From 9936df64d926e9dfb0fbb3610908273293db910b Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Mon, 5 Jan 2026 16:02:51 +0100
Subject: [PATCH] Disallow delete membership when managed by SCIM

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 .../settings/_components/MemberListItem.tsx          |  3 ++-
 pkg/iam/errors.go                                    | 12 ++++++++++++
 pkg/iam/organization_service.go                      |  4 ++++
 pkg/server/api/connect/v1/v1_resolver.go             |  5 +++++
 4 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/apps/console/src/pages/iam/organizations/settings/_components/MemberListItem.tsx b/apps/console/src/pages/iam/organizations/settings/_components/MemberListItem.tsx
index e14f2568d..f6494e09d 100644
--- a/apps/console/src/pages/iam/organizations/settings/_components/MemberListItem.tsx
+++ b/apps/console/src/pages/iam/organizations/settings/_components/MemberListItem.tsx
@@ -142,7 +142,8 @@ export function MemberListItem(props: {
                 <Spinner size={16} />
               ) : (
                 membership.canDelete &&
-                canEditThisRole && (
+                canEditThisRole &&
+                membership.source !== "SCIM" && (
                   <Button
                     variant="danger"
                     onClick={handleRemove}
diff --git a/pkg/iam/errors.go b/pkg/iam/errors.go
index 3cbd2bdfa..cb02cb1d3 100644
--- a/pkg/iam/errors.go
+++ b/pkg/iam/errors.go
@@ -135,6 +135,18 @@ func (e ErrMembershipInactive) Error() string {
 	return fmt.Sprintf("membership %q is inactive", e.MembershipID)
 }
 
+type ErrMembershipManagedBySCIM struct {
+	MembershipID gid.GID
+}
+
+func NewMembershipManagedBySCIMError(membershipID gid.GID) error {
+	return &ErrMembershipManagedBySCIM{MembershipID: membershipID}
+}
+
+func (e ErrMembershipManagedBySCIM) Error() string {
+	return fmt.Sprintf("membership %q is managed by SCIM and cannot be deleted manually", e.MembershipID)
+}
+
 type ErrOrganizationNotFound struct{ OrganizationID gid.GID }
 
 func NewOrganizationNotFoundError(organizationID gid.GID) error {
diff --git a/pkg/iam/organization_service.go b/pkg/iam/organization_service.go
index 3a28dc4e7..cc5521cac 100644
--- a/pkg/iam/organization_service.go
+++ b/pkg/iam/organization_service.go
@@ -253,6 +253,10 @@ func (s *OrganizationService) RemoveMember(
 				return NewMembershipNotFoundError(membership.ID)
 			}
 
+			if membership.Source == coredata.MembershipSourceSCIM {
+				return NewMembershipManagedBySCIMError(membershipID)
+			}
+
 			err := membership.Delete(ctx, tx, scope, membershipID)
 			if err != nil {
 				return fmt.Errorf("cannot delete membership: %w", err)
diff --git a/pkg/server/api/connect/v1/v1_resolver.go b/pkg/server/api/connect/v1/v1_resolver.go
index c23e38f7b..ae86dadaa 100644
--- a/pkg/server/api/connect/v1/v1_resolver.go
+++ b/pkg/server/api/connect/v1/v1_resolver.go
@@ -967,6 +967,11 @@ func (r *mutationResolver) RemoveMember(ctx context.Context, input types.RemoveM
 
 	err := r.iam.OrganizationService.RemoveMember(ctx, input.OrganizationID, input.MembershipID)
 	if err != nil {
+		var errManagedBySCIM *iam.ErrMembershipManagedBySCIM
+		if errors.As(err, &errManagedBySCIM) {
+			return nil, gqlutils.Conflict(err)
+		}
+
 		r.logger.ErrorCtx(ctx, "cannot remove member from organization", log.Error(err))
 		return nil, gqlutils.InternalServerError(ctx)
 	}