fix(scim): certification audit round

Three read-only auditors (IdP compatibility and docs, correctness and
regressions, code economy and tests) reviewed the merged branch. Every
verified finding is addressed here.

Sync-breaking and regressions:
- Accept provider extension URNs in `schemas` (Okta custom attributes,
  Entra custom extensions) and echo them on the resource; the check now
  lives in the write contracts.
- A lapsed enterprise plan no longer keeps refusing manual membership
  changes, invitations, or SSO JIT on a directory's behalf.
- Leaving a workspace no longer signs the leaver out (session spared).
- OAuth access and refresh tokens are refused for a directory-suspended
  account, like sessions and personal keys.
- Workspace-role changes for a directory-managed member are refused under
  membership locking, as the docs already said.
- A permission group moved back to governing everyone no longer fails a
  sync with a 500; the grant is left on record and logged.
- The explicit-membership flip after auto-mapping now happens after the
  projection, keeping the permission-group lock a leaf.
- Request-log prune runs before each pass, so a failing pass still bounds
  the log; contract-validation failures now carry scimType and detail in
  the activity log; `application/scim+json; charset=utf-8`.

Economy: shared helpers replace local copies (postgres error code, SHA-256
base64url, bearer parsing, email syntax, batch reconcile loop); unreachable
defensive checks behind the contracts removed; half-applied base-URL
injection removed from the route builder; casts, restating comments, and
unused exports dropped.

Docs: withdrawal semantics under locking stated precisely; SCIM env vars
added to the self-hosted, SSO, and environment-variable references; group
name uniqueness noted.

Tests: extension URN acceptance and echo, managed-membership guard and its
entitlement bypass, directory-only SSO admission, OAuth suspension,
permissions-route guard, settle step ordering, and the weak assertions
the audit flagged strengthened.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DGXcwsHzYGp6pUDWRtJKpz

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/scim.mdx

@@ -133,9 +133,11 @@ Mapping a permission group to a directory group switches that permission group t
 
 ## How access is withdrawn
 
-Sim records every grant it makes on your behalf. When someone leaves a group, only what the directory granted is taken back — access a workspace administrator granted by hand stays.
+Sim records every grant it makes on your behalf. When someone leaves a group, what the directory granted is taken back.
 
-The one exception is **managed membership locking**, which is on by default. With it on, the directory is the source of truth: Sim refuses invitations, workspace grants, and role changes for provisioned members, because the next sync would revert them anyway. Removals stay possible so an administrator can always act in an emergency. Turn it off if you want to layer manual access on top of directory access.
+**Managed membership locking**, on by default, makes the directory the source of truth for provisioned members: Sim refuses invitations, workspace grants, workspace role changes, and organization role changes for them, because the next sync would revert them anyway. Access a member already held by hand when a mapping started covering it counts as directory access from then on, so it is withdrawn with the mapping. Removals stay possible so an administrator can always act in an emergency.
+
+With locking off, manual access layers on top of directory access: access granted by hand stays when a group is left, and a workspace role raised by hand above what the directory set is left alone.
 
 ## Provisioning and SSO together
 
@@ -156,7 +158,8 @@ Sim also re-applies every group mapping once an hour, so drift cannot persist. Y
 - Resources: `/Users`, `/Groups`, plus `/ServiceProviderConfig`, `/ResourceTypes`, and `/Schemas`
 - Filters: `eq` only, up to ten terms joined with `and`. Users: `id`, `userName`, `externalId`, `emails.value` (also `emails[type eq "work"].value`), `active`. Groups: `id`, `displayName`, `externalId`
 - Limits: 1,500 requests per minute per connection, 1 MB per request, 5,000 members per group
-- `userName` is stored and returned lower-cased; attributes Sim does not model are kept and returned as sent, and a PUT preserves ones it omits
+- `userName` is stored and returned lower-cased; top-level attributes and schema extensions Sim does not model (custom attributes included) are kept and returned as sent, and a PUT preserves ones it omits
+- Group display names are unique within a connection, ignoring case
 - Page size: up to 100 per request
 
 <FAQ items={[

apps/docs/content/docs/platform/enterprise/self-hosted.mdx

@@ -48,6 +48,7 @@ Three features do not need a flag at all: **custom branding**, **session policie
 | Organizations | `ORGANIZATIONS_ENABLED` | `NEXT_PUBLIC_ORGANIZATIONS_ENABLED` |
 | Permission groups | `ACCESS_CONTROL_ENABLED` | `NEXT_PUBLIC_ACCESS_CONTROL_ENABLED` |
 | SAML and OIDC sign-in | `SSO_ENABLED` | `NEXT_PUBLIC_SSO_ENABLED` |
+| Directory provisioning (SCIM) | `SCIM_ENABLED` | `NEXT_PUBLIC_SCIM_ENABLED` |
 | Custom branding — on by default | `WHITELABELING_ENABLED` | `NEXT_PUBLIC_WHITELABELING_ENABLED` |
 | Audit logs | `AUDIT_LOGS_ENABLED` | `NEXT_PUBLIC_AUDIT_LOGS_ENABLED` |
 | Usage tracking | `USAGE_MONITORING_ENABLED` | `NEXT_PUBLIC_USAGE_MONITORING_ENABLED` |

apps/docs/content/docs/platform/enterprise/sso.mdx

@@ -342,6 +342,10 @@ Self-hosted deployments use environment variables instead of the billing/plan ch
 SSO_ENABLED=true
 NEXT_PUBLIC_SSO_ENABLED=true
 
+# Optional: directory provisioning (SCIM), configured from the SSO settings page
+SCIM_ENABLED=true
+NEXT_PUBLIC_SCIM_ENABLED=true
+
 # Required if you want users auto-added to your organization on first SSO sign-in
 ORGANIZATIONS_ENABLED=true
 NEXT_PUBLIC_ORGANIZATIONS_ENABLED=true

apps/docs/content/docs/platform/self-hosting/environment-variables.mdx

@@ -251,6 +251,7 @@ Enterprise features are unlocked by configuration rather than billing on self-ho
 |----------|-------------|
 | `ENTERPRISE_ENABLED`, `NEXT_PUBLIC_ENTERPRISE_ENABLED` | Enable the whole enterprise feature set |
 | `SSO_ENABLED`, `NEXT_PUBLIC_SSO_ENABLED` | Enable SAML and OIDC single sign-on on its own. See [Authentication](/platform/self-hosting/authentication#sso-saml-and-oidc) |
+| `SCIM_ENABLED`, `NEXT_PUBLIC_SCIM_ENABLED` | Enable directory provisioning on its own. Needs SSO. See [Directory provisioning](/platform/enterprise/scim) |
 | `INSTANCE_ORG_NAME` | Name of the organization every user joins automatically at signup |
 | `INSTANCE_ORG_SLUG` | Slug for that organization (derived from the name when omitted) |
 | `INSTANCE_ORG_OWNER_EMAIL` | Owner of that organization (defaults to the first user to sign up) |

apps/sim/app/api/cron/scim-reconcile/route.ts

@@ -1,5 +1,5 @@
 import { createLogger } from '@sim/logger'
-import { toError } from '@sim/utils/errors'
+import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
 import { verifyCronAuth } from '@/lib/auth/internal'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -25,7 +25,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     logger.info('SCIM reconciliation sweep complete', sweep)
     return NextResponse.json({ success: true, ...sweep })
   } catch (error) {
-    logger.error('SCIM reconciliation sweep failed', { error: toError(error).message })
+    logger.error('SCIM reconciliation sweep failed', { error: getErrorMessage(error) })
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
   }
 })

apps/sim/app/api/scim/v2/Groups/[id]/route.ts

@@ -10,7 +10,7 @@ import {
   patchScimGroup,
   replaceScimGroup,
 } from '@/ee/scim/lib/application/groups/manage-groups'
-import { assertGroupSchemas, toCanonicalGroup } from '@/ee/scim/lib/protocol/canonical'
+import { toCanonicalGroup } from '@/ee/scim/lib/protocol/canonical'
 import { parseAttributeProjection } from '@/ee/scim/lib/protocol/resources'
 import { defineScimRoute } from '@/ee/scim/lib/route'
 
@@ -32,7 +32,6 @@ export const PUT = defineScimRoute({
   operation: replaceScimGroup.operation,
   useCase: replaceScimGroup,
   mapInput: ({ params, body }) => {
-    assertGroupSchemas(body.schemas)
     return { groupId: params.id, group: toCanonicalGroup(body) }
   },
   present: (result) => result.resource,

apps/sim/app/api/scim/v2/Groups/route.ts

@@ -1,6 +1,6 @@
 import { createScimGroupContract, listScimGroupsContract } from '@/lib/api/contracts/scim'
 import { createScimGroup, listScimGroups } from '@/ee/scim/lib/application/groups/manage-groups'
-import { assertGroupSchemas, toCanonicalGroup } from '@/ee/scim/lib/protocol/canonical'
+import { toCanonicalGroup } from '@/ee/scim/lib/protocol/canonical'
 import { parseAttributeProjection, toListResponse } from '@/ee/scim/lib/protocol/resources'
 import { defineScimRoute } from '@/ee/scim/lib/route'
 
@@ -24,7 +24,6 @@ export const POST = defineScimRoute({
   operation: createScimGroup.operation,
   useCase: createScimGroup,
   mapInput: ({ body }) => {
-    assertGroupSchemas(body.schemas)
     return { group: toCanonicalGroup(body) }
   },
   present: (result) => result.resource,

apps/sim/app/api/scim/v2/Users/[id]/route.ts

@@ -7,7 +7,7 @@ import {
 import { deprovisionScimUser } from '@/ee/scim/lib/application/users/deprovision-user'
 import { getScimUser } from '@/ee/scim/lib/application/users/read-users'
 import { patchScimUser, replaceScimUser } from '@/ee/scim/lib/application/users/update-user'
-import { assertUserSchemas, toCanonicalUser } from '@/ee/scim/lib/protocol/canonical'
+import { toCanonicalUser } from '@/ee/scim/lib/protocol/canonical'
 import { parseAttributeProjection } from '@/ee/scim/lib/protocol/resources'
 import { defineScimRoute } from '@/ee/scim/lib/route'
 
@@ -29,7 +29,6 @@ export const PUT = defineScimRoute({
   operation: replaceScimUser.operation,
   useCase: replaceScimUser,
   mapInput: ({ params, body }) => {
-    assertUserSchemas(body.schemas)
     return { scimUserId: params.id, attributes: toCanonicalUser(body) }
   },
   present: (result) => result.resource,

apps/sim/app/api/scim/v2/Users/route.ts

@@ -1,7 +1,7 @@
 import { createScimUserContract, listScimUsersContract } from '@/lib/api/contracts/scim'
 import { provisionScimUser } from '@/ee/scim/lib/application/users/provision-user'
 import { listScimUsers } from '@/ee/scim/lib/application/users/read-users'
-import { assertUserSchemas, toCanonicalUser } from '@/ee/scim/lib/protocol/canonical'
+import { toCanonicalUser } from '@/ee/scim/lib/protocol/canonical'
 import { parseAttributeProjection, toListResponse } from '@/ee/scim/lib/protocol/resources'
 import { defineScimRoute } from '@/ee/scim/lib/route'
 
@@ -31,7 +31,6 @@ export const POST = defineScimRoute({
   operation: provisionScimUser.operation,
   useCase: provisionScimUser,
   mapInput: ({ body }) => {
-    assertUserSchemas(body.schemas)
     return { attributes: toCanonicalUser(body) }
   },
   present: (result) => result.resource,

apps/sim/app/api/workspaces/[id]/permissions/route.test.ts

@@ -16,9 +16,18 @@ import {
 } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockSyncWorkspaceEnvCredentials, mockGetEffectiveWorkspacePermission } = vi.hoisted(() => ({
+const {
+  mockSyncWorkspaceEnvCredentials,
+  mockGetEffectiveWorkspacePermission,
+  mockAssertMembershipNotScimManaged,
+} = vi.hoisted(() => ({
   mockSyncWorkspaceEnvCredentials: vi.fn(),
   mockGetEffectiveWorkspacePermission: vi.fn(),
+  mockAssertMembershipNotScimManaged: vi.fn(),
+}))
+
+vi.mock('@/ee/scim/lib/managed-membership', () => ({
+  assertMembershipNotScimManaged: mockAssertMembershipNotScimManaged,
 }))
 
 vi.mock('@sim/audit', () => auditMock)
@@ -37,6 +46,7 @@ vi.mock('@/lib/workspaces/permissions/utils', () => ({
   getEffectiveWorkspacePermission: mockGetEffectiveWorkspacePermission,
 }))
 
+import { ForbiddenOperationError } from '@/lib/core/application'
 import { PATCH } from '@/app/api/workspaces/[id]/permissions/route'
 
 const mockGetSession = authMockFns.mockGetSession
@@ -558,6 +568,37 @@ describe('workspace permissions route', () => {
       })
     })
 
+    it('refuses a role change for a member the directory manages', async () => {
+      queueOrgWorkspace([], [permissionRow(MEMBER_ID, 'read')])
+      mockAssertMembershipNotScimManaged.mockRejectedValueOnce(
+        new ForbiddenOperationError('SCIM_MANAGED_MEMBERSHIP', 'Managed by the directory')
+      )
+
+      const response = await PATCH(
+        createMockRequest('PATCH', { updates: [{ userId: MEMBER_ID, permissions: 'write' }] }),
+        routeContext
+      )
+
+      expect(response.status).toBe(403)
+      await expect(response.json()).resolves.toMatchObject({ error: 'Managed by the directory' })
+      expect(mockAssertMembershipNotScimManaged).toHaveBeenCalledWith(
+        expect.objectContaining({ organizationId: ORG_ID, userId: MEMBER_ID })
+      )
+      expect(dbChainMockFns.update).not.toHaveBeenCalled()
+    })
+
+    it('does not consult the directory for a personal workspace', async () => {
+      queuePersonalWorkspace([permissionRow(ADMIN_ID, 'admin'), permissionRow(MEMBER_ID, 'read')])
+      dbChainMockFns.returning.mockResolvedValue([{ id: 'perm-1' }])
+
+      await PATCH(
+        createMockRequest('PATCH', { updates: [{ userId: MEMBER_ID, permissions: 'write' }] }),
+        routeContext
+      )
+
+      expect(mockAssertMembershipNotScimManaged).not.toHaveBeenCalled()
+    })
+
     it('refuses to change the role of an organization admin', async () => {
       queueOrgWorkspace([{ userId: MEMBER_ID }], [permissionRow(MEMBER_ID, 'admin')])