From c6c6e29d73ad584abf4ba2ae174eb2de650a36fc Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Mon, 9 Mar 2026 16:21:22 +0100
Subject: [PATCH] Fix delete does not completly remove the record

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 pkg/iam/scim/service.go | 47 +++++++++++++++++++++++------------------
 1 file changed, 26 insertions(+), 21 deletions(-)

diff --git a/pkg/iam/scim/service.go b/pkg/iam/scim/service.go
index a9c254bd0..bb54ba52c 100644
--- a/pkg/iam/scim/service.go
+++ b/pkg/iam/scim/service.go
@@ -296,10 +296,7 @@ func (s *Service) GetUser(
 ) (scim.Resource, error) {
 	scope := coredata.NewScopeFromObjectID(config.OrganizationID)
 
-	var (
-		profile    *coredata.MembershipProfile
-		membership *coredata.Membership
-	)
+	var profile *coredata.MembershipProfile
 
 	err := s.pg.WithConn(
 		ctx,
@@ -309,24 +306,13 @@ func (s *Service) GetUser(
 				if err == coredata.ErrResourceNotFound {
 					return scimerrors.ScimErrorResourceNotFound(profileID.String())
 				}
-				return fmt.Errorf("cannot load membership: %w", err)
+				return fmt.Errorf("cannot load profile: %w", err)
 			}
 
 			if profile.OrganizationID != config.OrganizationID {
 				return scimerrors.ScimErrorResourceNotFound(profileID.String())
 			}
 
-			membership = &coredata.Membership{}
-			if err := membership.LoadByIdentityIDAndOrganizationID(
-				ctx,
-				conn,
-				scope,
-				profile.IdentityID,
-				profile.OrganizationID,
-			); err != nil {
-				return fmt.Errorf("cannot load membership: %w", err)
-			}
-
 			return nil
 		},
 	)
@@ -580,18 +566,37 @@ func (s *Service) DeleteUser(
 				return scimerrors.ScimErrorResourceNotFound(profileID.String())
 			}
 
+			invitations := &coredata.Invitations{}
+			onlyPending := coredata.NewInvitationFilter([]coredata.InvitationStatus{coredata.InvitationStatusPending})
+			if err := invitations.ExpireByUserID(
+				ctx,
+				tx,
+				scope,
+				profile.ID,
+				onlyPending,
+			); err != nil {
+				return fmt.Errorf("cannot expire pending invitations: %w", err)
+			}
+
 			membership := &coredata.Membership{}
 			if err := membership.LoadByIdentityIDAndOrganizationID(
 				ctx, tx, scope, profile.IdentityID, config.OrganizationID,
 			); err != nil {
-				if errors.Is(err, coredata.ErrResourceNotFound) {
-					return scimerrors.ScimErrorResourceNotFound(profileID.String())
+				if !errors.Is(err, coredata.ErrResourceNotFound) {
+					return fmt.Errorf("cannot load membership: %w", err)
+				}
+			} else {
+				if err := membership.Delete(ctx, tx, scope, membership.ID); err != nil {
+					return fmt.Errorf("cannot delete membership: %w", err)
 				}
-				return fmt.Errorf("cannot load membership: %w", err)
 			}
 
-			if err := membership.Delete(ctx, tx, scope, membership.ID); err != nil {
-				return fmt.Errorf("cannot delete membership: %w", err)
+			if err := profile.Delete(ctx, tx, scope, profile.ID); err != nil {
+				return fmt.Errorf("cannot delete profile: %w", err)
+			}
+
+			if err := webhook.InsertData(ctx, tx, scope, config.OrganizationID, coredata.WebhookEventTypeUserDeleted, webhooktypes.NewUser(profile)); err != nil {
+				return fmt.Errorf("cannot insert webhook event: %w", err)
 			}
 
 			return nil