test(scim): replay Okta Tier 1.5 fixtures through chi router (V2-305)

[Nic-dorman]

Summary

• Adds internal/handlers/scim_okta_fixtures_test.go — a Go test that table-drives all 8 captured Okta fixtures through the live SCIM handler stack
• 8 lifecycle replays (create, update, deactivate, reactivate, existence-check, group add/remove, group metadata no-op) + 3 dedicated cases proving the findings from the fixtures README
• All 11 tests pass on SQLite (~5s total). Postgres should pass automatically via the V2-270 CI matrix.

What this proves

Every commit to indelible's SCIM code now gets checked against the real Okta wire format — without anyone needing a live tenant. This is the missing CI surface that turns the captured fixtures from documentation into a regression gate.

The 3 dedicated cases — one per finding from the rehearsal

Test	Finding it proves
TestSCIM_OktaFixture_PasswordIsIgnored	Indelible discards Okta's random initial password. Confirmed by attempting a local login with the captured password and asserting 401, not 200.
TestSCIM_OktaFixture_GroupMetadataPATCHIsNoop	The no-op replace id+displayName PATCH Okta sends before every membership op leaves group state unchanged.
TestSCIM_OktaFixture_FilterByValueRemove	The members[value eq "X"] filter path parses correctly when used for removes (the shape both Okta and AAD use).

Implementation notes

• ID normalization via regex (option B from the V2-305 ticket discussion). Per-run-varying fields (id, value, Users/N, Groups/N, created, lastModified) get replaced with placeholders on both expected and actual before structural JSON comparison.
• Per-fixture seed function that brings the DB to the state each captured fixture implies — admin (id=1) + sentinels + the fixture user (id=4) for user-targeting fixtures; same plus a seeded group with the right pre-state for group-targeting fixtures.
• No new test deps — uses stdlib + the existing PR fix(scim): unbreak provisioning + add Tier 1 handler tests (V2-273) #27 scaffolding (scimTestEnv, setupSCIMTest, env.do).

Stacking

This PR contains 3 commits but only the last one is unique to V2-305:

1. PR fix(scim): unbreak provisioning + add Tier 1 handler tests (V2-273) #27's commit (Tier 1 handler tests + SCIM mount fix) — base scaffolding
2. PR test(scim): Okta Tier 1.5 fixtures from real-tenant capture (V2-273) #36's commit (8 Okta fixtures + README) — the data this PR consumes
3. This PR's commit — the replay test

Once PR #27 and PR #36 merge, the diff collapses to just commit #3. Base is set to nic/v2-273-tier1.5-okta-fixtures so GitHub auto-tracks the dependency chain.

Test plan

• go test ./internal/handlers/ -run TestSCIM_OktaFixture -v — all 11 pass locally on SQLite
• CI runs Postgres leg (handled automatically by V2-270 matrix)
• Reviewer: spot-check one of the dedicated cases to validate the assertion shape matches the finding it claims to prove

V2-273 acceptance status (after this merges)

• Tier 1 (PR fix(scim): unbreak provisioning + add Tier 1 handler tests (V2-273) #27)
• Tier 1.5 fixtures (PR test(scim): Okta Tier 1.5 fixtures from real-tenant capture (V2-273) #36)
• Tier 1.5 replay test (this PR)
• Tier 2 Okta (rehearsal 2026-05-18)
• Tier 2 Azure AD (blocked on operator email)
• USER-GUIDE docs (V2-306)

Closes V2-305.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com