Fix re-activitating membership does not reset the role

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/iam/scim/service.go

@@ -176,8 +176,12 @@ func (s *Service) CreateUser(
 			return fmt.Errorf("cannot load membership: %w", err)
 		} else {
 			// Update existing membership - reactivate if inactive, update source to SCIM
+			wasInactive := membership.State == coredata.MembershipStateInactive
 			membership.Source = coredata.MembershipSourceSCIM
 			membership.State = coredata.MembershipStateActive
+			if wasInactive {
+				membership.Role = coredata.MembershipRoleViewer
+			}
 			membership.UpdatedAt = now
 
 			err = membership.Update(ctx, tx, scope)
@@ -232,7 +236,6 @@ func (s *Service) GetUser(
 	return membershipToResource(membership), nil
 }
 
-// ListUsers lists all users in an organization, with optional filter support
 func (s *Service) ListUsers(
 	ctx context.Context,
 	config *coredata.SCIMConfiguration,
@@ -297,6 +300,7 @@ func (s *Service) ReplaceUser(
 	if err != nil {
 		return scim.Resource{}, err
 	}
+
 	return membershipToResource(membership), nil
 }
 
@@ -311,6 +315,7 @@ func (s *Service) PatchUser(
 	if err != nil {
 		return scim.Resource{}, err
 	}
+
 	return membershipToResource(membership), nil
 }
 
@@ -326,7 +331,9 @@ func (s *Service) updateUser(
 
 	var membership *coredata.Membership
 
-	err := s.pg.WithTx(ctx, func(tx pg.Conn) error {
+	err := s.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
 			membership = &coredata.Membership{}
 			err := membership.LoadByID(ctx, tx, scope, membershipID)
 			if err != nil {
@@ -345,6 +352,7 @@ func (s *Service) updateUser(
 			if active != nil {
 				if *active && membership.State == coredata.MembershipStateInactive {
 					membership.State = coredata.MembershipStateActive
+					membership.Role = coredata.MembershipRoleViewer
 					needsUpdate = true
 				} else if !*active && membership.State == coredata.MembershipStateActive {
 					membership.State = coredata.MembershipStateInactive
@@ -380,7 +388,8 @@ func (s *Service) updateUser(
 			}
 
 			return nil
-	})
+		},
+	)
 
 	if err != nil {
 		return nil, err