feat(SCIM): Support deactivated user membership by khvn26 · Pull Request #8370 · Flagsmith/flagsmith

khvn26 · 2026-08-25T19:45:34Z

Thanks for submitting a PR! Please check the boxes below:

I have read the Contributing Guide.
I have added information to docs/ if required so people know about the feature.
I have filled in the "Changes" section below.
I have filled in the "How did you test this code" section below.

Changes

Contributes to #8368

In this PR, we add UserOrganisation.is_active, defaulting to True, so a membership can be suspended without being destroyed.

A deactivated member:

can still log in, but gets a 403 on the organisation and no longer sees it in the organisation picker;
doesn't count towards the plan's seat limit;
keeps their role, project/environment permissions and group memberships, so reactivation restores access exactly as it was.

Membership is checked in a lot of places, all of which previously traversed the Organisation.users M2M and so would have kept letting deactivated members in.

The traversals are now expressed as permission_service.get_active_membership_filter, which keeps the user and is_active lookups in a single filter() call.

UserOrganisation.is_active is exposed read-only on UserOrganisationSerializer so the frontend can surface deactivated members later. Nothing in the api writes it yet outside set_organisation_membership_active.

How did you test this code?

Added unit tests.

Adds `UserOrganisation.is_active`, defaulting to `True`. Deactivated members can still log in, but cannot access the organisation, do not see it in the organisation picker, and do not count towards the seat limit. Their roles, permissions and group memberships are retained, so reactivation restores access. Reactivation deliberately does not enforce the seat limit: it is driven by an external identity provider over SCIM, where failing the call would leave the provider and Flagsmith out of sync. Ref: #8368

Ref: #8368

vercel · 2026-08-25T19:45:40Z

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	Aug 25, 2026 8:33pm
flagsmith-frontend-preview	Ignored	Preview	Aug 25, 2026 8:33pm
flagsmith-frontend-staging	Ignored	Preview	Aug 25, 2026 8:33pm

coderabbitai · 2026-08-25T19:46:43Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e3b552df-a6d4-49d5-9f63-21e959887316

📥 Commits

Reviewing files that changed from the base of the PR and between 70993ec and 20bff27.

📒 Files selected for processing (1)

api/tests/unit/organisations/test_unit_organisations_deactivated_membership.py

Included review availability: Your plan provides up to 8 included reviews per hour; 4 remain after this review.

📝 Walkthrough

Walkthrough

The change adds an is_active state to organisation memberships. Organisation access, permissions, audit logs, invitations, notifications, seat counts, and dashboard counts now exclude inactive memberships. Users can still log in, and memberships remain available for reactivation. API key users retain access to their master-key organisation. Tests and documentation cover the updated behaviour.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 20bff

This change adds deactivated membership handling and exposes its status without any supplied merge-blocking concern; no actionable merge-blocking risk remains after normal checks and review.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-25T19:46:59Z

Docker builds report

Image	Build Status	Security report
`ghcr.io/flagsmith/flagsmith-e2e:pr-8370`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-api-test:pr-8370`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-frontend:pr-8370`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-api:pr-8370`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-private-cloud:pr-8370`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith:pr-8370`	Finished ✅	Results ✅

github-actions · 2026-08-25T19:51:48Z

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #19767 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

3 passed

Details

3 tests across 3 suites
38.9 seconds
20bff27
🔄 Run: #19767 (attempt 1)

🗂️ Previous results

✅ oss · depot-ubuntu-latest-16 — run #19767 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
42.1 seconds
20bff27
🔄 Run: #19767 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-16 — run #19767 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

23 passed
1 skipped

Details

24 tests across 18 suites
1 minute, 29 seconds
20bff27
🔄 Run: #19767 (attempt 1)

Skipped tests

firefox › tests/onboarding-tests.pw.ts › Onboarding › New user connects via the single-page onboarding flow @oss

✅ oss · depot-ubuntu-latest-arm-16 — run #19767 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
44.9 seconds
20bff27
🔄 Run: #19767 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-16 — run #19765 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

3 passed

Details

3 tests across 3 suites
36.9 seconds
70993ec
🔄 Run: #19765 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #19765 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
38 seconds
70993ec
🔄 Run: #19765 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #19765 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
46 seconds
70993ec
🔄 Run: #19765 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #19763 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

2 passed

Details

2 tests across 2 suites
53.6 seconds
cb13a47
🔄 Run: #19763 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-16 — run #19763 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

3 passed

Details

3 tests across 3 suites
32.8 seconds
cb13a47
🔄 Run: #19763 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #19763 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
45.2 seconds
cb13a47
🔄 Run: #19763 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #19763 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
40.3 seconds
cb13a47
🔄 Run: #19763 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #19761 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
36.5 seconds
6161672
🔄 Run: #19761 (attempt 1)

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 74b6d7d8-d0ac-45cc-a7a3-64a569bf5999

📥 Commits

Reviewing files that changed from the base of the PR and between 0212201 and 6161672.

📒 Files selected for processing (17)

api/api_keys/user.py
api/audit/views.py
api/organisations/invites/views.py
api/organisations/migrations/0061_add_user_organisation_is_active.py
api/organisations/models.py
api/organisations/serializers.py
api/organisations/task_helpers.py
api/organisations/views.py
api/permissions/permission_service.py
api/sales_dashboard/views.py
api/tests/unit/organisations/test_unit_organisations_deactivated_membership.py
api/tests/unit/users/test_unit_users_models.py
api/users/abc.py
api/users/models.py
docs/docs/administration-and-security/access-control/scim.md
docs/docs/deployment-self-hosting/observability/_events-catalogue.md
openapi.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

github-actions · 2026-08-25T19:52:53Z

Visual Regression

19 screenshots compared. See report for details.
View full report

Ref: #8368

codecov · 2026-08-25T20:03:09Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.80%. Comparing base (b9b32ba) to head (20bff27).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #8370    +/-   ##
========================================
  Coverage   98.79%   98.80%            
========================================
  Files        1616     1618     +2     
  Lines       65283    65409   +126     
========================================
+ Hits        64499    64625   +126     
  Misses        784      784

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

`cancel_users` picked the earliest-joined admin without regard to `is_active`. A deactivated admin could therefore be retained while every active membership was deleted, leaving the organisation with no user able to access it and no way to undo it. Prefer the earliest active admin, fall back to the earliest active member, and no-op when no seat is in use \u2014 which also removes the latent `AttributeError` when the organisation has no admin at all. Ref: #8368

The early return in `set_organisation_membership_active` lost its test when the seat-limit check was removed, leaving the branch uncovered. Ref: #8368

khvn26 added 2 commits August 25, 2026 20:43

docs(scim): document deactivated user membership

e169e20

Ref: #8368

khvn26 requested review from a team as code owners August 25, 2026 19:45

khvn26 requested review from bakirFS and matthewelwell and removed request for a team August 25, 2026 19:45

flagsmith-engineering Bot assigned matthewelwell and bakirFS Aug 25, 2026

github-actions Bot added api Issue related to the REST API docs Documentation updates labels Aug 25, 2026

khvn26 changed the title ~~feat(organisations): Support deactivated user membership~~ feat(SCIM): Support deactivated user membership Aug 25, 2026

github-actions Bot added feature New feature or request and removed docs Documentation updates labels Aug 25, 2026

chore: Update documentation artefacts

6161672

flagsmith-engineering Bot requested a review from a team as a code owner August 25, 2026 19:47

github-actions Bot added the docs Documentation updates label Aug 25, 2026

coderabbitai Bot reviewed Aug 25, 2026

View reviewed changes

Comment thread api/organisations/models.py

docs(scim): fold deactivation into the user lifecycle section

cb13a47

Ref: #8368

vercel Bot had a problem deploying to Preview – docs August 25, 2026 19:53 Failure

github-actions Bot removed the feature New feature or request label Aug 25, 2026

github-actions Bot added feature New feature or request and removed docs Documentation updates labels Aug 25, 2026

test(organisations): cover the no-op membership activation branch

20bff27

The early return in `set_organisation_membership_active` lost its test when the seat-limit check was removed, leaving the branch uncovered. Ref: #8368

github-actions Bot added docs Documentation updates feature New feature or request and removed feature New feature or request docs Documentation updates labels Aug 25, 2026

Uh oh!

Conversation

khvn26 commented Aug 25, 2026

Changes

How did you test this code?

Uh oh!

vercel Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

github-actions Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docker builds report

Uh oh!

github-actions Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Visual Regression

Uh oh!

codecov Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vercel Bot commented Aug 25, 2026 •

edited

Loading

coderabbitai Bot commented Aug 25, 2026 •

edited

Loading

github-actions Bot commented Aug 25, 2026 •

edited

Loading

github-actions Bot commented Aug 25, 2026 •

edited

Loading

github-actions Bot commented Aug 25, 2026 •

edited

Loading

codecov Bot commented Aug 25, 2026 •

edited

Loading