From 63bcdbe5a579278e6f8c963b5d97c383b7754803 Mon Sep 17 00:00:00 2001
From: arc53-machine <232052973+arc53-machine@users.noreply.github.com>
Date: Thu, 17 Sep 2026 13:20:04 +0100
Subject: [PATCH] refactor(settings): fail at load when SCIM is enabled without
 a token

Review follow-up. SCIM_ENABLED=true with no SCIM_TOKEN was only caught per
request, as a 503 from the SCIM routes. The auth group's model validator
now rejects that combination when Settings loads, the same way it rejects
AUTH_TYPE=oidc without its required settings, so the misconfiguration is
reported once at startup rather than on the first provisioning call. The
route-level guard stays as defence in depth.
---
 docsgpt/core/settings/auth.py | 4 +++-
 tests/core/test_settings.py   | 8 ++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/docsgpt/core/settings/auth.py b/docsgpt/core/settings/auth.py
index 5069d6cf..85c57b84 100644
--- a/docsgpt/core/settings/auth.py
+++ b/docsgpt/core/settings/auth.py
@@ -92,9 +92,11 @@ class AuthSettings(SettingsGroup):
         return normalize_choice(v)
 
     @model_validator(mode="after")
-    def _require_oidc_settings(self):
+    def _require_dependent_settings(self):
         if self.AUTH_TYPE == "oidc":
             missing = [name for name in OIDC_REQUIRED if not getattr(self, name)]
             if missing:
                 raise ValueError(f"AUTH_TYPE=oidc requires settings: {', '.join(missing)}")
+        if self.SCIM_ENABLED and not self.SCIM_TOKEN:
+            raise ValueError("SCIM_ENABLED requires settings: SCIM_TOKEN")
         return self
diff --git a/tests/core/test_settings.py b/tests/core/test_settings.py
index 36967fce..1074fe63 100644
--- a/tests/core/test_settings.py
+++ b/tests/core/test_settings.py
@@ -177,6 +177,14 @@ class TestCrossFieldRules:
     def test_oidc_settings_are_not_required_for_other_modes(self):
         assert Settings.model_validate({"AUTH_TYPE": "session_jwt"}).OIDC_ISSUER is None
 
+    @pytest.mark.parametrize("raw", [None, "", "None"])
+    def test_scim_enabled_requires_a_token(self, raw):
+        with pytest.raises(ValidationError, match="SCIM_ENABLED requires settings: SCIM_TOKEN"):
+            Settings.model_validate({"SCIM_ENABLED": True, "SCIM_TOKEN": raw})
+
+    def test_scim_disabled_needs_no_token(self):
+        assert Settings.model_validate({"SCIM_ENABLED": False}).SCIM_TOKEN is None
+
 
 @pytest.mark.unit
 class TestClosedChoices: