admin_setting_scim_integration_test.go

// Copyright IBM Corp. 2018, 2026
// SPDX-License-Identifier: MPL-2.0

package tfe

import (
	"context"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestAdminSettings_SCIM_Read(t *testing.T) {
	skipUnlessEnterprise(t)
	client := testClient(t)
	ctx := context.Background()

	t.Run("read scim settings with default values", func(t *testing.T) {
		scimSettings, err := client.Admin.Settings.SCIM.Read(ctx)
		require.NoError(t, err)

		assert.Equal(t, "scim", scimSettings.ID)
		assert.False(t, scimSettings.Enabled)
		assert.False(t, scimSettings.Paused)
		assert.Empty(t, scimSettings.SiteAdminGroupSCIMID)
		assert.Empty(t, scimSettings.SiteAdminGroupDisplayName)
	})
}

func TestAdminSettings_SCIM_Update(t *testing.T) {
	skipUnlessEnterprise(t)
	client := testClient(t)
	ctx := context.Background()

	enableSAML(ctx, t, client, true)
	defer enableSAML(ctx, t, client, false)

	scimClient := client.Admin.Settings.SCIM

	t.Run("enable scim settings", func(t *testing.T) {
		err := setSAMLProviderType(ctx, t, client, true)
		require.NoErrorf(t, err, "failed to set SAML provider type")
		defer cleanupSCIMSettings(ctx, t, client)

		scimSettings, err := scimClient.Update(ctx, AdminSCIMSettingUpdateOptions{Enabled: Bool(true)})
		require.NoError(t, err)

		assert.True(t, scimSettings.Enabled)
	})

	t.Run("pause scim settings", func(t *testing.T) {
		err := setSAMLProviderType(ctx, t, client, true)
		require.NoErrorf(t, err, "failed to set SAML provider type")
		defer cleanupSCIMSettings(ctx, t, client)

		_, err = scimClient.Update(ctx, AdminSCIMSettingUpdateOptions{
			Enabled: Bool(true),
		})
		require.NoError(t, err)

		testCases := []struct {
			name   string
			paused bool
		}{
			{"pause scim provisioning", true},
			{"unpause scim provisioning", false},
		}

		for _, tc := range testCases {
			t.Run(tc.name, func(t *testing.T) {
				_, err := scimClient.Update(ctx, AdminSCIMSettingUpdateOptions{Paused: &tc.paused})
				require.NoError(t, err)
				scimSettings, err := scimClient.Read(ctx)
				require.NoError(t, err)
				assert.Equal(t, tc.paused, scimSettings.Paused)
			})
		}
	})

	t.Run("update site admin group scim id", func(t *testing.T) {
		err := setSAMLProviderType(ctx, t, client, true)
		require.NoErrorf(t, err, "failed to set SAML provider type")
		defer cleanupSCIMSettings(ctx, t, client)

		_, err = scimClient.Update(ctx, AdminSCIMSettingUpdateOptions{Enabled: Bool(true)})
		require.NoError(t, err)

		scimToken, err := scimClient.Tokens.Create(ctx)
		require.NoError(t, err)
		require.NotEmpty(t, scimToken.Token)
		scimGroupID := createSCIMGroup(ctx, t, client, "foo", scimToken.Token)

		testCases := []struct {
			name        string
			scimGroupID string
			raiseError  bool
		}{
			{"link scim group to site admin role", scimGroupID, false},
			{"trying to link non-existent group - should raise error", "this-group-doesn't-exist", true},
		}

		for _, tc := range testCases {
			t.Run(tc.name, func(t *testing.T) {
				_, err := scimClient.Update(ctx, AdminSCIMSettingUpdateOptions{SiteAdminGroupSCIMID: &tc.scimGroupID})
				if tc.raiseError {
					require.Error(t, err)
					return
				}
				require.NoError(t, err)
				scimSettings, err := scimClient.Read(ctx)
				require.NoError(t, err)
				assert.Equal(t, tc.scimGroupID, scimSettings.SiteAdminGroupSCIMID)
				assert.Equal(t, "foo", scimSettings.SiteAdminGroupDisplayName)
			})
		}
	})
}

func TestAdminSettings_SCIM_Delete(t *testing.T) {
	skipUnlessEnterprise(t)
	client := testClient(t)
	ctx := context.Background()

	enableSAML(ctx, t, client, true)
	defer enableSAML(ctx, t, client, false)

	scimClient := client.Admin.Settings.SCIM

	t.Run("disable scim settings", func(t *testing.T) {
		err := setSAMLProviderType(ctx, t, client, true)
		require.NoErrorf(t, err, "failed to set SAML provider type")
		defer cleanupSCIMSettings(ctx, t, client)

		testCases := []struct {
			name          string
			isScimEnabled bool
		}{
			{"disable scim provisioning when it's already enabled", true},
			{"disable scim provisioning when it's already disabled - should not raise error", false},
		}

		for _, tc := range testCases {
			t.Run(tc.name, func(t *testing.T) {
				if tc.isScimEnabled {
					_, err := scimClient.Update(ctx, AdminSCIMSettingUpdateOptions{Enabled: Bool(true)})
					require.NoError(t, err)
				}

				err := scimClient.Delete(ctx)
				require.NoError(t, err)

				scimSettings, err := scimClient.Read(ctx)
				require.NoError(t, err)
				assert.False(t, scimSettings.Enabled)
			})
		}
	})
}

// cleanup scim settings by disabling scim provisioning and setting saml provider type to unknown.
func cleanupSCIMSettings(ctx context.Context, t *testing.T, client *Client) {
	t.Helper()
	scimSettings, err := client.Admin.Settings.SCIM.Read(ctx)
	if err == nil && scimSettings.Enabled {
		err = client.Admin.Settings.SCIM.Delete(ctx)
		require.NoErrorf(t, err, "failed to disable SCIM provisioning")
	}

	err = setSAMLProviderType(ctx, t, client, false)
	require.NoErrorf(t, err, "failed to set SAML provider type")
}