feat: Add SCIM V2#2309

Open

Bewinxed wants to merge 101 commits intomasterfrom

bewinxed/add-scim-v2

Commits on Feb 5, 2026

Commits on Feb 6, 2026

fix: harden SCIM cross-provider isolation, error handling, and batch queries
Bewinxed
committed
refactor: route all SCIM PATCH paths through filter.ParsePath
Bewinxed
committed
fix: pass ResponseWriter to MaxBytesReader instead of nil
Bewinxed
committed
fix: wrap all raw DB/model errors in SCIMHTTPError types
Bewinxed
committed
fix: map uniqueness violations to 409 in group patch and replace
Bewinxed
committed
fix: validate all member IDs in SetMembers before replacing
Bewinxed
committed
fix: preserve non-not-found errors in SetMembers validation and lock rows
Bewinxed
committed
fix: remove DISTINCT from FOR SHARE query and de-duplicate in Go
Bewinxed
committed
fix: enable SCIM user reactivation for SSO users
Bewinxed
committed
fix: scope SCIM reactivation lookup by provider to prevent cross-provider conflicts
Bewinxed
committed
fix: make SCIM reactivation deterministic by querying all matching SSO users
Bewinxed
committed
fix: return 400 for unsupported SCIM PATCH paths and value types
Bewinxed
committed
fix: log SCIM 5xx errors at Error level and 429 at Warn level
Bewinxed
committed
fix: reject ambiguous reactivation when multiple deprovisioned users exist
Bewinxed
committed
fix: support SCIM PATCH add with explicit path for user attributes
Bewinxed
committed
fix: cap startIndex, use SetEmail in PATCH, map externalId uniqueness to 409, validate filter comparison types
Bewinxed
committed
fix: use SetEmail consistently in SCIM PATCH/PUT and map email uniqueness violations to 409
Bewinxed
committed
fix: enforce provider-scoped email uniqueness in SCIM PUT and PATCH paths
Bewinxed
committed
test: add SCIM email uniqueness regression tests for PUT and PATCH
Bewinxed
committed
fix: fix group member pointer aliasing, group create race, and FlexBool validation
Bewinxed
committed
fix: preserve non-SCIM metadata in PUT and pass IP to audit logs
Bewinxed
committed
fix: stop clearing provider_id on externalId removal and batch group member adds
Bewinxed
committed
fix: normalize active parsing, derive externalId from identity data, cap filter length, exclude members from group list by default
Bewinxed
committed
fix: use identity_data for externalId filter and add row locking to AddMembers
Bewinxed
committed
fix: lock identity rows alongside user rows in group membership validation
Bewinxed
committed
fix: honor active attribute on SCIM user create
Bewinxed
committed
fix: check non-SSO email collisions, sync sub on externalId change, generic group error
Bewinxed
committed
fix: default members in group list, avoid eager loading, make timestamps NOT NULL
Bewinxed
committed

Commits on Feb 7, 2026