Disallow delete membership when managed by SCIM

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/iam/errors.go

@@ -135,6 +135,18 @@ func (e ErrMembershipInactive) Error() string {
 	return fmt.Sprintf("membership %q is inactive", e.MembershipID)
 }
 
+type ErrMembershipManagedBySCIM struct {
+	MembershipID gid.GID
+}
+
+func NewMembershipManagedBySCIMError(membershipID gid.GID) error {
+	return &ErrMembershipManagedBySCIM{MembershipID: membershipID}
+}
+
+func (e ErrMembershipManagedBySCIM) Error() string {
+	return fmt.Sprintf("membership %q is managed by SCIM and cannot be deleted manually", e.MembershipID)
+}
+
 type ErrOrganizationNotFound struct{ OrganizationID gid.GID }
 
 func NewOrganizationNotFoundError(organizationID gid.GID) error {

pkg/iam/organization_service.go

@@ -253,6 +253,10 @@ func (s *OrganizationService) RemoveMember(
 				return NewMembershipNotFoundError(membership.ID)
 			}
 
+			if membership.Source == coredata.MembershipSourceSCIM {
+				return NewMembershipManagedBySCIMError(membershipID)
+			}
+
 			err := membership.Delete(ctx, tx, scope, membershipID)
 			if err != nil {
 				return fmt.Errorf("cannot delete membership: %w", err)