diff --git a/apps/sim/hooks/queries/organization.test.tsx b/apps/sim/hooks/queries/organization.test.tsx
index 16dfcccad6c..6e5f17644a0 100644
--- a/apps/sim/hooks/queries/organization.test.tsx
+++ b/apps/sim/hooks/queries/organization.test.tsx
@@ -78,6 +78,7 @@ const ROSTER_A: { success: true; data: OrganizationRoster } = {
name: 'Member A',
email: 'member-a@example.com',
image: null,
+ suspendedAt: null,
workspaces: [],
},
],
diff --git a/apps/sim/lib/api-key/service.ts b/apps/sim/lib/api-key/service.ts
index 4520b92f22a..edcee7df2f1 100644
--- a/apps/sim/lib/api-key/service.ts
+++ b/apps/sim/lib/api-key/service.ts
@@ -48,6 +48,7 @@ interface HashCandidate {
type: string
expiresAt: Date | null
userBanned: boolean | null
+ userSuspendedAt: Date | null
}
/**
@@ -84,6 +85,7 @@ export async function authenticateApiKeyFromHeader(
type: apiKeyTable.type,
expiresAt: apiKeyTable.expiresAt,
userBanned: userTable.banned,
+ userSuspendedAt: userTable.suspendedAt,
})
.from(apiKeyTable)
.leftJoin(userTable, eq(apiKeyTable.userId, userTable.id))
@@ -97,6 +99,14 @@ export async function authenticateApiKeyFromHeader(
// Defense in depth: banning deletes a user's keys, but reject any survivor too.
if (record.userBanned) return INVALID
+ /**
+ * A suspension deliberately leaves the account's resources intact, so unlike
+ * a ban it does not delete the keys. Refusing a personal key here is what
+ * ends the member's own machine access. A workspace key is shared and
+ * belongs to the workspace, so one member's suspension does not break it.
+ */
+ if (record.userSuspendedAt && keyType === 'personal') return INVALID
+
if (options.userId && record.userId !== options.userId) return INVALID
if (options.keyTypes?.length && !options.keyTypes.includes(keyType)) return INVALID
if (record.expiresAt && record.expiresAt < new Date()) return INVALID
diff --git a/apps/sim/lib/api/contracts/organization-scim.ts b/apps/sim/lib/api/contracts/organization-scim.ts
new file mode 100644
index 00000000000..e9eb7d34368
--- /dev/null
+++ b/apps/sim/lib/api/contracts/organization-scim.ts
@@ -0,0 +1,200 @@
+import { z } from 'zod'
+import { organizationIdSchema } from '@/lib/api/contracts/primitives'
+import { defineRouteContract } from '@/lib/api/contracts/types'
+
+/**
+ * The settings surface an organization administrator uses to configure directory
+ * provisioning. Ordinary session-authenticated internal routes; the SCIM
+ * protocol surface is separate and lives in `contracts/scim.ts`.
+ */
+
+const organizationParamsSchema = z.object({ id: organizationIdSchema })
+
+const scimScopeSchema = z.enum(['users:read', 'users:write', 'groups:read', 'groups:write'])
+
+export const scimConnectionSettingsSchema = z.object({
+ lockManualMembership: z.boolean().optional(),
+ disableJit: z.boolean().optional(),
+ autoMapPermissionGroupsByName: z.boolean().optional(),
+})
+export type ScimConnectionSettingsInput = z.input
+
+const scimCredentialSchema = z.object({
+ id: z.string(),
+ tokenPrefix: z.string(),
+ scopes: z.array(scimScopeSchema),
+ expiresAt: z.string().nullable(),
+ lastUsedAt: z.string().nullable(),
+ createdAt: z.string(),
+})
+
+const scimConnectionSchema = z.object({
+ id: z.string(),
+ status: z.enum(['active', 'disabled']),
+ baseUrl: z.string(),
+ settings: scimConnectionSettingsSchema,
+ lastRequestAt: z.string().nullable(),
+ reconciledAt: z.string().nullable(),
+ createdAt: z.string(),
+ credentials: z.array(scimCredentialSchema),
+ userCount: z.number().int(),
+ groupCount: z.number().int(),
+})
+
+export const getScimConnectionContract = defineRouteContract({
+ method: 'GET',
+ path: '/api/organizations/[id]/scim',
+ params: organizationParamsSchema,
+ response: {
+ mode: 'json',
+ schema: z.object({ connection: scimConnectionSchema.nullable() }),
+ },
+})
+
+export const configureScimConnectionContract = defineRouteContract({
+ method: 'PUT',
+ path: '/api/organizations/[id]/scim',
+ params: organizationParamsSchema,
+ body: z.object({
+ status: z.enum(['active', 'disabled']).optional(),
+ settings: scimConnectionSettingsSchema.optional(),
+ }),
+ response: { mode: 'json', schema: z.object({ connection: scimConnectionSchema }) },
+})
+
+export const issueScimCredentialContract = defineRouteContract({
+ method: 'POST',
+ path: '/api/organizations/[id]/scim/credentials',
+ params: organizationParamsSchema,
+ body: z.object({
+ /** Days until the credential stops working. Omitted means it does not expire. */
+ expiresInDays: z.number().int().min(1).max(3650).optional(),
+ }),
+ response: {
+ mode: 'json',
+ /** `secret` appears here and nowhere else; only its digest is stored. */
+ schema: z.object({ secret: z.string(), credential: scimCredentialSchema }),
+ status: 201,
+ },
+})
+
+export const revokeScimCredentialContract = defineRouteContract({
+ method: 'DELETE',
+ path: '/api/organizations/[id]/scim/credentials/[credentialId]',
+ params: organizationParamsSchema.extend({ credentialId: z.string().min(1).max(128) }),
+ response: { mode: 'json', schema: z.object({ success: z.literal(true) }) },
+})
+
+const groupMappingSchema = z.object({
+ id: z.string(),
+ groupId: z.string(),
+ groupDisplayName: z.string(),
+ targetKind: z.enum(['permission_group', 'workspace', 'org_role']),
+ permissionGroupId: z.string().nullable(),
+ workspaceId: z.string().nullable(),
+ permissionType: z.enum(['admin', 'write', 'read']).nullable(),
+ role: z.string().nullable(),
+})
+
+export const listScimGroupMappingsContract = defineRouteContract({
+ method: 'GET',
+ path: '/api/organizations/[id]/scim/mappings',
+ params: organizationParamsSchema,
+ response: {
+ mode: 'json',
+ schema: z.object({
+ groups: z.array(
+ z.object({
+ id: z.string(),
+ displayName: z.string(),
+ memberCount: z.number().int(),
+ mappings: z.array(groupMappingSchema),
+ })
+ ),
+ }),
+ },
+})
+
+export const scimGroupMappingBodySchema = z.discriminatedUnion('targetKind', [
+ z.object({
+ groupId: z.string().min(1).max(128),
+ targetKind: z.literal('permission_group'),
+ permissionGroupId: z.string().min(1).max(128),
+ }),
+ z.object({
+ groupId: z.string().min(1).max(128),
+ targetKind: z.literal('workspace'),
+ workspaceId: z.string().min(1).max(128),
+ permissionType: z.enum(['admin', 'write', 'read']),
+ }),
+ z.object({
+ groupId: z.string().min(1).max(128),
+ targetKind: z.literal('org_role'),
+ role: z.literal('admin'),
+ }),
+])
+
+export const upsertScimGroupMappingContract = defineRouteContract({
+ method: 'POST',
+ path: '/api/organizations/[id]/scim/mappings',
+ params: organizationParamsSchema,
+ body: scimGroupMappingBodySchema,
+ response: {
+ mode: 'json',
+ schema: z.object({ mapping: groupMappingSchema, reconciledUsers: z.number().int() }),
+ status: 201,
+ },
+})
+
+export const deleteScimGroupMappingContract = defineRouteContract({
+ method: 'DELETE',
+ path: '/api/organizations/[id]/scim/mappings/[mappingId]',
+ params: organizationParamsSchema.extend({ mappingId: z.string().min(1).max(128) }),
+ response: {
+ mode: 'json',
+ schema: z.object({ success: z.literal(true), reconciledUsers: z.number().int() }),
+ },
+})
+
+const scimActivityEntrySchema = z.object({
+ id: z.string(),
+ method: z.string(),
+ path: z.string(),
+ status: z.number().int(),
+ scimType: z.string().nullable(),
+ detail: z.string().nullable(),
+ userAgent: z.string().nullable(),
+ durationMs: z.number().int(),
+ createdAt: z.string(),
+})
+
+export const listScimActivityContract = defineRouteContract({
+ method: 'GET',
+ path: '/api/organizations/[id]/scim/activity',
+ params: organizationParamsSchema,
+ query: z.object({ limit: z.coerce.number().int().min(1).max(200).optional() }),
+ response: {
+ mode: 'json',
+ schema: z.object({ entries: z.array(scimActivityEntrySchema) }),
+ },
+})
+
+export const reconcileScimConnectionContract = defineRouteContract({
+ method: 'POST',
+ path: '/api/organizations/[id]/scim/reconcile',
+ params: organizationParamsSchema,
+ response: {
+ mode: 'json',
+ schema: z.object({
+ reconciledUsers: z.number().int(),
+ grantsAdded: z.number().int(),
+ grantsRemoved: z.number().int(),
+ }),
+ },
+})
+
+export type ScimGroupMappingBody = z.input
+export type ScimActivityEntry = z.output
+export type ScimConnectionView = z.output
+export type ScimCredentialView = z.output
+export type ScimGroupMappingView = z.output
diff --git a/apps/sim/lib/api/contracts/organization.ts b/apps/sim/lib/api/contracts/organization.ts
index f8cf72bed90..c86bdf21da4 100644
--- a/apps/sim/lib/api/contracts/organization.ts
+++ b/apps/sim/lib/api/contracts/organization.ts
@@ -275,6 +275,8 @@ export const rosterMemberSchema = z.object({
name: z.string(),
email: z.string(),
image: z.string().nullable(),
+ /** Set while a directory deactivation blocks the member's sign-in; access is otherwise intact. */
+ suspendedAt: z.string().nullable(),
workspaces: z.array(rosterWorkspaceAccessSchema),
})
diff --git a/apps/sim/lib/api/contracts/scim.ts b/apps/sim/lib/api/contracts/scim.ts
new file mode 100644
index 00000000000..f5263422e41
--- /dev/null
+++ b/apps/sim/lib/api/contracts/scim.ts
@@ -0,0 +1,347 @@
+import { z } from 'zod'
+import { defineRouteContract } from '@/lib/api/contracts/types'
+import {
+ SCIM_ENTERPRISE_USER_SCHEMA,
+ SCIM_GROUP_SCHEMA,
+ SCIM_LIST_RESPONSE_SCHEMA,
+ SCIM_MAX_GROUP_MEMBERS,
+ SCIM_MAX_PATCH_OPERATIONS,
+ SCIM_PATCH_OP_SCHEMA,
+ SCIM_USER_SCHEMA,
+} from '@/ee/scim/lib/protocol/constants'
+import {
+ canonicalizeAttributeNames,
+ normalizeScimBoolean,
+ stripProviderSchemaMarkers,
+ unwrapSingleElement,
+} from '@/ee/scim/lib/protocol/normalize'
+
+/**
+ * Wire schemas for the SCIM 2.0 surface.
+ *
+ * Inbound shapes are deliberately tolerant. RFC 7643 defines far more than Sim
+ * models, and a provider that sends an attribute this server does not store must
+ * still get its write accepted — so object schemas pass unknown keys through
+ * rather than stripping or rejecting them, and the canonicalizer decides what is
+ * kept. Outbound shapes are strict and drive the route builder's response
+ * validation.
+ */
+
+/** Accepts the string booleans Microsoft Entra's classic provisioning job sends. */
+const scimBoolean = z.preprocess(
+ (value) => normalizeScimBoolean(unwrapSingleElement(value)),
+ z.boolean()
+)
+
+const scimEmailSchema = z.looseObject({
+ value: z.string().trim().min(1, 'An email entry requires a value').max(320),
+ type: z.string().max(64).optional(),
+ primary: scimBoolean.optional(),
+})
+
+const scimNameSchema = z.looseObject({
+ formatted: z.string().max(256).optional(),
+ givenName: z.string().max(128).optional(),
+ familyName: z.string().max(128).optional(),
+})
+
+const scimEnterpriseSchema = z.looseObject({
+ department: z.string().max(256).optional(),
+ employeeNumber: z.string().max(128).optional(),
+ costCenter: z.string().max(128).optional(),
+ division: z.string().max(128).optional(),
+ organization: z.string().max(256).optional(),
+ manager: z
+ .union([
+ z.string().max(256),
+ z.looseObject({
+ value: z.string().max(256).optional(),
+ displayName: z.string().max(256).optional(),
+ }),
+ ])
+ .optional(),
+})
+
+/**
+ * An inbound User.
+ *
+ * `password` is stripped during parsing. Okta sends one on every create even
+ * when password sync is off, and Sim never stores or uses it; dropping it here
+ * keeps the credential out of the parsed request object and therefore out of
+ * every log line and error detail downstream.
+ */
+const USER_WRITE_ATTRIBUTES = [
+ 'schemas',
+ 'userName',
+ 'externalId',
+ 'active',
+ 'displayName',
+ 'name',
+ 'emails',
+ SCIM_ENTERPRISE_USER_SCHEMA,
+] as const
+
+/**
+ * A `schemas` list that declares the resource's core schema. Every extension is
+ * let through: providers declare their own URNs the moment an administrator
+ * adds a custom attribute (Okta `urn:okta::2.0:user:custom`, Entra
+ * `urn:ietf:params:scim:schemas:extension::2.0:User`), and refusing them
+ * would stop the sync at the first write.
+ */
+function scimSchemasDeclaring(core: string) {
+ return z
+ .array(z.string().max(256))
+ .min(1, 'schemas must name at least one URN')
+ .max(10)
+ .refine(
+ (schemas) => stripProviderSchemaMarkers(schemas).includes(core),
+ `schemas must include ${core}`
+ )
+}
+
+export const scimUserWriteSchema = z.preprocess(
+ (body) => canonicalizeAttributeNames(body, USER_WRITE_ATTRIBUTES),
+ z
+ .looseObject({
+ schemas: scimSchemasDeclaring(SCIM_USER_SCHEMA),
+ userName: z.string().trim().min(1, 'userName must not be empty').max(320),
+ externalId: z.string().trim().max(256).optional(),
+ active: scimBoolean.optional(),
+ displayName: z.string().max(256).optional(),
+ name: scimNameSchema.optional(),
+ emails: z.array(scimEmailSchema).max(20).optional(),
+ [SCIM_ENTERPRISE_USER_SCHEMA]: scimEnterpriseSchema.optional(),
+ })
+ .transform(({ password: _password, ...rest }) => rest)
+)
+/** What the route receives after parsing, which is what the canonicalizer reads. */
+export type ScimUserWriteParsed = z.output
+
+const scimGroupMemberSchema = z.looseObject({
+ value: z.string().trim().min(1, 'A group member requires a value').max(256),
+ display: z.string().max(256).optional(),
+ type: z.string().max(64).optional(),
+})
+
+const GROUP_WRITE_ATTRIBUTES = ['schemas', 'displayName', 'externalId', 'members'] as const
+
+export const scimGroupWriteSchema = z.preprocess(
+ (body) => canonicalizeAttributeNames(body, GROUP_WRITE_ATTRIBUTES),
+ z.looseObject({
+ schemas: scimSchemasDeclaring(SCIM_GROUP_SCHEMA),
+ displayName: z.string().trim().min(1, 'displayName must not be empty').max(256),
+ externalId: z.string().trim().max(256).optional(),
+ members: z.array(scimGroupMemberSchema).max(SCIM_MAX_GROUP_MEMBERS).optional(),
+ })
+)
+export type ScimGroupWriteParsed = z.output
+
+/**
+ * A PATCH request body.
+ *
+ * `op` is lower-cased before validation because Entra capitalizes it, and
+ * defaults to `replace` because Okta omits it on the deactivation call that is
+ * the single most important request this server handles.
+ */
+export const scimPatchBodySchema = z.object({
+ schemas: z
+ .array(z.string().max(256))
+ .refine(
+ (schemas) => schemas.includes(SCIM_PATCH_OP_SCHEMA),
+ `schemas must include ${SCIM_PATCH_OP_SCHEMA}`
+ ),
+ Operations: z
+ .array(
+ z.object({
+ op: z
+ .string()
+ .default('replace')
+ .transform((value) => value.trim().toLowerCase())
+ .pipe(z.enum(['add', 'replace', 'remove'])),
+ path: z.string().max(512).optional(),
+ value: z.unknown().optional(),
+ })
+ )
+ .min(1, 'Operations must contain at least one operation')
+ .max(SCIM_MAX_PATCH_OPERATIONS),
+})
+export type ScimPatchBody = z.output
+export type ScimPatchOperation = ScimPatchBody['Operations'][number]
+
+export const scimAttributesQuerySchema = z.object({
+ attributes: z.string().max(1024).optional(),
+ excludedAttributes: z.string().max(1024).optional(),
+})
+
+export const scimListQuerySchema = scimAttributesQuerySchema.extend({
+ filter: z.string().max(2048).optional(),
+ startIndex: z.coerce.number().int().optional(),
+ count: z.coerce.number().int().optional(),
+})
+
+export const scimResourceParamsSchema = z.object({ id: z.string().min(1).max(256) })
+
+const scimMetaSchema = z.object({
+ resourceType: z.enum(['User', 'Group']),
+ created: z.string(),
+ lastModified: z.string(),
+ location: z.string(),
+ version: z.string(),
+})
+
+/**
+ * Only `schemas`, `id`, and `meta` are always present. Every other attribute may
+ * be dropped by `attributes` / `excludedAttributes` (RFC 7644 section 3.9), which
+ * Entra uses on every listing, so the response schema cannot require them.
+ */
+export const scimUserResourceSchema = z.looseObject({
+ schemas: z.array(z.string()),
+ id: z.string(),
+ externalId: z.string().optional(),
+ userName: z.string().optional(),
+ active: z.boolean().optional(),
+ displayName: z.string().optional(),
+ name: z
+ .looseObject({
+ formatted: z.string(),
+ givenName: z.string().optional(),
+ familyName: z.string().optional(),
+ })
+ .optional(),
+ emails: z
+ .array(z.object({ value: z.string(), type: z.string().optional(), primary: z.boolean() }))
+ .optional(),
+ groups: z
+ .array(z.object({ value: z.string(), display: z.string(), $ref: z.string() }))
+ .optional(),
+ meta: scimMetaSchema,
+})
+
+export const scimGroupResourceSchema = z.looseObject({
+ schemas: z.array(z.string()),
+ id: z.string(),
+ externalId: z.string().optional(),
+ displayName: z.string().optional(),
+ members: z
+ .array(
+ z.object({
+ value: z.string(),
+ display: z.string().optional(),
+ $ref: z.string(),
+ type: z.literal('User'),
+ })
+ )
+ .optional(),
+ meta: scimMetaSchema,
+})
+
+function listResponseSchema- (item: Item) {
+ return z.object({
+ schemas: z.tuple([z.literal(SCIM_LIST_RESPONSE_SCHEMA)]),
+ totalResults: z.number().int(),
+ startIndex: z.number().int(),
+ itemsPerPage: z.number().int(),
+ Resources: z.array(item),
+ })
+}
+
+export const listScimUsersContract = defineRouteContract({
+ method: 'GET',
+ path: '/api/scim/v2/Users',
+ query: scimListQuerySchema,
+ response: { mode: 'json', schema: listResponseSchema(scimUserResourceSchema) },
+})
+
+export const createScimUserContract = defineRouteContract({
+ method: 'POST',
+ path: '/api/scim/v2/Users',
+ body: scimUserWriteSchema,
+ response: { mode: 'json', schema: scimUserResourceSchema, status: 201 },
+})
+
+export const getScimUserContract = defineRouteContract({
+ method: 'GET',
+ path: '/api/scim/v2/Users/[id]',
+ params: scimResourceParamsSchema,
+ query: scimAttributesQuerySchema,
+ response: { mode: 'json', schema: scimUserResourceSchema },
+})
+
+export const replaceScimUserContract = defineRouteContract({
+ method: 'PUT',
+ path: '/api/scim/v2/Users/[id]',
+ params: scimResourceParamsSchema,
+ body: scimUserWriteSchema,
+ response: { mode: 'json', schema: scimUserResourceSchema },
+})
+
+/**
+ * Returns the updated resource rather than `204`. Okta documents both as
+ * acceptable and Microsoft's own examples show a body, so the shape that
+ * satisfies both providers is the one that carries the resource.
+ */
+export const patchScimUserContract = defineRouteContract({
+ method: 'PATCH',
+ path: '/api/scim/v2/Users/[id]',
+ params: scimResourceParamsSchema,
+ body: scimPatchBodySchema,
+ response: { mode: 'json', schema: scimUserResourceSchema },
+})
+
+export const deleteScimUserContract = defineRouteContract({
+ method: 'DELETE',
+ path: '/api/scim/v2/Users/[id]',
+ params: scimResourceParamsSchema,
+ response: { mode: 'empty', status: 204 },
+})
+
+export const listScimGroupsContract = defineRouteContract({
+ method: 'GET',
+ path: '/api/scim/v2/Groups',
+ query: scimListQuerySchema,
+ response: { mode: 'json', schema: listResponseSchema(scimGroupResourceSchema) },
+})
+
+export const createScimGroupContract = defineRouteContract({
+ method: 'POST',
+ path: '/api/scim/v2/Groups',
+ body: scimGroupWriteSchema,
+ response: { mode: 'json', schema: scimGroupResourceSchema, status: 201 },
+})
+
+export const getScimGroupContract = defineRouteContract({
+ method: 'GET',
+ path: '/api/scim/v2/Groups/[id]',
+ params: scimResourceParamsSchema,
+ query: scimAttributesQuerySchema,
+ response: { mode: 'json', schema: scimGroupResourceSchema },
+})
+
+export const replaceScimGroupContract = defineRouteContract({
+ method: 'PUT',
+ path: '/api/scim/v2/Groups/[id]',
+ params: scimResourceParamsSchema,
+ body: scimGroupWriteSchema,
+ response: { mode: 'json', schema: scimGroupResourceSchema },
+})
+
+/**
+ * Returns `204`. Microsoft states a group PATCH "should yield an HTTP 204 No
+ * Content" and warns against returning the member list, which for a large
+ * group is the difference between a small response and a thousand-entry one on
+ * every incremental sync.
+ */
+export const patchScimGroupContract = defineRouteContract({
+ method: 'PATCH',
+ path: '/api/scim/v2/Groups/[id]',
+ params: scimResourceParamsSchema,
+ body: scimPatchBodySchema,
+ response: { mode: 'empty', status: 204 },
+})
+
+export const deleteScimGroupContract = defineRouteContract({
+ method: 'DELETE',
+ path: '/api/scim/v2/Groups/[id]',
+ params: scimResourceParamsSchema,
+ response: { mode: 'empty', status: 204 },
+})
diff --git a/apps/sim/lib/api/contracts/workspaces.ts b/apps/sim/lib/api/contracts/workspaces.ts
index 318562ae4bf..242158ab1e9 100644
--- a/apps/sim/lib/api/contracts/workspaces.ts
+++ b/apps/sim/lib/api/contracts/workspaces.ts
@@ -254,6 +254,7 @@ export const deploymentFeaturesSchema = z.object({
dataRetention: z.boolean(),
inbox: z.boolean(),
sandboxes: z.boolean(),
+ scim: z.boolean(),
sessionPolicies: z.boolean(),
sso: z.boolean(),
usageMonitoring: z.boolean(),
diff --git a/apps/sim/lib/api/server/routes/index.ts b/apps/sim/lib/api/server/routes/index.ts
index d19270b906d..e42507d6cc8 100644
--- a/apps/sim/lib/api/server/routes/index.ts
+++ b/apps/sim/lib/api/server/routes/index.ts
@@ -17,6 +17,10 @@ export {
createInternalResourceConcealmentPolicy,
createV2ResourceConcealmentPolicy,
} from '@/lib/api/server/routes/resource-concealment'
+export {
+ createScimRouteBuilder,
+ defineScimDiscoveryRoute,
+} from '@/lib/api/server/routes/scim-route'
export { defineV2BinaryRoute } from '@/lib/api/server/routes/v2-binary-route'
export { defineV2BodyLifecycleRoute } from '@/lib/api/server/routes/v2-body-lifecycle-route'
export {
diff --git a/apps/sim/lib/api/server/routes/scim-route.test.ts b/apps/sim/lib/api/server/routes/scim-route.test.ts
new file mode 100644
index 00000000000..dd2f6611d63
--- /dev/null
+++ b/apps/sim/lib/api/server/routes/scim-route.test.ts
@@ -0,0 +1,197 @@
+/**
+ * @vitest-environment node
+ */
+import { resetEnvFlagsMock, setEnvFlags } from '@sim/testing'
+import { NextRequest } from 'next/server'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+ checkRateLimitDirect: vi.fn(),
+ enforceIpRateLimit: vi.fn(),
+}))
+
+vi.mock('@/ee/scim/lib/base-url', () => ({ scimBaseUrl: () => 'https://sim.test/api/scim/v2' }))
+
+vi.mock('@/lib/core/rate-limiter', () => ({
+ RateLimiter: class {
+ checkRateLimitDirect = mocks.checkRateLimitDirect
+ },
+ enforceIpRateLimit: mocks.enforceIpRateLimit,
+}))
+
+import type { ScimConnectionPrincipal } from '@sim/auth/principal'
+import {
+ createScimUserContract,
+ deleteScimUserContract,
+ listScimUsersContract,
+} from '@/lib/api/contracts/scim'
+import { createScimRouteBuilder } from '@/lib/api/server/routes'
+import { scimOperations } from '@/ee/scim/lib/application/operations'
+import { SCIM_MEDIA_TYPE } from '@/ee/scim/lib/protocol/constants'
+import { ScimError } from '@/ee/scim/lib/protocol/errors'
+
+const principal: ScimConnectionPrincipal = {
+ kind: 'scim_connection',
+ organizationId: 'org-1',
+ connectionId: 'conn-1',
+ credentialId: 'cred-1',
+ scopes: ['users:read', 'users:write'],
+}
+
+const authenticate = vi.fn()
+const recordRequest = vi.fn()
+const defineScimRoute = createScimRouteBuilder({
+ authenticate,
+ recordRequest,
+})
+
+const listUsers = defineScimRoute({
+ contract: listScimUsersContract,
+ operation: scimOperations.listUsers,
+ useCase: { operation: scimOperations.listUsers, execute: vi.fn() },
+ mapInput: () => ({}),
+ present: () => ({
+ schemas: ['urn:ietf:params:scim:api:messages:2.0:ListResponse'],
+ totalResults: 0,
+ startIndex: 1,
+ itemsPerPage: 0,
+ Resources: [],
+ }),
+})
+
+const createUser = defineScimRoute({
+ contract: createScimUserContract,
+ operation: scimOperations.provisionUser,
+ useCase: { operation: scimOperations.provisionUser, execute: vi.fn().mockResolvedValue({}) },
+ mapInput: () => ({}),
+ present: () => ({
+ schemas: ['urn:ietf:params:scim:schemas:core:2.0:User'],
+ id: 'su-1',
+ meta: {
+ resourceType: 'User',
+ created: '2026-01-01T00:00:00.000Z',
+ lastModified: '2026-01-01T00:00:00.000Z',
+ location: 'https://sim.test/api/scim/v2/Users/su-1',
+ version: 'W/"1"',
+ },
+ }),
+ headers: () => ({ Location: 'https://sim.test/api/scim/v2/Users/su-1' }),
+})
+
+const deleteUser = defineScimRoute({
+ contract: deleteScimUserContract,
+ operation: scimOperations.deprovisionUser,
+ useCase: { operation: scimOperations.deprovisionUser, execute: vi.fn().mockResolvedValue({}) },
+ mapInput: () => ({}),
+})
+
+const withParams = { params: Promise.resolve({ id: 'su-1' }) }
+
+function request(method: string, path: string, init: RequestInit = {}) {
+ return new NextRequest(`https://sim.test${path}`, { method, ...init })
+}
+
+afterEach(resetEnvFlagsMock)
+
+describe('SCIM route builder', () => {
+ beforeEach(() => {
+ vi.clearAllMocks()
+ setEnvFlags({ isScimEnabled: true })
+ authenticate.mockResolvedValue(principal)
+ mocks.checkRateLimitDirect.mockResolvedValue({ allowed: true, resetAt: new Date() })
+ mocks.enforceIpRateLimit.mockResolvedValue(null)
+ })
+
+ it('hides the whole surface, wrong method included, when the feature is off', async () => {
+ setEnvFlags({ isScimEnabled: false })
+ const response = await listUsers(request('POST', '/api/scim/v2/Users'), undefined)
+ expect(response.status).toBe(404)
+ expect(authenticate).not.toHaveBeenCalled()
+ })
+
+ it('answers in the SCIM media type with the RFC envelope', async () => {
+ const response = await listUsers(request('GET', '/api/scim/v2/Users'), undefined)
+ expect(response.status).toBe(200)
+ expect(response.headers.get('content-type')).toBe(`${SCIM_MEDIA_TYPE}; charset=utf-8`)
+ expect(recordRequest).toHaveBeenCalledWith(expect.objectContaining({ status: 200, principal }))
+ })
+
+ it('refuses a body without a SCIM or JSON content type before authenticating', async () => {
+ const response = await createUser(
+ request('POST', '/api/scim/v2/Users', {
+ body: '{}',
+ headers: { 'content-type': 'text/plain' },
+ }),
+ undefined
+ )
+ expect(response.status).toBe(415)
+ expect(authenticate).not.toHaveBeenCalled()
+ })
+
+ it('lets DELETE through with no body and no content type, answering 204', async () => {
+ const response = await deleteUser(request('DELETE', '/api/scim/v2/Users/su-1'), withParams)
+ expect(response.status).toBe(204)
+ expect(await response.text()).toBe('')
+ })
+
+ it('adds the Location header on a create', async () => {
+ const response = await createUser(
+ request('POST', '/api/scim/v2/Users', {
+ body: JSON.stringify({
+ schemas: ['urn:ietf:params:scim:schemas:core:2.0:User'],
+ userName: 'ada@acme.test',
+ }),
+ headers: { 'content-type': SCIM_MEDIA_TYPE },
+ }),
+ undefined
+ )
+ expect(response.status).toBe(201)
+ expect(response.headers.get('location')).toBe('https://sim.test/api/scim/v2/Users/su-1')
+ })
+
+ it('renders a parse failure in the SCIM envelope', async () => {
+ const response = await createUser(
+ request('POST', '/api/scim/v2/Users', {
+ body: '{not json',
+ headers: { 'content-type': 'application/json' },
+ }),
+ undefined
+ )
+ expect(response.status).toBe(400)
+ expect(await response.json()).toMatchObject({
+ schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'],
+ status: '400',
+ scimType: 'invalidSyntax',
+ detail: 'Request body is not valid JSON',
+ })
+ })
+
+ it('bounds failed authentication per address and renders 401 with the challenge', async () => {
+ authenticate.mockRejectedValue(
+ new ScimError(401, undefined, 'Invalid SCIM token', {
+ 'WWW-Authenticate': 'Bearer realm="SCIM"',
+ })
+ )
+ const refused = await listUsers(request('GET', '/api/scim/v2/Users'), undefined)
+ expect(refused.status).toBe(401)
+ expect(refused.headers.get('www-authenticate')).toBe('Bearer realm="SCIM"')
+ expect(mocks.enforceIpRateLimit).toHaveBeenCalledWith('scim-auth', expect.anything())
+ expect(recordRequest).not.toHaveBeenCalled()
+
+ mocks.enforceIpRateLimit.mockResolvedValue(new Response(null, { status: 429 }))
+ const limited = await listUsers(request('GET', '/api/scim/v2/Users'), undefined)
+ expect(limited.status).toBe(429)
+ expect(limited.headers.get('retry-after')).toBe('60')
+ })
+
+ it('throttles an authenticated connection with Retry-After', async () => {
+ mocks.checkRateLimitDirect.mockResolvedValue({
+ allowed: false,
+ resetAt: new Date(Date.now() + 5000),
+ })
+ const response = await listUsers(request('GET', '/api/scim/v2/Users'), undefined)
+ expect(response.status).toBe(429)
+ expect(Number(response.headers.get('retry-after'))).toBeGreaterThanOrEqual(1)
+ expect(recordRequest).toHaveBeenCalledWith(expect.objectContaining({ status: 429 }))
+ })
+})
diff --git a/apps/sim/lib/api/server/routes/scim-route.ts b/apps/sim/lib/api/server/routes/scim-route.ts
new file mode 100644
index 00000000000..1b965875110
--- /dev/null
+++ b/apps/sim/lib/api/server/routes/scim-route.ts
@@ -0,0 +1,328 @@
+import type { ScimConnectionPrincipal } from '@sim/auth/principal'
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import type { AnyApiRouteContract, ContractJsonResponse } from '@/lib/api/contracts/types'
+import { type ParsedRequest, parseRequest } from '@/lib/api/server/validation'
+import type { ApplicationOperation, OperationUseCase } from '@/lib/core/application/operation'
+import { enforceIpRateLimit, RateLimiter } from '@/lib/core/rate-limiter'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import type { ScimConnectionAuthenticator } from '@/ee/scim/lib/authenticate'
+import { scimBaseUrl } from '@/ee/scim/lib/base-url'
+import { isScimDeploymentEnabled } from '@/ee/scim/lib/entitlement'
+import {
+ SCIM_ACCEPTED_MEDIA_TYPES,
+ SCIM_MAX_BODY_BYTES,
+ SCIM_MEDIA_TYPE,
+ SCIM_RATE_LIMIT,
+} from '@/ee/scim/lib/protocol/constants'
+import {
+ ScimError,
+ type ScimErrorBody,
+ type ScimType,
+ scimErrorBody,
+ toScimError,
+} from '@/ee/scim/lib/protocol/errors'
+import type { ScimRequestLogEntry } from '@/ee/scim/lib/request-log'
+
+const logger = createLogger('ScimRoute')
+const rateLimiter = new RateLimiter()
+
+/**
+ * The route builder for the SCIM 2.0 surface.
+ *
+ * SCIM cannot use `defineInternalJsonRoute`, and the differences are all
+ * protocol rather than preference: the caller is a bearer credential with no
+ * user and no workspace, the error envelope is RFC 7644's rather than Sim's
+ * `{ error }`, responses must carry `application/scim+json`, `DELETE` and group
+ * `PATCH` answer `204` with no body, and a wrong media type is a `415` before
+ * anything is parsed. This is the documented protocol exception the API rules
+ * allow, and it applies `withRouteHandler` exactly as the internal builder does
+ * so request ids, logging, and abort handling stay identical.
+ */
+
+export interface ScimPresenterContext {
+ baseUrl: string
+}
+
+interface ScimRouteOptions {
+ contract: C
+ operation: O
+ useCase: OperationUseCase, I, R>
+ mapInput(
+ parsed: ParsedRequest,
+ context: { principal: ScimConnectionPrincipal; request: NextRequest }
+ ): I
+ /** Omitted for `204` routes, which have no body to render. */
+ present?(result: NoInfer, context: ScimPresenterContext): ContractJsonResponse
+ /** Extra response headers, such as `Location` on a create. */
+ headers?(result: NoInfer, context: ScimPresenterContext): Record
+}
+
+export interface ScimRouteContext {
+ params?: Promise>
+}
+
+export type ScimNextRouteHandler = (
+ request: NextRequest,
+ context: ScimRouteContext | undefined
+) => Promise | NextResponse | Response
+
+/** Dependencies the builder needs, injected so the module stays testable. */
+interface ScimRouteDependencies {
+ authenticate: ScimConnectionAuthenticator
+ recordRequest(entry: ScimRequestLogEntry): void
+}
+
+function scimResponse(body: unknown, status: number, headers?: Record): Response {
+ return NextResponse.json(body, {
+ status,
+ headers: {
+ 'content-type': `${SCIM_MEDIA_TYPE}; charset=utf-8`,
+ 'cache-control': 'no-store',
+ ...headers,
+ },
+ })
+}
+
+function scimErrorResponse(error: ScimError): Response {
+ return scimResponse(error.body, error.status, error.headers)
+}
+
+const MUTATING_METHODS = new Set(['POST', 'PUT', 'PATCH'])
+
+/**
+ * Requires a SCIM or JSON content type on a body-bearing request.
+ *
+ * `DELETE` is excluded because Okta sends it with no body and no content type,
+ * and Entra sends one with `text/plain`.
+ */
+function assertAcceptableMediaType(request: NextRequest): void {
+ if (!MUTATING_METHODS.has(request.method)) return
+ const header = request.headers.get('content-type')
+ if (!header) throw new ScimError(415, undefined, 'A content type is required')
+ const mediaType = header.split(';')[0]?.trim().toLowerCase()
+ if (!SCIM_ACCEPTED_MEDIA_TYPES.some((accepted) => accepted === mediaType)) {
+ throw new ScimError(
+ 415,
+ undefined,
+ `SCIM requests must use ${SCIM_MEDIA_TYPE} or application/json`
+ )
+ }
+}
+
+/**
+ * Consumes one token from the connection's bucket.
+ *
+ * Keyed by connection rather than by credential, so rotating a token cannot be
+ * used to double the allowance, and never by IP: a provisioning service calls
+ * from a large shared range, where an IP bucket would either be useless or would
+ * throttle unrelated tenants together.
+ */
+async function enforceConnectionRateLimit(principal: ScimConnectionPrincipal): Promise {
+ const { allowed, resetAt } = await rateLimiter.checkRateLimitDirect(
+ `route:scim:connection:${principal.connectionId}`,
+ SCIM_RATE_LIMIT
+ )
+ if (allowed) return
+ const retryAfter = Math.max(1, Math.ceil((resetAt.getTime() - Date.now()) / 1000))
+ throw new ScimError(429, undefined, 'Rate limit exceeded', {
+ 'Retry-After': String(retryAfter),
+ 'X-RateLimit-Reset': resetAt.toISOString(),
+ })
+}
+
+export function createScimRouteBuilder(dependencies: ScimRouteDependencies) {
+ return function defineScimRoute<
+ C extends AnyApiRouteContract,
+ O extends ApplicationOperation,
+ I,
+ R,
+ >(options: ScimRouteOptions): ScimNextRouteHandler {
+ if (options.operation.id !== options.useCase.operation.id) {
+ throw new Error(
+ `Route operation ${options.operation.id} does not match use case ${options.useCase.operation.id}`
+ )
+ }
+ const isEmptyResponse = options.contract.response.mode === 'empty'
+ const present = options.present
+ if (!isEmptyResponse && !present) {
+ throw new Error(`${options.contract.method} ${options.contract.path} requires a presenter`)
+ }
+ const declaredStatus = options.contract.response.status
+ const successStatus =
+ declaredStatus === undefined
+ ? 200
+ : Array.isArray(declaredStatus)
+ ? declaredStatus[0]
+ : declaredStatus
+
+ return withRouteHandler(
+ async (request, context) => {
+ const startedAt = Date.now()
+ let principal: ScimConnectionPrincipal | undefined
+ let status = 500
+ let scimType: ScimType | undefined
+ let detail: string | undefined
+
+ try {
+ if (!isScimDeploymentEnabled()) throw new ScimError(404, undefined, 'Not found')
+ if (request.method !== options.contract.method) {
+ throw new ScimError(405, undefined, `${request.method} is not supported here`)
+ }
+ assertAcceptableMediaType(request)
+
+ /**
+ * Scope is enforced by the use-case wrapper from the operation's own
+ * declaration, so the route cannot disagree with it. The builder only
+ * authenticates and admits.
+ */
+ principal = await dependencies.authenticate(request)
+ await enforceConnectionRateLimit(principal)
+
+ const parsed = await parseRequest(options.contract, request, context ?? {}, {
+ maxBodyBytes: SCIM_MAX_BODY_BYTES,
+ validationErrorResponse: (error) =>
+ NextResponse.json(
+ scimErrorBody(400, 'invalidValue', error.issues[0]?.message ?? 'Invalid request'),
+ { status: 400 }
+ ),
+ invalidJsonResponse: () =>
+ NextResponse.json(
+ scimErrorBody(400, 'invalidSyntax', 'Request body is not valid JSON'),
+ { status: 400 }
+ ),
+ payloadTooLargeResponse: () =>
+ NextResponse.json(scimErrorBody(413, undefined, 'Request body is too large'), {
+ status: 413,
+ }),
+ /**
+ * Entra sends `excludedAttributes=` with an empty value on some list
+ * calls; treating that as a client error would fail an ordinary sync.
+ */
+ rejectBlankQueryValues: false,
+ })
+ if (!parsed.success) {
+ const failure = (await parsed.response.json()) as ScimErrorBody
+ status = parsed.response.status
+ scimType = failure.scimType
+ detail = failure.detail
+ return scimResponse(failure, status)
+ }
+
+ const baseUrl = scimBaseUrl()
+ const input = options.mapInput(parsed.data, { principal, request })
+ const result = await options.useCase.execute({ principal, input, request })
+
+ if (isEmptyResponse) {
+ status = successStatus
+ return new Response(null, {
+ status,
+ headers: { 'cache-control': 'no-store' },
+ })
+ }
+
+ if (!present) throw new Error('unreachable: presenter checked at definition')
+ const presented = present(result, { baseUrl })
+ const validated =
+ options.contract.response.mode === 'json'
+ ? options.contract.response.schema.parse(presented)
+ : presented
+ status = successStatus
+ return scimResponse(validated, status, options.headers?.(result, { baseUrl }))
+ } catch (error) {
+ const scim = toScimError(error)
+ status = scim.status
+ scimType = scim.scimType
+ detail = scim.message
+ /**
+ * Authenticated traffic is admitted per connection. A caller that failed
+ * to authenticate has no connection, so token guessing is bounded per
+ * source address instead.
+ */
+ if (scim.status === 401 && !principal) {
+ const limited = await enforceIpRateLimit('scim-auth', request)
+ if (limited) {
+ status = 429
+ return scimResponse(
+ scimErrorBody(429, undefined, 'Too many failed authentication attempts'),
+ 429,
+ { 'Retry-After': '60' }
+ )
+ }
+ }
+ if (scim.status >= 500) {
+ logger.error('SCIM request failed', {
+ connectionId: principal?.connectionId,
+ path: options.contract.path,
+ error,
+ })
+ }
+ return scimErrorResponse(scim)
+ } finally {
+ if (principal) {
+ dependencies.recordRequest({
+ principal,
+ method: request.method,
+ path: options.contract.path,
+ status,
+ ...(scimType ? { scimType } : {}),
+ ...(detail ? { detail } : {}),
+ userAgent: request.headers.get('user-agent'),
+ durationMs: Date.now() - startedAt,
+ })
+ }
+ }
+ },
+ {
+ /**
+ * The terminal envelopes have to speak SCIM too. A provider that receives
+ * Sim's `{ error }` shape on an unhandled fault logs an unparsable
+ * response, which is materially harder to diagnose than a typed one.
+ */
+ typedErrorResponse: ({ error, status }) =>
+ scimResponse(scimErrorBody(status, undefined, error.message), status),
+ unhandledErrorResponse: () =>
+ scimResponse(scimErrorBody(500, undefined, 'Internal server error'), 500),
+ clientAbortResponse: () => new Response(null, { status: 499 }),
+ }
+ )
+ }
+}
+
+/**
+ * A discovery route: unauthenticated, static, and identical for every tenant.
+ *
+ * RFC 7644 requires these to be reachable so a provider can negotiate before it
+ * holds a credential, and they disclose only what this server implements.
+ */
+export function defineScimDiscoveryRoute(
+ build: (baseUrl: string, params: Record) => unknown
+): ScimNextRouteHandler {
+ return withRouteHandler(
+ async (request, context) => {
+ try {
+ if (!isScimDeploymentEnabled()) throw new ScimError(404, undefined, 'Not found')
+ if (request.method !== 'GET') {
+ throw new ScimError(405, undefined, `${request.method} is not supported here`)
+ }
+ /** Unauthenticated, so the only admission control available is by address. */
+ const limited = await enforceIpRateLimit('scim-discovery', request)
+ if (limited) {
+ throw new ScimError(429, undefined, 'Rate limit exceeded', {
+ 'Retry-After': limited.headers.get('Retry-After') ?? '60',
+ })
+ }
+ const params = context?.params ? await context.params : {}
+ return scimResponse(build(scimBaseUrl(), params), 200)
+ } catch (error) {
+ return scimErrorResponse(toScimError(error))
+ }
+ },
+ {
+ typedErrorResponse: ({ error, status }) =>
+ scimResponse(scimErrorBody(status, undefined, error.message), status),
+ unhandledErrorResponse: () =>
+ scimResponse(scimErrorBody(500, undefined, 'Internal server error'), 500),
+ }
+ )
+}
diff --git a/apps/sim/lib/api/server/routes/v2-api-key-auth.ts b/apps/sim/lib/api/server/routes/v2-api-key-auth.ts
index b70596830a3..ca111042d92 100644
--- a/apps/sim/lib/api/server/routes/v2-api-key-auth.ts
+++ b/apps/sim/lib/api/server/routes/v2-api-key-auth.ts
@@ -72,6 +72,7 @@ interface ApiKeyRow {
type: string
expiresAt: Date | null
userBanned: boolean | null
+ userSuspendedAt: Date | null
}
function requireValidRow(row: ApiKeyRow | undefined): ApiKeyRow {
@@ -83,6 +84,11 @@ function requireValidRow(row: ApiKeyRow | undefined): ApiKeyRow {
throw new Error(`Personal API key ${row.id} is missing its credential owner`)
}
if (row.userBanned) throw new V2ApiKeyUnauthenticatedError()
+ /**
+ * A suspension keeps the account's resources — and therefore its keys —
+ * intact, so refusing the key here is what ends its machine access.
+ */
+ if (row.userSuspendedAt) throw new V2ApiKeyUnauthenticatedError()
return row
}
if (row.type === 'workspace' && row.workspaceId) return row
@@ -103,6 +109,7 @@ async function authenticateApiKey(apiKeyHeader: string): Promise {
- // Blocked emails/domains must not establish sessions, regardless of
- // provider (email/password, OAuth, SSO). Deliberately outside the
- // try below — a thrown APIError must propagate, not be swallowed.
+ /**
+ * Blocked emails/domains and suspended accounts must not establish
+ * sessions, whatever the provider (email/password, OAuth, SSO).
+ * Deliberately outside the try below: a thrown APIError must
+ * propagate, not be swallowed.
+ */
const accessControl = await getAccessControlConfig()
+ const [sessionUser] = await db
+ .select({ email: schema.user.email, suspendedAt: schema.user.suspendedAt })
+ .from(schema.user)
+ .where(eq(schema.user.id, session.userId))
+ .limit(1)
+
+ /**
+ * A suspension leaves the account's resources intact, so nothing else
+ * in the sign-in path refuses it. This is the gate that makes a
+ * directory deactivation take effect on the next sign-in attempt;
+ * existing sessions are deleted when the suspension is applied.
+ */
+ if (sessionUser?.suspendedAt) {
+ logger.warn('Blocking session creation for suspended account', {
+ userId: session.userId,
+ })
+ throw new APIError('FORBIDDEN', {
+ message: 'This account is suspended. Please contact your administrator.',
+ })
+ }
+
if (
accessControl.blockedSignupDomains.length > 0 ||
accessControl.blockedEmails.length > 0
) {
- const [sessionUser] = await db
- .select({ email: schema.user.email })
- .from(schema.user)
- .where(eq(schema.user.id, session.userId))
- .limit(1)
if (isEmailBlockedByAccessControl(sessionUser?.email, accessControl)) {
logger.warn('Blocking session creation for blocked account', {
userId: session.userId,
diff --git a/apps/sim/lib/auth/ban.ts b/apps/sim/lib/auth/ban.ts
index 8ca733d2994..6c0d0379cd9 100644
--- a/apps/sim/lib/auth/ban.ts
+++ b/apps/sim/lib/auth/ban.ts
@@ -12,26 +12,44 @@ export function isBanActive(row: { banned: boolean | null; banExpires: Date | nu
return true
}
+/**
+ * True when the account cannot act: an active ban, or a suspension.
+ *
+ * A suspension is what a directory deactivation applies. It must stop the
+ * person's scheduled runs, webhook triggers, and inbox tasks the same way a ban
+ * does — the identity provider said "this person is gone", and their
+ * automations continuing to run under their credentials would be exactly the
+ * outcome deprovisioning exists to prevent.
+ */
+export function isAccountBlocked(row: {
+ banned: boolean | null
+ banExpires: Date | null
+ suspendedAt?: Date | null
+}): boolean {
+ return isBanActive(row) || Boolean(row.suspendedAt)
+}
+
/**
* True when a raw email (e.g. an inbound sender) is blocked: it is in the
* appconfig blocked-emails list, its domain is in the blocked-domains list,
- * or it belongs to an account with an active ban. Covers senders that don't
- * resolve to a known user id.
+ * or it belongs to an account with an active ban or suspension. Covers senders
+ * that don't resolve to a known user id.
*/
export async function isEmailBlocked(email: string | null | undefined): Promise {
if (!email) return false
const accessControl = await getAccessControlConfig()
if (isEmailBlockedByAccessControl(email, accessControl)) return true
const rows = await db
- .select({ banned: user.banned, banExpires: user.banExpires })
+ .select({ banned: user.banned, banExpires: user.banExpires, suspendedAt: user.suspendedAt })
.from(user)
.where(sql`lower(${user.email}) = ${email.toLowerCase()}`)
- return rows.some(isBanActive)
+ return rows.some(isAccountBlocked)
}
/**
* Returns the subset of the given user ids that are currently blocked: an
- * active account ban, or an email/domain in the appconfig blocked lists.
+ * active account ban or suspension, or an email/domain in the appconfig
+ * blocked lists.
* One user query plus the cached access-control fetch. Throws on db
* failure — callers must fail closed.
*/
@@ -42,12 +60,20 @@ export async function getActivelyBannedUserIds(userIds: string[]): Promise isBanActive(row) || isEmailBlockedByAccessControl(row.email, accessControl))
+ .filter(
+ (row) => isAccountBlocked(row) || isEmailBlockedByAccessControl(row.email, accessControl)
+ )
.map((row) => row.id)
}
diff --git a/apps/sim/lib/auth/oauth-access-token.test.ts b/apps/sim/lib/auth/oauth-access-token.test.ts
index 9f51b181be0..24aa9891feb 100644
--- a/apps/sim/lib/auth/oauth-access-token.test.ts
+++ b/apps/sim/lib/auth/oauth-access-token.test.ts
@@ -23,6 +23,7 @@ function row(overrides: Record = {}) {
clientDisabled: false,
userBanned: false,
userBanExpires: null,
+ userSuspendedAt: null,
userExists: 'user-1',
...overrides,
}
@@ -107,6 +108,9 @@ describe('verifyOAuthAccessToken', () => {
queueTableRows(schemaMock.oauthAccessToken, [row({ userBanned: true })])
expect(await reason('sim_oat_x')).toBe('user_banned')
+ queueTableRows(schemaMock.oauthAccessToken, [row({ userSuspendedAt: new Date() })])
+ expect(await reason('sim_oat_x')).toBe('user_banned')
+
queueTableRows(schemaMock.oauthAccessToken, [
row({ userBanned: true, userBanExpires: new Date(Date.now() - 1) }),
])
diff --git a/apps/sim/lib/auth/oauth-access-token.ts b/apps/sim/lib/auth/oauth-access-token.ts
index f38e3881e6a..8bc7401e863 100644
--- a/apps/sim/lib/auth/oauth-access-token.ts
+++ b/apps/sim/lib/auth/oauth-access-token.ts
@@ -4,7 +4,7 @@ import { oauthAccessToken, oauthClient, user } from '@sim/db/schema'
import { createLogger } from '@sim/logger'
import { sha256Hex } from '@sim/security/hash'
import { eq } from 'drizzle-orm'
-import { isBanActive } from '@/lib/auth/ban'
+import { isAccountBlocked } from '@/lib/auth/ban'
import { OAUTH_ACCESS_TOKEN_PREFIX } from '@/lib/auth/oauth-provider'
const logger = createLogger('OAuthAccessToken')
@@ -90,6 +90,7 @@ export async function verifyOAuthAccessToken(token: string): Promise {
const [activeUser] = await tx
- .select({ id: user.id, banned: user.banned, banExpires: user.banExpires })
+ .select({
+ id: user.id,
+ banned: user.banned,
+ banExpires: user.banExpires,
+ suspendedAt: user.suspendedAt,
+ })
.from(user)
.where(eq(user.id, provisionalToken.userId))
.for('share')
.limit(1)
- if (!activeUser || isBanActive(activeUser)) {
+ if (!activeUser || isAccountBlocked(activeUser)) {
return protocolError('invalid_grant', 'Refresh token is invalid.')
}
diff --git a/apps/sim/lib/auth/sso/application/admit-sso-user.test.ts b/apps/sim/lib/auth/sso/application/admit-sso-user.test.ts
index 06194b17a02..7dccdad2ff5 100644
--- a/apps/sim/lib/auth/sso/application/admit-sso-user.test.ts
+++ b/apps/sim/lib/auth/sso/application/admit-sso-user.test.ts
@@ -48,6 +48,13 @@ vi.mock('@/lib/billing/core/usage', () => ({
syncUsageLimitsFromSubscription: mockSyncUsageLimitsFromSubscription,
}))
+const { mockIsScimEntitledForOrganization } = vi.hoisted(() => ({
+ mockIsScimEntitledForOrganization: vi.fn(),
+}))
+vi.mock('@/ee/scim/lib/entitlement', () => ({
+ isScimEntitledForOrganization: mockIsScimEntitledForOrganization,
+}))
+
vi.mock('@/lib/posthog/server', () => ({
captureServerEvent: mockCaptureServerEvent,
}))
@@ -84,6 +91,11 @@ function queueIdentity({
queueTableRows(schemaMock.account, accountLinked ? [{ id: 'account-1' }] : [])
}
+/** The directory-only read runs after the identity reads and before the membership lookup. */
+function queueDirectoryOnly(directoryOnly: boolean) {
+ queueTableRows(schemaMock.scimConnection, directoryOnly ? [{ id: 'scim-1' }] : [])
+}
+
async function execute() {
return admitSsoUser.execute({ principal, input: { providerId: 'acme-sso' } })
}
@@ -179,6 +191,29 @@ describe('SSO JIT admission', () => {
expect(mockEnsureUserInOrganizationTx).not.toHaveBeenCalled()
})
+ it('leaves admission to the directory when a connection has disabled JIT', async () => {
+ queueIdentity()
+ queueDirectoryOnly(true)
+ mockIsScimEntitledForOrganization.mockResolvedValue(true)
+
+ await expect(execute()).resolves.toEqual({
+ kind: 'provisioning-disabled',
+ organizationId: 'org-1',
+ })
+ expect(mockEnsureUserInOrganizationTx).not.toHaveBeenCalled()
+ })
+
+ it('admits by JIT again once the directory can no longer sync', async () => {
+ queueIdentity()
+ queueDirectoryOnly(true)
+ mockIsScimEntitledForOrganization.mockResolvedValue(false)
+
+ const outcome = await execute()
+
+ expect(outcome.kind).toBe('provisioned')
+ expect(mockEnsureUserInOrganizationTx).toHaveBeenCalled()
+ })
+
it('keeps an existing member active when new provisioning is invite-only', async () => {
queueIdentity({ jitProvisioningEnabled: false })
queueTableRows(schemaMock.member, [{ id: 'member-existing' }])
diff --git a/apps/sim/lib/auth/sso/application/admit-sso-user.ts b/apps/sim/lib/auth/sso/application/admit-sso-user.ts
index 3207660bacc..7d211e5fd5a 100644
--- a/apps/sim/lib/auth/sso/application/admit-sso-user.ts
+++ b/apps/sim/lib/auth/sso/application/admit-sso-user.ts
@@ -5,15 +5,15 @@ import {
invitation,
member,
permissions,
+ scimConnection,
ssoProvider,
- subscription,
user,
workspace,
} from '@sim/db/schema'
import { createLogger } from '@sim/logger'
import { normalizeSSODomain } from '@sim/utils/sso-domain'
import { normalizeEmail } from '@sim/utils/string'
-import { and, desc, eq, gt, inArray, isNull, sql } from 'drizzle-orm'
+import { and, eq, gt, isNull, sql } from 'drizzle-orm'
import { applySessionPolicyToNewMember } from '@/lib/auth/session-policy'
import { ssoJitAdmissionOperation } from '@/lib/auth/sso/application/operations'
import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
@@ -21,11 +21,11 @@ import {
acquireOrganizationUserMutationLocks,
ensureUserInOrganizationTx,
} from '@/lib/billing/organizations/membership'
+import { resolveOrganizationSeatPolicyTx } from '@/lib/billing/organizations/seat-policy'
import { reconcileOrganizationSeats } from '@/lib/billing/organizations/seats'
-import { isTeam } from '@/lib/billing/plan-helpers'
-import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
import { assertOperationPrincipal, type OperationUseCase } from '@/lib/core/application/operation'
import { captureServerEvent } from '@/lib/posthog/server'
+import { isScimEntitledForOrganization } from '@/ee/scim/lib/entitlement'
const logger = createLogger('SsoJitAdmission')
@@ -130,7 +130,28 @@ async function runAdmissionTransaction(
organizationIds: [provider.organizationId],
})
- if (!provider.jitProvisioningEnabled) {
+ /**
+ * An organization whose directory is the only way in has said so on its
+ * SCIM connection; a first sign-in must not create a membership the directory
+ * did not ask for and will not know about.
+ */
+ const [directoryOnly] = await tx
+ .select({ id: scimConnection.id })
+ .from(scimConnection)
+ .where(
+ and(
+ eq(scimConnection.organizationId, provider.organizationId),
+ eq(scimConnection.status, 'active'),
+ sql`coalesce((${scimConnection.settings} ->> 'disableJit')::boolean, false) = true`
+ )
+ )
+ .limit(1)
+
+ /** A directory that can no longer sync (plan lapsed, feature off) no longer owns the door either. */
+ const directoryOwnsAdmission =
+ Boolean(directoryOnly) && (await isScimEntitledForOrganization(provider.organizationId))
+
+ if (!provider.jitProvisioningEnabled || directoryOwnsAdmission) {
const [sameOrganization] = await tx
.select({ id: member.id })
.from(member)
@@ -230,27 +251,12 @@ async function runAdmissionTransaction(
}
}
- const [organizationSubscription] = await tx
- .select({ id: subscription.id, plan: subscription.plan })
- .from(subscription)
- .where(
- and(
- eq(subscription.referenceId, provider.organizationId),
- inArray(subscription.status, ENTITLED_SUBSCRIPTION_STATUSES)
- )
- )
- .orderBy(desc(subscription.periodStart), desc(subscription.id))
- .limit(1)
-
+ const seatPolicy = await resolveOrganizationSeatPolicyTx(tx, provider.organizationId)
const membershipResult = await ensureUserInOrganizationTx(tx, {
userId,
organizationId: provider.organizationId,
role: 'member',
- /** Team seats grow to the committed member count; Enterprise remains fixed-capacity. */
- ...(isTeam(organizationSubscription?.plan) ? { skipSeatValidation: true } : {}),
- ...(organizationSubscription?.id
- ? { organizationSubscriptionId: organizationSubscription.id }
- : {}),
+ ...seatPolicy,
})
if (!membershipResult.success || !membershipResult.memberId) {
@@ -267,8 +273,8 @@ async function runAdmissionTransaction(
return {
...attribution,
- ...(organizationSubscription?.id
- ? { organizationSubscriptionId: organizationSubscription.id }
+ ...(seatPolicy.organizationSubscriptionId
+ ? { organizationSubscriptionId: seatPolicy.organizationSubscriptionId }
: {}),
result: {
kind: membershipResult.alreadyMember ? 'already-member' : 'provisioned',
diff --git a/apps/sim/lib/billing/organizations/membership.ts b/apps/sim/lib/billing/organizations/membership.ts
index b60cca4b149..21da676b383 100644
--- a/apps/sim/lib/billing/organizations/membership.ts
+++ b/apps/sim/lib/billing/organizations/membership.ts
@@ -24,7 +24,10 @@ import { getErrorMessage } from '@sim/utils/errors'
import { generateId } from '@sim/utils/id'
import { normalizeEmail } from '@sim/utils/string'
import { and, count, desc, eq, inArray, isNull, ne, or, sql } from 'drizzle-orm'
-import { invalidateMembershipCache } from '@/lib/auth/security-policy'
+import {
+ invalidateMembershipCache,
+ invalidateSecurityPolicyVersionCache,
+} from '@/lib/auth/security-policy'
import { applySessionPolicyToNewMember } from '@/lib/auth/session-policy'
import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
import {
@@ -47,11 +50,16 @@ import { enqueueOutboxEvent } from '@/lib/core/outbox/service'
import { revokeWorkspaceCredentialMembershipsTx } from '@/lib/credentials/access'
import type { DbOrTx } from '@/lib/db/types'
import { acquireInvitationMutationLocks } from '@/lib/invitations/locks'
+import {
+ revokePersonalApiKeysTx,
+ revokeUserSessionsTx,
+} from '@/lib/organizations/members/revocation'
import { removeWorkspaceSkillMembershipsTx } from '@/lib/skills/access'
import {
reassignWorkflowOwnershipForWorkspaceMemberRemovalTx,
WorkspaceBillingAccountRemovalError,
} from '@/lib/workspaces/utils'
+import { endDirectoryMembershipTx } from '@/ee/scim/lib/identity/end-directory-membership'
export { acquireUserBillingIdentityLock } from '@/lib/billing/organizations/billing-identity-lock'
export { WORKSPACE_BILLING_ACCOUNT_REMOVAL_ERROR } from '@/lib/workspaces/utils'
@@ -462,6 +470,15 @@ export interface RemoveMemberParams {
memberId: string
/** Skip departed usage capture and Pro restoration (default: false) */
skipBillingLogic?: boolean
+ /**
+ * Also delete the member's personal API keys. Off by default: personal keys
+ * are the person's own and outlive one organization. Directory
+ * deprovisioning turns it on, because there the person is leaving Sim as far
+ * as the organization is concerned.
+ */
+ revokePersonalApiKeys?: boolean
+ /** The caller's own session token, kept alive when a member removes themselves. */
+ spareSessionToken?: string
/**
* Only remove the member when they hold no remaining permission on any of the
* org's workspaces, evaluated atomically under the membership lock. Used by
@@ -1235,6 +1252,8 @@ export async function removeUserFromOrganization(
memberId,
skipBillingLogic = false,
requireNoOrgWorkspaceAccess = false,
+ revokePersonalApiKeys = false,
+ spareSessionToken,
} = params
const billingActions = {
@@ -1330,6 +1349,21 @@ export async function removeUserFromOrganization(
)
)
+ /**
+ * Leaving ends live access at once: sessions go with the membership
+ * rather than lingering until a cookie cache lapses, and any directory
+ * row that described this membership is replaced by its tombstone in the
+ * same commit, so the directory and the organization can never disagree
+ * about who is a member.
+ */
+ await revokeUserSessionsTx(tx, {
+ userId,
+ organizationId,
+ ...(spareSessionToken ? { spareSessionToken } : {}),
+ })
+ if (revokePersonalApiKeys) await revokePersonalApiKeysTx(tx, { userId })
+ await endDirectoryMembershipTx(tx, { userId, organizationId })
+
if (workspaceIds.length === 0) {
return {
skipped: false as const,
@@ -1403,6 +1437,7 @@ export async function removeUserFromOrganization(
// The departed member's cookie-version/hook-clamp fallbacks must stop
// resolving to this org immediately, not after the membership-cache TTL.
invalidateMembershipCache(userId)
+ invalidateSecurityPolicyVersionCache(organizationId)
logger.info('Removed member from organization', {
organizationId,
diff --git a/apps/sim/lib/billing/organizations/seat-policy.ts b/apps/sim/lib/billing/organizations/seat-policy.ts
new file mode 100644
index 00000000000..4ed76960ff1
--- /dev/null
+++ b/apps/sim/lib/billing/organizations/seat-policy.ts
@@ -0,0 +1,36 @@
+import { subscription } from '@sim/db/schema'
+import { and, desc, eq, inArray } from 'drizzle-orm'
+import { isTeam } from '@/lib/billing/plan-helpers'
+import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
+import type { DbOrTx } from '@/lib/db/types'
+
+/**
+ * How admission into an organization treats seats.
+ *
+ * Team plans add a seat when someone joins; Enterprise buys a fixed number in
+ * advance and must refuse beyond it. SSO just-in-time admission and directory
+ * provisioning share this rule so a first sign-in and a directory push agree on
+ * who fits, and both hand the same subscription id to the seat reconciliation
+ * that follows a successful join.
+ */
+export async function resolveOrganizationSeatPolicyTx(
+ tx: DbOrTx,
+ organizationId: string
+): Promise<{ skipSeatValidation?: true; organizationSubscriptionId?: string }> {
+ const [entitled] = await tx
+ .select({ id: subscription.id, plan: subscription.plan })
+ .from(subscription)
+ .where(
+ and(
+ eq(subscription.referenceId, organizationId),
+ inArray(subscription.status, ENTITLED_SUBSCRIPTION_STATUSES)
+ )
+ )
+ .orderBy(desc(subscription.periodStart), desc(subscription.id))
+ .limit(1)
+
+ return {
+ ...(isTeam(entitled?.plan) ? { skipSeatValidation: true as const } : {}),
+ ...(entitled?.id ? { organizationSubscriptionId: entitled.id } : {}),
+ }
+}
diff --git a/apps/sim/lib/compare/data/sim.ts b/apps/sim/lib/compare/data/sim.ts
index 8bf43d4c589..ec777532b99 100644
--- a/apps/sim/lib/compare/data/sim.ts
+++ b/apps/sim/lib/compare/data/sim.ts
@@ -1008,8 +1008,8 @@ export const simProfile: CompetitorProfile = {
},
sso: {
value:
- 'Yes: SAML 2.0 and OIDC single sign-on, with users routed to SSO by their email domain and automatically provisioned into the organization on first sign-in',
- shortValue: 'SAML 2.0 and OIDC SSO with auto-provisioning',
+ 'Yes: SAML 2.0 and OIDC single sign-on, with users routed to SSO by their email domain, plus SCIM 2.0 directory provisioning for Okta, Microsoft Entra ID, OneLogin, and JumpCloud that creates, updates, deactivates, and removes members and maps pushed groups to permission groups, workspace access, and the organization admin role',
+ shortValue: 'SAML 2.0 and OIDC SSO with SCIM 2.0 provisioning',
confidence: 'verified',
sources: [
{
@@ -1017,6 +1017,11 @@ export const simProfile: CompetitorProfile = {
label: 'Sim Docs: Single Sign-On (SSO)',
asOf: '2026-07-02',
},
+ {
+ url: 'https://docs.sim.ai/platform/enterprise/scim',
+ label: 'Sim Docs: Directory provisioning (SCIM)',
+ asOf: '2026-09-07',
+ },
],
},
sessionPolicy: {
diff --git a/apps/sim/lib/copilot/generated/docs-manifest.ts b/apps/sim/lib/copilot/generated/docs-manifest.ts
index 86005762478..e2f9e8f6189 100644
--- a/apps/sim/lib/copilot/generated/docs-manifest.ts
+++ b/apps/sim/lib/copilot/generated/docs-manifest.ts
@@ -375,6 +375,7 @@ export const DOCS_MANIFEST: readonly string[] = [
'platform/enterprise/data-drains.mdx',
'platform/enterprise/data-retention.mdx',
'platform/enterprise/forks.mdx',
+ 'platform/enterprise/scim.mdx',
'platform/enterprise/self-hosted.mdx',
'platform/enterprise/session-policies.mdx',
'platform/enterprise/sso.mdx',
diff --git a/apps/sim/lib/core/application/forbidden.ts b/apps/sim/lib/core/application/forbidden.ts
index 8dae46aff49..996618b1793 100644
--- a/apps/sim/lib/core/application/forbidden.ts
+++ b/apps/sim/lib/core/application/forbidden.ts
@@ -65,6 +65,8 @@ export const FORBIDDEN_DETAIL_CODES = [
'INTEGRATION_NOT_ALLOWED',
/** The OAuth access token was not granted the scope this operation needs. */
'INSUFFICIENT_SCOPE',
+ /** The organization's identity provider owns this membership, so Sim will not change it. */
+ 'SCIM_MANAGED_MEMBERSHIP',
] as const
export type ForbiddenDetailCode = (typeof FORBIDDEN_DETAIL_CODES)[number]
diff --git a/apps/sim/lib/core/application/operation.ts b/apps/sim/lib/core/application/operation.ts
index 90828c4262d..22a819e90d8 100644
--- a/apps/sim/lib/core/application/operation.ts
+++ b/apps/sim/lib/core/application/operation.ts
@@ -88,8 +88,18 @@ export function assertOperationOAuthPolicy(
* Every principal kind an operation can name. `credential_group_enrollment`
* authenticates one enrollment flow, while `system` is an infrastructure-owned
* workflow execution identity; neither performs a semantic resource operation.
+ *
+ * `scim_connection` is excluded for a different reason: it is an organization's
+ * identity provider, which provisions membership and never reads or writes a
+ * workspace resource. Leaving it out makes that a compile-time fact — a
+ * workspace operation cannot name it even by accident — and SCIM declares its
+ * own operation type in `ee/scim/lib/application/operations.ts`, the way
+ * organization BYOK does.
*/
-export type PrincipalKind = Exclude
+export type PrincipalKind = Exclude<
+ Principal['kind'],
+ 'credential_group_enrollment' | 'system' | 'scim_connection'
+>
/**
* A principal kind a non-workspace operation may name. `delegated` is excluded
diff --git a/apps/sim/lib/core/application/workspace-authorization.ts b/apps/sim/lib/core/application/workspace-authorization.ts
index e7cdeb09d63..d8cae5aeb7d 100644
--- a/apps/sim/lib/core/application/workspace-authorization.ts
+++ b/apps/sim/lib/core/application/workspace-authorization.ts
@@ -50,6 +50,7 @@ export function capabilityGovernedPrincipalUserId(principal: Principal): string
case 'workspace_api_key':
case 'system':
case 'credential_group_enrollment':
+ case 'scim_connection':
return null
case 'delegated': {
if (principal.serviceId === 'executor') return null
diff --git a/apps/sim/lib/core/config/deployment-shape.test.ts b/apps/sim/lib/core/config/deployment-shape.test.ts
index a01adc99bd8..9de0eca990f 100644
--- a/apps/sim/lib/core/config/deployment-shape.test.ts
+++ b/apps/sim/lib/core/config/deployment-shape.test.ts
@@ -36,6 +36,7 @@ describe('resolveDeploymentShape', () => {
dataRetention: false,
inbox: true,
sandboxes: true,
+ scim: false,
sessionPolicies: true,
sso: true,
usageMonitoring: false,
diff --git a/apps/sim/lib/core/config/deployment-shape.ts b/apps/sim/lib/core/config/deployment-shape.ts
index a00429c6fce..299610a5ff6 100644
--- a/apps/sim/lib/core/config/deployment-shape.ts
+++ b/apps/sim/lib/core/config/deployment-shape.ts
@@ -14,6 +14,7 @@ import {
isHosted,
isInboxEnabled,
isSandboxesEnabled,
+ isScimEnabled,
isSessionPoliciesEnabled,
isSsoEnabled,
isUsageMonitoringEnabled,
@@ -94,6 +95,7 @@ export function resolveDeploymentShape(): DeploymentShape {
dataRetention: isDataRetentionEnabled,
inbox: isInboxEnabled,
sandboxes: isSandboxesEnabled,
+ scim: isScimEnabled,
sessionPolicies: isSessionPoliciesEnabled,
sso: isSsoEnabled,
usageMonitoring: isUsageMonitoringEnabled,
diff --git a/apps/sim/lib/core/config/enterprise-entitlements.ts b/apps/sim/lib/core/config/enterprise-entitlements.ts
index f48fd8ca9a0..55635084fc7 100644
--- a/apps/sim/lib/core/config/enterprise-entitlements.ts
+++ b/apps/sim/lib/core/config/enterprise-entitlements.ts
@@ -35,6 +35,7 @@ export type EnterpriseFeature =
| 'inbox'
| 'organizations'
| 'sandboxes'
+ | 'scim'
| 'sessionPolicies'
| 'sso'
| 'usageMonitoring'
@@ -82,6 +83,7 @@ export const ENTERPRISE_FEATURE_LEGACY_DEFAULTS: Readonly target.workspaceId)
const existingUser = await db
- .select({ id: user.id })
+ .select({
+ id: user.id,
+ scimManaged:
+ organizationId && isScimDeploymentEnabled()
+ ? scimManagedUserPredicate(organizationId, user.id)
+ : sql`false`,
+ })
.from(user)
.where(sql`lower(${user.email}) = ${normalizedEmail}`)
.then((rows) => rows[0])
+ /**
+ * When the organization has made its identity provider the source of truth for
+ * membership, a Sim invitation to someone the directory already provisions is
+ * redundant at best and reverted at worst. Read as part of the lookup above so
+ * the common case costs no extra query.
+ */
+ if (organizationId) {
+ await assertInviteeNotScimManaged({ organizationId, managed: existingUser?.scimManaged })
+ }
+
const existingMembership = existingUser ? await getUserOrganization(existingUser.id) : null
let existingOrganizationRole = existingMembership?.role
let organizationRoleUpdated = false
diff --git a/apps/sim/lib/organizations/members/lifecycle.test.ts b/apps/sim/lib/organizations/members/lifecycle.test.ts
new file mode 100644
index 00000000000..c813bc9df0e
--- /dev/null
+++ b/apps/sim/lib/organizations/members/lifecycle.test.ts
@@ -0,0 +1,166 @@
+/**
+ * @vitest-environment node
+ */
+import { member, session, user } from '@sim/db/schema'
+import { dbChainMockFns, queueTableRows, resetDbChainMock } from '@sim/testing'
+import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockAcquireLocks, mockInvalidateVersion, mockInvalidateMembership } = vi.hoisted(() => ({
+ mockAcquireLocks: vi.fn(),
+ mockInvalidateVersion: vi.fn(),
+ mockInvalidateMembership: vi.fn(),
+}))
+
+vi.mock('@/lib/billing/organizations/membership', () => ({
+ acquireOrganizationUserMutationLocks: mockAcquireLocks,
+}))
+vi.mock('@/lib/auth/security-policy', () => ({
+ invalidateSecurityPolicyVersionCache: mockInvalidateVersion,
+ invalidateMembershipCache: mockInvalidateMembership,
+}))
+
+import { db } from '@sim/db'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import {
+ changeMemberRoleTx,
+ suspendMemberTx,
+ unsuspendMemberTx,
+} from '@/lib/organizations/members/lifecycle'
+import {
+ invalidateAfterSessionRevocation,
+ revokeUserSessionsTx,
+} from '@/lib/organizations/members/revocation'
+
+afterAll(resetDbChainMock)
+
+beforeEach(() => {
+ vi.clearAllMocks()
+ resetDbChainMock()
+})
+
+describe('changeMemberRoleTx', () => {
+ it('takes the organization and user locks before reading the membership', async () => {
+ queueTableRows(member, [{ id: 'm-1', role: 'member' }])
+ await changeMemberRoleTx(db, { organizationId: 'org-1', userId: 'u-1', role: 'admin' })
+ expect(mockAcquireLocks).toHaveBeenCalledWith(db, {
+ userId: 'u-1',
+ organizationIds: ['org-1'],
+ })
+ expect(mockAcquireLocks.mock.invocationCallOrder[0]).toBeLessThan(
+ dbChainMockFns.select.mock.invocationCallOrder[0]
+ )
+ })
+
+ it('reports the change it made', async () => {
+ queueTableRows(member, [{ id: 'm-1', role: 'member' }])
+ await expect(
+ changeMemberRoleTx(db, { organizationId: 'org-1', userId: 'u-1', role: 'admin' })
+ ).resolves.toEqual({ changed: true, from: 'member', to: 'admin' })
+ expect(dbChainMockFns.update).toHaveBeenCalledWith(member)
+ expect(dbChainMockFns.set).toHaveBeenCalledWith({ role: 'admin' })
+ })
+
+ it('writes nothing when the role already matches', async () => {
+ queueTableRows(member, [{ id: 'm-1', role: 'admin' }])
+ await expect(
+ changeMemberRoleTx(db, { organizationId: 'org-1', userId: 'u-1', role: 'admin' })
+ ).resolves.toEqual({ changed: false, role: 'admin' })
+ expect(dbChainMockFns.update).not.toHaveBeenCalled()
+ })
+
+ it('refuses to touch the owner and reports a missing member', async () => {
+ queueTableRows(member, [{ id: 'm-1', role: 'owner' }])
+ const owner = await changeMemberRoleTx(db, {
+ organizationId: 'org-1',
+ userId: 'u-1',
+ role: 'member',
+ }).catch((error) => error)
+ expect(owner).toBeInstanceOf(OrchestrationError)
+ expect(owner.code).toBe('conflict')
+
+ const missing = await changeMemberRoleTx(db, {
+ organizationId: 'org-1',
+ userId: 'u-2',
+ role: 'member',
+ }).catch((error) => error)
+ expect(missing.code).toBe('not_found')
+ expect(dbChainMockFns.update).not.toHaveBeenCalled()
+ })
+})
+
+describe('revokeUserSessionsTx', () => {
+ it('deletes the user’s own sessions and bumps the organization security version together', async () => {
+ dbChainMockFns.returning.mockResolvedValueOnce([{ id: 's-1' }, { id: 's-2' }])
+ await expect(
+ revokeUserSessionsTx(db, { userId: 'u-1', organizationId: 'org-1' })
+ ).resolves.toEqual({ revoked: 2 })
+ expect(dbChainMockFns.delete).toHaveBeenCalledWith(session)
+ expect(dbChainMockFns.where).toHaveBeenCalledWith(
+ expect.objectContaining({
+ type: 'and',
+ conditions: expect.arrayContaining([
+ { type: 'eq', left: session.userId, right: 'u-1' },
+ { type: 'isNull', column: session.impersonatedBy },
+ ]),
+ })
+ )
+ expect(dbChainMockFns.update).toHaveBeenCalledTimes(1)
+ })
+
+ it('spares the session token the caller is still using', async () => {
+ await revokeUserSessionsTx(db, {
+ userId: 'u-1',
+ organizationId: 'org-1',
+ spareSessionToken: 'keep-me',
+ })
+ expect(dbChainMockFns.where).toHaveBeenCalledWith(
+ expect.objectContaining({
+ conditions: expect.arrayContaining([{ type: 'ne', left: session.token, right: 'keep-me' }]),
+ })
+ )
+ })
+
+ it('clears the caches only through the separate post-commit step', () => {
+ invalidateAfterSessionRevocation({ userId: 'u-1', organizationId: 'org-1' })
+ expect(mockInvalidateVersion).toHaveBeenCalledWith('org-1')
+ expect(mockInvalidateMembership).toHaveBeenCalledWith('u-1')
+ })
+})
+
+describe('suspendMemberTx and unsuspendMemberTx', () => {
+ it('suspends once, revokes sessions, and never touches API keys', async () => {
+ dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'u-1' }])
+ dbChainMockFns.returning.mockResolvedValueOnce([{ id: 's-1' }])
+ await expect(
+ suspendMemberTx(db, { userId: 'u-1', organizationId: 'org-1', source: 'scim' })
+ ).resolves.toEqual({ suspended: true, sessionsRevoked: 1 })
+ expect(mockAcquireLocks).toHaveBeenCalledTimes(1)
+ expect(dbChainMockFns.set).toHaveBeenCalledWith(
+ expect.objectContaining({ suspensionSource: 'scim', suspendedAt: expect.any(Date) })
+ )
+ expect(dbChainMockFns.delete).toHaveBeenCalledTimes(1)
+ expect(dbChainMockFns.delete).toHaveBeenCalledWith(session)
+ })
+
+ it('reports an already-suspended account without claiming a second suspension', async () => {
+ dbChainMockFns.returning.mockResolvedValueOnce([])
+ await expect(
+ suspendMemberTx(db, { userId: 'u-1', organizationId: 'org-1', source: 'scim' })
+ ).resolves.toMatchObject({ suspended: false })
+ })
+
+ it('lifts only a suspension raised by the same source', async () => {
+ dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'u-1' }])
+ await expect(unsuspendMemberTx(db, { userId: 'u-1', source: 'scim' })).resolves.toEqual({
+ unsuspended: true,
+ })
+ expect(dbChainMockFns.update).toHaveBeenCalledWith(user)
+ expect(dbChainMockFns.where).toHaveBeenCalledWith({
+ type: 'and',
+ conditions: [
+ { type: 'eq', left: user.id, right: 'u-1' },
+ { type: 'eq', left: user.suspensionSource, right: 'scim' },
+ ],
+ })
+ })
+})
diff --git a/apps/sim/lib/organizations/members/lifecycle.ts b/apps/sim/lib/organizations/members/lifecycle.ts
new file mode 100644
index 00000000000..95343294053
--- /dev/null
+++ b/apps/sim/lib/organizations/members/lifecycle.ts
@@ -0,0 +1,118 @@
+import { member, user } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { and, eq, isNull } from 'drizzle-orm'
+import { acquireOrganizationUserMutationLocks } from '@/lib/billing/organizations/membership'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import type { DbOrTx } from '@/lib/db/types'
+import { revokeUserSessionsTx } from '@/lib/organizations/members/revocation'
+
+const logger = createLogger('OrganizationMemberLifecycle')
+
+/**
+ * Member lifecycle primitives shared by the settings UI and directory
+ * provisioning: suspension, and role changes. Removal lives with the billing
+ * membership primitives; live-access revocation lives in `revocation.ts`.
+ */
+
+/**
+ * Who applied a suspension. A source only ever lifts its own, so a second source
+ * added later cannot have its suspensions undone by a directory sync.
+ */
+export type SuspensionSource = 'scim'
+
+export interface SuspendMemberResult {
+ suspended: boolean
+ sessionsRevoked: number
+}
+
+/**
+ * Suspends an account: sign-in is refused, API keys stop authenticating, and
+ * everything the person owns is left exactly as it was.
+ *
+ * Deliberately not the platform ban. A ban runs `disableUserResources`, which
+ * archives every workspace the user owns and deletes their API keys, and there
+ * is no server-side path to undo it. A directory deactivation is routine and
+ * reversible — someone on leave, or moved between teams — so it must not destroy
+ * the work they own. That includes their API keys: the key rows stay, and the
+ * authentication paths refuse them while `suspendedAt` is set, so reactivation
+ * restores every automation exactly as it was.
+ */
+export async function suspendMemberTx(
+ tx: DbOrTx,
+ params: { userId: string; organizationId: string; source: SuspensionSource }
+): Promise {
+ await acquireOrganizationUserMutationLocks(tx, {
+ userId: params.userId,
+ organizationIds: [params.organizationId],
+ })
+
+ const [updated] = await tx
+ .update(user)
+ .set({ suspendedAt: new Date(), suspensionSource: params.source, updatedAt: new Date() })
+ .where(and(eq(user.id, params.userId), isNull(user.suspendedAt)))
+ .returning({ id: user.id })
+
+ const sessions = await revokeUserSessionsTx(tx, {
+ userId: params.userId,
+ organizationId: params.organizationId,
+ })
+
+ return { suspended: Boolean(updated), sessionsRevoked: sessions.revoked }
+}
+
+/** Lifts a suspension, but only one raised by the same source. */
+export async function unsuspendMemberTx(
+ tx: DbOrTx,
+ params: { userId: string; source: SuspensionSource }
+): Promise<{ unsuspended: boolean }> {
+ const [updated] = await tx
+ .update(user)
+ .set({ suspendedAt: null, suspensionSource: null, updatedAt: new Date() })
+ .where(and(eq(user.id, params.userId), eq(user.suspensionSource, params.source)))
+ .returning({ id: user.id })
+ return { unsuspended: Boolean(updated) }
+}
+
+export type OrganizationMemberRole = 'admin' | 'member'
+
+export type ChangeMemberRoleResult =
+ | { changed: true; from: string; to: OrganizationMemberRole }
+ | { changed: false; role: string }
+
+/**
+ * Changes a member's organization role.
+ *
+ * Ownership is out of scope in both directions: the owner's role cannot be
+ * lowered here, and no caller can raise someone to owner. Transferring ownership
+ * moves billing and the last-owner guarantee with it, which is its own operation.
+ */
+export async function changeMemberRoleTx(
+ tx: DbOrTx,
+ params: { organizationId: string; userId: string; role: OrganizationMemberRole }
+): Promise {
+ await acquireOrganizationUserMutationLocks(tx, {
+ userId: params.userId,
+ organizationIds: [params.organizationId],
+ })
+
+ const [current] = await tx
+ .select({ id: member.id, role: member.role })
+ .from(member)
+ .where(and(eq(member.organizationId, params.organizationId), eq(member.userId, params.userId)))
+ .limit(1)
+
+ if (!current) throw new OrchestrationError('not_found', 'Member not found')
+ if (current.role === 'owner') {
+ throw new OrchestrationError('conflict', 'The organization owner’s role cannot be changed')
+ }
+ if (current.role === params.role) return { changed: false, role: current.role }
+
+ await tx.update(member).set({ role: params.role }).where(eq(member.id, current.id))
+ logger.info('Changed organization member role', {
+ organizationId: params.organizationId,
+ userId: params.userId,
+ from: current.role,
+ to: params.role,
+ })
+ return { changed: true, from: current.role, to: params.role }
+}
diff --git a/apps/sim/lib/organizations/members/revocation.ts b/apps/sim/lib/organizations/members/revocation.ts
new file mode 100644
index 00000000000..b1ba25881c3
--- /dev/null
+++ b/apps/sim/lib/organizations/members/revocation.ts
@@ -0,0 +1,85 @@
+import { apiKey, organization, session as sessionTable } from '@sim/db/schema'
+import { and, eq, isNull, ne, sql } from 'drizzle-orm'
+import {
+ invalidateMembershipCache,
+ invalidateSecurityPolicyVersionCache,
+} from '@/lib/auth/security-policy'
+import type { DbOrTx } from '@/lib/db/types'
+
+/**
+ * Ending a person's live access: their sessions and their personal API keys.
+ *
+ * Shared by removal from an organization, suspension, and an email change, so
+ * every path that must sign someone out does it the same way. Kept apart from
+ * the membership primitives so the removal transaction can call it without a
+ * module cycle.
+ */
+
+export interface RevokeSessionsResult {
+ revoked: number
+}
+
+/**
+ * Deletes a user's sessions and forces cached session cookies in the
+ * organization to re-read the database.
+ *
+ * Both halves commit together. Deleting sessions without bumping the version
+ * would leave the signed cookie cache authenticating a deleted session for up
+ * to five minutes, which is precisely the window a revocation exists to close.
+ *
+ * Impersonation sessions are spared: they are platform support tooling, not the
+ * member's own access.
+ */
+export async function revokeUserSessionsTx(
+ tx: DbOrTx,
+ params: { userId: string; organizationId: string; spareSessionToken?: string }
+): Promise