Waleed cbbcca970c fix(okta): stop partial updates erasing stored profile data (#6751) ...

* fix(okta): stop partial updates erasing stored profile data

Post-merge audit of the Okta integration (follows #6741), verified against the
OpenAPI spec bundled in okta-sdk-golang/.generator.

Two updates could silently destroy data:

- `update_group` targets `PUT /api/v1/groups/{groupId}`, which Okta documents as
  `replaceGroup` — it swaps the profile wholesale. Sending only the two fields
  the tool exposes erased the stored description on every rename, and dropped
  every org-defined custom attribute along with it. The tool now reads the group
  and overlays the supplied fields before replacing, matching the read-modify-
  write `salesforce_update_custom_field` already uses for the same hazard.
- `update_user` gated its profile fields on `!== undefined`, so an empty string
  reached Okta and blanked the stored value. The block strips blanks before they
  get there, but the tool is `user-or-llm` and a model routinely emits `""` for a
  field it has nothing to say about, so the guard belongs on the tool.

Also corrected:

- `forgetDevices` defaults to true at Okta, so the unseeded switch rendered off
  while remembered factors were in fact being cleared.
- Group rules take a plain keyword on `search`, not the SCIM-style expression the
  shared Search field's wand generates, so they get their own field.
- `get_logs` dropped `limit=0`, which the spec documents as valid.
- `get_user` emitted an activation timestamp under `activated`, which the block
  declares as the lifecycle boolean; the timestamp is now `activatedAt`.
- Descriptions that overstated what an endpoint does: `list_users` omits
  DEPROVISIONED users, `delete_user` deactivates before it deletes,
  `delete_group_rule` answers 202, and `excludedGroupIds` is always empty because
  Okta does not support group exclusions.

* fix(okta): forward the abort signal through the group read-modify-write

* test(okta): rename the shared body-builder helper

* fix(okta): key the send-email and search mappings off the operation

* docs(okta): use TSDoc for the new block annotations

2026-08-15 17:18:28 -07:00

..

docs

fix(okta): stop partial updates erasing stored profile data (#6751)

2026-08-15 17:18:28 -07:00