fix(scim): address cubic's second review round

- One entitlement gate: the deployment flag is the outer gate everywhere
  (authentication, admin API, reconcile job, discovery)
- Group PATCH: path-less add contributes members; add without a value is
  refused; filter booleans only for active; formatted name applied after
  its parts
- Projection: mappings to workspaces that left the organization are
  ignored and their provenance dropped without touching the other tenant
- Update refuses a stale row for someone who left; deprovision serializes
  on the user locks and scopes account-wide effects to a real removal
- Auto-map drops the stale automatic mapping on rename; mapping upserts
  are conflict-safe and refuse the default group; connection settings
  merge under the row lock
- Relinking keeps email verification when the address is unchanged;
  addresses are syntax-checked; failed provisioning cleans up through the
  account-deletion path; inactive provisioning invalidates caches
- Reconcile watermark advances only on a completed pass
- Wrapped orchestration errors keep their SCIM status; revoke audit names
  the connection; group members show their display name
- UI: error state on the settings read, activity polls; SCIM reachable for
  admins who did not configure SSO; docs wording on keys and cookies

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/scim.mdx

@@ -22,7 +22,7 @@ It pairs with [SSO](/platform/enterprise/sso). SSO proves who someone is when th
 | --- | --- |
 | Assigns a person to the Sim app | Creates their account and adds them to your organization as a Member |
 | Updates their name or email | Updates the Sim account, and ends their sessions if the address changed |
-| Deactivates them | Blocks sign-in and stops their API keys. Everything they own, and every grant they hold, is left untouched |
+| Deactivates them | Blocks sign-in and stops their personal API keys. Everything they own, and every grant they hold, is left untouched; shared workspace keys keep working |
 | Reactivates them | Restores access exactly as it was |
 | Removes them from the app | Removes their organization membership and reassigns what they owned |
 | Adds them to a group | Grants whatever that group maps to |
@@ -156,7 +156,7 @@ Sim also re-applies every group mapping on a schedule, so drift cannot persist.
 <FAQ items={[
   {
     question: "What happens to someone's workflows when they are deactivated?",
-    answer: "Nothing. A deactivation blocks sign-in and stops their API keys, and leaves every workspace, workflow, and credential they own exactly as it was. Reactivating them restores access. Only a removal — which your provider sends explicitly — reassigns what they owned. A deactivated member also keeps their seat until they are removed."
+    answer: "Nothing. A deactivation blocks sign-in and stops their personal API keys, and leaves every workspace, workflow, and credential they own exactly as it was. Reactivating them restores access. Only a removal — which your provider sends explicitly — reassigns what they owned. A deactivated member also keeps their seat until they are removed."
   },
   {
     question: "Can the directory provision someone outside our verified domains?",
@@ -176,7 +176,7 @@ Sim also re-applies every group mapping on a schedule, so drift cannot persist.
   },
   {
     question: "Does a deactivation sign someone out immediately?",
-    answer: "Their sessions are deleted at once and their API keys stop authenticating immediately. A browser tab holding a cached session cookie can survive up to five minutes; enabling a session policy shortens that window."
+    answer: "Their sessions are deleted at once and their personal API keys stop authenticating immediately. The organization's security version changes at the same time, so a browser still holding a cached session cookie is re-checked on its next request and refused."
   },
   {
     question: "Can we still invite people manually?",

apps/sim/app/api/workspaces/invitations/batch/route.ts

@@ -40,13 +40,6 @@ function batchErrorResponse(error: unknown) {
     return NextResponse.json({ error: error.message }, { status: 403 })
   }
 
-  if (error instanceof ForbiddenOperationError) {
-    return NextResponse.json(
-      { error: error.message, details: { code: error.detailCode } },
-      { status: 403 }
-    )
-  }
-
   logger.error('Error creating workspace invitation batch:', error)
   return NextResponse.json({ error: 'Failed to create invitation batch' }, { status: 500 })
 }
@@ -107,6 +100,11 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
           failed.push({ email: error.email ?? normalizedEmail, error: error.message })
           continue
         }
+        /** A directory-managed address is refused with its reason, like any other per-email refusal. */
+        if (error instanceof ForbiddenOperationError) {
+          failed.push({ email: normalizedEmail, error: error.message })
+          continue
+        }
 
         /**
          * One bad address must not discard the invitations that already

apps/sim/ee/scim/components/scim-section.tsx

@@ -26,7 +26,10 @@ import type {
 } from '@/lib/api/contracts/organization-scim'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import { RowActionsMenu } from '@/app/workspace/[workspaceId]/settings/components/row-actions-menu'
-import { SettingsEmptyState } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
+import {
+  SettingsEmptyState,
+  SettingsQueryErrorState,
+} from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
 import { SettingsResourceRow } from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
 import { SettingsSection } from '@/app/workspace/[workspaceId]/settings/components/settings-section/settings-section'
 import {
@@ -523,11 +526,28 @@ function ConnectionDetails({ organizationId, connection }: ConnectionDetailsProp
  */
 export function ScimSection({ organizationId }: ScimSectionProps) {
   const { features } = useDeploymentShape()
-  const { data, isLoading } = useScimConnection(organizationId, features.scim)
+  const { data, isLoading, isError, error, isFetching, refetch } = useScimConnection(
+    organizationId,
+    features.scim
+  )
   const configure = useConfigureScimConnection()
 
   if (!features.scim) return null
 
+  if (isError) {
+    return (
+      <SettingsSection label='Directory provisioning'>
+        <SettingsQueryErrorState
+          error={error}
+          fallback='Failed to load directory provisioning settings'
+          isRetrying={isFetching}
+          onRetry={() => void refetch()}
+          variant='inline'
+        />
+      </SettingsSection>
+    )
+  }
+
   const connection = data?.connection ?? null
   const enabled = connection?.status === 'active'
 

apps/sim/ee/scim/hooks/scim.ts

@@ -16,8 +16,9 @@ import {
 
 export const SCIM_CONNECTION_STALE_TIME = 30 * 1000
 export const SCIM_MAPPINGS_STALE_TIME = 30 * 1000
-/** Activity is a debugging surface; a short window keeps it close to live. */
+/** Activity is a debugging surface; it polls while mounted so a sync in progress shows up without a reload. */
 export const SCIM_ACTIVITY_STALE_TIME = 10 * 1000
+export const SCIM_ACTIVITY_REFETCH_INTERVAL = 15 * 1000
 
 export const scimKeys = {
   all: ['scim'] as const,
@@ -69,6 +70,7 @@ export function useScimActivity(organizationId?: string, enabled = true) {
     },
     enabled: Boolean(organizationId) && enabled,
     staleTime: SCIM_ACTIVITY_STALE_TIME,
+    refetchInterval: SCIM_ACTIVITY_REFETCH_INTERVAL,
   })
 }
 

apps/sim/ee/sso/components/sso-settings.tsx

@@ -327,9 +327,12 @@ function OrganizationSsoSettings({ organizationId }: SSOProps) {
   } else {
     if (!isLoadingProviders && isSSOProviderOwner === false && providers.length > 0) {
       return (
-        <SettingsEmptyState>
-          Only the user who configured SSO can manage these settings.
-        </SettingsEmptyState>
+        <>
+          <SettingsEmptyState>
+            Only the user who configured SSO can manage these settings.
+          </SettingsEmptyState>
+          <ScimSection organizationId={organizationId} />
+        </>
       )
     }
   }

apps/sim/lib/api/contracts/organization-scim.ts

@@ -65,7 +65,7 @@ export const configureScimConnectionContract = defineRouteContract({
   body: z.object({
     status: z.enum(['active', 'disabled']).optional(),
     settings: scimConnectionSettingsSchema.optional(),
-    ssoProviderId: z.string().max(128).nullable().optional(),
+    ssoProviderId: z.string().min(1).max(128).nullable().optional(),
   }),
   response: { mode: 'json', schema: z.object({ connection: scimConnectionSchema }) },
 })

apps/sim/lib/api/server/routes/scim-route.ts

@@ -4,6 +4,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import type { AnyApiRouteContract, ContractJsonResponse } from '@/lib/api/contracts/types'
 import { type ParsedRequest, parseRequest } from '@/lib/api/server/validation'
 import type { ApplicationOperation, OperationUseCase } from '@/lib/core/application/operation'
+import { isScimEnabled } from '@/lib/core/config/env-flags'
 import { enforceIpRateLimit, RateLimiter } from '@/lib/core/rate-limiter'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -294,6 +295,8 @@ export function defineScimDiscoveryRoute(
   return withRouteHandler<ScimRouteContext | undefined>(
     async (request, context) => {
       try {
+        /** A deployment without the feature exposes no provisioning surface, discovery included. */
+        if (!isScimEnabled) throw new ScimError(404, undefined, 'Not found')
         if (request.method !== 'GET') {
           throw new ScimError(405, undefined, `${request.method} is not supported here`)
         }

apps/sim/lib/scim/application/admin/connection.ts

@@ -73,55 +73,64 @@ export const configureScimConnection = defineAuthorizedScimAdminUseCase({
       await assertWorkspaceInOrganization(context.organizationId, grant.workspaceId)
     }
 
-    const [existing] = await db
-      .select({
-        id: scimConnection.id,
-        settings: scimConnection.settings,
-        status: scimConnection.status,
-      })
-      .from(scimConnection)
-      .where(eq(scimConnection.organizationId, context.organizationId))
-      .limit(1)
-
-    const nextSettings: ScimConnectionSettings = {
-      /**
-       * Locking manual membership defaults on for a new connection. Once a
-       * directory owns membership, a change made only in Sim is reverted by the
-       * next sync, so a member edited by hand looks like it worked and then
-       * silently does not.
-       */
-      lockManualMembership: true,
-      ...(existing?.settings ?? {}),
-      ...(input.settings ?? {}),
-    }
+    /**
+     * Read, merge, and write under the row lock, so two administrators changing
+     * different settings at once both land instead of the later write carrying
+     * a stale copy of the earlier one's field.
+     */
+    const { created, status } = await db.transaction(async (tx) => {
+      const [existing] = await tx
+        .select({
+          id: scimConnection.id,
+          settings: scimConnection.settings,
+          status: scimConnection.status,
+        })
+        .from(scimConnection)
+        .where(eq(scimConnection.organizationId, context.organizationId))
+        .limit(1)
+        .for('update')
 
-    const connectionId = existing?.id ?? generateId()
-    const nextStatus = input.status ?? existing?.status ?? 'active'
+      const nextSettings: ScimConnectionSettings = {
+        /**
+         * Locking manual membership defaults on for a new connection. Once a
+         * directory owns membership, a change made only in Sim is reverted by
+         * the next sync, so a member edited by hand looks like it worked and
+         * then silently does not.
+         */
+        lockManualMembership: true,
+        ...(existing?.settings ?? {}),
+        ...(input.settings ?? {}),
+      }
+      const nextStatus = input.status ?? existing?.status ?? 'active'
 
-    if (existing) {
-      await db
-        .update(scimConnection)
-        .set({
+      if (existing) {
+        await tx
+          .update(scimConnection)
+          .set({
+            status: nextStatus,
+            settings: nextSettings,
+            ...(input.ssoProviderId !== undefined ? { ssoProviderId: input.ssoProviderId } : {}),
+            updatedAt: new Date(),
+          })
+          .where(eq(scimConnection.id, existing.id))
+      } else {
+        await tx.insert(scimConnection).values({
+          id: generateId(),
+          organizationId: context.organizationId,
+          ssoProviderId: input.ssoProviderId ?? null,
           status: nextStatus,
           settings: nextSettings,
-          ...(input.ssoProviderId !== undefined ? { ssoProviderId: input.ssoProviderId } : {}),
-          updatedAt: new Date(),
+          createdBy: context.actorUserId,
         })
-        .where(eq(scimConnection.id, existing.id))
-    } else {
-      await db.insert(scimConnection).values({
-        id: connectionId,
-        organizationId: context.organizationId,
-        ssoProviderId: input.ssoProviderId ?? null,
-        status: nextStatus,
-        settings: nextSettings,
-        createdBy: context.actorUserId,
-      })
-    }
+      }
+      return { created: !existing, status: nextStatus }
+    })
 
     const view = await loadConnectionView(context.organizationId)
-    if (!view) throw new OrchestrationError('internal', 'The connection could not be read back')
-    return { connection: view, created: !existing }
+    if (!view || view.status !== status) {
+      throw new OrchestrationError('internal', 'The connection could not be read back')
+    }
+    return { connection: view, created }
   },
   projectAudit: ({ result }) => ({
     action:

apps/sim/lib/scim/application/admin/credentials.ts

@@ -111,15 +111,19 @@ export const revokeScimCredential = defineAuthorizedScimAdminUseCase({
           )`
         )
       )
-      .returning({ id: scimCredential.id, tokenPrefix: scimCredential.tokenPrefix })
+      .returning({
+        id: scimCredential.id,
+        tokenPrefix: scimCredential.tokenPrefix,
+        connectionId: scimCredential.connectionId,
+      })
 
     if (!revoked) throw new OrchestrationError('not_found', 'Credential not found')
     return { success: true as const, revoked }
   },
   projectAudit: ({ result }) => ({
     action: AuditAction.SCIM_CREDENTIAL_REVOKED,
     resourceType: AuditResourceType.SCIM_CONNECTION,
-    resourceId: result.revoked.id,
-    metadata: { tokenPrefix: result.revoked.tokenPrefix },
+    resourceId: result.revoked.connectionId,
+    metadata: { credentialId: result.revoked.id, tokenPrefix: result.revoked.tokenPrefix },
   }),
 })