From 784c88895af14fc50c153d6f80f91ebe0c7eb2b4 Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Tue, 24 Mar 2026 10:38:12 +0100
Subject: [PATCH] Allow editing non-SCIM fields on SCIM-managed profiles

Contract start and end dates are never synced by SCIM, so they
should remain editable even when a profile is SCIM-managed.
The backend now skips overwriting SCIM-synced fields (fullName,
kind, position, additionalEmailAddresses) for SCIM profiles,
and the frontend disables only those fields instead of the
entire form.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 .../organizations/people/_components/PersonForm.tsx | 13 ++++++++-----
 pkg/iam/organization_service.go                     | 10 ++++++----
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/apps/console/src/pages/iam/organizations/people/_components/PersonForm.tsx b/apps/console/src/pages/iam/organizations/people/_components/PersonForm.tsx
index 3aadbe16e..bf6f85e0a 100644
--- a/apps/console/src/pages/iam/organizations/people/_components/PersonForm.tsx
+++ b/apps/console/src/pages/iam/organizations/people/_components/PersonForm.tsx
@@ -77,6 +77,7 @@ export function PersonForm(props: {
   id?: string;
   connectionId?: DataID;
   disabled?: boolean;
+  scimManaged?: boolean;
   defaultValues?: z.infer<typeof schema>;
   onSubmit?: () => void;
 }) {
@@ -84,6 +85,7 @@ export function PersonForm(props: {
     id,
     connectionId = "",
     disabled = false,
+    scimManaged = false,
     defaultValues = {
       fullName: "",
       emailAddress: "",
@@ -162,7 +164,7 @@ export function PersonForm(props: {
 
   return (
     <form onSubmit={e => void handleSubmit(e)} className="space-y-4">
-      <Field label={__("Full name *")} {...register("fullName")} type="text" disabled={disabled} />
+      <Field label={__("Full name *")} {...register("fullName")} type="text" disabled={disabled || scimManaged} />
       {id
         ? (
             <>
@@ -223,7 +225,7 @@ export function PersonForm(props: {
         name="kind"
         type="select"
         label={__("Type")}
-        disabled={disabled}
+        disabled={disabled || scimManaged}
       >
         {getRoles(__).map(role => (
           <Option key={role.value} value={role.value}>
@@ -236,9 +238,9 @@ export function PersonForm(props: {
         {...register("position")}
         type="text"
         placeholder={__("e.g. CEO, CFO, etc.")}
-        disabled={disabled}
+        disabled={disabled || scimManaged}
       />
-      <EmailsField control={control} register={register} disabled={disabled} />
+      <EmailsField control={control} register={register} disabled={disabled || scimManaged} />
       <Field label={__("Contract start date")}>
         <Input
           {...register("contractStartDate")}
@@ -272,7 +274,8 @@ export function PersonFormLoader(props: { fragmentRef: PersonFormFragment$key })
   return (
     <PersonForm
       id={person.id}
-      disabled={!person.canUpdate || person.source === "SCIM"}
+      disabled={!person.canUpdate}
+      scimManaged={person.source === "SCIM"}
       defaultValues={
         {
           kind: person.kind,
diff --git a/pkg/iam/organization_service.go b/pkg/iam/organization_service.go
index 7fd49c791..1c9fad9d6 100644
--- a/pkg/iam/organization_service.go
+++ b/pkg/iam/organization_service.go
@@ -977,10 +977,12 @@ func (s *OrganizationService) UpdateUser(ctx context.Context, req *UpdateUserReq
 				return fmt.Errorf("cannot load profile: %w", err)
 			}
 
-			profile.FullName = req.FullName
-			profile.Kind = req.Kind
-			profile.AdditionalEmailAddresses = req.AdditionalEmailAddresses
-			profile.Position = req.Position
+			if profile.Source != coredata.ProfileSourceSCIM {
+				profile.FullName = req.FullName
+				profile.Kind = req.Kind
+				profile.AdditionalEmailAddresses = req.AdditionalEmailAddresses
+				profile.Position = req.Position
+			}
 
 			if req.ContractStartDate != nil {
 				profile.ContractStartDate = *req.ContractStartDate