test(webapp): cover the SSO entitlement gate on directory sync

Locks in the three branches of the new gate: effects apply for an
entitled org, are skipped for one without the entitlement (provision and
deprovision alike, so revocation can't remove members), and an
unreadable entitlement throws a warn-level retryable error rather than
silently dropping a directory change.

Also covers per-org memoisation across a batch and that one unentitled
org doesn't block another.

Picks up @trigger.dev/platform 1.3.0, which is what makes limits.hasSso
visible to the webapp at all.

Author: matt-aitken

apps/webapp/test/directorySyncEffects.server.test.ts

@@ -0,0 +1,130 @@
+import type { DirectorySyncEffect } from "@trigger.dev/plugins";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("~/db.server", () => ({ prisma: {}, $replica: {} }));
+vi.mock("~/services/platformNotifications.server", () => ({
+  createPlatformNotification: vi.fn(),
+}));
+
+const getSsoEntitlement = vi.fn();
+vi.mock("~/services/platform.v3.server", async (importOriginal) => {
+  const actual = (await importOriginal()) as Record<string, unknown>;
+  return { ...actual, getSsoEntitlement: (orgId: string) => getSsoEntitlement(orgId) };
+});
+
+const setUserRole = vi.fn();
+vi.mock("~/services/rbac.server", () => ({
+  rbac: { setUserRole: (a: unknown) => setUserRole(a) },
+}));
+
+const ensureOrgMember = vi.fn();
+const ensureUserForDirectory = vi.fn();
+const removeOrgMemberForDirectory = vi.fn();
+vi.mock("~/models/orgMember.server", () => ({
+  ensureOrgMember: (a: unknown) => ensureOrgMember(a),
+  ensureUserForDirectory: (a: unknown) => ensureUserForDirectory(a),
+  removeOrgMemberForDirectory: (a: unknown) => removeOrgMemberForDirectory(a),
+}));
+
+import { applyDirectorySyncEffects } from "~/services/directorySyncEffects.server";
+
+const ENTITLED_ORG = "org_entitled";
+const UNENTITLED_ORG = "org_unentitled";
+
+function provision(organizationId: string, email = "someone@acme.com"): DirectorySyncEffect {
+  return {
+    kind: "provision",
+    userId: "user_1",
+    email,
+    firstName: null,
+    lastName: null,
+    organizationId,
+    roleId: null,
+  };
+}
+
+function deprovision(organizationId: string): DirectorySyncEffect {
+  return { kind: "deprovision", userId: "user_1", organizationId };
+}
+
+describe("applyDirectorySyncEffects — SSO entitlement gate", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    ensureOrgMember.mockResolvedValue(undefined);
+    removeOrgMemberForDirectory.mockResolvedValue({ removed: true });
+    setUserRole.mockResolvedValue({ ok: true });
+  });
+
+  it("applies effects for an entitled org", async () => {
+    getSsoEntitlement.mockResolvedValue("entitled");
+
+    await applyDirectorySyncEffects([provision(ENTITLED_ORG)]);
+
+    expect(ensureOrgMember).toHaveBeenCalledTimes(1);
+    expect(ensureOrgMember).toHaveBeenCalledWith(
+      expect.objectContaining({ organizationId: ENTITLED_ORG, source: "directory_sync" })
+    );
+  });
+
+  it("skips provisioning for an org without the entitlement", async () => {
+    getSsoEntitlement.mockResolvedValue("not_entitled");
+
+    await applyDirectorySyncEffects([provision(UNENTITLED_ORG)]);
+
+    expect(ensureOrgMember).not.toHaveBeenCalled();
+    expect(ensureUserForDirectory).not.toHaveBeenCalled();
+  });
+
+  it("skips deprovisioning too, so revocation cannot remove members", async () => {
+    getSsoEntitlement.mockResolvedValue("not_entitled");
+
+    await applyDirectorySyncEffects([deprovision(UNENTITLED_ORG)]);
+
+    expect(removeOrgMemberForDirectory).not.toHaveBeenCalled();
+  });
+
+  it("throws on an unreadable entitlement so the worker retries", async () => {
+    getSsoEntitlement.mockResolvedValue("unknown");
+
+    await expect(applyDirectorySyncEffects([provision(ENTITLED_ORG)])).rejects.toThrow(
+      /could not read the SSO entitlement/
+    );
+
+    expect(ensureOrgMember).not.toHaveBeenCalled();
+  });
+
+  it("marks the retry as a warning rather than a pageable error", async () => {
+    getSsoEntitlement.mockResolvedValue("unknown");
+
+    await applyDirectorySyncEffects([provision(ENTITLED_ORG)]).then(
+      () => expect.unreachable("should have thrown"),
+      (error) => expect(error).toMatchObject({ logLevel: "warn" })
+    );
+  });
+
+  it("resolves the entitlement once per org across a batch", async () => {
+    getSsoEntitlement.mockResolvedValue("entitled");
+
+    await applyDirectorySyncEffects([
+      provision(ENTITLED_ORG, "a@acme.com"),
+      provision(ENTITLED_ORG, "b@acme.com"),
+      provision(ENTITLED_ORG, "c@acme.com"),
+    ]);
+
+    expect(getSsoEntitlement).toHaveBeenCalledTimes(1);
+    expect(ensureOrgMember).toHaveBeenCalledTimes(3);
+  });
+
+  it("gates per org, so one unentitled org does not block another", async () => {
+    getSsoEntitlement.mockImplementation(async (orgId: string) =>
+      orgId === ENTITLED_ORG ? "entitled" : "not_entitled"
+    );
+
+    await applyDirectorySyncEffects([provision(UNENTITLED_ORG), provision(ENTITLED_ORG)]);
+
+    expect(ensureOrgMember).toHaveBeenCalledTimes(1);
+    expect(ensureOrgMember).toHaveBeenCalledWith(
+      expect.objectContaining({ organizationId: ENTITLED_ORG })
+    );
+  });
+});