From d3467c0a05ab85d9b245b8d31f80ee938c0c32b9 Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Wed, 12 Nov 2025 09:28:33 +0100
Subject: [PATCH] Make SAML role mapping optional

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 pkg/auth/saml_mapper.go  |  7 ++++---
 pkg/auth/saml_service.go |  2 +-
 pkg/authz/service.go     | 13 +++++++++----
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/pkg/auth/saml_mapper.go b/pkg/auth/saml_mapper.go
index 69d55ede1..f63f41a47 100644
--- a/pkg/auth/saml_mapper.go
+++ b/pkg/auth/saml_mapper.go
@@ -77,12 +77,13 @@ func ExtractEmailDomain(email string) (string, error) {
 	return domain, nil
 }
 
-func MapSAMLRoleToSystemRole(samlRole string) coredata.Role {
+func MapSAMLRoleToSystemRole(samlRole string) *coredata.Role {
 	if samlRole != "" && isValidRole(samlRole) {
-		return coredata.Role(samlRole)
+		role := coredata.Role(samlRole)
+		return &role
 	}
 
-	return coredata.RoleMember
+	return nil
 }
 
 func isValidRole(role string) bool {
diff --git a/pkg/auth/saml_service.go b/pkg/auth/saml_service.go
index a18c956db..f91767e62 100644
--- a/pkg/auth/saml_service.go
+++ b/pkg/auth/saml_service.go
@@ -407,7 +407,7 @@ func (s *SAMLService) InitiateSAMLLogin(
 type SAMLUserInfo struct {
 	Email          string
 	FullName       string
-	Role           coredata.Role
+	Role           *coredata.Role
 	SAMLSubject    string
 	OrganizationID gid.GID
 	SAMLConfigID   gid.GID
diff --git a/pkg/authz/service.go b/pkg/authz/service.go
index 5692273b5..b1445468b 100644
--- a/pkg/authz/service.go
+++ b/pkg/authz/service.go
@@ -827,7 +827,7 @@ func (s *TenantAuthzService) EnsureSAMLMembership(
 	ctx context.Context,
 	userID gid.GID,
 	organizationID gid.GID,
-	role coredata.Role,
+	role *coredata.Role,
 ) error {
 	now := time.Now()
 
@@ -842,12 +842,17 @@ func (s *TenantAuthzService) EnsureSAMLMembership(
 					return fmt.Errorf("cannot load membership: %w", err)
 				}
 
+				membershipRole := coredata.RoleMember
+				if role != nil {
+					membershipRole = *role
+				}
+
 				membershipID := gid.New(s.scope.GetTenantID(), coredata.MembershipEntityType)
 				membership = coredata.Membership{
 					ID:             membershipID,
 					UserID:         userID,
 					OrganizationID: organizationID,
-					Role:           role,
+					Role:           membershipRole,
 					CreatedAt:      now,
 					UpdatedAt:      now,
 				}
@@ -859,8 +864,8 @@ func (s *TenantAuthzService) EnsureSAMLMembership(
 				return nil
 			}
 
-			if membership.Role != role {
-				membership.Role = role
+			if role != nil && membership.Role != *role {
+				membership.Role = *role
 				membership.UpdatedAt = now
 
 				if err := membership.Update(ctx, tx, s.scope); err != nil {