From 0f8c9e1217ba7a4bf476444bc792c64623c73dce Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 27 May 2026 18:49:51 +0000 Subject: [PATCH] Pass scope into ArchiveUser Change ArchiveUser to receive an explicit coredata scope from callers\ninstead of rebuilding scope from organization ID inside the service.\n\nWire connect and MCP resolvers to pass the authorized scope through to\nArchiveUser. Signed-off-by: Cursor Agent Co-authored-by: Bryan FRIMIN --- pkg/iam/organization_service.go | 3 +-- pkg/server/api/connect/v1/profile_resolvers.go | 5 +++-- pkg/server/api/mcp/v1/schema.resolvers.go | 5 +++-- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/pkg/iam/organization_service.go b/pkg/iam/organization_service.go index ed461aa68..21ea51409 100644 --- a/pkg/iam/organization_service.go +++ b/pkg/iam/organization_service.go @@ -368,11 +368,10 @@ func (s *OrganizationService) RemoveUser( func (s *OrganizationService) ArchiveUser( ctx context.Context, + scope coredata.Scoper, organizationID gid.GID, profileID gid.GID, ) error { - scope := coredata.NewScopeFromObjectID(organizationID) - return s.pg.WithTx( ctx, func(ctx context.Context, tx pg.Tx) error { diff --git a/pkg/server/api/connect/v1/profile_resolvers.go b/pkg/server/api/connect/v1/profile_resolvers.go index e7fd4ef5f..8a609184e 100644 --- a/pkg/server/api/connect/v1/profile_resolvers.go +++ b/pkg/server/api/connect/v1/profile_resolvers.go @@ -106,11 +106,12 @@ func (r *mutationResolver) UpdateUser(ctx context.Context, input types.UpdateUse // ArchiveUser is the resolver for the archiveUser field. func (r *mutationResolver) ArchiveUser(ctx context.Context, input types.ArchiveUserInput) (*types.ArchiveUserPayload, error) { - if _, err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete); err != nil { + scope, err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete) + if err != nil { return nil, err } - err := r.iam.OrganizationService.ArchiveUser(ctx, input.OrganizationID, input.ProfileID) + err = r.iam.OrganizationService.ArchiveUser(ctx, scope, input.OrganizationID, input.ProfileID) if err != nil { if _, ok := errors.AsType[*iam.ErrUserManagedBySCIM](err); ok { return nil, gqlutils.Conflictf(ctx, "user is managed by SCIM and cannot be archived") diff --git a/pkg/server/api/mcp/v1/schema.resolvers.go b/pkg/server/api/mcp/v1/schema.resolvers.go index 01208739f..5af6d709e 100644 --- a/pkg/server/api/mcp/v1/schema.resolvers.go +++ b/pkg/server/api/mcp/v1/schema.resolvers.go @@ -2937,11 +2937,12 @@ func (r *Resolver) RemoveUserTool(ctx context.Context, req *mcp.CallToolRequest, } func (r *Resolver) ArchiveUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ArchiveUserInput) (*mcp.CallToolResult, types.ArchiveUserOutput, error) { - if _, err := r.Authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete); err != nil { + scope, err := r.Authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete) + if err != nil { return nil, types.ArchiveUserOutput{}, err } - err := r.iamSvc.OrganizationService.ArchiveUser(ctx, input.OrganizationID, input.ProfileID) + err = r.iamSvc.OrganizationService.ArchiveUser(ctx, scope, input.OrganizationID, input.ProfileID) if err != nil { if _, ok := errors.AsType[*iam.ErrUserManagedBySCIM](err); ok { return nil, types.ArchiveUserOutput{}, fmt.Errorf("user is managed by SCIM and cannot be archived: %w", err)