From 5e316d9d6ec19c8265fc59ea70f7cb23df994a1b Mon Sep 17 00:00:00 2001
From: Carlos Monastyrski <charly.monastyrski@gmail.com>
Date: Thu, 23 Oct 2025 15:38:37 -0300
Subject: [PATCH] Add missing membership role to SAML mapped group

---
 ...023121055_fix-missing-group-memberships.ts | 19 +++++++++++++------
 .../saml-config/saml-config-service.ts        | 10 +++++++++-
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/backend/src/db/migrations/20251023121055_fix-missing-group-memberships.ts b/backend/src/db/migrations/20251023121055_fix-missing-group-memberships.ts
index e4af23c46..117ac12e9 100644
--- a/backend/src/db/migrations/20251023121055_fix-missing-group-memberships.ts
+++ b/backend/src/db/migrations/20251023121055_fix-missing-group-memberships.ts
@@ -1,21 +1,20 @@
 import { Knex } from "knex";
 
-import { AccessScope, TableName } from "../schemas";
+import { AccessScope, OrgMembershipRole, TableName } from "../schemas";
 
 export async function up(knex: Knex): Promise<void> {
   const hasGroupsTable = await knex.schema.hasTable(TableName.Groups);
   const hasMembershipTable = await knex.schema.hasTable(TableName.Membership);
+  const hasMembershipRoleTable = await knex.schema.hasTable(TableName.MembershipRole);
 
-  if (!hasGroupsTable || !hasMembershipTable) {
+  if (!hasGroupsTable || !hasMembershipTable || !hasMembershipRoleTable) {
     return;
   }
 
   const groupsWithoutMembership = await knex
     .select(`${TableName.Groups}.id`, `${TableName.Groups}.orgId`)
     .from(TableName.Groups)
-    .leftJoin(TableName.Membership, function joinGroupMembership() {
-      this.on(`${TableName.Groups}.id`, "=", `${TableName.Membership}.actorGroupId`);
-    })
+    .leftJoin(TableName.Membership, `${TableName.Groups}.id`, `${TableName.Membership}.actorGroupId`)
     .whereNull(`${TableName.Membership}.actorGroupId`);
 
   if (groupsWithoutMembership.length > 0) {
@@ -26,7 +25,15 @@ export async function up(knex: Knex): Promise<void> {
       isActive: true
     }));
 
-    await knex(TableName.Membership).insert(membershipInserts);
+    const insertedMemberships = await knex(TableName.Membership).insert(membershipInserts).returning("*");
+
+    const membershipRoleInserts = insertedMemberships.map((membership) => ({
+      membershipId: membership.id,
+      role: OrgMembershipRole.NoAccess,
+      customRoleId: null
+    }));
+
+    await knex(TableName.MembershipRole).insert(membershipRoleInserts);
   }
 
   await knex.schema.alterTable(TableName.Membership, (t) => {
diff --git a/backend/src/ee/services/saml-config/saml-config-service.ts b/backend/src/ee/services/saml-config/saml-config-service.ts
index f9c97fc6f..c99ae8b28 100644
--- a/backend/src/ee/services/saml-config/saml-config-service.ts
+++ b/backend/src/ee/services/saml-config/saml-config-service.ts
@@ -183,7 +183,7 @@ export const samlConfigServiceFactory = ({
             transaction
           );
           orgGroupsMap.set(groupName, newGroup);
-          await membershipGroupDAL.create(
+          const orgMembership = await membershipGroupDAL.create(
             {
               actorGroupId: newGroup.id,
               scope: AccessScope.Organization,
@@ -191,6 +191,14 @@ export const samlConfigServiceFactory = ({
             },
             transaction
           );
+          await membershipRoleDAL.create(
+            {
+              membershipId: orgMembership.id,
+              role: OrgMembershipRole.NoAccess,
+              customRoleId: null
+            },
+            transaction
+          );
         }
       }