disallow provisioned users creating organizations

Author: n1ru4l

integration-tests/tests/api/auth/scim.spec.ts

@@ -3372,49 +3372,6 @@ test.concurrent('user cannot login via OIDC if SCIM user provisioning is require
   invariant(signInUpResult.type === 'success', 'Expected sign in/up to succeed.');
 });
 
-test.concurrent('provisioned user cannot update their profile via GraphQL', async ({ expect }) => {
-  const seed = initSeed();
-  const owner = await seed.createOwner();
-  const org = await owner.createOrg();
-  const oidc = await org.createOIDCIntegration();
-  const oidcMock = await oidc.createMockServerAndUpdateIntegrationEndpoints();
-  const domain = await oidc.registerFakeDomain();
-  const accessToken = await org.createOrganizationAccessToken({
-    permissions: ['member:describe', 'member:modify'],
-    resources: { mode: ResourceAssignmentModeType.Granular },
-  });
-  const scim = createScimTestkit({
-    baseUrl,
-    headers: {
-      'Content-Type': 'application/scim+json',
-      Authorization: `Bearer ${accessToken.privateAccessKey}`,
-    },
-  });
-  const email = `profile@${domain}`;
-  const externalId = crypto.randomUUID();
-
-  await scim.createUser({
-    externalId,
-    emails: [{ primary: true, type: 'work', value: email }],
-    userName: email,
-  });
-
-  oidcMock.setUser({ email, userIdClaim: externalId });
-  const auth = await oidcMock.runGetAuthorizationUrl();
-  const signInResult = await oidcMock.runSignInUp({ state: auth.state });
-  invariant(signInResult.type === 'success', 'Expected sign in to succeed.');
-
-  const result = await updateMe(
-    {
-      displayName: 'updated-display-name',
-      fullName: 'Updated Full Name',
-    },
-    signInResult.accessToken,
-  ).then(r => r.expectNoGraphQLErrors());
-  expect(result.updateMe.ok).toEqual(null);
-  expect(result.updateMe.error?.message).toEqual('Provisioned users can not be modified.');
-});
-
 test.concurrent(
   'organization admin can still sign in via non-oidc method even if login through the identity provider is enforced',
   async () => {
@@ -4122,3 +4079,95 @@ describe('Personal Access Tokens', () => {
     },
   );
 });
+
+
+test.concurrent('provisioned user cannot update their profile via GraphQL', async ({ expect }) => {
+  const seed = initSeed();
+  const owner = await seed.createOwner();
+  const org = await owner.createOrg();
+  const oidc = await org.createOIDCIntegration();
+  const oidcMock = await oidc.createMockServerAndUpdateIntegrationEndpoints();
+  const domain = await oidc.registerFakeDomain();
+  const accessToken = await org.createOrganizationAccessToken({
+    permissions: ['member:describe', 'member:modify'],
+    resources: { mode: ResourceAssignmentModeType.Granular },
+  });
+  const scim = createScimTestkit({
+    baseUrl,
+    headers: {
+      'Content-Type': 'application/scim+json',
+      Authorization: `Bearer ${accessToken.privateAccessKey}`,
+    },
+  });
+  const email = `profile@${domain}`;
+  const externalId = crypto.randomUUID();
+
+  await scim.createUser({
+    externalId,
+    emails: [{ primary: true, type: 'work', value: email }],
+    userName: email,
+  });
+
+  oidcMock.setUser({ email, userIdClaim: externalId });
+  const auth = await oidcMock.runGetAuthorizationUrl();
+  const signInResult = await oidcMock.runSignInUp({ state: auth.state });
+  invariant(signInResult.type === 'success', 'Expected sign in to succeed.');
+
+  const result = await updateMe(
+    {
+      displayName: 'updated-display-name',
+      fullName: 'Updated Full Name',
+    },
+    signInResult.accessToken,
+  ).then(r => r.expectNoGraphQLErrors());
+  expect(result.updateMe.ok).toEqual(null);
+  expect(result.updateMe.error?.message).toEqual('Provisioned users can not be modified.');
+});
+
+test.concurrent('provisioned user cannot create an organization', async ({ expect }) => {
+  const seed = initSeed();
+  const owner = await seed.createOwner();
+  const org = await owner.createOrg();
+  const oidc = await org.createOIDCIntegration();
+  const oidcMock = await oidc.createMockServerAndUpdateIntegrationEndpoints();
+  const domain = await oidc.registerFakeDomain();
+  const accessToken = await org.createOrganizationAccessToken({
+    permissions: ['member:describe', 'member:modify'],
+    resources: { mode: ResourceAssignmentModeType.Granular },
+  });
+  const scim = createScimTestkit({
+    baseUrl,
+    headers: {
+      'Content-Type': 'application/scim+json',
+      Authorization: `Bearer ${accessToken.privateAccessKey}`,
+    },
+  });
+  const email = `create-organization@${domain}`;
+  const externalId = crypto.randomUUID();
+
+  await scim.createUser({
+    externalId,
+    emails: [{ primary: true, type: 'work', value: email }],
+    userName: email,
+  });
+
+  oidcMock.setUser({ email, userIdClaim: externalId });
+  const auth = await oidcMock.runGetAuthorizationUrl();
+  const signInResult = await oidcMock.runSignInUp({ state: auth.state });
+  invariant(signInResult.type === 'success', 'Expected sign in to succeed.');
+
+  const slug = `scim-${crypto.randomUUID()}`;
+  const result = await createOrganization({ slug }, signInResult.accessToken).then(response =>
+    response.expectNoGraphQLErrors(),
+  );
+
+  expect(result.createOrganization).toEqual({
+    ok: null,
+    error: {
+      message: 'Provisioned users can not create organizations.',
+      inputErrors: {
+        slug: null,
+      },
+    },
+  });
+});

packages/services/api/src/modules/organization/providers/organization-manager.ts

@@ -320,11 +320,19 @@ export class OrganizationManager {
     user: {
       id: string;
       superTokensUserId: string | null;
+      provisionedByOrganizationId: string | null;
     };
   }) {
     const { slug, user } = input;
     this.logger.info('Creating an organization (input=%o)', input);
 
+    if (user.provisionedByOrganizationId !== null) {
+      return {
+        ok: false as const,
+        message: 'Provisioned users can not create organizations.',
+      };
+    }
+
     const result = await this.storage.createOrganization({
       slug,
       userId: user.id,