Problem

The lack of soft deletion is somewhat painful. It may be worrisome for customers and might prevent them from enabling SCIM. In the worse case, it may lead to unintentional hard deletions despite the the warning of this behavior at several places in the docs and the “Beta” label.

Solution

Implement soft deletion.

• Change getUserFromDB also fetch deleted users. This needs a new function on the DB accessor level next to ListForSCIM(maybe GetForSCIM) that uses a custom SQL query that doesn't include is_deleted = NULL. It can be a simple one that can only fetch a single user by ID.
  • Make sure this uses an index! The ID is the primary key of the table, though, so we're probably fine!
• Create deleteUser (or softDeleteUser) function in scim/user.go that calls tx.Users().Delete() to soft delete the user. The functionality itself is implemented
• Create recoverUser function in scim/user.go that calls RecoverUsersList to restore the user.
• Modify these parts of PATCH and PUT to call the new deleteUser function rather than h.Delete().
• Add Deleted bool field to the UserForSCIM struct
• Implement Users().Delete() in our mock DB, and change our "hard delete for soft delete" test cases to test soft deletion and restoration.

Caveat: Normal GET requests will still go through getAllFromDB() which will use ListForSCIM on the DB level, and will not include deleted users! To also make that work, we'd need to add a flag to ListForSCIM to include deleted users, and add indexes to some of our user_* tables to be able to query deleted users and their properties effectively.