Disallow delete membership when managed by SCIM

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

apps/console/src/pages/iam/organizations/settings/_components/MemberListItem.tsx

@@ -142,7 +142,8 @@ export function MemberListItem(props: {
                 <Spinner size={16} />
               ) : (
                 membership.canDelete &&
-                canEditThisRole && (
+                canEditThisRole &&
+                membership.source !== "SCIM" && (
                   <Button
                     variant="danger"
                     onClick={handleRemove}

pkg/iam/errors.go

@@ -135,6 +135,18 @@ func (e ErrMembershipInactive) Error() string {
 	return fmt.Sprintf("membership %q is inactive", e.MembershipID)
 }
 
+type ErrMembershipManagedBySCIM struct {
+	MembershipID gid.GID
+}
+
+func NewMembershipManagedBySCIMError(membershipID gid.GID) error {
+	return &ErrMembershipManagedBySCIM{MembershipID: membershipID}
+}
+
+func (e ErrMembershipManagedBySCIM) Error() string {
+	return fmt.Sprintf("membership %q is managed by SCIM and cannot be deleted manually", e.MembershipID)
+}
+
 type ErrOrganizationNotFound struct{ OrganizationID gid.GID }
 
 func NewOrganizationNotFoundError(organizationID gid.GID) error {

pkg/iam/organization_service.go

@@ -253,6 +253,10 @@ func (s *OrganizationService) RemoveMember(
 				return NewMembershipNotFoundError(membership.ID)
 			}
 
+			if membership.Source == coredata.MembershipSourceSCIM {
+				return NewMembershipManagedBySCIMError(membershipID)
+			}
+
 			err := membership.Delete(ctx, tx, scope, membershipID)
 			if err != nil {
 				return fmt.Errorf("cannot delete membership: %w", err)

pkg/server/api/connect/v1/v1_resolver.go

@@ -967,6 +967,11 @@ func (r *mutationResolver) RemoveMember(ctx context.Context, input types.RemoveM
 
 	err := r.iam.OrganizationService.RemoveMember(ctx, input.OrganizationID, input.MembershipID)
 	if err != nil {
+		var errManagedBySCIM *iam.ErrMembershipManagedBySCIM
+		if errors.As(err, &errManagedBySCIM) {
+			return nil, gqlutils.Conflict(err)
+		}
+
 		r.logger.ErrorCtx(ctx, "cannot remove member from organization", log.Error(err))
 		return nil, gqlutils.InternalServerError(ctx)
 	}