Fix SCIM disable all non SCIM managed members

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/coredata/membership_filter.go

@@ -23,6 +23,7 @@ type MembershipFilter struct {
 	email  *mail.Addr
 	role   *MembershipRole
 	state  *MembershipState
+	source *MembershipSource
 }
 
 func NewMembershipFilter() *MembershipFilter {
@@ -56,11 +57,21 @@ func (f *MembershipFilter) State() *MembershipState {
 	return f.state
 }
 
+func (f *MembershipFilter) WithSource(source MembershipSource) *MembershipFilter {
+	f.source = &source
+	return f
+}
+
+func (f *MembershipFilter) Source() *MembershipSource {
+	return f.source
+}
+
 func (f *MembershipFilter) SQLArguments() pgx.StrictNamedArgs {
 	return pgx.StrictNamedArgs{
 		"filter_email":  f.email,
 		"filter_role":   f.role,
 		"filter_state":  f.state,
+		"filter_source": f.source,
 	}
 }
 
@@ -86,5 +97,12 @@ AND (
 			m.state = @filter_state::membership_state
 		ELSE TRUE
 	END
+)
+AND (
+	CASE
+		WHEN @filter_source::text IS NOT NULL THEN
+			m.source = @filter_source::text
+		ELSE TRUE
+	END
 )`
 }

pkg/iam/scim/service.go

@@ -294,6 +294,13 @@ func (s *Service) ListUsers(
 		return nil, 0, err
 	}
 
+	// Only return SCIM-managed users. This ensures that:
+	// 1. Users created through other means (manual, SAML) are not deactivated
+	//    when they don't exist in the identity provider.
+	// 2. When a manual user exists in the identity provider but not in the
+	//    SCIM list, CreateUser is called which enrolls them into SCIM management.
+	filter.WithSource(coredata.MembershipSourceSCIM)
+
 	scope := coredata.NewScopeFromObjectID(config.OrganizationID)
 
 	var memberships coredata.Memberships