feat(SCIM): Wire flagsmith-private SCIM app into the api by khvn26 · Pull Request #7512 · Flagsmith/flagsmith

khvn26 · 2026-05-13T18:49:36Z

Thanks for submitting a PR! Please check the boxes below:

I have read the Contributing Guide.
I have added information to docs/ if required so people know about the feature.
I have filled in the "Changes" section below.
I have filled in the "How did you test this code" section below.

Changes

Closes #7150.

Conditionally registers the SCIM Django app shipped by flagsmith-private when the scim module is importable: adds django_scim and scim to INSTALLED_APPS, sets the django-scim2 SCIM_SERVICE_PROVIDER settings (with AUTH_CHECK_MIDDLEWARE pointed at scim.middleware.ScimAuthenticationMiddleware), and mounts the protocol URLs at /api/v1/scim/v2/ plus the configuration management URLs at /api/v1/organisations/<int:organisation_pk>/scim/.

flagsmith-private is now installed from the prod CodeArtifact PyPI repository (flagsmith-pypi-production) rather than a git ref, pinned to >=0.5.1,<1. The new .github/actions/codeartifact-login composite action assumes the codeartifact-github-actions-production role via OIDC, fetches a token, and exports it as UV_INDEX_FLAGSMITH_PYPI_PRODUCTION_*. Every CI job and Dockerfile stage that installs the scim / release-pipelines extras runs the login step first. For local dev, make codeartifact-login writes the same env vars to a git-ignored .env-codeartifact file that the Makefile auto-includes.

Dependabot is wired to the same index via its native OIDC support for CodeArtifact — a registries: block in .github/dependabot.yml reuses the same IAM role (its trust policy already accepts repo:Flagsmith/*). No cron-based token refresh required.

How did you test this code?

Integration tests under api/tests/integration/scim/ cover:

GET /api/v1/scim/v2/{ServiceProviderConfig,Schemas,ResourceTypes} with a valid SCIM bearer for an Enterprise org → 200.
Same endpoints without a bearer → 401.
Same endpoints with a bearer for a non-Enterprise org → 403.
URL routing for the management endpoints under /api/v1/organisations/{pk}/scim/.
Settings assertions: SCIM_INSTALLED, INSTALLED_APPS entries, and SCIM_SERVICE_PROVIDER shape.

Tests are gated on settings.SCIM_INSTALLED and skip on the public PR job (which doesn't install --extra scim).

vercel · 2026-05-13T18:49:42Z

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	May 14, 2026 4:50pm
flagsmith-frontend-preview	Ignored	Preview	May 14, 2026 4:50pm
flagsmith-frontend-staging	Ignored	Preview	May 14, 2026 4:50pm

codecov · 2026-05-13T18:55:22Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.47%. Comparing base (70f25fa) to head (94be7de).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7512   +/-   ##
=======================================
  Coverage   98.46%   98.47%           
=======================================
  Files        1398     1400    +2     
  Lines       52900    52986   +86     
=======================================
+ Hits        52090    52176   +86     
  Misses        810      810

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

claude

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

github-actions · 2026-05-14T15:11:54Z

Docker builds report

Image	Build Status	Security report
`ghcr.io/flagsmith/flagsmith-api-test:pr-7512`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-frontend:pr-7512`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-api:pr-7512`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith:pr-7512`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-api-test:pr-7512`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-private-cloud:pr-7512`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-frontend:pr-7512`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith:pr-7512`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-api:pr-7512`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-private-cloud:pr-7512`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-e2e:pr-7512`	Finished ✅	Skipped

Conditionally register the SCIM Django app, the auth middleware, and the django-scim2 `SCIM_SERVICE_PROVIDER` settings when the `scim` module from `flagsmith-private` is on the path. Mount the protocol URLs at `/scim/v2/` and the configuration management URLs at `/api/v1/organisations/{organisation_pk}/scim/`. flagsmith-private bumped to v0.5.0 for the SCIM app and a new `scim` extra is exposed for parity with the other private modules. Refs #7150. beep boop

github-actions · 2026-05-14T15:17:39Z

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
37.9 seconds
32ddcbf
🔄 Run: #16752 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
32.3 seconds
07e8f84
🔄 Run: #16753 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
46.1 seconds
32ddcbf
🔄 Run: #16752 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

18 passed

Details

18 tests across 14 suites
1 minute, 16 seconds
32ddcbf
🔄 Run: #16752 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
43.2 seconds
07e8f84
🔄 Run: #16753 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

2 passed

Details

2 tests across 2 suites
37.3 seconds
07e8f84
🔄 Run: #16753 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

2 passed

Details

2 tests across 2 suites
40.8 seconds
07e8f84
🔄 Run: #16753 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
58 seconds
32ddcbf
🔄 Run: #16752 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
42.2 seconds
d55aa19
🔄 Run: #16756 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
39 seconds
d55aa19
🔄 Run: #16756 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
42.5 seconds
d55aa19
🔄 Run: #16756 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

2 passed

Details

2 tests across 2 suites
37.6 seconds
d55aa19
🔄 Run: #16756 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
43 seconds
046598c
🔄 Run: #16757 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
39.5 seconds
046598c
🔄 Run: #16757 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

3 passed

Details

3 tests across 3 suites
1 minute, 4 seconds
046598c
🔄 Run: #16757 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
1 minute, 5 seconds
046598c
🔄 Run: #16757 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
38 seconds
2d1c9f6
🔄 Run: #16758 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
42.5 seconds
2d1c9f6
🔄 Run: #16758 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

3 passed

Details

3 tests across 3 suites
31.5 seconds
2d1c9f6
🔄 Run: #16758 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

2 passed

Details

2 tests across 2 suites
57.1 seconds
2d1c9f6
🔄 Run: #16758 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

2 passed

Details

2 tests across 2 suites
44.5 seconds
8613629
🔄 Run: #16759 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
33.6 seconds
8613629
🔄 Run: #16759 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
56.4 seconds
8613629
🔄 Run: #16759 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
46.8 seconds
8613629
🔄 Run: #16759 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
41.6 seconds
7117445
🔄 Run: #16760 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
40.2 seconds
7117445
🔄 Run: #16760 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
33.8 seconds
7117445
🔄 Run: #16760 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

2 passed

Details

2 tests across 2 suites
38.6 seconds
7117445
🔄 Run: #16760 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
39.2 seconds
94be7de
🔄 Run: #16761 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
41.9 seconds
94be7de
🔄 Run: #16761 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

2 passed

Details

2 tests across 2 suites
38.4 seconds
94be7de
🔄 Run: #16761 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
35.9 seconds
94be7de
🔄 Run: #16761 (attempt 1)

github-actions · 2026-05-14T15:19:56Z

Visual Regression

16 screenshots compared. See report for details.
View full report

Dependabot natively supports OIDC for AWS CodeArtifact private indexes (`registries[].type: python-index` + `role-name` etc.) — no cron-based token refresh needed. Reuses the existing `codeartifact-github-actions-production` role; its trust policy already accepts `repo:Flagsmith/*` subject claims, which matches Dependabot's `repo:Flagsmith/flagsmith:dependabot` sub. Unblocks `uv lock` re-resolution during Dependabot scans for /api, which would otherwise 401 against the private index even for unrelated public-package bumps. beep boop

emyller

Approved with one question.

emyller

LGTM!

django-scim2 builds resource `meta.location` URLs by `urljoin`ing `reverse('scim:...')` onto `BASE_LOCATION_GETTER(request)`. The default getter pulls from the `NETLOC`/`SCHEME` SCIM_SERVICE_PROVIDER settings, which we were populating from `FLAGSMITH_API_URL` — forcing self-hosters to configure that env var correctly for SCIM URLs to render. Override `BASE_LOCATION_GETTER` with one that returns `request.build_absolute_uri('/')` instead. The host follows whatever the request was served on, no configuration required. beep boop

github-actions Bot added api Issue related to the REST API feature New feature or request labels May 13, 2026

khvn26 force-pushed the feat/scim-main-repo-integration branch from 70722d7 to 4dad568 Compare May 14, 2026 14:21