From 2ac68220b055a03d5ba41cef7e5bd5be9336da7e Mon Sep 17 00:00:00 2001 From: David Croft Date: Sun, 19 Jul 2026 21:28:09 +1000 Subject: [PATCH] feat(scim): warn when SCIM runs without org event logging log_event is a no-op unless ORG_EVENTS_ENABLED is set, so SCIM provisioning changes would leave no audit trail on a default deployment. Print a startup warning when SCIM_ENABLED is set but ORG_EVENTS_ENABLED is not. Co-Authored-By: Claude Fable 5 --- src/config.rs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/config.rs b/src/config.rs index de0ebfa3..ffaa089c 100644 --- a/src/config.rs +++ b/src/config.rs @@ -1008,6 +1008,11 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> { println!("[WARNING] To enable the admin page without a token, use `DISABLE_ADMIN_TOKEN`."); } + if cfg.scim_enabled && !cfg.org_events_enabled { + println!("[WARNING] `SCIM_ENABLED` is set, but `ORG_EVENTS_ENABLED` is not."); + println!("[WARNING] SCIM provisioning changes will not appear in the organization event log."); + } + if cfg.push_enabled && (cfg.push_installation_id == String::new() || cfg.push_installation_key == String::new()) { err!( "Misconfigured Push Notification service\n\