fix(ci): preserve hosted SCIM entitlement coverage

Author: waleedlatif1

.github/CI.md

@@ -30,6 +30,8 @@ Memory-heavy builds and browser jobs retain appropriately sized Blacksmith runne
 
 Every HTTP and browser group consumes the same production build in an isolated job/database. Electron also uses that build and skips its development-route warm-up. Local HTTP and Electron development runs retain their dev-server behavior. Build inputs exclude test-only files so a harness edit can reuse an unchanged production build.
 
+SCIM's production app uses a `sim.ai` fixture hostname mapped to loopback, since `NEXT_PUBLIC_FORCE_HOSTED` is ignored in production. Readiness, HTTP tests, and internal API requests still connect to loopback. The SCIM suite verifies that ending an Enterprise subscription rejects both owner administration and an existing bearer token, and that restoring it restores access.
+
 ## Coverage removed or consolidated
 
 - SEO is plain HTTP, independent of browser and viewport. Its complete suite runs once in the SEO job, instead of repeating in each of four mobile shards.

.github/scripts/http-e2e.sh

@@ -33,6 +33,7 @@ realtime_pid=''
 realtime_tag=''
 realtime_log=''
 browsers_pid=''
+local_app_url=''
 # `dev` or `start`; a group sets it before start_app.
 app_server=${E2E_APP_SERVER:-dev}
 
@@ -78,7 +79,8 @@ start_app() {
     status_log="$report_dir/$name-http-status.log"
   fi
   app_tag="$name-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$$"
-  export NEXT_PUBLIC_APP_URL="http://127.0.0.1:$port"
+  local_app_url="http://127.0.0.1:$port"
+  export NEXT_PUBLIC_APP_URL="${E2E_APP_PUBLIC_URL:-$local_app_url}"
   export BETTER_AUTH_URL="$NEXT_PUBLIC_APP_URL"
   export DISABLE_TELEMETRY=true NEXT_TELEMETRY_DISABLED=1
   if [ "$app_server" = start ]; then
@@ -96,7 +98,7 @@ start_app() {
       --port "$port" > "$server_log" 2>&1 &
   fi
   server_pid=$!
-  wait_ready "$server_pid" "$NEXT_PUBLIC_APP_URL/api/health" "$label app"
+  wait_ready "$server_pid" "$local_app_url/api/health" "$label app"
 }
 
 # start_realtime <name> <port>: the Socket.IO server the app's browser clients connect to, so pages
@@ -143,12 +145,12 @@ case "$group" in
     export DB_TX_TRIPWIRE=throw
     export NEXT_PUBLIC_CHAT_DISABLED=true
     start_app scim 3017 SCIM record-http-status
-    SCIM_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+    SCIM_E2E_BASE_URL="$local_app_url" \
     SCIM_E2E_DATABASE_URL="$DATABASE_URL" \
     SCIM_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
     SCIM_E2E_REPORT_PATH="$report_dir/scim-e2e-report.json" \
       bun run test:scim:e2e
-    VERSION_COMPARE_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+    VERSION_COMPARE_E2E_BASE_URL="$local_app_url" \
     VERSION_COMPARE_E2E_DATABASE_URL="$DATABASE_URL" \
     VERSION_COMPARE_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
     VERSION_COMPARE_E2E_REPORT_PATH="$report_dir/version-compare-http-report.json" \

.github/workflows/checks.yml

@@ -228,6 +228,9 @@ jobs:
       DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_test
       BETTER_AUTH_SECRET: http-e2e-ci-secret-at-least-32-characters
       E2E_APP_SERVER: start
+      E2E_APP_PUBLIC_URL: ${{ matrix.group == 'scim' && 'http://scim-e2e.sim.ai:3017' || '' }}
+      INTERNAL_API_BASE_URL: ${{ matrix.group == 'scim' && 'http://127.0.0.1:3017' || '' }}
+      TRUSTED_ORIGINS: ${{ matrix.group == 'scim' && 'http://127.0.0.1:3017' || '' }}
       PROJECT_FILES_E2E_APP_SERVER: start
       ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000'
 
@@ -275,6 +278,10 @@ jobs:
           cd "$addon_dir"
           bun run install
 
+      - name: Map the hosted SCIM fixture to loopback
+        if: matrix.group == 'scim'
+        run: printf '127.0.0.1 scim-e2e.sim.ai\n' | sudo tee -a /etc/hosts
+
       # No step timeout: the job's bound covers a hang without cutting a slow but healthy suite
       # short of writing its report.
       - name: Run end-to-end suites

apps/sim/ee/scim/TESTING.md

@@ -9,9 +9,10 @@ provisioning service.
 ## Requirements
 
 - Bun and the repository dependencies installed.
-- A running local app configured for Enterprise SCIM, using a dedicated local
+- A running local app configured for hosted Enterprise SCIM with billing enabled, using a dedicated local
   PostgreSQL database with all migrations applied (including `0325`). Leave
   Redis unconfigured so the app uses PostgreSQL for rate-limit storage.
+  For `next dev`, set `NEXT_PUBLIC_FORCE_HOSTED=true` and `BILLING_ENABLED=true`.
 - The app's local `BETTER_AUTH_SECRET`, at least 32 characters long.
 - An app URL using HTTP on `localhost`, `127.0.0.1`, or `::1`. The database must
   also use a loopback host, and its name must include `test` or `scim`.
@@ -53,6 +54,8 @@ timeout.
 
 - Discovery, session-authenticated configuration, credential hashing, tenant
   isolation, bearer authentication, content type, and malformed JSON errors.
+- Hosted Enterprise entitlement loss rejects both session-authenticated administration
+  and an existing bearer token; restoring the subscription restores both paths.
 - User and group creation, reads, replacement, PATCH, deletion, conflict errors,
   stable pagination, count-only queries, and group/member attribute projection.
 - Case-insensitive user lookup, external IDs, secondary/work/primary email
@@ -78,10 +81,14 @@ timeout.
 
 The `e2e (scim)` job in `.github/workflows/checks.yml`
 provisions its own database through `db:migrate`, starts a local Next.js app
-with hosted Enterprise configuration, and runs the HTTP suite above. It has its
+with hosted Enterprise configuration, and runs the HTTP suite above. The production
+app's public URL uses `scim-e2e.sim.ai`, mapped to loopback on that runner; the
+tests and internal API requests still connect to `127.0.0.1`. Production ignores
+`NEXT_PUBLIC_FORCE_HOSTED`, so setting that flag alone cannot provide hosted coverage.
+It has its
 own database because the hosted app runs background usage replay against it.
-Readiness is bounded to 300 seconds, since the first request cold-compiles the
-app; the server is stopped when the step exits. A failure prints the server log
+Readiness is bounded to 600 seconds for either production or local development
+startup; the server is stopped when the step exits. A failure prints the server log
 tail and uploads the credential-free scenario report, an allowlist of HTTP
 status log lines, and the local app's server log. The CI app uses only fixture
 secrets.

apps/sim/scripts/test-scim-e2e.ts

@@ -282,6 +282,24 @@ async function run() {
     }
   )
 
+  await check(
+    'Hosted SCIM rejects administration and bearer access after Enterprise entitlement ends',
+    async () => {
+      await admin(primary)
+      await scim(token, '/Users')
+      await sql`update subscription set status = 'canceled' where reference_id = ${primary.orgId}`
+      try {
+        const denied = await admin(primary, '', { expected: 403 })
+        assert.match(string(denied.body.error), /active enterprise subscription/)
+        await scim(token, '/Users', { expected: 401 })
+      } finally {
+        await sql`update subscription set status = 'active' where reference_id = ${primary.orgId}`
+      }
+      await admin(primary)
+      await scim(token, '/Users')
+    }
+  )
+
   await check(
     'Protocol authentication, malformed JSON, and content-type errors are SCIM responses',
     async () => {