Visitar URL original
fix(scim): harden directory lifecycle and clarify group mappings by waleedlatif1 · Pull Request #9429 · simstudioai/sim · GitHub
Skip to content

fix(scim): harden directory lifecycle and clarify group mappings - #9429

Merged
waleedlatif1 merged 2 commits into
stagingfrom
codex/scim-admin-lifecycle-audit
Oct 29, 2026
Merged

fix(scim): harden directory lifecycle and clarify group mappings#9429
waleedlatif1 merged 2 commits into
stagingfrom
codex/scim-admin-lifecycle-audit

Conversation

@waleedlatif1

@waleedlatif1 waleedlatif1 commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • Serialize Chat admission with SCIM suspension, keep stopped runs stopped after reactivation, and revoke OAuth grants on permanent removal.
  • Withdraw stale automatic group mappings after renames and read membership-lock and name-matching settings after acquiring the organization lock.
  • Show automatic mappings and unassigned policy memberships, refresh affected permission caches, correct empty-policy descriptions, explain mapping conflicts and removal consequences, and update the SCIM, Okta, and Entra guides with a current screenshot.

Type of Change

  • Bug fix

Testing

  • Real app HTTP suite: 28 scenarios and 181 requests, including Okta/Entra payload emulation. Real PostgreSQL/Redis integration suite: 68 tests. Regression negative controls fail before each fix.
  • Admin UI: 16 browser checks, including cached member lists after adding and removing a mapping. Documentation: production build, three guides at 12 viewport widths, provider tabs, screenshot viewer, and links.
  • Full repository tests, lint, type-check, all 61 audits, test-type ratchet, artifact generation, and block-registry check pass. Cleanup and test-audit have no remaining findings.
  • This run used provider-shaped requests; it does not establish new live-provider validation or certification. The guides retain the scope and limitations of earlier live tests.

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing (new tests pass the test-audit authoring gate)
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

@vercel

vercel Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs Ready Ready Preview Oct 29, 2026 1:48am UTC

Request Review

cubic-dev-ai[bot]
cubic-dev-ai Bot reviewed Oct 29, 2026
View reviewed changes

@cubic-dev-ai cubic-dev-ai Bot left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 26 files

This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic

Comment thread apps/sim/ee/scim/lib/application/groups/manage-groups.ts Resolved
Comment thread apps/sim/ee/scim/hooks/scim.ts Resolved
Comment thread apps/sim/lib/api/contracts/permission-groups.ts Resolved
@greptile-apps

greptile-apps Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

RetriggerView in GreptileConfidence Score: 5/5

[High impact] The PR appears safe to merge; no blocking issues remain in the reviewed changes.

Summary

Hardens SCIM suspension and removal, fixes automatic mappings after group renames, and makes policy assignments clearer.

  • Suspended members’ active Chat runs stop and stay stopped after reactivation.
  • Permanent SCIM removal revokes the member’s OAuth grants.
  • SCIM group writes and projections follow the latest organization settings.
  • SCIM mapping settings show automatic links and missing policy assignments.
  • SCIM guides explain how provider setup, workspace access, and policy mappings fit together.

Diagram

 
sequenceDiagram
  participant Chat as Chat admission
  participant Account as Account row
  participant SCIM as SCIM suspension
  participant Runs as Chat runs
  Chat->>Account: Take shared lock
  Chat->>Runs: Insert run and check suspension
  Chat->>Account: Commit and release lock
  SCIM->>Account: Set suspension after waiting for admission
  SCIM->>Runs: Record durable Stops
  SCIM->>Account: Commit
  Note over Runs: Reactivation does not clear Stops
Loading

Reviews (2) · Last reviewed commit: "fix(scim): close provisioning races and ..." · Reviewed by Greptile

greptile-apps[bot]
greptile-apps Bot reviewed Oct 29, 2026
View reviewed changes
Comment thread apps/sim/lib/organizations/members/lifecycle.ts Resolved
@waleedlatif1 waleedlatif1 mentioned this pull request Oct 29, 2026
Merged
@waleedlatif1
waleedlatif1 force-pushed the codex/scim-admin-lifecycle-audit branch from 1f1fd73 to f492eef Compare October 29, 2026 01:39
@waleedlatif1

waleedlatif1 commented Oct 29, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@waleedlatif1

waleedlatif1 commented Oct 29, 2026

Copy link
Copy Markdown
Collaborator Author

@cubic-dev-ai review this PR

@cubic-dev-ai

cubic-dev-ai Bot commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai[bot]
cubic-dev-ai Bot reviewed Oct 29, 2026
View reviewed changes

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 30 files

Confidence score: 5/5

  • Automated review surfaced no issues in the provided summaries.
  • No files require special attention.

Turn on auto-fix | Re-trigger cubic

@waleedlatif1
waleedlatif1 merged commit 31f7529 into staging Oct 29, 2026
128 of 131 checks passed
@waleedlatif1
waleedlatif1 deleted the codex/scim-admin-lifecycle-audit branch October 29, 2026 02:01

This branch was successfully deployed

1 active deployment
Preview — f492eef2 Deployed Oct 29, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments
@cubic-dev-ai cubic-dev-ai[bot] cubic-dev-ai[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@waleedlatif1