fix(groups): reconcile members on PUT and invalidate user cache

[nirclarity]

Summary

Two related fixes to GroupsController that block end-to-end group membership sync from Okta to Keycloak via SCIM.

Bug 1 — updateGroup silently drops members

The current implementation only updates displayName:

public Group updateGroup(ScimContext scimContext, GroupModel existing, ... Group group) {
    existing.setName(group.getDisplayName());
    return translateGroup(scimContext, existing);
}

Okta's Group Push uses PUT /Groups/{id} (not PATCH) with the desired final member list. With this no-op handler, the plugin returns 200 with the request "accepted" but membership changes never propagate to Keycloak — silently. Particularly nasty because Okta sees success and stops retrying.

(This is a separate-but-related issue to the path-less PATCH shape covered in #95 / #100.)

Fix: reconcile the request's members against the current members. Mirror the logic already in createGroup and patchGroup's REPLACE branch — remove users not in the desired set (with leave events) and add new ones (with join events).

Bug 2 — stale Keycloak user cache after membership change

After calling user.leaveGroup(...) / user.joinGroup(...), Keycloak's Infinispan user-side cache isn't invalidated. The join table in Postgres updates correctly, and getGroupMembersStream reads fresh, so /groups/{id}/members and the plugin's own SCIM GET /Groups/{id} view are correct. But /users/{id}/groups reads the user object's cached groups list and returns stale entries until the realm cache is manually cleared or the TTL expires.

This caused removed-from-group users to still appear in their groups list via the Admin REST API, even though SCIM had processed the removal correctly.

Fix: after each leaveGroup / joinGroup, explicitly evict the user from UserCache so subsequent reads re-read from DB.

Verification

Tested against Keycloak 26.6.0 + Okta SCIM provisioning (real Okta tenant + ngrok-exposed Keycloak):

• Okta PUT /Groups/{id} adding a user → user appears in both /scim/v2/Groups/{id}.members and /admin/realms/{r}/users/{id}/groups immediately.
• Okta PUT /Groups/{id} removing a user → both views update immediately (no cache clear needed).
• Multi-user reconciliation (full member list replacement) works end-to-end.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[nicolamacoir]

Thanks for this fix!
Before merging this, could you please add a regression test?

[nirclarity]

Thanks for this fix! Before merging this, could you please add a regression test?

Sure! I hope to get back to this soon :)