Drop group_id column from scim_oauth_access_tokens

Series

group_id has been dead since group SCIM tokens moved to group_scim_auth_access_tokens in 17.9.

Prerequisites — target master, any order, all must land before step 2:

MR	What
!261148	GroupScimAuthAccessToken gets its own serializer
!261149	Real group_id only on the group SCIM API entity
!261150 (merged)	No SCIM token transfer on group org transfer

Steps — sequential, one milestone apart, since each needs the previous deployed, not just merged:

Step	MR	Milestone	What	State
1	!256720 (merged)	19.5	Delete orphaned group-level rows	merged
2	!256721	19.6	Remove code references, add ignore_column	open
3	!256722 👈	19.7	Drop group_id column	open
4	!256725	19.8	Remove ignore_column rule	open

What does this MR do and why?

Drops group_id from scim_oauth_access_tokens in a post-deployment migration, and tidies the table description in db/docs/scim_oauth_access_tokens.yml.

Group-level SCIM tokens moved to group_scim_auth_access_tokens in 17.9, so the column has been unused since. !256721 removed the last code references and added ignore_column, so dropping the column here is safe. After this, organization_id is the sole sharding key, resolving the audit finding in work item 624518.

Dropping the column also drops a unique index on (group_id, token_encrypted) and the fk_rails_c84404fb6c foreign key to namespaces. down restores all three, so the rollback is faithful.

References

• Tracking work item: #630160
• Sharding key audit: #624518

How to set up and validate locally

bundle exec rails db:migrate

Confirm the column is gone, then exercise instance SCIM token creation and lookup:

ActiveRecord::Base.connection.column_exists?(:scim_oauth_access_tokens, :group_id)  # => false

org = Organizations::Organization.first
token = ScimOauthAccessToken.create!(organization: org)
ScimOauthAccessToken.instance_token_for(token.token) == token  # => true
ScimOauthAccessToken.find_for_instance == token                # => true

Load Admin > Settings > General (instance SCIM token section) and a group's SAML/SCIM settings page to confirm both still render.

Then check the rollback restores the column, the unique index and the foreign key:

bundle exec rails db:rollback:main STEP=1

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.