feat(webapp): WorkOS Directory Sync (SCIM) for Identity & Access

Extend the SSO plugin contract for directory sync and apply membership effects
from the accounts webhook worker: provision users in mapped groups (role from
group mapping, else the org default role), deprovision on removal, and keep a
sticky-removal tombstone so JIT never silently re-adds a removed user. JIT and
Directory Sync coexist; roles default to Developer (the JIT default-role picker
has no 'None'). Changing a group's role in the dashboard re-applies it to that
group's current members immediately. The Directory Sync settings section
(group→role mapping, external-domain + manual-membership policy, deferred Save)
appears once a domain is verified — independent of SSO — gated by the hasSso
flag. The settings page polls the whole page while entitled with override-aware
drafts so in-progress edits are never clobbered.

Author: 0ski

.changeset/directory-sync-plugin-contract.md

@@ -0,0 +1,5 @@
+---
+"@trigger.dev/plugins": patch
+---
+
+Extend the SSO plugin contract with WorkOS Directory Sync (SCIM) support.

apps/webapp/app/models/member.server.ts

@@ -5,15 +5,20 @@ import { customAlphabet } from "nanoid";
 import { logger } from "~/services/logger.server";
 import { getDefaultEnvironmentConcurrencyLimit } from "~/services/platform.v3.server";
 import { rbac } from "~/services/rbac.server";
+import { ssoController } from "~/services/sso.server";
 
 export const INVITE_NOT_FOUND = "Invite not found";
+export const INVITE_BLOCKED_DIRECTORY_MANAGED =
+  "Membership for this organization is managed by Directory Sync, so invites can't be accepted.";
 export const ENV_SETUP_INCOMPLETE =
   "You joined the organization, but we couldn't finish setting up your development environments. Please try accepting the invite again, or contact support if this persists.";
 
 export function isAcceptInviteFormError(error: unknown): error is Error {
   return (
     error instanceof Error &&
-    (error.message === INVITE_NOT_FOUND || error.message === ENV_SETUP_INCOMPLETE)
+    (error.message === INVITE_NOT_FOUND ||
+      error.message === ENV_SETUP_INCOMPLETE ||
+      error.message === INVITE_BLOCKED_DIRECTORY_MANAGED)
   );
 }
 
@@ -417,6 +422,14 @@ export async function acceptInvite({
     throw new Error(INVITE_NOT_FOUND);
   }
 
+  // Directory-managed membership: accepting an invite would add a member
+  // outside the directory. Block it (the invite can still be revoked by an
+  // admin). Fail-open on a plugin error so a hiccup doesn't strand joiners.
+  const membershipPolicy = await ssoController.getMembershipPolicy(invite.organizationId);
+  if (membershipPolicy.isOk() && !membershipPolicy.value.manualMembershipAllowed) {
+    throw new Error(INVITE_BLOCKED_DIRECTORY_MANAGED);
+  }
+
   const maximumConcurrencyLimit = await getDefaultEnvironmentConcurrencyLimit(
     invite.organizationId,
     "DEVELOPMENT"
@@ -501,6 +514,12 @@ export async function acceptInvite({
     });
   }
 
+  // Deliberate re-admission clears any sticky-removal tombstone so this
+  // membership isn't shadowed by a prior removal (best-effort; no-op in OSS).
+  await ssoController
+    .clearMembershipRemoval({ organizationId: invite.organization.id, userId: user.id })
+    .unwrapOr(undefined);
+
   return { remainingInvites, organization: invite.organization };
 }
 
@@ -513,7 +532,7 @@ export async function declineInvite({
 }) {
   return await prisma.$transaction(async (tx) => {
     //1. delete invite
-    const declinedInvite = await prisma.orgMemberInvite.delete({
+    const declinedInvite = await tx.orgMemberInvite.delete({
       where: {
         id: inviteId,
         email: user.email,
@@ -524,7 +543,7 @@ export async function declineInvite({
     });
 
     //2. check for other invites
-    const remainingInvites = await prisma.orgMemberInvite.findMany({
+    const remainingInvites = await tx.orgMemberInvite.findMany({
       where: {
         email: user.email,
       },

apps/webapp/app/models/orgMember.server.ts

@@ -1,6 +1,10 @@
 import { Prisma, prisma } from "~/db.server";
 import { logger } from "~/services/logger.server";
 import { rbac } from "~/services/rbac.server";
+import {
+  getValidPersonalAccessTokens,
+  revokePersonalAccessToken,
+} from "~/services/personalAccessToken.server";
 
 export type EnsureOrgMemberParams = {
   userId: string;
@@ -9,7 +13,7 @@ export type EnsureOrgMemberParams = {
   // value is an RBAC role id; when an RBAC plugin is installed it gets
   // attached after the OrgMember row is created.
   roleId: string | null;
-  source: "sso_jit" | "invite" | "manual";
+  source: "sso_jit" | "invite" | "manual" | "directory_sync";
 };
 
 export type EnsureOrgMemberResult = { created: boolean; orgMemberId: string };
@@ -132,3 +136,154 @@ export async function ensureOrgMember(
 
   return { created: true, orgMemberId: member.id };
 }
+
+// Find-or-create a User for a directory-provisioned member. Directory Sync
+// can provision a user before they have ever logged in, so the User row may
+// not exist yet. Email is the natural key (lowercased). New rows are marked
+// SSO since the user will authenticate via the org's IdP.
+export async function ensureUserForDirectory(params: {
+  email: string;
+  firstName: string | null;
+  lastName: string | null;
+}): Promise<{ userId: string }> {
+  const email = params.email.toLowerCase().trim();
+  const existing = await prisma.user.findFirst({ where: { email }, select: { id: true } });
+  if (existing) return { userId: existing.id };
+
+  const name = [params.firstName, params.lastName].filter(Boolean).join(" ").trim() || null;
+  // `User.email` is unique, so two concurrent directory events for the same
+  // email can both miss the lookup above and race on create; the loser gets
+  // P2002. Treat that as the idempotent "already exists" case (same pattern as
+  // `ensureOrgMember`) rather than throwing and burning a webhook retry.
+  try {
+    const created = await prisma.user.create({
+      data: {
+        email,
+        authenticationMethod: "SSO",
+        name,
+        displayName: name,
+      },
+      select: { id: true },
+    });
+    return { userId: created.id };
+  } catch (error) {
+    if (error instanceof Prisma.PrismaClientKnownRequestError && error.code === "P2002") {
+      const existingAfterConflict = await prisma.user.findFirst({
+        where: { email },
+        select: { id: true },
+      });
+      if (existingAfterConflict) return { userId: existingAfterConflict.id };
+    }
+    throw error;
+  }
+}
+
+// Whether the user holds the Owner system role in this org. Owner is the one
+// role Directory Sync must never strip (it can't be auto-granted and is the
+// org's recovery anchor), so deprovision is guarded against removing the last
+// one. Identified by the RBAC system role; OSS-safe (no plugin → not Owner).
+function isOwnerRole(role: { name: string; isSystem: boolean } | null): boolean {
+  return !!role && role.isSystem && role.name === "Owner";
+}
+
+export type RemoveOrgMemberForDirectoryResult =
+  | { removed: true }
+  | { removed: false; reason: "not_a_member" | "last_owner_protected" };
+
+// Deprovision a directory-removed user from an org: hard-delete the
+// OrgMember, drop the RBAC role, force-logout (nextSessionEnd), and revoke
+// the user's personal access tokens ONLY when this was their last org (PATs
+// are user-global, so revoking on a single-org removal would break their CLI
+// access to other orgs). Refuses to remove the org's last Owner.
+export async function removeOrgMemberForDirectory(params: {
+  userId: string;
+  organizationId: string;
+}): Promise<RemoveOrgMemberForDirectoryResult> {
+  const { userId, organizationId } = params;
+
+  const member = await prisma.orgMember.findFirst({
+    where: { userId, organizationId },
+    select: { id: true },
+  });
+  if (!member) return { removed: false, reason: "not_a_member" };
+
+  // Last-Owner guard: never leave the org without an Owner. Resolve every
+  // member's RBAC role and bail if this user is the only Owner.
+  const members = await prisma.orgMember.findMany({
+    where: { organizationId },
+    select: { userId: true },
+  });
+  const roles = await rbac.getUserRoles(
+    members.map((m) => m.userId),
+    organizationId
+  );
+  if (isOwnerRole(roles.get(userId) ?? null)) {
+    const otherOwners = members.filter(
+      (m) => m.userId !== userId && isOwnerRole(roles.get(m.userId) ?? null)
+    );
+    if (otherOwners.length === 0) {
+      logger.warn("removeOrgMemberForDirectory: refusing to remove last Owner", {
+        userId,
+        organizationId,
+      });
+      return { removed: false, reason: "last_owner_protected" };
+    }
+  }
+
+  await prisma.orgMember.delete({ where: { id: member.id } });
+  const removeRole = await rbac.removeUserRole({ userId, organizationId });
+  if (!removeRole.ok) {
+    logger.warn("removeOrgMemberForDirectory: failed to remove RBAC role", {
+      userId,
+      organizationId,
+      error: removeRole.error,
+    });
+  }
+
+  // Post-delete cleanup is best-effort: the membership (the critical state) is
+  // already gone, so any throw here must not propagate. If it did, the webhook
+  // worker would retry, hit the `not_a_member` guard above, and skip the rest
+  // of the cleanup entirely — leaving sessions or PATs behind. Swallowing lets
+  // this single pass finish force-logout + PAT revocation.
+
+  // Force logout everywhere.
+  try {
+    await prisma.user.update({ where: { id: userId }, data: { nextSessionEnd: new Date() } });
+  } catch (error) {
+    logger.warn("removeOrgMemberForDirectory: failed to force logout", {
+      userId,
+      organizationId,
+      error,
+    });
+  }
+
+  // Revoke PATs only if the user no longer belongs to ANY org — PATs are
+  // user-global and used by the CLI across every org the user is in. Each
+  // revoke is guarded so a concurrent self-revoke (which would throw) or one
+  // bad token doesn't abort the rest.
+  try {
+    const remainingMemberships = await prisma.orgMember.count({ where: { userId } });
+    if (remainingMemberships === 0) {
+      const tokens = await getValidPersonalAccessTokens(userId);
+      for (const token of tokens) {
+        try {
+          await revokePersonalAccessToken(token.id, userId);
+        } catch (error) {
+          logger.warn("removeOrgMemberForDirectory: failed to revoke PAT", {
+            userId,
+            tokenId: token.id,
+            error,
+          });
+        }
+      }
+    }
+  } catch (error) {
+    logger.warn("removeOrgMemberForDirectory: PAT cleanup failed", {
+      userId,
+      organizationId,
+      error,
+    });
+  }
+
+  return { removed: true };
+}

apps/webapp/app/routes/_app.orgs.$organizationSlug.invite/route.tsx

@@ -33,6 +33,7 @@ import { resolveOrgIdFromSlug } from "~/models/organization.server";
 import { TeamPresenter } from "~/presenters/TeamPresenter.server";
 import { scheduleEmail } from "~/services/scheduleEmail.server";
 import { rbac } from "~/services/rbac.server";
+import { ssoController } from "~/services/sso.server";
 import { dashboardAction, dashboardLoader } from "~/services/routeBuilders/dashboardBuilder";
 import { acceptInvitePath, organizationTeamPath, v3BillingPath } from "~/utils/pathBuilder";
 import { PurchaseSeatsModal } from "../_app.orgs.$organizationSlug.settings.team/route";
@@ -171,7 +172,7 @@ export const action = dashboardAction(
     },
     authorization: { action: "manage", resource: { type: "members" } },
   },
-  async ({ request, params, user }) => {
+  async ({ request, params, user, context }) => {
     const userId = user.id;
     const { organizationSlug } = params;
 
@@ -182,6 +183,18 @@ export const action = dashboardAction(
       return json(submission.reply());
     }
 
+    // Directory-managed membership: inviting is disabled (the directory is the
+    // authority). Enforced here; the Team page also hides the invite button.
+    if (context.organizationId) {
+      const policy = await ssoController.getMembershipPolicy(context.organizationId);
+      if (policy.isOk() && !policy.value.manualMembershipAllowed) {
+        return json(
+          { errors: { body: "Membership is managed by Directory Sync" } },
+          { status: 403 }
+        );
+      }
+    }
+
     // Resolve the RBAC role choice. NO_RBAC_ROLE / undefined / unknown
     // role → don't pass one through; the runtime fallback handles it.
     // Validation: the chosen role must be in the org's assignable set