From 44f017668be72a31fae8f8c8402726948c92687c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= <freben@gmail.com>
Date: Thu, 28 May 2026 16:53:20 +0200
Subject: [PATCH] Fix remaining stale docs and add mutual exclusivity tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Fix two remaining config.d.ts entries that still referenced the
  automatic accountEnabled base filter
- Add tests verifying that userFilter + userGroupMemberFilter and
  userFilter + userGroupMemberSearch are rejected

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
---
 .../config.d.ts                               |  6 ++-
 .../src/microsoftGraph/config.test.ts         | 38 +++++++++++++++++++
 2 files changed, 42 insertions(+), 2 deletions(-)

diff --git a/plugins/catalog-backend-module-msgraph/config.d.ts b/plugins/catalog-backend-module-msgraph/config.d.ts
index 6553484bda..b1252a3a90 100644
--- a/plugins/catalog-backend-module-msgraph/config.d.ts
+++ b/plugins/catalog-backend-module-msgraph/config.d.ts
@@ -164,7 +164,8 @@ export interface Config {
               expand?: string;
               /**
                * The filter to apply to extract users.
-               * Combined with the base `accountEnabled eq true` filter
+               * Disabled users (accountEnabled === false) are always
+               * filtered out client-side regardless of this setting.
                *
                * E.g. "userType eq 'member'"
                */
@@ -298,7 +299,8 @@ export interface Config {
                 expand?: string;
                 /**
                  * The filter to apply to extract users.
-                 * Combined with the base `accountEnabled eq true` filter
+                 * Disabled users (accountEnabled === false) are always
+                 * filtered out client-side regardless of this setting.
                  *
                  * E.g. "userType eq 'member'"
                  */
diff --git a/plugins/catalog-backend-module-msgraph/src/microsoftGraph/config.test.ts b/plugins/catalog-backend-module-msgraph/src/microsoftGraph/config.test.ts
index 9fb1f44249..9a134cd1c3 100644
--- a/plugins/catalog-backend-module-msgraph/src/microsoftGraph/config.test.ts
+++ b/plugins/catalog-backend-module-msgraph/src/microsoftGraph/config.test.ts
@@ -197,6 +197,44 @@ describe('readProviderConfigs', () => {
     expect(actual).toEqual(expected);
   });
 
+  it('should reject userFilter combined with userGroupMemberFilter', () => {
+    const config = {
+      catalog: {
+        providers: {
+          microsoftGraphOrg: {
+            customProviderId: {
+              tenantId: 'tenantId',
+              user: { filter: "userType eq 'member'" },
+              userGroupMember: { filter: "displayName eq 'Team'" },
+            },
+          },
+        },
+      },
+    };
+    expect(() => readProviderConfigs(new ConfigReader(config))).toThrow(
+      'mutually exclusive',
+    );
+  });
+
+  it('should reject userFilter combined with userGroupMemberSearch', () => {
+    const config = {
+      catalog: {
+        providers: {
+          microsoftGraphOrg: {
+            customProviderId: {
+              tenantId: 'tenantId',
+              user: { filter: "userType eq 'member'" },
+              userGroupMember: { search: '"displayName:team"' },
+            },
+          },
+        },
+      },
+    };
+    expect(() => readProviderConfigs(new ConfigReader(config))).toThrow(
+      'userGroupMemberSearch cannot be specified',
+    );
+  });
+
   it('should fail if clientId is set without clientSecret', () => {
     const config = {
       catalog: {