From 98a878b44b890607ed4ca816a1ba330cc1a03445 Mon Sep 17 00:00:00 2001
From: Philipinho <16838612+Philipinho@users.noreply.github.com>
Date: Sun, 22 Feb 2026 00:27:45 +0000
Subject: [PATCH] scim tokens

---
 .../migrations/20260221T092214-scim.ts        | 31 +++++++++++++------
 .../src/database/repos/group/group.repo.ts    |  1 +
 .../repos/workspace/workspace.repo.ts         |  1 +
 apps/server/src/database/types/db.d.ts        |  2 ++
 4 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/apps/server/src/database/migrations/20260221T092214-scim.ts b/apps/server/src/database/migrations/20260221T092214-scim.ts
index c53f1632..961788e7 100644
--- a/apps/server/src/database/migrations/20260221T092214-scim.ts
+++ b/apps/server/src/database/migrations/20260221T092214-scim.ts
@@ -11,9 +11,7 @@ export async function up(db: Kysely<any>): Promise<void> {
     .addColumn('token_last_four', 'varchar(4)', (col) => col.notNull())
     .addColumn('expires_at', 'timestamptz')
     .addColumn('last_used_at', 'timestamptz')
-    .addColumn('is_enabled', 'boolean', (col) =>
-      col.notNull().defaultTo(true),
-    )
+    .addColumn('is_enabled', 'boolean', (col) => col.notNull().defaultTo(true))
     .addColumn('creator_id', 'uuid', (col) =>
       col.references('users.id').onDelete('set null'),
     )
@@ -66,20 +64,35 @@ export async function up(db: Kysely<any>): Promise<void> {
     .where('scim_external_id', 'is not', null)
     .unique()
     .execute();
+
+  await db.schema
+    .alterTable('groups')
+    .addColumn('is_external', 'boolean', (col) =>
+      col.notNull().defaultTo(false),
+    )
+    .execute();
+
+  await db.schema
+    .alterTable('workspaces')
+    .addColumn('is_scim_enabled', 'boolean', (col) =>
+      col.notNull().defaultTo(false),
+    )
+    .execute();
 }
 
 export async function down(db: Kysely<any>): Promise<void> {
   await db.schema.dropTable('scim_tokens').execute();
 
   await db.schema.dropIndex('idx_users_workspace_scim_external_id').execute();
-  await db.schema
-    .alterTable('users')
-    .dropColumn('scim_external_id')
-    .execute();
+  await db.schema.alterTable('users').dropColumn('scim_external_id').execute();
 
   await db.schema.dropIndex('idx_groups_workspace_scim_external_id').execute();
+  await db.schema.alterTable('groups').dropColumn('scim_external_id').execute();
+
+  await db.schema.alterTable('groups').dropColumn('is_external').execute();
+
   await db.schema
-    .alterTable('groups')
-    .dropColumn('scim_external_id')
+    .alterTable('workspaces')
+    .dropColumn('is_scim_enabled')
     .execute();
 }
diff --git a/apps/server/src/database/repos/group/group.repo.ts b/apps/server/src/database/repos/group/group.repo.ts
index e8a4d363..f9f8059f 100644
--- a/apps/server/src/database/repos/group/group.repo.ts
+++ b/apps/server/src/database/repos/group/group.repo.ts
@@ -22,6 +22,7 @@ export class GroupRepo {
     'name',
     'description',
     'isDefault',
+    'isExternal',
     'creatorId',
     'workspaceId',
     'createdAt',
diff --git a/apps/server/src/database/repos/workspace/workspace.repo.ts b/apps/server/src/database/repos/workspace/workspace.repo.ts
index 5e054650..40e6eebd 100644
--- a/apps/server/src/database/repos/workspace/workspace.repo.ts
+++ b/apps/server/src/database/repos/workspace/workspace.repo.ts
@@ -33,6 +33,7 @@ export class WorkspaceRepo {
     'enforceSso',
     'plan',
     'enforceMfa',
+    'isScimEnabled',
   ];
   constructor(@InjectKysely() private readonly db: KyselyDB) {}
 
diff --git a/apps/server/src/database/types/db.d.ts b/apps/server/src/database/types/db.d.ts
index f0a2d9e3..9e0e41f6 100644
--- a/apps/server/src/database/types/db.d.ts
+++ b/apps/server/src/database/types/db.d.ts
@@ -184,6 +184,7 @@ export interface Groups {
   description: string | null;
   id: Generated<string>;
   isDefault: boolean;
+  isExternal: Generated<boolean>;
   name: string;
   scimExternalId: string | null;
   updatedAt: Generated<Timestamp>;
@@ -352,6 +353,7 @@ export interface Workspaces {
   enforceMfa: Generated<boolean | null>;
   enforceSso: Generated<boolean>;
   hostname: string | null;
+  isScimEnabled: Generated<boolean>;
   id: Generated<string>;
   licenseKey: string | null;
   logo: string | null;