fix(scim): mapping provenance column, drop the unused SSO binding, and close the third review round

- scim_group_mapping.source ('manual' | 'automatic') carries provenance so
  a deleted author cannot turn a manual mapping into an automatic one;
  the unreleased 0323 migration is regenerated from the schema
- scim_connection.sso_provider_id removed: nothing read it
- Entitlement mirrors SSO access: flag is the outer gate, self-hosted is
  entitled by the flag, hosted requires the enterprise plan; protected and
  discovery routes answer 404 when the flag is off
- Group PATCH: replace without a value is refused
- Deprovision re-checks membership under the lock before account-wide
  effects; relinking an active identity lifts a lingering suspension;
  instance-organization deployments refuse a connection for any other org
- Lowering a workspace grant that is no longer at the recorded level
  re-establishes the desired level instead of recording it as applied
- Connection audit names the actual transition; update responses render
  inside the write transaction
- Reconcile every hour with settings re-read per batch
- UI: error states for groups and activity; default group excluded from
  the mapping picker

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/app/api/organizations/[id]/scim/route.ts

@@ -39,7 +39,6 @@ export const PUT = defineInternalJsonRoute({
     organizationId: params.id,
     ...(body.status !== undefined ? { status: body.status } : {}),
     ...(body.settings !== undefined ? { settings: body.settings } : {}),
-    ...(body.ssoProviderId !== undefined ? { ssoProviderId: body.ssoProviderId } : {}),
   }),
   useCase: configureScimConnection,
   present: ({ connection }) => ({ connection }),

apps/sim/ee/scim/components/scim-section.tsx

@@ -205,8 +205,17 @@ interface GroupMappingsProps {
 }
 
 function GroupMappings({ organizationId }: GroupMappingsProps) {
-  const { data: groups, isLoading } = useScimGroupMappings(organizationId)
-  const { data: permissionGroups = [] } = usePermissionGroups(organizationId)
+  const {
+    data: groups,
+    isLoading,
+    isError,
+    error,
+    isFetching,
+    refetch,
+  } = useScimGroupMappings(organizationId)
+  const { data: allPermissionGroups = [] } = usePermissionGroups(organizationId)
+  /** The default group governs by having no members, so it cannot be a membership target. */
+  const permissionGroups = allPermissionGroups.filter((group) => !group.isDefault)
   const { data: workspaces = [] } = useOrganizationWorkspaces(organizationId)
   const deleteMapping = useDeleteScimGroupMapping()
 
@@ -227,6 +236,17 @@ function GroupMappings({ organizationId }: GroupMappingsProps) {
   if (isLoading) {
     return <SettingsEmptyState variant='inline'>Loading groups...</SettingsEmptyState>
   }
+  if (isError) {
+    return (
+      <SettingsQueryErrorState
+        error={error}
+        fallback='Failed to load directory groups'
+        isRetrying={isFetching}
+        onRetry={() => void refetch()}
+        variant='inline'
+      />
+    )
+  }
   if (!groups || groups.length === 0) {
     return (
       <SettingsEmptyState variant='inline'>
@@ -278,11 +298,29 @@ interface ActivityListProps {
 }
 
 function ActivityList({ organizationId }: ActivityListProps) {
-  const { data: entries, isLoading } = useScimActivity(organizationId)
+  const {
+    data: entries,
+    isLoading,
+    isError,
+    error,
+    isFetching,
+    refetch,
+  } = useScimActivity(organizationId)
 
   if (isLoading) {
     return <SettingsEmptyState variant='inline'>Loading activity...</SettingsEmptyState>
   }
+  if (isError) {
+    return (
+      <SettingsQueryErrorState
+        error={error}
+        fallback='Failed to load directory activity'
+        isRetrying={isFetching}
+        onRetry={() => void refetch()}
+        variant='inline'
+      />
+    )
+  }
   if (!entries || entries.length === 0) {
     return <SettingsEmptyState variant='inline'>No requests yet.</SettingsEmptyState>
   }

apps/sim/lib/api/contracts/organization-scim.ts

@@ -39,7 +39,6 @@ const scimConnectionSchema = z.object({
   status: z.enum(['active', 'disabled']),
   baseUrl: z.string(),
   settings: scimConnectionSettingsSchema,
-  ssoProviderId: z.string().nullable(),
   lastRequestAt: z.string().nullable(),
   reconciledAt: z.string().nullable(),
   createdAt: z.string(),
@@ -65,7 +64,6 @@ export const configureScimConnectionContract = defineRouteContract({
   body: z.object({
     status: z.enum(['active', 'disabled']).optional(),
     settings: scimConnectionSettingsSchema.optional(),
-    ssoProviderId: z.string().min(1).max(128).nullable().optional(),
   }),
   response: { mode: 'json', schema: z.object({ connection: scimConnectionSchema }) },
 })

apps/sim/lib/api/server/routes/scim-route.ts

@@ -167,6 +167,8 @@ export function createScimRouteBuilder(dependencies: ScimRouteDependencies) {
           if (request.method !== options.contract.method) {
             throw new ScimError(405, undefined, `${request.method} is not supported here`)
           }
+          /** A deployment without the feature exposes no provisioning surface at all. */
+          if (!isScimEnabled) throw new ScimError(404, undefined, 'Not found')
           assertAcceptableMediaType(request)
 
           /**

apps/sim/lib/scim/application/admin/connection-view.ts

@@ -114,7 +114,6 @@ export async function loadConnectionView(
     status: row.status === 'disabled' ? 'disabled' : 'active',
     baseUrl: scimBaseUrl(),
     settings: row.settings,
-    ssoProviderId: row.ssoProviderId,
     lastRequestAt: row.lastRequestAt?.toISOString() ?? null,
     reconciledAt: row.reconciledAt?.toISOString() ?? null,
     createdAt: row.createdAt.toISOString(),

apps/sim/lib/scim/application/admin/connection.ts

@@ -1,13 +1,8 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import { db } from '@sim/db'
-import {
-  type ScimConnectionSettings,
-  scimConnection,
-  scimRequestLog,
-  ssoProvider,
-} from '@sim/db/schema'
+import { type ScimConnectionSettings, scimConnection, scimRequestLog } from '@sim/db/schema'
 import { generateId } from '@sim/utils/id'
-import { and, desc, eq } from 'drizzle-orm'
+import { desc, eq } from 'drizzle-orm'
 import type { ScimConnectionSettingsInput } from '@/lib/api/contracts/organization-scim'
 import { acquireOrganizationMutationLock } from '@/lib/billing/organizations/membership'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
@@ -40,31 +35,11 @@ export interface ConfigureScimConnectionInput {
   organizationId: string
   status?: 'active' | 'disabled'
   settings?: ScimConnectionSettingsInput
-  ssoProviderId?: string | null
 }
 
 export const configureScimConnection = defineAuthorizedScimAdminUseCase({
   operation: scimAdminOperations.configure,
   async execute({ input, context }: ScimAdminUseCaseArgs<ConfigureScimConnectionInput>) {
-    if (input.ssoProviderId) {
-      const [provider] = await db
-        .select({ id: ssoProvider.id })
-        .from(ssoProvider)
-        .where(
-          and(
-            eq(ssoProvider.id, input.ssoProviderId),
-            eq(ssoProvider.organizationId, context.organizationId)
-          )
-        )
-        .limit(1)
-      if (!provider) {
-        throw new OrchestrationError(
-          'not_found',
-          'That SSO provider does not belong to this organization'
-        )
-      }
-    }
-
     /**
      * A default grant hands every provisioned member a workspace, so the
      * workspace must be this organization's — the same check a group mapping
@@ -80,7 +55,7 @@ export const configureScimConnection = defineAuthorizedScimAdminUseCase({
      * carrying a stale copy of the earlier one's field — and two first-time
      * enables, where there is no row yet to lock, cannot both insert.
      */
-    const { created, status } = await db.transaction(async (tx) => {
+    const { created, previousStatus, status } = await db.transaction(async (tx) => {
       await acquireOrganizationMutationLock(tx, context.organizationId)
       const [existing] = await tx
         .select({
@@ -111,36 +86,35 @@ export const configureScimConnection = defineAuthorizedScimAdminUseCase({
           .set({
             status: nextStatus,
             settings: nextSettings,
-            ...(input.ssoProviderId !== undefined ? { ssoProviderId: input.ssoProviderId } : {}),
             updatedAt: new Date(),
           })
           .where(eq(scimConnection.id, existing.id))
       } else {
         await tx.insert(scimConnection).values({
           id: generateId(),
           organizationId: context.organizationId,
-          ssoProviderId: input.ssoProviderId ?? null,
           status: nextStatus,
           settings: nextSettings,
           createdBy: context.actorUserId,
         })
       }
-      return { created: !existing, status: nextStatus }
+      return { created: !existing, previousStatus: existing?.status ?? null, status: nextStatus }
     })
 
     const view = await loadConnectionView(context.organizationId)
     if (!view || view.status !== status) {
       throw new OrchestrationError('internal', 'The connection could not be read back')
     }
-    return { connection: view, created }
+    return { connection: view, created, previousStatus }
   },
+  /** The action names the transition: enabling (first time or again), disabling, or editing in place. */
   projectAudit: ({ result }) => ({
     action:
-      result.connection.status === 'active'
-        ? result.created
+      result.connection.status !== result.previousStatus
+        ? result.connection.status === 'active'
           ? AuditAction.SCIM_CONNECTION_ENABLED
-          : AuditAction.SCIM_CONNECTION_SETTINGS_UPDATED
-        : AuditAction.SCIM_CONNECTION_DISABLED,
+          : AuditAction.SCIM_CONNECTION_DISABLED
+        : AuditAction.SCIM_CONNECTION_SETTINGS_UPDATED,
     resourceType: AuditResourceType.SCIM_CONNECTION,
     resourceId: result.connection.id,
     metadata: { status: result.connection.status },

apps/sim/lib/scim/application/admin/mappings.ts

@@ -217,6 +217,7 @@ export const upsertScimGroupMapping = defineAuthorizedScimAdminUseCase({
       workspaceId: input.targetKind === 'workspace' ? input.workspaceId : null,
       permissionType: input.targetKind === 'workspace' ? input.permissionType : null,
       role: input.targetKind === 'org_role' ? input.role : null,
+      source: 'manual',
       createdBy: context.actorUserId,
     }
 

apps/sim/lib/scim/application/users/deprovision-user.ts

@@ -103,7 +103,19 @@ export const deprovisionScimUser = defineAuthorizedScimUseCase({
        * A stale row for someone who already left — and may since have joined
        * another organization — must not sign them out or revoke their keys there.
        */
-      if (membership) {
+      const [rejoined] = membership
+        ? await tx
+            .select({ id: member.id })
+            .from(member)
+            .where(
+              and(
+                eq(member.organizationId, context.organizationId),
+                eq(member.userId, current.userId)
+              )
+            )
+            .limit(1)
+        : []
+      if (membership && !rejoined) {
         await revokeUserSessionsTx(tx, {
           userId: current.userId,
           organizationId: context.organizationId,

apps/sim/lib/scim/application/users/provision-user.ts

@@ -15,9 +15,14 @@ import { reconcileOrganizationSeats } from '@/lib/billing/organizations/seats'
 import { isTeam } from '@/lib/billing/plan-helpers'
 import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
 import type { DbOrTx } from '@/lib/db/types'
+import {
+  getInstanceOrganizationId,
+  isInstanceOrganizationMode,
+} from '@/lib/organizations/instance-org'
 import {
   invalidateAfterSessionRevocation,
   suspendMemberTx,
+  unsuspendMemberTx,
 } from '@/lib/organizations/members/lifecycle'
 import { captureServerEvent } from '@/lib/posthog/server'
 import {
@@ -127,6 +132,22 @@ export const provisionScimUser = defineAuthorizedScimUseCase({
      * hang off them. Reimplementing that with a direct insert would skip every
      * one.
      */
+    /**
+     * In instance-organization mode every account is placed in the instance
+     * organization at creation, and an account belongs to one organization. A
+     * connection for any other organization could never admit anyone.
+     */
+    if (isInstanceOrganizationMode()) {
+      const instanceOrganizationId = await getInstanceOrganizationId()
+      if (instanceOrganizationId && instanceOrganizationId !== context.organizationId) {
+        throw new ScimError(
+          409,
+          undefined,
+          'This deployment places every account in its instance organization, so directory provisioning is available only for that organization.'
+        )
+      }
+    }
+
     const resolution = await resolveProvisionedIdentity(db, {
       connectionId: context.connection.id,
       organizationId: context.organizationId,
@@ -209,6 +230,8 @@ export const provisionScimUser = defineAuthorizedScimUseCase({
          */
         if (resolution.action === 'link') {
           await syncAccountIdentityTx(tx, { userId, email, name: attributes.name.formatted })
+          /** A relinked account may still carry the suspension a lost deprovisioning left behind. */
+          if (attributes.active) await unsuspendMemberTx(tx, { userId, source: 'scim' })
         }
 
         const inserted = await insertScimUser(tx, {

apps/sim/lib/scim/application/users/update-user.ts

@@ -164,14 +164,16 @@ async function loadUserForUpdate(
   return current
 }
 
+/** Rendered inside the write transaction, so a concurrent delete cannot make a committed update unreadable. */
 async function renderUpdated(
+  tx: DbOrTx,
   connectionId: string,
   scimUserId: string,
   baseUrl: string
 ): Promise<ReturnType<typeof toUserResource>> {
-  const record = await findScimUserById(db, connectionId, scimUserId)
+  const record = await findScimUserById(tx, connectionId, scimUserId)
   if (!record) throw new ScimError(500, undefined, 'The updated user could not be read back')
-  const groups = (await loadGroupsForScimUsers(db, [record.id])).get(record.id) ?? []
+  const groups = (await loadGroupsForScimUsers(tx, [record.id])).get(record.id) ?? []
   return toUserResource(toUserResourceRow(record, groups), baseUrl)
 }
 
@@ -225,7 +227,7 @@ export const replaceScimUser = defineAuthorizedScimUseCase({
     input,
     context,
   }: ScimUseCaseArgs<ReplaceScimUserInput>): Promise<UpdateScimUserResult> {
-    const { scimUserId, userId, outcome } = await db.transaction(async (tx) => {
+    return db.transaction(async (tx) => {
       const current = await loadUserForUpdate(tx, context, input.scimUserId)
 
       /**
@@ -245,21 +247,16 @@ export const replaceScimUser = defineAuthorizedScimUseCase({
        * changes nothing must not write, audit, or re-project, or a 2,000-user
        * organization produces 2,000 spurious audit rows per sync.
        */
-      if (userAttributesEqual(current.attributes, next)) {
-        return { scimUserId: current.id, userId: current.userId, outcome: null }
-      }
+      const outcome = userAttributesEqual(current.attributes, next)
+        ? null
+        : await applyUserUpdate(tx, context, current, next)
       return {
         scimUserId: current.id,
         userId: current.userId,
-        outcome: await applyUserUpdate(tx, context, current, next),
+        outcome,
+        resource: await renderUpdated(tx, context.connection.id, current.id, context.baseUrl),
       }
     })
-    return {
-      scimUserId,
-      userId,
-      outcome,
-      resource: await renderUpdated(context.connection.id, scimUserId, context.baseUrl),
-    }
   },
   projectAudit: ({ result }) => auditEntries(result),
   afterSuccess: async ({ result, context }) =>
@@ -277,7 +274,7 @@ export const patchScimUser = defineAuthorizedScimUseCase({
     input,
     context,
   }: ScimUseCaseArgs<PatchScimUserInput>): Promise<UpdateScimUserResult> {
-    const { scimUserId, userId, outcome } = await db.transaction(async (tx) => {
+    return db.transaction(async (tx) => {
       const current = await loadUserForUpdate(tx, context, input.scimUserId)
 
       const { next, changed } = applyUserPatch(current.attributes, input.operations)
@@ -289,19 +286,14 @@ export const patchScimUser = defineAuthorizedScimUseCase({
        * projection pass, and a `lastModified` bump for a request that meant
        * nothing.
        */
-      if (!changed) return { scimUserId: current.id, userId: current.userId, outcome: null }
+      const outcome = changed ? await applyUserUpdate(tx, context, current, next) : null
       return {
         scimUserId: current.id,
         userId: current.userId,
-        outcome: await applyUserUpdate(tx, context, current, next),
+        outcome,
+        resource: await renderUpdated(tx, context.connection.id, current.id, context.baseUrl),
       }
     })
-    return {
-      scimUserId,
-      userId,
-      outcome,
-      resource: await renderUpdated(context.connection.id, scimUserId, context.baseUrl),
-    }
   },
   projectAudit: ({ result }) => auditEntries(result),
   afterSuccess: async ({ result, context }) =>