feat: SCIM 2.0 user provisioning

[TerrifiedBug]

Summary

• Add SCIM 2.0 protocol support for automated user lifecycle management from identity providers (Okta, Entra ID, OneLogin, etc.)
• Prisma migration adds scimExternalId to User and scimEnabled/scimBearerToken to SystemSettings
• SCIM service layer handles user CRUD with proper mapping to VectorFlow's lockedAt pattern (no hard deletes)
• API routes at /api/scim/v2/Users and /api/scim/v2/Groups with encrypted bearer token auth
• Groups endpoints map SCIM Groups to VectorFlow Teams with member add/remove
• Settings UI adds SCIM tab with enable/disable toggle, base URL display, token generation with one-time-show modal
• Documentation: new SCIM guide with IdP-specific instructions, updated auth docs and SUMMARY

Test plan

• Run npx prisma migrate dev to apply the migration
• Navigate to Settings > SCIM as a Super Admin; verify toggle, URL display, and token generation work
• Copy generated token; verify it cannot be retrieved after closing the dialog
• Test SCIM endpoints with curl: GET /api/scim/v2/Users with valid/invalid bearer tokens
• Test user creation via POST /api/scim/v2/Users with SCIM JSON payload
• Test user deactivation via PATCH /api/scim/v2/Users/:id with active: false
• Test group listing via GET /api/scim/v2/Groups and member management via PATCH
• Verify disabling SCIM clears the token and rejects subsequent requests
• Verify TypeScript compiles cleanly (npx tsc --noEmit)

[greptile-apps]

Greptile Summary

This PR adds a complete SCIM 2.0 user provisioning integration, covering a Prisma migration, a service layer, four route files (/api/scim/v2/Users and /api/scim/v2/Groups), a tRPC settings router extension, and a settings UI tab. The implementation fits naturally into VectorFlow's existing patterns: token storage uses the project's AES-256-GCM encrypt/decrypt helpers, account deactivation maps to the lockedAt/lockedBy pattern used elsewhere, and all mutations write to the audit log.

All implementation details are correct:

• Authentication: Bearer token validation uses crypto.timingSafeEqual for constant-time comparison, preventing timing attacks
• User operations: Type-narrowed patch operations with case-normalized op.op field; audit logging on all mutations; lockedBy: "SCIM" recorded for both inactive creation and deactivation
• Group operations: Azure AD value-array member removal is supported; PUT handler wrapped in atomic prisma.$transaction preventing member data loss on failure; audit logging present
• Pagination: NaN-safe parameter handling with Number.isFinite() checks on both Users and Groups endpoints
• Error handling: Differentiated 409 responses for email vs. externalId unique constraint violations

The implementation is production-ready.

Confidence Score: 5/5

• All security, correctness, and data-integrity concerns have been properly addressed.
• The SCIM implementation is complete and correct. All cryptographic operations use constant-time comparison, all mutations are audit-logged, all user state transitions properly track the lock source (lockedBy), all database operations are atomic where needed, and all external inputs are validated with proper type narrowing and bounds checking. No issues remain.
• No files require special attention.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[IdP sends SCIM request] --> B[authenticateScim]
    B --> C{scimEnabled AND<br/>token valid?}
    C -- No --> D[401 Unauthorized]
    C -- Yes --> E{HTTP Method + Path}

    E --> F["POST /Users"]
    F --> G[scimCreateUser]
    G --> G1[user.create in DB]
    G1 --> G2[writeAuditLog<br/>scim.user_created]
    G2 --> G3[201 Created]

    E --> H["PATCH /Users/:id"]
    H --> I[scimPatchUser<br/>normalize op.op case]
    I --> I1[user.update in DB]
    I1 --> I2[writeAuditLog<br/>scim.user_patched]
    I2 --> I3[200 OK]

    E --> J["DELETE /Users/:id"]
    J --> K[scimDeleteUser<br/>soft-lock only]
    K --> K1[user.update<br/>lockedAt + lockedBy=SCIM]
    K1 --> K2[writeAuditLog<br/>scim.user_deactivated]
    K2 --> K3[204 No Content]

    E --> L["PATCH /Groups/:id"]
    L --> M[prisma transaction<br/>add or remove TeamMember]
    M --> N[writeAuditLog<br/>scim.group_patched]
    N --> O[200 OK]

    E --> P["PUT /Groups/:id"]
    P --> Q[prisma transaction<br/>deleteMany + create loop]
    Q --> R[writeAuditLog<br/>scim.group_updated]
    R --> S[200 OK]

Loading

_{Last reviewed commit: 46f1085}

[TerrifiedBug]

@greptile review