib/scim/application/admin/manage-connection'
+import { listScimActivity } from '@/lib/scim/application/admin/connection'
 
 /** Recent provisioning requests, so a failing sync can be diagnosed from Sim. */
 export const GET = defineInternalJsonRoute({

apps/sim/app/api/organizations/[id]/scim/credentials/[credentialId]/route.ts

@@ -5,7 +5,7 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { revokeScimCredential } from '@/lib/scim/application/admin/manage-connection'
+import { revokeScimCredential } from '@/lib/scim/application/admin/credentials'
 
 export const DELETE = defineInternalJsonRoute({
   contract: revokeScimCredentialContract,
@@ -18,4 +18,5 @@ export const DELETE = defineInternalJsonRoute({
     credentialId: params.credentialId,
   }),
   useCase: revokeScimCredential,
+  present: ({ success }) => ({ success }),
 })

apps/sim/app/api/organizations/[id]/scim/credentials/route.ts

@@ -5,7 +5,7 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { issueScimCredential } from '@/lib/scim/application/admin/manage-connection'
+import { issueScimCredential } from '@/lib/scim/application/admin/credentials'
 
 /** Issues a bearer credential. The secret is returned once and never stored. */
 export const POST = defineInternalJsonRoute({
@@ -23,4 +23,5 @@ export const POST = defineInternalJsonRoute({
     ...(body.expiresInDays !== undefined ? { expiresInDays: body.expiresInDays } : {}),
   }),
   useCase: issueScimCredential,
+  present: ({ secret, credential }) => ({ secret, credential }),
 })

apps/sim/app/api/organizations/[id]/scim/mappings/[mappingId]/route.ts

@@ -5,7 +5,7 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { deleteScimGroupMapping } from '@/lib/scim/application/admin/manage-connection'
+import { deleteScimGroupMapping } from '@/lib/scim/application/admin/mappings'
 
 export const DELETE = defineInternalJsonRoute({
   contract: deleteScimGroupMappingContract,
@@ -15,4 +15,5 @@ export const DELETE = defineInternalJsonRoute({
   errorPolicy: internalOrchestrationErrorPolicy,
   mapInput: ({ params }) => ({ organizationId: params.id, mappingId: params.mappingId }),
   useCase: deleteScimGroupMapping,
+  present: ({ success, reconciledUsers }) => ({ success, reconciledUsers }),
 })