From 1bc5ebce2c690f25bea964b758f5ffafb6f189c0 Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Tue, 3 Feb 2026 16:01:03 +0100
Subject: [PATCH] Fix SCIM disable all non SCIM managed members

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 pkg/coredata/membership_filter.go | 30 ++++++++++++++++++++++++------
 pkg/iam/scim/service.go           |  7 +++++++
 2 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/pkg/coredata/membership_filter.go b/pkg/coredata/membership_filter.go
index 0ab393801..18102055c 100644
--- a/pkg/coredata/membership_filter.go
+++ b/pkg/coredata/membership_filter.go
@@ -20,9 +20,10 @@ import (
 )
 
 type MembershipFilter struct {
-	email *mail.Addr
-	role  *MembershipRole
-	state *MembershipState
+	email  *mail.Addr
+	role   *MembershipRole
+	state  *MembershipState
+	source *MembershipSource
 }
 
 func NewMembershipFilter() *MembershipFilter {
@@ -56,11 +57,21 @@ func (f *MembershipFilter) State() *MembershipState {
 	return f.state
 }
 
+func (f *MembershipFilter) WithSource(source MembershipSource) *MembershipFilter {
+	f.source = &source
+	return f
+}
+
+func (f *MembershipFilter) Source() *MembershipSource {
+	return f.source
+}
+
 func (f *MembershipFilter) SQLArguments() pgx.StrictNamedArgs {
 	return pgx.StrictNamedArgs{
-		"filter_email": f.email,
-		"filter_role":  f.role,
-		"filter_state": f.state,
+		"filter_email":  f.email,
+		"filter_role":   f.role,
+		"filter_state":  f.state,
+		"filter_source": f.source,
 	}
 }
 
@@ -86,5 +97,12 @@ AND (
 			m.state = @filter_state::membership_state
 		ELSE TRUE
 	END
+)
+AND (
+	CASE
+		WHEN @filter_source::text IS NOT NULL THEN
+			m.source = @filter_source::text
+		ELSE TRUE
+	END
 )`
 }
diff --git a/pkg/iam/scim/service.go b/pkg/iam/scim/service.go
index 72a0a6e21..4405570d1 100644
--- a/pkg/iam/scim/service.go
+++ b/pkg/iam/scim/service.go
@@ -294,6 +294,13 @@ func (s *Service) ListUsers(
 		return nil, 0, err
 	}
 
+	// Only return SCIM-managed users. This ensures that:
+	// 1. Users created through other means (manual, SAML) are not deactivated
+	//    when they don't exist in the identity provider.
+	// 2. When a manual user exists in the identity provider but not in the
+	//    SCIM list, CreateUser is called which enrolls them into SCIM management.
+	filter.WithSource(coredata.MembershipSourceSCIM)
+
 	scope := coredata.NewScopeFromObjectID(config.OrganizationID)
 
 	var memberships coredata.Memberships