fix(organizations): refuse self-leave for directory-managed members and keep the renamed name visible

Author: waleedlatif1

apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.tsx

@@ -66,7 +66,14 @@ export function OrganizationHeader({
   const [isInviteModalOpen, setIsInviteModalOpen] = useState(false)
   const [isMenuOpen, setIsMenuOpen] = useState(false)
   const [draftName, setDraftName] = useState<string | null>(null)
-  const initial = getOrganizationInitial(organization.name)
+  /**
+   * The name just saved, shown until the refreshed server prop replaces the one
+   * it was saved over; without it the old name flashes back in between.
+   */
+  const [savedName, setSavedName] = useState<{ name: string; replaces: string } | null>(null)
+  if (savedName && savedName.replaces !== organization.name) setSavedName(null)
+  const organizationName = savedName?.name ?? organization.name
+  const initial = getOrganizationInitial(organizationName)
 
   if (isCollapsed) {
     return (
@@ -103,21 +110,24 @@ export function OrganizationHeader({
   const submitRename = () => {
     if (draftName === null || renameOrganization.isPending) return
     const name = draftName.trim()
-    if (!name || name === organization.name) {
+    if (!name || name === organizationName) {
       stopRenaming()
       return
     }
     renameOrganization.mutate(
       { orgId: organization.id, name },
       {
-        onSuccess: stopRenaming,
+        onSuccess: () => {
+          setSavedName({ name, replaces: organization.name })
+          stopRenaming()
+        },
         onError: () => requestAnimationFrame(() => nameInputRef.current?.focus()),
       }
     )
   }
 
   const logo = (
-    <IdentityTile size='lg' initial={initial} logoUrl={organization.logo} alt={organization.name} />
+    <IdentityTile size='lg' initial={initial} logoUrl={organization.logo} alt={organizationName} />
   )
 
   return (
@@ -156,7 +166,7 @@ export function OrganizationHeader({
             leftAdornment={<IdentityTile initial={initial} logoUrl={organization.logo} />}
             rightAdornment={<ChipChevronDown />}
           >
-            {organization.name}
+            {organizationName}
           </Chip>
         </DropdownMenuTrigger>
         <DropdownMenuContent
@@ -222,13 +232,13 @@ export function OrganizationHeader({
                   className='h-auto min-w-0 p-0 hover-hover:opacity-70 focus-visible:opacity-70'
                   onSelect={(event) => {
                     event.preventDefault()
-                    setDraftName(organization.name)
+                    setDraftName(organizationName)
                   }}
                 >
-                  <OverflowText label={organization.name} />
+                  <OverflowText label={organizationName} />
                 </DropdownMenuItem>
               ) : (
-                <OverflowText label={organization.name} />
+                <OverflowText label={organizationName} />
               )}
               {renameOrganization.isError && (
                 <span role='alert' className='text-[var(--text-error)] text-caption'>

apps/sim/ee/scim/lib/managed-membership.integration.ts

@@ -10,7 +10,7 @@ vi.mock('@/lib/core/config/env-flags', () => ({
 }))
 
 async function loadRuntime() {
-  const [{ db }, schema, { eq, inArray, sql }, { alias }, membership, entitlement] =
+  const [{ db }, schema, { and, eq, inArray, sql }, { alias }, membership, entitlement] =
     await Promise.all([
       import('@sim/db'),
       import('@sim/db/schema'),
@@ -19,7 +19,19 @@ async function loadRuntime() {
       import('@/ee/scim/lib/managed-membership'),
       import('@/ee/scim/lib/entitlement'),
     ])
-  return { db, schema, eq, inArray, sql, alias, ...membership, ...entitlement }
+  const { removeOrganizationMemberRecord } = await import('@/lib/organizations/member-manager')
+  return {
+    db,
+    schema,
+    and,
+    eq,
+    inArray,
+    sql,
+    alias,
+    removeOrganizationMemberRecord,
+    ...membership,
+    ...entitlement,
+  }
 }
 
 describe('SCIM managed membership in PostgreSQL', () => {
@@ -29,6 +41,7 @@ describe('SCIM managed membership in PostgreSQL', () => {
   let connectionId: string
   let managedUserId: string
   let unmanagedUserId: string
+  let adminUserId: string
   let managedEmail: string
 
   beforeAll(async () => {
@@ -42,6 +55,7 @@ describe('SCIM managed membership in PostgreSQL', () => {
     connectionId = generateId()
     managedUserId = generateId()
     unmanagedUserId = generateId()
+    adminUserId = generateId()
     managedEmail = `${managedUserId}@scim-membership.test`
     const { db, schema } = runtime
     const now = new Date()
@@ -54,7 +68,7 @@ describe('SCIM managed membership in PostgreSQL', () => {
       }))
     )
     await db.insert(schema.user).values(
-      [managedUserId, unmanagedUserId].map((id) => ({
+      [managedUserId, unmanagedUserId, adminUserId].map((id) => ({
         id,
         name: 'SCIM predicate test',
         email: `${id}@scim-membership.test`,
@@ -99,7 +113,9 @@ describe('SCIM managed membership in PostgreSQL', () => {
     const { db, schema, eq, inArray } = runtime
     await db.delete(schema.subscription).where(eq(schema.subscription.referenceId, orgId))
     await db.delete(schema.organization).where(inArray(schema.organization.id, [orgId, otherOrgId]))
-    await db.delete(schema.user).where(inArray(schema.user.id, [managedUserId, unmanagedUserId]))
+    await db
+      .delete(schema.user)
+      .where(inArray(schema.user.id, [managedUserId, unmanagedUserId, adminUserId]))
   })
 
   async function invitee(organizationId: string, email: string) {
@@ -194,4 +210,63 @@ describe('SCIM managed membership in PostgreSQL', () => {
       })
     ).rejects.toMatchObject({ cause: { code: '42P01' } })
   })
+
+  describe('removing a member', () => {
+    beforeEach(async () => {
+      const { db, schema } = runtime
+      await db.insert(schema.member).values([
+        { id: generateId(), organizationId: orgId, userId: adminUserId, role: 'owner' },
+        { id: generateId(), organizationId: orgId, userId: managedUserId, role: 'member' },
+        { id: generateId(), organizationId: orgId, userId: unmanagedUserId, role: 'member' },
+      ])
+    })
+
+    async function isMember(userId: string) {
+      const { db, schema, and, eq } = runtime
+      const rows = await db
+        .select({ id: schema.member.id })
+        .from(schema.member)
+        .where(and(eq(schema.member.organizationId, orgId), eq(schema.member.userId, userId)))
+      return rows.length > 0
+    }
+
+    it('refuses a managed member leaving on their own and keeps the membership', async () => {
+      const { removeOrganizationMemberRecord } = runtime
+      await expect(
+        removeOrganizationMemberRecord({
+          organizationId: orgId,
+          userId: managedUserId,
+          actorUserId: managedUserId,
+        })
+      ).rejects.toMatchObject({
+        detailCode: 'SCIM_MANAGED_MEMBERSHIP',
+        message: expect.stringContaining('Ask your identity provider administrator'),
+      })
+      expect(await isMember(managedUserId)).toBe(true)
+    })
+
+    it('lets an administrator remove the same managed member', async () => {
+      const { removeOrganizationMemberRecord } = runtime
+      await expect(
+        removeOrganizationMemberRecord({
+          organizationId: orgId,
+          userId: managedUserId,
+          actorUserId: adminUserId,
+        })
+      ).resolves.toMatchObject({ membershipType: 'internal' })
+      expect(await isMember(managedUserId)).toBe(false)
+    })
+
+    it('lets an unmanaged member leave on their own', async () => {
+      const { removeOrganizationMemberRecord } = runtime
+      await expect(
+        removeOrganizationMemberRecord({
+          organizationId: orgId,
+          userId: unmanagedUserId,
+          actorUserId: unmanagedUserId,
+        })
+      ).resolves.toMatchObject({ membershipType: 'internal' })
+      expect(await isMember(unmanagedUserId)).toBe(false)
+    })
+  })
 })

apps/sim/ee/scim/lib/managed-membership.ts

@@ -14,7 +14,8 @@ import { isScimDeploymentEnabled, isScimEntitledForOrganization } from '@/ee/sci
  * remedy.
  *
  * Deliberately not applied to deprovisioning: an administrator must always be
- * able to remove someone in an emergency, whatever the directory believes.
+ * able to remove someone in an emergency, whatever the directory believes. A
+ * member removing themselves is refused, since the directory would re-add them.
  */
 
 /**
@@ -63,6 +64,32 @@ export async function assertMembershipNotScimManaged(params: {
   userId: string
   executor: DbOrTx
 }): Promise<void> {
+  await refuseIfDirectoryManaged(
+    params,
+    'This member is managed by the organization’s identity provider. Make the change there, or turn off managed-membership locking in the organization’s directory settings.'
+  )
+}
+
+/**
+ * Refuses a directory-managed member leaving on their own. Unlike an
+ * administrator's removal, which must always succeed, a self-leave only lasts
+ * until the next sync re-adds the member, so it is refused with the remedy.
+ */
+export async function assertSelfLeaveNotScimManaged(params: {
+  organizationId: string
+  userId: string
+  executor: DbOrTx
+}): Promise<void> {
+  await refuseIfDirectoryManaged(
+    params,
+    'Your membership is managed by your organization’s identity provider. Ask your identity provider administrator to remove you there.'
+  )
+}
+
+async function refuseIfDirectoryManaged(
+  params: { organizationId: string; userId: string; executor: DbOrTx },
+  message: string
+): Promise<void> {
   if (!isScimDeploymentEnabled()) return
   const [row] = await params.executor
     .select({ managed: scimManagedUserPredicate(params.organizationId, sql`${params.userId}`) })
@@ -74,10 +101,7 @@ export async function assertMembershipNotScimManaged(params: {
    * once a managed row is found, so the common case costs nothing.
    */
   if (!(await isScimEntitledForOrganization(params.organizationId, params.executor))) return
-  throw new ForbiddenOperationError(
-    'SCIM_MANAGED_MEMBERSHIP',
-    'This member is managed by the organization’s identity provider. Make the change there, or turn off managed-membership locking in the organization’s directory settings.'
-  )
+  throw new ForbiddenOperationError('SCIM_MANAGED_MEMBERSHIP', message)
 }
 
 /** Refuses an invitation to someone the directory already provisions, while the directory can still sync. */

apps/sim/lib/billing/organizations/membership.ts

@@ -76,6 +76,7 @@ import { removeWorkspaceSkillMembershipsTx } from '@/lib/skills/access'
 import { reassignSharedResourceOwnershipForWorkspaceMemberRemovalTx } from '@/lib/workspaces/resource-handoff'
 import { WorkspaceBillingAccountRemovalError } from '@/lib/workspaces/utils'
 import { endDirectoryMembershipTx } from '@/ee/scim/lib/identity/end-directory-membership'
+import { assertSelfLeaveNotScimManaged } from '@/ee/scim/lib/managed-membership'
 
 export { acquireUserBillingIdentityLock } from '@/lib/billing/organizations/identity-lock'
 export { WORKSPACE_BILLING_ACCOUNT_REMOVAL_ERROR } from '@/lib/workspaces/utils'
@@ -1384,8 +1385,11 @@ export async function removeUserFromOrganization(
     const result = await withInvitationSafeOrganizationAccessMutation(
       { userId, organizationId, scope: 'all' },
       async (tx, { workspaceIds, invitationIds }) => {
-        if (actorUserId)
+        if (actorUserId) {
           await requireMemberManagementAuthority(tx, organizationId, actorUserId, userId)
+          if (actorUserId === userId)
+            await assertSelfLeaveNotScimManaged({ organizationId, userId, executor: tx })
+        }
         if (requireNoOrgWorkspaceAccess && workspaceIds.length > 0) {
           const [remainingAccess] = await tx
             .select({ id: permissions.id })