From e42e6407df9d4902b132e6c596fbf0678c9682f3 Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Sun, 1 Feb 2026 21:56:17 +0100
Subject: [PATCH] Fix AI review

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 .../settings/_components/SCIMConfiguration.tsx   |  8 ++++----
 pkg/coredata/connector.go                        |  6 +++++-
 pkg/coredata/migrations/20260129T120000Z.sql     |  2 --
 pkg/coredata/migrations/20260201T120000Z.sql     |  6 ++++--
 pkg/iam/scim/bridge/client/client.go             |  2 +-
 pkg/iam/scim/bridge_runner_backoff.go            | 16 +++++++++++++++-
 6 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/apps/console/src/pages/iam/organizations/settings/_components/SCIMConfiguration.tsx b/apps/console/src/pages/iam/organizations/settings/_components/SCIMConfiguration.tsx
index 34fabffd1..35305ce34 100644
--- a/apps/console/src/pages/iam/organizations/settings/_components/SCIMConfiguration.tsx
+++ b/apps/console/src/pages/iam/organizations/settings/_components/SCIMConfiguration.tsx
@@ -232,11 +232,11 @@ export function SCIMConfiguration(props: {
     });
   };
 
-  if (!scimConfiguration) {
-    if (hasIdentityProvider) {
-      return null;
-    }
+  if (hasIdentityProvider) {
+    return null;
+  }
 
+  if (!scimConfiguration) {
     return (
       <Card padded>
         <div className="flex items-center justify-between">
diff --git a/pkg/coredata/connector.go b/pkg/coredata/connector.go
index b02d7c396..3761d5fe7 100644
--- a/pkg/coredata/connector.go
+++ b/pkg/coredata/connector.go
@@ -550,11 +550,15 @@ WHERE
 	}
 	maps.Copy(args, scope.SQLArguments())
 
-	_, err = conn.Exec(ctx, q, args)
+	result, err := conn.Exec(ctx, q, args)
 	if err != nil {
 		return fmt.Errorf("cannot update connector: %w", err)
 	}
 
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
 	c.EncryptedConnection = encryptedConnection
 	c.populateSlackSettings()
 
diff --git a/pkg/coredata/migrations/20260129T120000Z.sql b/pkg/coredata/migrations/20260129T120000Z.sql
index 1d5cd4d5d..ad9fb24ec 100644
--- a/pkg/coredata/migrations/20260129T120000Z.sql
+++ b/pkg/coredata/migrations/20260129T120000Z.sql
@@ -1,7 +1,5 @@
--- Add sync tracking fields to iam_scim_bridges table
 ALTER TABLE iam_scim_bridges ADD COLUMN last_synced_at TIMESTAMP WITH TIME ZONE;
 ALTER TABLE iam_scim_bridges ADD COLUMN next_sync_at TIMESTAMP WITH TIME ZONE DEFAULT NOW();
 ALTER TABLE iam_scim_bridges ADD COLUMN sync_error TEXT;
 
--- Create index for efficient polling of bridges due for sync
 CREATE INDEX idx_iam_scim_bridges_next_sync ON iam_scim_bridges (next_sync_at) WHERE state = 'ACTIVE';
diff --git a/pkg/coredata/migrations/20260201T120000Z.sql b/pkg/coredata/migrations/20260201T120000Z.sql
index 69b89a8a9..756d60418 100644
--- a/pkg/coredata/migrations/20260201T120000Z.sql
+++ b/pkg/coredata/migrations/20260201T120000Z.sql
@@ -1,8 +1,10 @@
--- Add failure tracking columns to iam_scim_bridges table
 ALTER TABLE iam_scim_bridges ADD COLUMN consecutive_failures INTEGER NOT NULL DEFAULT 0;
 ALTER TABLE iam_scim_bridges ADD COLUMN total_sync_count INTEGER NOT NULL DEFAULT 0;
 ALTER TABLE iam_scim_bridges ADD COLUMN total_failure_count INTEGER NOT NULL DEFAULT 0;
 
--- Drop old index and create new one that covers all processable states
+ALTER TABLE iam_scim_bridges ALTER COLUMN consecutive_failures DROP DEFAULT;
+ALTER TABLE iam_scim_bridges ALTER COLUMN total_sync_count DROP DEFAULT;
+ALTER TABLE iam_scim_bridges ALTER COLUMN total_failure_count DROP DEFAULT;
+
 DROP INDEX IF EXISTS idx_iam_scim_bridges_next_sync;
 CREATE INDEX idx_iam_scim_bridges_next_sync ON iam_scim_bridges (next_sync_at) WHERE state IN ('ACTIVE', 'FAILED', 'SYNCING');
diff --git a/pkg/iam/scim/bridge/client/client.go b/pkg/iam/scim/bridge/client/client.go
index 66da7e7d8..1b06b186b 100644
--- a/pkg/iam/scim/bridge/client/client.go
+++ b/pkg/iam/scim/bridge/client/client.go
@@ -240,7 +240,7 @@ func (c *Client) DeactivateUser(ctx context.Context, userID string) error {
 	}
 	defer resp.Body.Close()
 
-	if resp.StatusCode != http.StatusOK {
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent {
 		respBody, _ := io.ReadAll(resp.Body)
 		return fmt.Errorf("SCIM API error: status %d, body: %s", resp.StatusCode, string(respBody))
 	}
diff --git a/pkg/iam/scim/bridge_runner_backoff.go b/pkg/iam/scim/bridge_runner_backoff.go
index 6cf6abfb0..78ff8cb1d 100644
--- a/pkg/iam/scim/bridge_runner_backoff.go
+++ b/pkg/iam/scim/bridge_runner_backoff.go
@@ -34,7 +34,21 @@ func (r *BridgeRunner) calculateBackoff(consecutiveFailures int) time.Duration {
 		return r.cfg.Interval
 	}
 
-	backoff := r.cfg.Interval * time.Duration(1<<consecutiveFailures)
+	// Cap the shift exponent to prevent integer overflow from the shift itself.
+	// Bit 63 is the sign bit, so shifting by 63+ produces negative or zero values.
+	const maxShift = 62
+	shiftAmount := consecutiveFailures
+	if shiftAmount > maxShift {
+		shiftAmount = maxShift
+	}
+
+	backoff := r.cfg.Interval * time.Duration(1<<shiftAmount)
+
+	// Detect multiplication overflow: if result is non-positive or less than the
+	// base interval, overflow occurred. Return MaxBackoff in this case.
+	if backoff <= 0 || backoff < r.cfg.Interval {
+		return r.cfg.MaxBackoff
+	}
 
 	if backoff > r.cfg.MaxBackoff {
 		return r.cfg.MaxBackoff