fix(scim): certification pass — removal side effects, hourly sweep, dead surface, docs

- Organization removal no longer deletes personal API keys except when
  the directory deprovisions; a member removing themselves keeps their
  own session. Every other caller keeps the session revocation
- The reconcile interval is shorter than the cron period, so the
  once-an-hour guarantee actually holds
- Removed: defaultWorkspaceGrants (no client, no docs), the unused
  tombstone and delete helpers, parameters no caller varied, the
  duplicate discovery list helper; the routes barrel exports the SCIM
  builders; group cap raised to 5,000
- Docs: per-resource filters and limits, authentication failures absent
  from Activity, name matching and the permanent explicit-membership
  switch, default group not a target, credential expiry choices, SSO and
  both flags as prerequisites, what disabling the connection does

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DGXcwsHzYGp6pUDWRtJKpz

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/scim.mdx

@@ -13,7 +13,7 @@ Directory provisioning connects your identity provider to Sim over SCIM 2.0. You
 It pairs with [SSO](/platform/enterprise/sso). SSO proves who someone is when they sign in. Directory provisioning decides who exists and what they can reach, before and after that.
 
 <Callout type="info">
-  Enterprise plans. Requires at least one [verified domain](/platform/enterprise/verified-domains) for your organization. Self-hosted deployments turn it on with `SCIM_ENABLED=true` and `NEXT_PUBLIC_SCIM_ENABLED=true`, alongside the [SSO variables](/platform/enterprise/sso#self-hosted-setup).
+  Enterprise plans. Requires [SSO](/platform/enterprise/sso) to be enabled, because provisioning is configured from the SSO settings page, and at least one [verified domain](/platform/enterprise/verified-domains) for your organization. Self-hosted deployments turn it on with `SCIM_ENABLED=true` (the server) and `NEXT_PUBLIC_SCIM_ENABLED=true` (the settings page), alongside the [SSO variables](/platform/enterprise/sso#self-hosted-setup).
 </Callout>
 
 ## What it does
@@ -54,7 +54,7 @@ https://<your-sim-domain>/api/scim/v2
 <Step>
 ### Issue a credential
 
-Select **Issue credential**. The token appears once — copy it straight into your provider.
+Choose whether the credential expires (never, 90 days, or a year) and select **Issue credential**. The token appears once — copy it straight into your provider.
 
 Two credentials can be active at a time, so you can rotate without downtime: issue the new one, update your provider, confirm a sync succeeds, then revoke the old one.
 </Step>
@@ -121,7 +121,11 @@ Groups mean nothing to Sim until you say what they stand for. In **Settings →
 - a **workspace**, at Read, Write, or Admin
 - the **organization admin role**
 
-A group can carry several mappings. When two groups grant the same workspace at different levels, the stronger one wins.
+A group can carry several mappings. When two groups grant the same workspace at different levels, the stronger one wins. The organization's default permission group cannot be a target: it governs by having no members.
+
+Turning on **Match permission groups by name** maps a pushed group to an existing permission group of the same name automatically, and remaps it when the group is renamed. Nothing is created.
+
+Mapping a permission group to a directory group switches that permission group to explicit membership permanently: it governs exactly the people in it, and an empty group governs nobody. A permission group that governed everyone in its workspaces stops doing so the moment it is mapped, so map groups you created for the directory rather than your organization-wide ones.
 
 </Step>
 
@@ -141,7 +145,7 @@ If you want the directory to be the only way in, enable **Disable just-in-time p
 
 ## Watching a sync
 
-**Settings → SSO → Directory provisioning → Activity** lists recent requests with their status and, for a failure, what was wrong. Providers report a failed cycle without saying what they sent, so this is usually the fastest way to see the cause.
+**Settings → SSO → Directory provisioning → Activity** lists recent authenticated requests with their status and, for a failure, what was wrong. Providers report a failed cycle without saying what they sent, so this is usually the fastest way to see the cause. A request that fails to authenticate has no connection to log against, so a wrong or revoked token shows up only as your provider's own authentication error.
 
 Sim also re-applies every group mapping once an hour, so drift cannot persist. You can run it on demand with **Reconcile now**, which is also how a change to the connection settings reaches members before the next sync.
 
@@ -150,7 +154,9 @@ Sim also re-applies every group mapping once an hour, so drift cannot persist. Y
 - Base URL: `https://<your-sim-domain>/api/scim/v2`
 - Authentication: `Authorization: Bearer <credential>`
 - Resources: `/Users`, `/Groups`, plus `/ServiceProviderConfig`, `/ResourceTypes`, and `/Schemas`
-- Filters: `eq`, joined with `and`, on `id`, `userName`, `externalId`, `emails.value`, `active`, and `displayName`
+- Filters: `eq` only, up to ten terms joined with `and`. Users: `id`, `userName`, `externalId`, `emails.value` (also `emails[type eq "work"].value`), `active`. Groups: `id`, `displayName`, `externalId`
+- Limits: 1,500 requests per minute per connection, 1 MB per request, 5,000 members per group
+- `userName` is stored and returned lower-cased; attributes Sim does not model are kept and returned as sent, and a PUT preserves ones it omits
 - Page size: up to 100 per request
 
 <FAQ items={[
@@ -178,6 +184,10 @@ Sim also re-applies every group mapping once an hour, so drift cannot persist. Y
     question: "Does a deactivation sign someone out immediately?",
     answer: "Their sessions are deleted at once and their personal API keys stop authenticating immediately. The organization's security version changes at the same time, so a browser still holding a cached session cookie is re-checked on its next request and refused."
   },
+  {
+    question: "What happens to deactivated members if we turn provisioning off?",
+    answer: "They stay deactivated. Disabling the connection stops the directory from making changes; it does not undo the ones it made. To restore someone without the directory, remove them from the organization and invite them again."
+  },
   {
     question: "Can we still invite people manually?",
     answer: "Only with managed membership locking turned off. With it on, Sim refuses manual changes for provisioned members, because the directory would revert them on its next sync."

apps/sim/app/api/organizations/[id]/members/[memberId]/route.ts

@@ -443,6 +443,7 @@ export const DELETE = withRouteHandler(
         userId: targetUserId,
         organizationId,
         memberId: targetMember[0].id,
+        spareSessionToken: session.session.token,
       })
 
       if (!result.success) {

apps/sim/app/api/organizations/[id]/transfer-ownership/route.ts

@@ -148,6 +148,7 @@ export const POST = withRouteHandler(
         userId: session.user.id,
         organizationId,
         memberId: selfMember.id,
+        spareSessionToken: session.session.token,
       })
 
       if (!removeResult.success) {

apps/sim/app/api/scim/v2/ResourceTypes/[id]/route.ts

@@ -1,4 +1,4 @@
-import { defineScimDiscoveryRoute } from '@/lib/api/server/routes/scim-route'
+import { defineScimDiscoveryRoute } from '@/lib/api/server/routes'
 import { resourceTypes } from '@/ee/scim/protocol/discovery'
 import { notFound } from '@/ee/scim/protocol/errors'
 

apps/sim/app/api/scim/v2/ResourceTypes/route.ts

@@ -1,4 +1,7 @@
-import { defineScimDiscoveryRoute } from '@/lib/api/server/routes/scim-route'
-import { discoveryList, resourceTypes } from '@/ee/scim/protocol/discovery'
+import { defineScimDiscoveryRoute } from '@/lib/api/server/routes'
+import { resourceTypes } from '@/ee/scim/protocol/discovery'
+import { toListResponse } from '@/ee/scim/protocol/resources'
 
-export const GET = defineScimDiscoveryRoute((baseUrl) => discoveryList(resourceTypes(baseUrl)))
+export const GET = defineScimDiscoveryRoute((baseUrl) =>
+  toListResponse(resourceTypes(baseUrl), resourceTypes(baseUrl).length, 1)
+)

apps/sim/app/api/scim/v2/Schemas/[id]/route.ts

@@ -1,4 +1,4 @@
-import { defineScimDiscoveryRoute } from '@/lib/api/server/routes/scim-route'
+import { defineScimDiscoveryRoute } from '@/lib/api/server/routes'
 import { schemaDefinitions } from '@/ee/scim/protocol/discovery'
 import { notFound } from '@/ee/scim/protocol/errors'
 

apps/sim/app/api/scim/v2/Schemas/route.ts

@@ -1,4 +1,7 @@
-import { defineScimDiscoveryRoute } from '@/lib/api/server/routes/scim-route'
-import { discoveryList, schemaDefinitions } from '@/ee/scim/protocol/discovery'
+import { defineScimDiscoveryRoute } from '@/lib/api/server/routes'
+import { schemaDefinitions } from '@/ee/scim/protocol/discovery'
+import { toListResponse } from '@/ee/scim/protocol/resources'
 
-export const GET = defineScimDiscoveryRoute((baseUrl) => discoveryList(schemaDefinitions(baseUrl)))
+export const GET = defineScimDiscoveryRoute((baseUrl) =>
+  toListResponse(schemaDefinitions(baseUrl), schemaDefinitions(baseUrl).length, 1)
+)

apps/sim/app/api/scim/v2/ServiceProviderConfig/route.ts

@@ -1,4 +1,4 @@
-import { defineScimDiscoveryRoute } from '@/lib/api/server/routes/scim-route'
+import { defineScimDiscoveryRoute } from '@/lib/api/server/routes'
 import { serviceProviderConfig } from '@/ee/scim/protocol/discovery'
 
 /** Unauthenticated by design: a provider negotiates before it holds a credential. */

apps/sim/ee/README.md

@@ -19,4 +19,4 @@ Production deployment requires an active Enterprise subscription.
 
 Enterprise features are imported directly throughout the codebase. The `ee/` directory
 is required at build time. Feature visibility is controlled at runtime via environment
-variables (e.g., `NEXT_PUBLIC_ACCESS_CONTROL_ENABLED`, `NEXT_PUBLIC_SSO_ENABLED`, `NEXT_PUBLIC_SCIM_ENABLED`).
+variables (e.g., `NEXT_PUBLIC_ACCESS_CONTROL_ENABLED`, `NEXT_PUBLIC_SSO_ENABLED`, `SCIM_ENABLED` with `NEXT_PUBLIC_SCIM_ENABLED`).

apps/sim/ee/scim/application/admin/connection.ts

@@ -6,11 +6,7 @@ import { desc, eq } from 'drizzle-orm'
 import type { ScimConnectionSettingsInput } from '@/lib/api/contracts/organization-scim'
 import { acquireOrganizationMutationLock } from '@/lib/billing/organizations/membership'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
-import {
-  assertWorkspaceInOrganization,
-  loadConnectionView,
-  requireConnection,
-} from '@/ee/scim/application/admin/connection-view'
+import { loadConnectionView, requireConnection } from '@/ee/scim/application/admin/connection-view'
 import {
   defineAuthorizedScimAdminUseCase,
   type ScimAdminUseCaseArgs,
@@ -36,21 +32,6 @@ export interface ConfigureScimConnectionInput {
 export const configureScimConnection = defineAuthorizedScimAdminUseCase({
   operation: scimAdminOperations.configure,
   async execute({ input, context }: ScimAdminUseCaseArgs<ConfigureScimConnectionInput>) {
-    /**
-     * A default grant hands every provisioned member a workspace, so the
-     * workspace must be this organization's — the same check a group mapping
-     * gets, or an administrator could name a workspace id from another tenant.
-     */
-    for (const grant of input.settings?.defaultWorkspaceGrants ?? []) {
-      await assertWorkspaceInOrganization(context.organizationId, grant.workspaceId)
-    }
-
-    /**
-     * Read, merge, and write under the organization lock, so two administrators
-     * changing different settings at once both land instead of the later write
-     * carrying a stale copy of the earlier one's field — and two first-time
-     * enables, where there is no row yet to lock, cannot both insert.
-     */
     const { created, previousStatus, status } = await db.transaction(async (tx) => {
       await acquireOrganizationMutationLock(tx, context.organizationId)
       const [existing] = await tx