PR Custody

MCPG-210: add starter mapping rule template to SCIM Settings

@eullersilva-plankchecks n/achecks…mcpg-210-add-starter-mapping-rule-template-to-scim-settings-page → main4 files · +311 −0review: @sohamganatraupdated 3w ago

GitHub

▸Description· 2 comments · 3 noise

Summary

Adds a Start from a template button to the SCIM rules editor on /settings/sso. Clicking it inserts a placeholder JSON mapping rule into the editor as an unsaved draft, so org admins setting up SCIM no longer have to author rules from a blank textarea.

Helper buildStarterScimRule(availableTeams) in @repo/types returns a rule conforming to EditableScimMappingRuleSchema. With available SCIM-managed teams it produces a team_membership rule pointed at the first team; otherwise it falls back to org_admin so the rule is schema-valid out of the box.
Button onClick appends the starter when the editor contains a valid JSON array, replaces silently when the editor is empty, and prompts via ConfirmDialog before overwriting any other unparseable content.
Inserted rule is draft only — admin must click Save rules to activate (existing useUnsavedChangesWarning already wired).

Closes MCPG-210.

Acceptance criteria

"Start from a template" button visible on SCIM Settings → Rules (org_admin only — page already gated).
Click inserts placeholder rule JSON with clearly-marked replacement tokens (name: "Starter rule — replace placeholder values before saving", values: ["<your-department-name>"]).
Inserted rule is in a draft / unsaved state — admin must explicitly save to activate.
Tested with a new org with no existing rules: admin goes from "empty rules" to "user shows on People page" in under 5 minutes. Pending manual verification on alpha.

Test plan

bunx turbo check-types — clean
bunx turbo lint — clean
Unit tests added for buildStarterScimRule (team / no-team / placeholder shape) in packages/types/src/scim.test.ts
Component tests added for the button (insert-into-empty / append / dismiss-confirm-on-invalid) in apps/admin/app/settings/sso/_components.test.tsx
Manual: empty rules → click button → save → verify user projects on People page
Manual: existing rules → click button → assert the new rule is appended, not replaced
Manual: invalid JSON → click button → confirm dialog appears and Cancel preserves the draft

Known local-env note: bunx vitest run fails repo-wide on this machine due to a pre-existing zod 4 + bun runtime issue (z.string is undefined at packages/types/src/team-shared.ts:3). Reproduces on main without these changes. CI (node) is expected to run the new tests normally.

Out of scope (future iterations from the ticket)

Provider-aware variants (Okta / Entra / JumpCloud).
"Create rule from this group" buttons next to discovered SCIM groups.
Suggested rules inferred from unmatched users.

@eullersilva-plank3w ago

@codex review

@chatgpt-codex-connector[bot]agent3w ago

Codex Review: Didn't find any major issues. Swish!

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

▸ 3 bot/status comments hidden

@linear-code[bot]3w ago

Description

Once an Okta-pushed user lands in our SCIM ingestion (after the 5-bug fix umbrella), the user is only visible in the admin UI's People page if at least one active SCIM mapping rule matches them. Without rules, users land in scim_unmatched_user and are only visible in the SCIM Settings repair queue.

Today, org admins setting up SCIM for the first time have to author JSON mapping rules from scratch with no starter, no examples, and no inference from their actual Okta groups. For an Okta-first product, this is significant onboarding friction. A new org with SCIM correctly provisioned but no mapping rules effectively does nothing visible on the People page.

Proposal

Add a "Use starter template" affordance in SCIM Settings → Rules. Clicking it inserts a pre-filled JSON rule that the admin can immediately customize. Provider-aware where useful (Okta sends group payloads slightly differently than Entra/JumpCloud).

Minimum viable (MVP)

A single static starter template like:

{
  "name": "Default team membership by email domain",
  "match": { "email_domain": "<your-domain.com>" },
  "assign": { "team": "<default-team-slug>", "role": "member" }
}

with placeholder values the admin must replace. The button copy says something like "Start from a template" rather than "Apply" — to make it clear this is a draft, not an active rule.

Future iterations (separate scope, not blocking MVP)

Provider-aware variants (Okta-shape, Entra-shape) with the right attribute paths for each provider's group payload.
"Create rule from this group" buttons next to discovered SCIM groups in the SCIM Settings page, with JSON pre-filled from the actual group's displayName / externalId.
"Suggested rules" view that infers candidate rules from observed unmatched users.

Why this matters

Reduces time-to-first-projection from hours of trial-and-error to minutes.
Directly tied to the Bug 1-5 umbrella ticket: even with all 5 bugs fixed, the People page stays empty for any org without mapping rules. The fix umbrella unblocks the chain; this ticket unblocks the on top of it.

loading diff…

▸Description· 2 comments · 3 noise

Summary

Helper buildStarterScimRule(availableTeams) in @repo/types returns a rule conforming to EditableScimMappingRuleSchema. With available SCIM-managed teams it produces a team_membership rule pointed at the first team; otherwise it falls back to org_admin so the rule is schema-valid out of the box.
Button onClick appends the starter when the editor contains a valid JSON array, replaces silently when the editor is empty, and prompts via ConfirmDialog before overwriting any other unparseable content.
Inserted rule is draft only — admin must click Save rules to activate (existing useUnsavedChangesWarning already wired).

Closes MCPG-210.

Acceptance criteria

"Start from a template" button visible on SCIM Settings → Rules (org_admin only — page already gated).
Click inserts placeholder rule JSON with clearly-marked replacement tokens (name: "Starter rule — replace placeholder values before saving", values: ["<your-department-name>"]).
Inserted rule is in a draft / unsaved state — admin must explicitly save to activate.
Tested with a new org with no existing rules: admin goes from "empty rules" to "user shows on People page" in under 5 minutes. Pending manual verification on alpha.

Test plan

bunx turbo check-types — clean
bunx turbo lint — clean
Unit tests added for buildStarterScimRule (team / no-team / placeholder shape) in packages/types/src/scim.test.ts
Component tests added for the button (insert-into-empty / append / dismiss-confirm-on-invalid) in apps/admin/app/settings/sso/_components.test.tsx
Manual: empty rules → click button → save → verify user projects on People page
Manual: existing rules → click button → assert the new rule is appended, not replaced
Manual: invalid JSON → click button → confirm dialog appears and Cancel preserves the draft

Known local-env note: bunx vitest run fails repo-wide on this machine due to a pre-existing zod 4 + bun runtime issue (z.string is undefined at packages/types/src/team-shared.ts:3). Reproduces on main without these changes. CI (node) is expected to run the new tests normally.

Out of scope (future iterations from the ticket)

Provider-aware variants (Okta / Entra / JumpCloud).
"Create rule from this group" buttons next to discovered SCIM groups.
Suggested rules inferred from unmatched users.

@eullersilva-plank3w ago

@codex review

@chatgpt-codex-connector[bot]agent3w ago

Codex Review: Didn't find any major issues. Swish!

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

▸ 3 bot/status comments hidden

@linear-code[bot]3w ago

Description

Proposal

Minimum viable (MVP)

A single static starter template like:

{
  "name": "Default team membership by email domain",
  "match": { "email_domain": "<your-domain.com>" },
  "assign": { "team": "<default-team-slug>", "role": "member" }
}

with placeholder values the admin must replace. The button copy says something like "Start from a template" rather than "Apply" — to make it clear this is a draft, not an active rule.

Future iterations (separate scope, not blocking MVP)

Provider-aware variants (Okta-shape, Entra-shape) with the right attribute paths for each provider's group payload.
"Create rule from this group" buttons next to discovered SCIM groups in the SCIM Settings page, with JSON pre-filled from the actual group's displayName / externalId.
"Suggested rules" view that infers candidate rules from observed unmatched users.

Why this matters

Reduces time-to-first-projection from hours of trial-and-error to minutes.
Directly tied to the Bug 1-5 umbrella ticket: even with all 5 bugs fixed, the People page stays empty for any org without mapping rules. The fix umbrella unblocks the chain; this ticket unblocks the on top of it.

@vercel[bot]3w ago

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
composio-enterprise-admin	Blocked		May 19, 2026 8:50pm
composio-enterprise-internal	Blocked		May 19, 2026 8:50pm