fix(scim): make SCIM DELETE RFC 7644 compliant (WI-1310)

SCIM DELETE only flipped is_active=false while leaving scim_managed=true,
so a deprovisioned user stayed fetchable via GET /Users/{id}, listed by
/Users, switchable back to active via PUT/PATCH, and exposed through group
member projections. RFC 7644 §3.6 permits retaining a deleted resource
only when it returns 404 and is omitted from all query results.

SCIM DELETE now tombstones the user in one transaction: is_active=false
plus a new users.scim_deleted_at marker, and SCIM-managed group
memberships removed. Every SCIM user query (list, count, get, and the
group-member join and member-visibility guard) excludes tombstoned rows,
so subsequent operations report 404. PATCH active=false remains the
visible deactivation path. Re-provisioning a tombstoned email answers
409 uniqueness instead of silently resurrecting the account; the row is
retained for historical references and stays distinct from the
administrative offboarding state.

Also carries the regenerated api/openapi-v2.json left stale by the theme
logo commit.

Black-box regression coverage in core-tests: delete-then-404 on every
operation, list/filter omission, group membership cleanup, re-provision
conflict, and PATCH-active deactivation staying visible. Tested against
SQLite and PostgreSQL.

Author: stefan-ernst

api/openapi-v2.json

@@ -23676,6 +23676,10 @@
                     "description": "The is default value.",
                     "type": "boolean"
                   },
+                  "logo_url": {
+                    "description": "The logo url value.",
+                    "type": "string"
+                  },
                   "name": {
                     "description": "The name value.",
                     "type": "string"
@@ -44147,6 +44151,10 @@
                     "description": "The is default value.",
                     "type": "boolean"
                   },
+                  "logo_url": {
+                    "description": "The logo url value.",
+                    "type": "string"
+                  },
                   "name": {
                     "description": "The name value.",
                     "type": "string"

internal/database/schema/users.sql

@@ -15,6 +15,7 @@
 		email_verification_expires DATETIME, -- Expiry time for verification token
 		scim_external_id TEXT, -- SCIM externalId from identity provider
 		scim_managed BOOLEAN DEFAULT false, -- If true, user is managed via SCIM
+		scim_deleted_at DATETIME, -- Set when the IdP deprovisioned the user via SCIM DELETE; row retained but hidden from every SCIM query (RFC 7644 §3.6)
 		offboarded_at DATETIME, -- Set when the account is administratively offboarded; never cleared, every activation path must reject it
 		is_agent BOOLEAN DEFAULT FALSE, -- If true, user is a non-human agent (API-only; cannot log in)
 		agent_owner_user_id INTEGER REFERENCES users(id) ON DELETE CASCADE, -- NULL = service user (admin-provisioned); non-NULL = owned agent (inherits owner permissions)
@@ -165,6 +166,7 @@ CREATE INDEX IF NOT EXISTS idx_user_invitations_token ON user_invitations(token)
 CREATE INDEX IF NOT EXISTS idx_user_invitations_user_id ON user_invitations(user_id);
 
 
+-- migration: 20260911_users_scim_deleted_at
 -- migration: 20260911_users_offboarded_at
 
 -- migration: 0014_users_is_agent

internal/handlers/scim.go

@@ -364,6 +364,19 @@ func (h *SCIMHandler) CreateUser(w http.ResponseWriter, r *http.Request) {
 
 	existingUser, err := h.repo.GetUserByEmail(email)
 	if err == nil {
+		// A tombstoned account stays deleted: re-provisioning the same email
+		// must conflict rather than resurrect it (RFC 7644 §3.6). Un-deleting
+		// is an operator decision, not an IdP-driven one.
+		if h.repo.IsUserSCIMDeleted(existingUser.ID) {
+			h.logSCIMAuditEvent(r, logger.ActionSCIMUserCreate, logger.ResourceUser, &existingUser.ID, email,
+				map[string]any{
+					"username": existingUser.Username,
+					"reason":   "email_matches_tombstoned_user",
+				}, false, "refused: email belongs to a SCIM-deleted user")
+			respondSCIMErrorMsg(w, http.StatusConflict, "User with this email already exists", "uniqueness")
+			return
+		}
+
 		username := scimUser.UserName
 		if username == "" {
 			username = existingUser.Username
@@ -652,7 +665,7 @@ func (h *SCIMHandler) DeleteUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err = h.repo.DeactivateUser(id)
+	err = h.repo.TombstoneUser(id)
 	if err != nil {
 		respondSCIMErrorMsg(w, http.StatusInternalServerError, "Failed to delete user", "")
 		return

internal/repository/scim_repository.go

@@ -56,8 +56,8 @@ type SCIMGroupMemberRow struct {
 func (r *SCIMRepository) ListUsersFiltered(whereClause string, filterArgs []any, count, offset int) ([]models.User, int, error) {
 	baseQuery := `SELECT id, email, username, first_name, last_name, is_active,
 	              COALESCE(scim_external_id, '') as scim_external_id, created_at, updated_at
-	              FROM users WHERE is_agent = false AND scim_managed = true`
-	countQuery := `SELECT COUNT(*) FROM users WHERE is_agent = false AND scim_managed = true`
+	              FROM users WHERE is_agent = false AND scim_managed = true AND scim_deleted_at IS NULL`
+	countQuery := `SELECT COUNT(*) FROM users WHERE is_agent = false AND scim_managed = true AND scim_deleted_at IS NULL`
 
 	args := []any{}
 	if whereClause != "" {
@@ -98,14 +98,16 @@ func (r *SCIMRepository) ListUsersFiltered(whereClause string, filterArgs []any,
 }
 
 // GetUserByID loads a single user with the SCIM-relevant flags.
+// Deprovisioned (tombstoned) users are excluded so every SCIM operation on
+// them — GET, PUT, PATCH, DELETE — reports 404 per RFC 7644 §3.6.
 func (r *SCIMRepository) GetUserByID(id int) (*models.User, error) {
 	var user models.User
 	var scimExternalID sql.NullString
 	err := r.db.QueryRow(`
 		SELECT id, email, username, first_name, last_name, is_active,
 		       scim_external_id, COALESCE(scim_managed, false), COALESCE(is_agent, false),
 		       created_at, updated_at
-		FROM users WHERE id = ?
+		FROM users WHERE id = ? AND scim_deleted_at IS NULL
 	`, id).Scan(&user.ID, &user.Email, &user.Username, &user.FirstName, &user.LastName,
 		&user.IsActive, &scimExternalID, &user.SCIMManaged, &user.IsAgent,
 		&user.CreatedAt, &user.UpdatedAt)
@@ -178,10 +180,39 @@ func (r *SCIMRepository) ReplaceUser(id int, email, username, firstName, lastNam
 	return err
 }
 
-// DeactivateUser flips a user inactive (SCIM DELETE deactivates, never deletes).
-func (r *SCIMRepository) DeactivateUser(id int) error {
-	_, err := r.db.ExecWrite(`UPDATE users SET is_active = false, updated_at = CURRENT_TIMESTAMP WHERE id = ?`, id)
-	return err
+// TombstoneUser applies an RFC 7644 §3.6 SCIM DELETE: the user is deactivated
+// and marked deprovisioned so every SCIM query hides the resource, while the
+// row itself is retained for historical references. SCIM-managed group
+// memberships are removed so group projections cannot expose the deleted
+// user. Runs in one transaction — a partial delete must never leave a visible
+// membership on a tombstoned user.
+func (r *SCIMRepository) TombstoneUser(id int) error {
+	return database.WithTx(r.db, func(tx database.Tx) error {
+		if _, err := tx.Exec(`
+			UPDATE users
+			SET is_active = false, scim_deleted_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP
+			WHERE id = ? AND scim_deleted_at IS NULL
+		`, id); err != nil {
+			return fmt.Errorf("failed to tombstone user: %w", err)
+		}
+		if _, err := tx.Exec(`
+			DELETE FROM group_members WHERE user_id = ? AND scim_managed = true
+		`, id); err != nil {
+			return fmt.Errorf("failed to remove SCIM group memberships: %w", err)
+		}
+		return nil
+	})
+}
+
+// IsUserSCIMDeleted reports whether the user row carries the SCIM
+// deprovisioning tombstone. Used by the create/adopt flow so a re-provisioning
+// request for a deleted account conflicts instead of resurrecting it.
+func (r *SCIMRepository) IsUserSCIMDeleted(id int) bool {
+	var deleted bool
+	err := r.db.QueryRow(
+		`SELECT scim_deleted_at IS NOT NULL FROM users WHERE id = ?`, id,
+	).Scan(&deleted)
+	return err == nil && deleted
 }
 
 // SetUserActive applies a SCIM PATCH to the active flag.
@@ -229,7 +260,7 @@ func (r *SCIMRepository) IsUserSCIMVisible(userID int) bool {
 	var ok bool
 	err := r.db.QueryRow(`
 		SELECT COALESCE(scim_managed, false) = true AND COALESCE(is_agent, false) = false
-		FROM users WHERE id = ?
+		FROM users WHERE id = ? AND scim_deleted_at IS NULL
 	`, userID).Scan(&ok)
 	return err == nil && ok
 }
@@ -336,7 +367,7 @@ func (r *SCIMRepository) GetGroupMembers(groupID int) ([]SCIMGroupMemberRow, err
 		SELECT u.id, u.first_name, u.last_name, u.username
 		FROM group_members gm
 		JOIN users u ON gm.user_id = u.id
-		WHERE gm.group_id = ? AND gm.scim_managed = true
+		WHERE gm.group_id = ? AND gm.scim_managed = true AND u.scim_deleted_at IS NULL
 	`, groupID)
 	if err != nil {
 		return nil, err