supabase / auth / 30933337581

72%

push

github

chore(scim): mount the SCIM router in the main route tree (#2658)

## What kind of change does this PR introduce?

Moves the SCIM routes into the main route tree and hands the feature-flag check to the API layer, so the SCIM package stops carrying that concern.

Extracted from #2643.

## What is the current behavior?

`/scim/v2` is mounted at the top level of the router, outside the `r.Route("/")` block, so it does not run `isValidExternalHost` the way the rest of the API does.

The feature flag is enforced by `scim.Server.Middleware`, which means the SCIM package has to know about `Experimental.ScimEnabled` and depend on `apierrors`.

## What is the new behavior?

- The routes move into the `r.Route("/")` subtree, so they run `isValidExternalHost` alongside every other endpoint.
- `(*API).requireScimServerEnabled` replaces `scim.Server.Middleware`, following the existing `requireOAuthServerEnabled`, `requirePasskeyEnabled`, and `requireCustomOAuthEnabled`.

The three endpoints still return 501. With the flag off they still return the same 404, which the test now pins on the body rather than the status code alone:

```json
{
  "code": 404,
  "error_code": "feature_disabled",
  "msg": "SCIM server is disabled"
}
```

## Additional context

46 of 48 new or added lines in 5 files covered. (95.83%)

18364 of 25430 relevant lines covered (72.21%)

686.12 hits per line