Greptile Summary

This PR adds four console.log diagnostic statements to the OIDC group-sync reconciliation chain — one in src/auth.ts after the SCIM+OIDC union is computed, and three in src/server/services/group-mappings.ts covering the loaded mappings, the desired-state map, and the existing DB records. No logic is changed; this is purely observability scaffolding to diagnose why SSO users aren't being mapped to teams in the remote deployment.

Key observations:

• Placement of all four logs is correct relative to the reconciliation steps they instrument.
• user.email is already logged at the earlier token-groups step (pre-existing log on line 256 of auth.ts); the new log follows the same pattern and adds scimEnabled state and the post-union group list.
• The allMappings log in reconcileUserTeamMemberships dumps the complete system-wide RBAC mapping table on every call — this function is invoked for both OIDC logins and SCIM membership changes, so the full config will appear in logs on every event. Scoping the log to only the matched mappings would reduce noise and limit config exposure in logs (see inline comment).

Confidence Score: 4/5

• Safe to merge — changes are purely diagnostic logging with no logic alterations; one minor issue with log scope.
• All four log statements are correctly placed and do not alter any control flow or data. No tokens, passwords, or encrypted secrets are logged. The only concern is that the allMappings dump in group-mappings.ts emits the full system-wide RBAC config table on every reconcile call (including SCIM events), which is noisier and broader in scope than necessary. This is a minor/style issue that doesn't affect correctness or security.
• src/server/services/group-mappings.ts — review the allMappings log scope at line 59

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[OIDC Callback] --> B[Extract groups from token claim]
    B --> C{SCIM enabled?}
    C -->|Yes| D[Load SCIM group memberships from DB]
    D --> E[Union of SCIM groups and token groups]
    C -->|No| F[Use token groups directly]
    E --> G[LOG: final groups list]
    F --> G
    G --> H[reconcileUserTeamMemberships]
    H --> I[Load all group mappings from SystemSettings]
    I --> J[LOG: userId + userGroups + full mappings dump]
    J --> K[Compute desired team roles map]
    K --> L[LOG: desired roles]
    L --> M[Fetch existing group-mapped memberships from DB]
    M --> N[LOG: existing members]
    N --> O[Diff desired vs existing]
    O --> P[Create new memberships]
    O --> Q[Update changed roles]
    O --> R[Delete stale memberships]

_{Last reviewed commit: 3fa3341}