Add scim bridge with connector

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/coredata/connector.go

@@ -150,6 +150,110 @@ func (c *Connectors) LoadAllByOrganizationIDWithoutDecryptedConnection(
 	return c.loadAllByOrganizationID(ctx, conn, scope, organizationID)
 }
 
+func (c *Connector) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	connectorID gid.GID,
+	encryptionKey cipher.EncryptionKey,
+) error {
+	if err := c.LoadMetadataByID(ctx, conn, scope, connectorID); err != nil {
+		return err
+	}
+
+	// Decrypt the connection
+	if len(c.EncryptedConnection) > 0 {
+		decryptedConnection, err := cipher.Decrypt(c.EncryptedConnection, encryptionKey)
+		if err != nil {
+			return fmt.Errorf("cannot decrypt connection: %w", err)
+		}
+
+		c.Connection, err = connector.UnmarshalConnection(c.Protocol.String(), c.Provider.String(), decryptedConnection)
+		if err != nil {
+			return fmt.Errorf("cannot unmarshal connection: %w", err)
+		}
+
+		c.populateSlackSettings()
+	}
+
+	return nil
+}
+
+// LoadMetadataByID loads connector metadata without decrypting the connection.
+// Use this when you only need provider, organization, or other metadata.
+func (c *Connector) LoadMetadataByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	connectorID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    provider,
+    protocol,
+    settings,
+    encrypted_connection,
+    created_at,
+    updated_at
+FROM
+    connectors
+WHERE
+    %s
+    AND id = @id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": connectorID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query connectors: %w", err)
+	}
+
+	loadedConnector, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Connector])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+		return fmt.Errorf("cannot collect connector row: %w", err)
+	}
+
+	*c = loadedConnector
+
+	return nil
+}
+
+func (c *Connector) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM connectors
+WHERE %s AND id = @id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": c.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete connector: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	return nil
+}
+
 func (c *Connector) Insert(
 	ctx context.Context,
 	conn pg.Conn,

pkg/coredata/connector_provider.go

@@ -22,12 +22,14 @@ import (
 type ConnectorProvider string
 
 const (
-	ConnectorProviderSlack ConnectorProvider = "SLACK"
+	ConnectorProviderSlack           ConnectorProvider = "SLACK"
+	ConnectorProviderGoogleWorkspace ConnectorProvider = "GOOGLE_WORKSPACE"
 )
 
 func ConnectorProviders() []ConnectorProvider {
 	return []ConnectorProvider{
 		ConnectorProviderSlack,
+		ConnectorProviderGoogleWorkspace,
 	}
 }
 
@@ -49,6 +51,8 @@ func (cp *ConnectorProvider) Scan(value any) error {
 	switch s {
 	case "SLACK":
 		*cp = ConnectorProviderSlack
+	case "GOOGLE_WORKSPACE":
+		*cp = ConnectorProviderGoogleWorkspace
 	default:
 		return fmt.Errorf("invalid ConnectorProvider value: %q", s)
 	}

pkg/coredata/entity_type_reg.go

@@ -78,6 +78,7 @@ const (
 	SCIMConfigurationEntityType                uint16 = 52
 	SCIMEventEntityType                        uint16 = 53
 	TokenEntityType                            uint16 = 54
+	SCIMBridgeEntityType                       uint16 = 55
 )
 
 func NewEntityFromID(id gid.GID) (any, bool) {
@@ -190,6 +191,8 @@ func NewEntityFromID(id gid.GID) (any, bool) {
 		return &SCIMEvent{ID: id}, true
 	case TokenEntityType:
 		return &Token{ID: id}, true
+	case SCIMBridgeEntityType:
+		return &SCIMBridge{ID: id}, true
 	default:
 		return nil, false
 	}

pkg/coredata/migrations/20260127T120000Z.sql

@@ -0,0 +1,12 @@
+CREATE TABLE iam_scim_bridges (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+    scim_configuration_id TEXT NOT NULL REFERENCES iam_scim_configurations(id) ON DELETE CASCADE,
+    connector_id TEXT REFERENCES connectors(id) ON DELETE SET NULL,
+    type TEXT NOT NULL,
+    state TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    CONSTRAINT iam_scim_bridges_scim_configuration_unique UNIQUE (scim_configuration_id)
+);

pkg/coredata/migrations/20260129T041655Z.sql

@@ -0,0 +1 @@
+ALTER TYPE connector_provider ADD VALUE 'GOOGLE_WORKSPACE';

pkg/coredata/scim_bridge.go

@@ -0,0 +1,323 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	SCIMBridge struct {
+		ID                  gid.GID         `db:"id"`
+		OrganizationID      gid.GID         `db:"organization_id"`
+		ScimConfigurationID gid.GID         `db:"scim_configuration_id"`
+		ConnectorID         *gid.GID        `db:"connector_id"`
+		Type                SCIMBridgeType  `db:"type"`
+		State               SCIMBridgeState `db:"state"`
+		CreatedAt           time.Time       `db:"created_at"`
+		UpdatedAt           time.Time       `db:"updated_at"`
+	}
+
+	SCIMBridges []*SCIMBridge
+)
+
+func (s *SCIMBridge) CursorKey(orderBy SCIMBridgeOrderField) page.CursorKey {
+	switch orderBy {
+	case SCIMBridgeOrderFieldCreatedAt:
+		return page.NewCursorKey(s.ID, s.CreatedAt)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (s *SCIMBridge) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) {
+	q := `SELECT organization_id FROM iam_scim_bridges WHERE id = $1 LIMIT 1;`
+
+	var organizationID gid.GID
+	if err := conn.QueryRow(ctx, q, s.ID).Scan(&organizationID); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrResourceNotFound
+		}
+		return nil, fmt.Errorf("cannot query scim bridge authorization attributes: %w", err)
+	}
+
+	return map[string]string{"organization_id": organizationID.String()}, nil
+}
+
+func (s *SCIMBridge) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	bridgeID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    scim_configuration_id,
+    connector_id,
+    type,
+    state,
+    created_at,
+    updated_at
+FROM
+    iam_scim_bridges
+WHERE
+    %s
+    AND id = @id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": bridgeID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_bridges: %w", err)
+	}
+
+	bridge, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SCIMBridge])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect scim_bridge: %w", err)
+	}
+
+	*s = bridge
+
+	return nil
+}
+
+func (s *SCIMBridge) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    scim_configuration_id,
+    connector_id,
+    type,
+    state,
+    created_at,
+    updated_at
+FROM
+    iam_scim_bridges
+WHERE
+    %s
+    AND organization_id = @organization_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_bridges: %w", err)
+	}
+
+	bridge, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SCIMBridge])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect scim_bridge: %w", err)
+	}
+
+	*s = bridge
+
+	return nil
+}
+
+func (s *SCIMBridge) LoadBySCIMConfigurationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	scimConfigurationID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    scim_configuration_id,
+    connector_id,
+    type,
+    state,
+    created_at,
+    updated_at
+FROM
+    iam_scim_bridges
+WHERE
+    %s
+    AND scim_configuration_id = @scim_configuration_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"scim_configuration_id": scimConfigurationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_bridges: %w", err)
+	}
+
+	bridge, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SCIMBridge])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect scim_bridge: %w", err)
+	}
+
+	*s = bridge
+
+	return nil
+}
+
+func (s *SCIMBridge) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO iam_scim_bridges (
+    id,
+    tenant_id,
+    organization_id,
+    scim_configuration_id,
+    connector_id,
+    type,
+    state,
+    created_at,
+    updated_at
+) VALUES (
+    @id,
+    @tenant_id,
+    @organization_id,
+    @scim_configuration_id,
+    @connector_id,
+    @type,
+    @state,
+    @created_at,
+    @updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":                    s.ID,
+		"tenant_id":             scope.GetTenantID(),
+		"organization_id":       s.OrganizationID,
+		"scim_configuration_id": s.ScimConfigurationID,
+		"connector_id":          s.ConnectorID,
+		"type":                  s.Type,
+		"state":                 s.State,
+		"created_at":            s.CreatedAt,
+		"updated_at":            s.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert scim_bridge: %w", err)
+	}
+
+	return nil
+}
+
+func (s *SCIMBridge) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE iam_scim_bridges
+SET
+    connector_id = @connector_id,
+    state = @state,
+    updated_at = @updated_at
+WHERE
+    %s
+    AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":           s.ID,
+		"connector_id": s.ConnectorID,
+		"state":        s.State,
+		"updated_at":   s.UpdatedAt,
+	}
+
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update scim_bridge: %w", err)
+	}
+
+	return nil
+}
+
+func (s *SCIMBridge) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM iam_scim_bridges
+WHERE
+    %s
+    AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": s.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete scim_bridge: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	return nil
+}

pkg/coredata/scim_bridge_order_field.go

@@ -0,0 +1,40 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	SCIMBridgeOrderField string
+)
+
+const (
+	SCIMBridgeOrderFieldCreatedAt SCIMBridgeOrderField = "CREATED_AT"
+)
+
+func (p SCIMBridgeOrderField) Column() string {
+	return string(p)
+}
+
+func (p SCIMBridgeOrderField) String() string {
+	return string(p)
+}
+
+func (p SCIMBridgeOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *SCIMBridgeOrderField) UnmarshalText(text []byte) error {
+	*p = SCIMBridgeOrderField(text)
+	return nil
+}

pkg/coredata/scim_bridge_state.go

@@ -0,0 +1,60 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type SCIMBridgeState string
+
+const (
+	SCIMBridgeStatePending SCIMBridgeState = "PENDING"
+	SCIMBridgeStateActive  SCIMBridgeState = "ACTIVE"
+	SCIMBridgeStateFailed  SCIMBridgeState = "FAILED"
+)
+
+func (s SCIMBridgeState) String() string {
+	return string(s)
+}
+
+func (s *SCIMBridgeState) Scan(value any) error {
+	var str string
+	switch v := value.(type) {
+	case string:
+		str = v
+	case []byte:
+		str = string(v)
+	default:
+		return fmt.Errorf("unsupported type for SCIMBridgeState: %T", value)
+	}
+
+	switch str {
+	case "PENDING":
+		*s = SCIMBridgeStatePending
+	case "ACTIVE":
+		*s = SCIMBridgeStateActive
+	case "FAILED":
+		*s = SCIMBridgeStateFailed
+	default:
+		return fmt.Errorf("invalid SCIMBridgeState value: %q", str)
+	}
+	return nil
+}
+
+func (s SCIMBridgeState) Value() (driver.Value, error) {
+	return s.String(), nil
+}

pkg/coredata/scim_bridge_type.go

@@ -0,0 +1,54 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type SCIMBridgeType string
+
+const (
+	SCIMBridgeTypeGoogleWorkspace SCIMBridgeType = "GOOGLE_WORKSPACE"
+)
+
+func (t SCIMBridgeType) String() string {
+	return string(t)
+}
+
+func (t *SCIMBridgeType) Scan(value any) error {
+	var str string
+	switch v := value.(type) {
+	case string:
+		str = v
+	case []byte:
+		str = string(v)
+	default:
+		return fmt.Errorf("unsupported type for SCIMBridgeType: %T", value)
+	}
+
+	switch str {
+	case "GOOGLE_WORKSPACE":
+		*t = SCIMBridgeTypeGoogleWorkspace
+	default:
+		return fmt.Errorf("invalid SCIMBridgeType value: %q", str)
+	}
+	return nil
+}
+
+func (t SCIMBridgeType) Value() (driver.Value, error) {
+	return t.String(), nil
+}

pkg/coredata/scim_configuration.go

@@ -32,6 +32,7 @@ type (
 	SCIMConfiguration struct {
 		ID             gid.GID   `db:"id"`
 		OrganizationID gid.GID   `db:"organization_id"`
+		BridgeID       *gid.GID  `db:"bridge_id"`
 		HashedToken    []byte    `db:"hashed_token"`
 		CreatedAt      time.Time `db:"created_at"`
 		UpdatedAt      time.Time `db:"updated_at"`
@@ -70,18 +71,31 @@ func (s *SCIMConfiguration) LoadByID(
 	configID gid.GID,
 ) error {
 	q := `
+WITH scim_config AS (
+    SELECT
+        id,
+        organization_id,
+        hashed_token,
+        created_at,
+        updated_at
+    FROM
+        iam_scim_configurations
+    WHERE
+        %s
+        AND id = @id
+    LIMIT 1
+)
 SELECT
-    id,
-    organization_id,
-    hashed_token,
-    created_at,
-    updated_at
+    sc.id,
+    sc.organization_id,
+    b.id AS bridge_id,
+    sc.hashed_token,
+    sc.created_at,
+    sc.updated_at
 FROM
-    iam_scim_configurations
-WHERE
-    %s
-    AND id = @id
-LIMIT 1;
+    scim_config sc
+LEFT JOIN
+    iam_scim_bridges b ON b.scim_configuration_id = sc.id;
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
@@ -115,18 +129,31 @@ func (s *SCIMConfiguration) LoadByOrganizationID(
 	organizationID gid.GID,
 ) error {
 	q := `
+WITH scim_config AS (
+    SELECT
+        id,
+        organization_id,
+        hashed_token,
+        created_at,
+        updated_at
+    FROM
+        iam_scim_configurations
+    WHERE
+        %s
+        AND organization_id = @organization_id
+    LIMIT 1
+)
 SELECT
-    id,
-    organization_id,
-    hashed_token,
-    created_at,
-    updated_at
+    sc.id,
+    sc.organization_id,
+    b.id AS bridge_id,
+    sc.hashed_token,
+    sc.created_at,
+    sc.updated_at
 FROM
-    iam_scim_configurations
-WHERE
-    %s
-    AND organization_id = @organization_id
-LIMIT 1;
+    scim_config sc
+LEFT JOIN
+    iam_scim_bridges b ON b.scim_configuration_id = sc.id;
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
@@ -159,17 +186,30 @@ func (s *SCIMConfiguration) LoadByHashedToken(
 	hashedToken []byte,
 ) error {
 	q := `
+WITH scim_config AS (
+    SELECT
+        id,
+        organization_id,
+        hashed_token,
+        created_at,
+        updated_at
+    FROM
+        iam_scim_configurations
+    WHERE
+        hashed_token = @hashed_token
+    LIMIT 1
+)
 SELECT
-    id,
-    organization_id,
-    hashed_token,
-    created_at,
-    updated_at
+    sc.id,
+    sc.organization_id,
+    b.id AS bridge_id,
+    sc.hashed_token,
+    sc.created_at,
+    sc.updated_at
 FROM
-    iam_scim_configurations
-WHERE
-    hashed_token = @hashed_token
-LIMIT 1;
+    scim_config sc
+LEFT JOIN
+    iam_scim_bridges b ON b.scim_configuration_id = sc.id;
 `
 
 	args := pgx.StrictNamedArgs{"hashed_token": hashedToken}