scim opt-in via feature flag

Author: n1ru4l

e2e/fixtures.ts

@@ -41,6 +41,7 @@ async function createSeedHelper(): Promise<SeedHelper> {
     async seedOrg() {
       const owner = await seed.createOwner();
       const org = await owner.createOrg();
+      await org.setFeatureFlag('scim', true);
 
       return {
         slug: org.organization.slug,

integration-tests/tests/api/auth/scim.spec.ts

@@ -656,6 +656,28 @@ describe('restrictions', () => {
     return result.createOIDCIntegration.ok!.createdOIDCIntegration.id;
   }
 
+  test.concurrent(
+    'SCIM provisioning requires the organization feature flag',
+    async ({ expect }) => {
+      const { ownerToken, createOrg } = await initSeed().createOwner();
+      const { organization } = await createOrg();
+      const oidcIntegrationId = await configureOIDC({
+        ownerToken,
+        organizationId: organization.id,
+      });
+
+      const result = await updateOIDCRestrictions(
+        { oidcIntegrationId, userProvisioningRequired: true },
+        ownerToken,
+      ).then(r => r.expectNoGraphQLErrors());
+
+      expect(result.updateOIDCRestrictions).toEqual({
+        ok: null,
+        error: { message: 'SCIM provisioning is disabled.' },
+      });
+    },
+  );
+
   test.concurrent(
     'users authorized with non-OIDC method cannot join an organization (default)',
     async ({ expect }) => {

integration-tests/tests/api/oidc-integrations/crud.spec.ts

@@ -28,7 +28,7 @@ import {
 } from './modules/integrations/providers/github-integration-manager';
 import { labModule } from './modules/lab';
 import { oidcIntegrationsModule } from './modules/oidc-integrations';
-import { OIDC_INTEGRATIONS_ENABLED } from './modules/oidc-integrations/providers/tokens';
+import { OIDCIntegrationConfig } from './modules/oidc-integrations/providers/oidc-integration-config';
 import { operationsModule } from './modules/operations';
 import { CLICKHOUSE_CONFIG, ClickHouseConfig } from './modules/operations/providers/tokens';
 import { OTEL_TRACING_ENABLED } from './modules/operations/providers/traces';
@@ -114,7 +114,7 @@ export function createRegistry({
   encryptionSecret,
   schemaConfig,
   supportConfig,
-  organizationOIDC,
+  oidcIntegrationConfig,
   pubSub,
   appDeploymentsEnabled,
   schemaProposalsEnabled,
@@ -157,7 +157,7 @@ export function createRegistry({
   } | null;
   schemaConfig: SchemaModuleConfig;
   supportConfig: SupportConfig | null;
-  organizationOIDC: boolean;
+  oidcIntegrationConfig: OIDCIntegrationConfig;
   pubSub: HivePubSub;
   appDeploymentsEnabled: boolean;
   schemaProposalsEnabled: boolean;
@@ -265,8 +265,8 @@ export function createRegistry({
       scope: Scope.Singleton,
     },
     {
-      provide: OIDC_INTEGRATIONS_ENABLED,
-      useValue: organizationOIDC,
+      provide: OIDCIntegrationConfig,
+      useValue: oidcIntegrationConfig,
       scope: Scope.Singleton,
     },
     {

packages/services/api/src/create.ts

@@ -3,6 +3,7 @@ import { gql } from 'graphql-modules';
 export default gql`
   extend type Organization {
     viewerCanManageOIDCIntegration: Boolean!
+    viewerCanManageSCIM: Boolean!
     oidcIntegration: OIDCIntegration
   }
 

packages/services/api/src/modules/oidc-integrations/module.graphql.ts

@@ -0,0 +1,11 @@
+import { Injectable } from 'graphql-modules';
+
+@Injectable()
+export class OIDCIntegrationConfig {
+  constructor(
+    /** Whether OIDC integrations are enabled. */
+    public readonly isEnabled: boolean,
+    /** Whether SCIM provisioning is globally enabled. */
+    public readonly isSCIMEnabled: boolean,
+  ) {}
+}

packages/services/api/src/modules/oidc-integrations/providers/oidc-integration-config.ts

@@ -3,7 +3,7 @@ import { Inject, Injectable, Scope } from 'graphql-modules';
 import zod from 'zod';
 import { maskToken } from '@hive/service-common';
 import * as GraphQLSchema from '../../../__generated__/types';
-import { OIDCIntegration } from '../../../shared/entities';
+import { OIDCIntegration, Organization } from '../../../shared/entities';
 import { HiveError } from '../../../shared/errors';
 import { AuditLogRecorder } from '../../audit-logs/providers/audit-log-recorder';
 import { Session } from '../../auth/lib/authz';
@@ -13,8 +13,8 @@ import { CryptoProvider } from '../../shared/providers/crypto';
 import { Logger } from '../../shared/providers/logger';
 import { PUB_SUB_CONFIG, type HivePubSub } from '../../shared/providers/pub-sub';
 import { Storage } from '../../shared/providers/storage';
+import { OIDCIntegrationConfig } from './oidc-integration-config';
 import { OIDCIntegrationDomain, OIDCIntegrationStore } from './oidc-integration.store';
-import { OIDC_INTEGRATIONS_ENABLED } from './tokens';
 
 const dnsList = [
   // Google
@@ -38,7 +38,7 @@ export class OIDCIntegrationsProvider {
     private crypto: CryptoProvider,
     private auditLog: AuditLogRecorder,
     @Inject(PUB_SUB_CONFIG) private pubSub: HivePubSub,
-    @Inject(OIDC_INTEGRATIONS_ENABLED) private enabled: boolean,
+    private oidcIntegrationConfig: OIDCIntegrationConfig,
     private session: Session,
     private resourceAssignments: ResourceAssignments,
     private oidcIntegrationStore: OIDCIntegrationStore,
@@ -47,7 +47,7 @@ export class OIDCIntegrationsProvider {
   }
 
   isEnabled() {
-    return this.enabled;
+    return this.oidcIntegrationConfig.isEnabled;
   }
 
   async canViewerManageIntegrationForOrganization(organizationId: string) {
@@ -64,6 +64,13 @@ export class OIDCIntegrationsProvider {
     });
   }
 
+  async canViewerManageSCIMForOrganization(organization: Organization) {
+    return (
+      (await this.canViewerManageIntegrationForOrganization(organization.id)) &&
+      (organization.featureFlags.scim || this.oidcIntegrationConfig.isSCIMEnabled)
+    );
+  }
+
   async getOIDCIntegrationForOrganization(args: {
     organizationId: string;
     skipAccessCheck?: boolean;
@@ -416,6 +423,19 @@ export class OIDCIntegrationsProvider {
       },
     });
 
+    if (args.userProvisioningRequired === true) {
+      const organization = await this.storage.getOrganization({
+        organizationId: oidcIntegration.linkedOrganizationId,
+      });
+
+      if (!organization.featureFlags.scim) {
+        return {
+          type: 'error',
+          message: 'SCIM provisioning is disabled.',
+        } as const;
+      }
+    }
+
     return {
       type: 'ok',
       oidcIntegration: await this.storage.updateOIDCRestrictions(args),

packages/services/api/src/modules/oidc-integrations/providers/oidc-integrations.provider.ts

@@ -3,7 +3,7 @@ import type { OrganizationResolvers } from './../../../__generated__/types';
 
 export const Organization: Pick<
   OrganizationResolvers,
-  'oidcIntegration' | 'viewerCanManageOIDCIntegration'
+  'oidcIntegration' | 'viewerCanManageOIDCIntegration' | 'viewerCanManageSCIM'
 > = {
   oidcIntegration: async (organization, _, { injector }) => {
     if (injector.get(OIDCIntegrationsProvider).isEnabled() === false) {
@@ -19,4 +19,7 @@ export const Organization: Pick<
       .get(OIDCIntegrationsProvider)
       .canViewerManageIntegrationForOrganization(organization.id);
   },
+  viewerCanManageSCIM(organization, _, { injector }) {
+    return injector.get(OIDCIntegrationsProvider).canViewerManageSCIMForOrganization(organization);
+  },
 };

packages/services/api/src/modules/oidc-integrations/providers/tokens.ts

@@ -1000,7 +1000,8 @@ export class OrganizationAccessTokens {
     return (id: Permission) =>
       (!isAppDeploymentsEnabled && id.startsWith('appDeployment:')) ||
       (!isOTELTracingEnabled && id.startsWith('traces:')) ||
-      (!isSchemaProposalsEnabled && id.startsWith('schemaProposal:'))
+      (!isSchemaProposalsEnabled && id.startsWith('schemaProposal:')) ||
+      (!organization.featureFlags.scim && id.startsWith('scim:provision'))
         ? false
         : true;
   }