fix(scim): serialize first-time configuration; reconcile members when a rename drops an automatic mapping

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/lib/scim/application/admin/connection.ts

@@ -9,6 +9,7 @@ import {
 import { generateId } from '@sim/utils/id'
 import { and, desc, eq } from 'drizzle-orm'
 import type { ScimConnectionSettingsInput } from '@/lib/api/contracts/organization-scim'
+import { acquireOrganizationMutationLock } from '@/lib/billing/organizations/membership'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   assertWorkspaceInOrganization,
@@ -74,11 +75,13 @@ export const configureScimConnection = defineAuthorizedScimAdminUseCase({
     }
 
     /**
-     * Read, merge, and write under the row lock, so two administrators changing
-     * different settings at once both land instead of the later write carrying
-     * a stale copy of the earlier one's field.
+     * Read, merge, and write under the organization lock, so two administrators
+     * changing different settings at once both land instead of the later write
+     * carrying a stale copy of the earlier one's field — and two first-time
+     * enables, where there is no row yet to lock, cannot both insert.
      */
     const { created, status } = await db.transaction(async (tx) => {
+      await acquireOrganizationMutationLock(tx, context.organizationId)
       const [existing] = await tx
         .select({
           id: scimConnection.id,
@@ -88,7 +91,6 @@ export const configureScimConnection = defineAuthorizedScimAdminUseCase({
         .from(scimConnection)
         .where(eq(scimConnection.organizationId, context.organizationId))
         .limit(1)
-        .for('update')
 
       const nextSettings: ScimConnectionSettings = {
         /**

apps/sim/lib/scim/application/groups/manage-groups.ts

@@ -267,8 +267,9 @@ export const replaceScimGroup = defineAuthorizedScimUseCase({
           scimGroupId: current.id,
           displayName: input.group.displayName,
         })
-        /** A new mapping applies to everyone already in the group, not only to those moving today. */
-        if (mapped === 'mapped') for (const scimUserId of before) touched.add(scimUserId)
+        /** A mapping gained or lost applies to everyone already in the group, not only to those moving today. */
+        if (mapped === 'mapped' || mapped === 'unmapped')
+          for (const scimUserId of before) touched.add(scimUserId)
       }
 
       for (const scimUserId of before) {
@@ -393,7 +394,7 @@ export const patchScimGroup = defineAuthorizedScimUseCase({
             scimGroupId: current.id,
             displayName: patch.displayName,
           })
-          if (mapped === 'mapped') {
+          if (mapped === 'mapped' || mapped === 'unmapped') {
             for (const scimUserId of await loadGroupMemberIds(tx, current.id)) {
               touched.add(scimUserId)
             }

apps/sim/lib/scim/projection/auto-map.ts

@@ -24,7 +24,7 @@ import type { DbOrTx } from '@/lib/db/types'
 export async function autoMapPermissionGroupByName(
   tx: DbOrTx,
   params: { organizationId: string; scimGroupId: string; displayName: string }
-): Promise<'mapped' | 'already-mapped' | 'no-match'> {
+): Promise<'mapped' | 'already-mapped' | 'unmapped' | 'no-match'> {
   const [target] = await tx
     .select({ id: permissionGroup.id, membershipMode: permissionGroup.membershipMode })
     .from(permissionGroup)
@@ -37,7 +37,7 @@ export async function autoMapPermissionGroupByName(
     )
     .limit(1)
 
-  await tx
+  const removed = await tx
     .delete(scimGroupMapping)
     .where(
       and(
@@ -47,7 +47,9 @@ export async function autoMapPermissionGroupByName(
         ...(target ? [ne(scimGroupMapping.permissionGroupId, target.id)] : [])
       )
     )
-  if (!target) return 'no-match'
+    .returning({ id: scimGroupMapping.id })
+  /** `unmapped` tells the caller access changed even though nothing new was mapped. */
+  if (!target) return removed.length > 0 ? 'unmapped' : 'no-match'
 
   const [existing] = await tx
     .select({ id: scimGroupMapping.id })