@eullersilva-plankchecks…mcpg-222-align-scim-team-rename-default-with-idp-as-source-of-truth → main5 files · +254 −3review: @sohamganatraupdated 3w agoTeam.scimRenamePropagationEnabled with the IdP-as-source-of-truth principle: the schema default flips from false → true via a column-default migration. New scim_managed teams now adopt Okta group renames automatically.apps/admin/scripts-tmp/backfill-scim-rename-propagation.ts to opt existing teams in safely — it skips drifted teams by default (where teams.name !== scim_groups.displayName), and --force flips them too once the operator has coordinated.| File | Change |
|---|---|
packages/db/prisma/schema.prisma | scimRenamePropagationEnabled @default(false) → @default(true) |
packages/db/prisma/migrations/20260522150000_default_scim_rename_propagation_to_true/ | ALTER COLUMN ... SET DEFAULT true |
packages/types/src/team-config.ts | Zod default flipped to match |
docs/scim-known-limitations.md | Section 7.2 updated; points to the backfill script |
apps/admin/scripts-tmp/backfill-scim-rename-propagation.ts | New one-off backfill (--dry-run / --org-slug / --all / --force) |
The two main creation paths (scim/project.ts:1243, scim/repair.ts:449) already set true explicitly; this PR only changes the default for paths that don't (e.g. the legacy ensureScimManagedTeamForWebhookGroup). Keeping the column means an org admin who deliberately wants to pin one team against IdP renames still has a per-row override surface — a future ticket can expose a UI toggle.
prisma migrate deploy automatically (per CLAUDE.md Deployment Reality Check), so the column default applies on next deploy. No manual migrate step.scim_managed teams in alpha/prod, run the backfill script:# Dry run first
DATABASE_URL=... bun run apps/admin/scripts-tmp/backfill-scim-rename-propagation.ts --dry-run
# Target one org to validate
DATABASE_URL=... bun run apps/admin/scripts-tmp/backfill-scim-rename-propagation.ts --org-slug <slug>
# Then sweep
DATABASE_URL=... bun run apps/admin/scripts-tmp/backfill-scim-rename-propagation.ts --all
skipped_drifted lines and add --force only after deciding those renames should be undone.bunx turbo check-types --filter=@repo/admin — greenbunx turbo lint --filter=@repo/admin --filter=@repo/db --filter=@repo/types — greenbun+vitest+zod-v4 has a pre-existing z.string is undefined issue affecting 6 of 9 suites in packages/types, same one called out by PR #512)--dry-run against alpha DB, then --org-slug <test-org>, verify an Okta rename propagates to teams.name@codex review
Codex Review: Didn't find any major issues. :+1:
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
The Team.scimRenamePropagationEnabled flag defaults to false, meaning Okta group renames update our internal scim_groups.displayName mirror but do NOT update the user-visible teams.name. The propagation code exists at apps/admin/server/scim/project.ts:1314-1340 — it's just opt-in per team.
This contradicts the IdP-as-source-of-truth principle we agreed on while debugging MCPG-193. PR #486 was rejected in May 2026 for adding a groupPushAutoCreateEnabled flag that defaulted to false on the same grounds. This default is the same anti-pattern: org-side state quietly disagrees with what the IdP pushed, with no admin visibility into why.
scim_managed team created from Okta group push → scimRenamePropagationEnabled = falsegroup.update webhookscim_groups.displayName (mirror reflects new name)applyScimProjectionPlan evaluates rename propagation:
false → skips renameteams.name shows the old name forever; mirror shows the new namescimRenamePropagationEnabled Boolean default(true) in packages/db/prisma/schema.prisma:192.false keep false; newly-provisioned teams get true.)false rows alone, only new teams default to true. Safer rollout.scim_managedtruetrue, the inverse direction (an admin wanting to PIN a team name against IdP renames) has no surface. Worth filing as a separate UX ticket if the rollout warrants it.scimRenamePropagationEnabled defaults to true in schema.docs/scim-sync-design.md and/or CLAUDE.md notes the new behavior.groupPushAutoCreateEnabled defaulting to false).Deployment failed with the following error:
You must set up Two-Factor Authentication before accessing this team.
View Documentation: https://vercel.com/docs/two-factor-authentication