fix(webapp,plugins): additive Directory Sync roles + retryable account webhooks

Directory Sync is now additive: connecting a directory no longer resets
or removes the roles of members you added yourself. A member's role
changes only when they belong to a group you've explicitly mapped to a
role — new groups start unmapped ("Inherit") and change nothing until
you map them. Owner can now be assigned from the Directory Sync and SSO
role menus. Out-of-order webhooks from your identity provider are
retried instead of dropped, so directory setup is more reliable.

Mono-RevId: cd148230d7708141c30a13a4aae0e5ba2a4bfa5e

Author: 0ski

apps/webapp/app/routes/_app.orgs.$organizationSlug.settings.sso/route.tsx

@@ -168,10 +168,8 @@ export const loader = dashboardLoader(
     const status = statusResult.isOk() ? statusResult.value : EMPTY_SSO_STATUS;
     const directorySync = dsyncResult.isOk() ? dsyncResult.value : EMPTY_DIRECTORY_SYNC_STATUS;
 
-    // JIT can't grant Owner (reserved), and non-assignable/plan-gated roles
-    // are filtered out.
     const assignable = new Set(assignableIds);
-    const jitRoles = allRoles.filter((r) => r.name !== "Owner" && assignable.has(r.id));
+    const jitRoles = allRoles.filter((r) => assignable.has(r.id));
 
     return typedjson({
       status,
@@ -810,7 +808,7 @@ function ActiveConnectionState({
         />
         <SettingsRow
           title="Default role for new users"
-          description="Assigned to users created by just-in-time provisioning. Owner can't be granted automatically."
+          description="Assigned to users created by just-in-time provisioning."
           action={
             <Select<string, Role>
               value={draftJitRoleId}
@@ -1085,7 +1083,11 @@ function DirectorySyncSection({
                         setDraftGroupRoles((prev) => ({ ...prev, [group.groupId]: v }))
                       }
                       items={[
-                        { id: NULL_ROLE_VALUE, name: "No access", description: "" },
+                        {
+                          id: NULL_ROLE_VALUE,
+                          name: "Inherit",
+                          description: "Uses the Default role for unmapped users",
+                        },
                         ...jitRoles,
                       ]}
                       variant="secondary/small"
@@ -1094,7 +1096,7 @@ function DirectorySyncSection({
                       placement="bottom-end"
                       text={(v) =>
                         v === NULL_ROLE_VALUE
-                          ? "No access"
+                          ? "Inherit"
                           : (jitRoles.find((r) => r.id === v)?.name ?? "Select a role")
                       }
                     >

apps/webapp/app/services/directorySyncEffects.server.ts

@@ -88,9 +88,7 @@ async function applyEffect(effect: DirectorySyncEffect): Promise<string | null>
         source: "directory_sync",
       });
 
-      // Directory owns the role: overwrite even an existing member
-      // (ensureOrgMember only sets it on create).
-      if (effect.roleId) {
+      if (effect.roleId && effect.roleAuthoritative) {
         const result = await rbac.setUserRole({
           userId,
           organizationId: effect.organizationId,

apps/webapp/app/v3/accountsWebhookWorker.server.ts

@@ -74,7 +74,11 @@ function initializeWorker() {
           data: payload.data,
         });
         if (result.isErr()) {
-          throw new Error(`account webhook processing failed: ${result.error}`);
+          const error = new Error(`account webhook processing failed: ${result.error}`);
+          if (result.error === "not_ready") {
+            Object.assign(error, { logLevel: "warn" as const });
+          }
+          throw error;
         }
         // Directory-sync events return membership effects to apply against
         // public.* tables (the plugin never writes those). A throw here

apps/webapp/test/directorySyncEffects.server.test.ts

@@ -31,7 +31,11 @@ import { applyDirectorySyncEffects } from "~/services/directorySyncEffects.serve
 const ENTITLED_ORG = "org_entitled";
 const UNENTITLED_ORG = "org_unentitled";
 
-function provision(organizationId: string, email = "someone@acme.com"): DirectorySyncEffect {
+function provision(
+  organizationId: string,
+  email = "someone@acme.com",
+  roleAuthoritative = false
+): DirectorySyncEffect {
   return {
     kind: "provision",
     userId: "user_1",
@@ -40,6 +44,7 @@ function provision(organizationId: string, email = "someone@acme.com"): Director
     lastName: null,
     organizationId,
     roleId: null,
+    roleAuthoritative,
   };
 }
 
@@ -165,7 +170,11 @@ describe("applyDirectorySyncEffects — SSO entitlement gate", () => {
       devEnvironmentsQueued: false,
     });
 
-    const effect = { ...provision(ENTITLED_ORG), roleId: "role_restricted" };
+    const effect = {
+      ...provision(ENTITLED_ORG),
+      roleId: "role_restricted",
+      roleAuthoritative: true,
+    };
 
     const { unqueuedUserIds } = await applyDirectorySyncEffects([effect]);
 
@@ -175,6 +184,23 @@ describe("applyDirectorySyncEffects — SSO entitlement gate", () => {
     );
   });
 
+  it("does not overwrite an existing role for a non-authoritative provision", async () => {
+    getSsoEntitlement.mockResolvedValue("entitled");
+
+    const effect = {
+      ...provision(ENTITLED_ORG),
+      roleId: "role_restricted",
+      roleAuthoritative: false,
+    };
+
+    await applyDirectorySyncEffects([effect]);
+
+    expect(ensureOrgMember).toHaveBeenCalledWith(
+      expect.objectContaining({ roleId: "role_restricted", organizationId: ENTITLED_ORG })
+    );
+    expect(setUserRole).not.toHaveBeenCalled();
+  });
+
   it("reports nothing to retry when every provision was queued", async () => {
     getSsoEntitlement.mockResolvedValue("entitled");
 

packages/plugins/src/sso.ts

@@ -99,17 +99,6 @@ export type DirectorySyncStatus = {
   groups: ReadonlyArray<DirectoryGroupMapping>;
 };
 
-// A host-actionable membership mutation derived from a directory-sync event.
-// The plugin owns all `enterprise.*` writes; these effects describe the
-// `public.*` (User / OrgMember / role / token) writes the host must perform —
-// the plugin never touches those tables. The host worker applies them
-// idempotently.
-//
-// - `provision`:   ensure the User exists (create when `userId === null`),
-//                  ensure the OrgMember exists, and set its role.
-// - `deprovision`: remove the membership (guarded against last-Owner), force
-//                  logout, and revoke tokens per host policy.
-// - `set_role`:    overwrite the member's role (directory-authoritative).
 export type DirectorySyncEffect =
   | {
       kind: "provision";
@@ -119,6 +108,7 @@ export type DirectorySyncEffect =
       lastName: string | null;
       organizationId: string;
       roleId: string | null;
+      roleAuthoritative: boolean;
     }
   | { kind: "deprovision"; userId: string; organizationId: string }
   | { kind: "set_role"; userId: string; organizationId: string; roleId: string };
@@ -147,10 +137,7 @@ export type SsoPortalError = "idp_org_unavailable" | "internal";
 // session is NOT an error: it's a successful result of `{ valid: false }`.
 export type SsoValidateError = "internal";
 
-// Inbound webhook handling. `invalid_signature` → reject (4xx, no retry);
-// `feature_disabled` → no plugin installed (host returns 404); `internal`
-// → transient, the host returns 5xx so the provider retries.
-export type SsoWebhookError = "invalid_signature" | "feature_disabled" | "internal";
+export type SsoWebhookError = "invalid_signature" | "feature_disabled" | "internal" | "not_ready";
 
 // A verified, JSON-serializable inbound event. Vendor-neutral envelope —
 // `event` is the provider's event-type string, `data` its opaque payload.