Add Canva as a pre-configured SCIM service provider

[c1-dev-bot]

Summary

• Adds Canva Enterprise as a pre-configured SCIM v2 service provider for baton-scim
• Configures the Canva SCIM endpoint (https://www.canva.com/_scim/v2/) with bearer token authentication
• Supports syncing users and groups from Canva Enterprise organizations
• Includes provisioning operations for group membership management

Usage

baton-scim --api-key=SCIM_ACCESS_TOKEN --service-provider=canva

Requires Canva Enterprise with SCIM provisioning enabled. The SCIM access token is generated from the Canva admin settings under SSO/SCIM configuration.

Known Limitations

• Group members: Canva's SCIM API returns an empty members array in group list responses. Group membership data may be limited.
• Roles: Canva uses a single role string field (values: "Member", "Brand Designer") rather than the standard SCIM roles array, so role syncing is not included in this config. A future enhancement could add custom handling for this field.
• Page size: Canva limits the SCIM list count parameter to a maximum of 10 items per page.
• Enterprise only: SCIM is only available for Canva Enterprise plans.

Test plan

• go build ./cmd/baton-scim/ compiles successfully
• go test ./... passes (config validation test confirms 5 providers)
• Manual testing with a Canva Enterprise SCIM token (requires human reviewer with Canva Enterprise access)

Fixes: CXH-1568

---

Automated PR Notice

This PR was automatically created by c1-dev-bot as a potential implementation.

This code requires:

• Human review of the implementation approach
• Manual testing to verify correctness
• Approval from the appropriate team before merging

[linear-code]

CXH-1568

[github-actions]

Connector PR Review: Add Canva as a pre-configured SCIM service provider

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Review mode: full
View review run

Review Summary

This PR adds Canva Enterprise as the 5th pre-configured SCIM v2 service provider. The config YAML follows the same structure and conventions as the existing providers (Slack, Miro, Postman, Zoom). It includes user/group sync with standard SCIM field mappings, pagination using standard SCIM pagination fields, and group membership provisioning via PATCH operations. The known limitations around page size, empty group members, and non-standard roles are documented in the PR description.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• pkg/config/service_providers/canva.yaml (pagination): The connector's default page size is 100 (defaultPageSize in pkg/scim/client.go:26), but the PR description notes Canva limits count to a maximum of 10. If Canva's API rejects requests with count > 10 (rather than silently capping), user and group listing will fail. The current YAML schema has no per-provider page size override. Consider verifying Canva's behavior during manual testing and, if needed, filing a follow-up to support a configurable page size in the pagination YAML block.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `pkg/config/service_providers/canva.yaml`:
- Around the pagination section: The connector default page size is 100 (defined in pkg/scim/client.go line 26 as defaultPageSize). The PR notes Canva limits count to 10 items per page. Verify during manual testing whether Canva returns an error or silently caps when count=100 is requested. If Canva errors, a code change is needed to support per-provider page size configuration in the pagination YAML config, or a requestDefaults.queryParams workaround. If Canva silently caps, pagination will self-correct since it uses the response's itemsPerPage to track progress.

[github-actions]

No blocking issues found.