disallow updating user properties via User.updateMe mutation of the user was provisioned via SCIM

Author: n1ru4l

integration-tests/testkit/flow.ts

@@ -2268,3 +2268,26 @@ export function createPersonalAccessToken(
     `),
   });
 }
+
+export function updateMe(input: GraphQLSchema.UpdateMeInput, authToken: string) {
+  return execute({
+    document: graphql(`
+      mutation TestKit_UpdateMeMutation($input: UpdateMeInput!) {
+        updateMe(input: $input) {
+          error {
+            message
+          }
+          ok {
+            updatedUser {
+              id
+              displayName
+              fullName
+            }
+          }
+        }
+      }
+    `),
+    variables: { input },
+    authToken,
+  });
+}

integration-tests/tests/api/auth/scim.spec.ts

@@ -2,8 +2,10 @@ import humanId from 'human-id';
 import {
   addGroupMappingToGroup,
   createMemberRole,
+  createOrganization,
   createPersonalAccessToken,
   readProjectInfo,
+  updateMe,
   updateMemberRole,
 } from 'testkit/flow';
 import { ResourceAssignmentModeType } from 'testkit/gql/graphql';
@@ -3370,6 +3372,49 @@ test.concurrent('user cannot login via OIDC if SCIM user provisioning is require
   invariant(signInUpResult.type === 'success', 'Expected sign in/up to succeed.');
 });
 
+test.concurrent('provisioned user cannot update their profile via GraphQL', async ({ expect }) => {
+  const seed = initSeed();
+  const owner = await seed.createOwner();
+  const org = await owner.createOrg();
+  const oidc = await org.createOIDCIntegration();
+  const oidcMock = await oidc.createMockServerAndUpdateIntegrationEndpoints();
+  const domain = await oidc.registerFakeDomain();
+  const accessToken = await org.createOrganizationAccessToken({
+    permissions: ['member:describe', 'member:modify'],
+    resources: { mode: ResourceAssignmentModeType.Granular },
+  });
+  const scim = createScimTestkit({
+    baseUrl,
+    headers: {
+      'Content-Type': 'application/scim+json',
+      Authorization: `Bearer ${accessToken.privateAccessKey}`,
+    },
+  });
+  const email = `profile@${domain}`;
+  const externalId = crypto.randomUUID();
+
+  await scim.createUser({
+    externalId,
+    emails: [{ primary: true, type: 'work', value: email }],
+    userName: email,
+  });
+
+  oidcMock.setUser({ email, userIdClaim: externalId });
+  const auth = await oidcMock.runGetAuthorizationUrl();
+  const signInResult = await oidcMock.runSignInUp({ state: auth.state });
+  invariant(signInResult.type === 'success', 'Expected sign in to succeed.');
+
+  const result = await updateMe(
+    {
+      displayName: 'updated-display-name',
+      fullName: 'Updated Full Name',
+    },
+    signInResult.accessToken,
+  ).then(r => r.expectNoGraphQLErrors());
+  expect(result.updateMe.ok).toEqual(null);
+  expect(result.updateMe.error?.message).toEqual('Provisioned users can not be modified.');
+});
+
 test.concurrent(
   'organization admin can still sign in via non-oidc method even if login through the identity provider is enforced',
   async () => {

integration-tests/tests/api/user.spec.ts

@@ -1,37 +1,16 @@
-import { graphql } from 'testkit/gql';
-import { execute } from 'testkit/graphql';
+import { updateMe } from 'testkit/flow';
 import { initSeed } from 'testkit/seed';
 
-const UpdateMeMutation = graphql(`
-  mutation UsersSpecUpdateMe($input: UpdateMeInput!) {
-    updateMe(input: $input) {
-      error {
-        message
-      }
-      ok {
-        updatedUser {
-          id
-          displayName
-          fullName
-        }
-      }
-    }
-  }
-`);
-
 test('can update full name and display name', async () => {
   const { ownerToken } = await initSeed().createOwner();
 
-  const result = await execute({
-    document: UpdateMeMutation,
-    variables: {
-      input: {
-        displayName: 'vegapunk',
-        fullName: 'Vincent Vega',
-      },
+  const result = await updateMe(
+    {
+      displayName: 'vegapunk',
+      fullName: 'Vincent Vega',
     },
-    authToken: ownerToken,
-  }).then(res => res.expectNoGraphQLErrors());
+    ownerToken,
+  ).then(res => res.expectNoGraphQLErrors());
 
   expect(result).toEqual({
     updateMe: {

packages/services/api/src/modules/auth/providers/auth-manager.ts

@@ -1,11 +1,11 @@
 import DataLoader from 'dataloader';
 import { Injectable, Scope } from 'graphql-modules';
-import type { User } from '../../../shared/entities';
+import { z } from 'zod';
 import { AccessError } from '../../../shared/errors';
 import { Storage } from '../../shared/providers/storage';
 import { Session } from '../lib/authz';
 import { OrganizationAccessScope, ProjectAccessScope, TargetAccessScope } from './scopes';
-import { UserManager } from './user-manager';
+import { displayNameLengthBoundaries, fullNameLengthBoundaries, UserManager } from './user-manager';
 
 export interface OrganizationAccessSelector {
   organizationId: string;
@@ -93,16 +93,51 @@ export class AuthManager {
     return owner === selector.userId;
   }
 
-  async updateCurrentUser(input: { displayName: string; fullName: string }): Promise<User> {
+  async updateCurrentUser(input: { displayName: string; fullName: string }) {
+    const InputModel = z.object({
+      displayName: z
+        .string()
+        .min(displayNameLengthBoundaries.min)
+        .max(displayNameLengthBoundaries.max),
+      fullName: z.string().min(fullNameLengthBoundaries.min).max(fullNameLengthBoundaries.max),
+    });
+    const result = InputModel.safeParse(input);
+
+    if (!result.success) {
+      return {
+        type: 'error' as const,
+        error: {
+          message: 'Please check your input.',
+          inputErrors: {
+            displayName: result.error.formErrors.fieldErrors.displayName?.[0],
+            fullName: result.error.formErrors.fieldErrors.fullName?.[0],
+          },
+        },
+      };
+    }
+
     const actor = await this.session.getActor();
     if (actor.type !== 'user') {
       throw new AccessError('Action can only be performed by user.');
     }
 
-    return this.userManager.updateUser({
-      id: actor.user.id,
-      ...input,
-    });
+    if (actor.user.provisionedByOrganizationId !== null) {
+      return {
+        type: 'error' as const,
+        error: {
+          message: 'Provisioned users can not be modified.',
+          inputErrors: {},
+        },
+      };
+    }
+
+    return {
+      type: 'success' as const,
+      user: await this.userManager.updateUser({
+        id: actor.user.id,
+        ...input,
+      }),
+    };
   }
 }
 

packages/services/api/src/modules/auth/resolvers/Mutation/updateMe.ts

@@ -1,42 +1,25 @@
-import { z } from 'zod';
 import { AuthManager } from '../../providers/auth-manager';
-import {
-  displayNameLengthBoundaries,
-  fullNameLengthBoundaries,
-} from '../../providers/user-manager';
 import type { MutationResolvers } from './../../../../__generated__/types';
 
 export const updateMe: NonNullable<MutationResolvers['updateMe']> = async (
   _,
   { input },
   { injector },
 ) => {
-  const InputModel = z.object({
-    displayName: z
-      .string()
-      .min(displayNameLengthBoundaries.min)
-      .max(displayNameLengthBoundaries.max),
-    fullName: z.string().min(fullNameLengthBoundaries.min).max(fullNameLengthBoundaries.max),
-  });
-  const result = InputModel.safeParse(input);
+  const updateResult = await injector.get(AuthManager).updateCurrentUser(input);
 
-  if (!result.success) {
+  if (updateResult.type === 'error') {
     return {
       error: {
-        message: 'Please check your input.',
-        inputErrors: {
-          displayName: result.error.formErrors.fieldErrors.displayName?.[0],
-          fullName: result.error.formErrors.fieldErrors.fullName?.[0],
-        },
+        inputErrors: updateResult.error.inputErrors,
+        message: updateResult.error.message,
       },
     };
   }
 
-  const updatedUser = await injector.get(AuthManager).updateCurrentUser(input);
-
   return {
     ok: {
-      updatedUser,
+      updatedUser: updateResult.user,
     },
   };
 };

packages/services/api/src/modules/oidc-integrations/resolvers/User.ts

@@ -1,5 +1,5 @@
 import type { UserResolvers } from './../../../__generated__/types';
 
 export const User: Pick<UserResolvers, 'canSwitchOrganization'> = {
-  canSwitchOrganization: () => true,
+  canSwitchOrganization: user => user.provisionedByOrganizationId === null,
 };

packages/web/app/src/components/ui/user-menu.tsx

@@ -79,6 +79,9 @@ const UserMenu_MeFragment = graphql(`
     provider
     isAdmin
     canSwitchOrganization
+    provisionInfo {
+      __typename
+    }
   }
 `);
 
@@ -184,14 +187,16 @@ export function UserMenu(props: {
                 </a>
               </DropdownMenuItem>
 
-              <DropdownMenuItem
-                onClick={() => {
-                  toggleUserSettingsModalOpen();
-                }}
-              >
-                <SettingsIcon className="mr-2 size-4" />
-                Profile settings
-              </DropdownMenuItem>
+              {me?.provisionInfo ? null : (
+                <DropdownMenuItem
+                  onClick={() => {
+                    toggleUserSettingsModalOpen();
+                  }}
+                >
+                  <SettingsIcon className="mr-2 size-4" />
+                  Profile settings
+                </DropdownMenuItem>
+              )}
               <DropdownMenuSeparator />
               <ThemeSwitcher />
               <DropdownMenuSeparator />