scimaenaga 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b1fa2914fdf977f0496f84a023f14ba49f61c893683fd04a85ca7ea4a35c4641
-  data.tar.gz: 0c23e5d65e10a641d965e34a0cc78fc72c0c5d9e80a438ba86a1aa59f70e4360
+  metadata.gz: 3707544f845a4f536dcb1b6bfee0d49c57b6a3108caf0683e24f8c11e3b21f14
+  data.tar.gz: b0fb686add4255d36fa4f906b4963ffc5d1b573317f2561f469d4e7cbd8b1f12
 SHA512:
-  metadata.gz: 98e1cecc1b60630c69c78380a59492f9dd293c25b267f16d985bcb76570cac0549648781dd9d3f749713df9e40df329349f88708af1e953ec65b7b18ec560648
-  data.tar.gz: 86d28c8634b38f8af5d85d7670b27e3e7caac314dc90131cd6de9910a284a66dd7a5763ee222c0a8c5adfcafc382b4a919c082fe7f150614359c9f95d1535e59
+  metadata.gz: 55612e839d248cbdf14100babd315839fca0b0b6494046201c9fa5a21435634b66a9672740a2187f1cf0bf8c72f46fb4428669b067e20f41453c9dbcfad7e19c
+  data.tar.gz: 6c5ffa9c7c769ceedaf08533789ed0864521deea11b2ebad56aa51e941bcdc3512b7027145f5f22c7aecf2359b7745cde59dc8fefc0a0dc0089ea2fff66d3655

data/MIT-LICENSE

@@ -1,4 +1,5 @@
 Copyright 2018 Lessonly
+Copyright 2021 Studist Corporation
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.md

@@ -2,7 +2,7 @@
 
 # Scimaenaga
 
-NOTE: This Gem is not yet fully SCIM complaint. It was developed with the main function of interfacing with Okta. There are features of SCIM that this Gem does not implement as described in the SCIM documentation or that have been left out completely.
+NOTE: This Gem is not yet fully SCIM complaint. It was developed with the main function of interfacing with Azure AD. There are features of SCIM that this Gem does not implement as described in the SCIM documentation or that have been left out completely.
 
 #### What is SCIM?
 
@@ -10,7 +10,7 @@ SCIM stands for System for Cross-domain Identity Management. At its core, it is
 
 To learn more about SCIM 2.0 you can read the documentation at [RFC 7643](https://tools.ietf.org/html/rfc7643) and [RFC 7644](https://tools.ietf.org/html/rfc7644).
 
-The goal of the Gem is to offer a relatively painless way of adding SCIM 2.0 to your app. This Gem should be fully compatible with Okta's SCIM implementation. This project is ongoing and will hopefully be fully SCIM compliant in time. Pull requests that assist in meeting that goal are welcome!
+The goal of the Gem is to offer a relatively painless way of adding SCIM 2.0 to your app. This Gem should be fully compatible with Azure AD's SCIM implementation. This project is ongoing and will hopefully be fully SCIM compliant in time. Pull requests that assist in meeting that goal are welcome!
 
 ## Installation
 
@@ -236,18 +236,6 @@ Sample request:
 $ curl -X PUT 'http://username:password@localhost:3000/scim/v2/Users/1' -d '{"schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],"userName":"test@example.com","name":{"givenName":"Test","familyName":"User"},"emails":[{"primary":true,"value":"test@example.com","type":"work"}],"displayName":"Test User","active":true}' -H 'Content-Type: application/scim+json'
 ```
 
-### Deprovision / Reprovision
-
-The PATCH request was implemented to work with Okta. Okta updates profiles with PUT and deprovisions / reprovisions with PATCH. This implementation of PATCH is not SCIM compliant as it does not update a single attribute on the user profile but instead only sends a status update request to the record.
-
-We would like to implement PATCH to be fully SCIM compliant in future releases.
-
-Sample request:
-
-```bash
-$ curl -X PATCH 'http://username:password@localhost:3000/scim/v2/Users/1' -d '{"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": [{"op": "replace", "value": { "active": false }}]}' -H 'Content-Type: application/scim+json'
-```
-
 ### Error Handling
 
 By default, scimaenaga will output any unhandled exceptions to your configured rails logs.

data/app/controllers/scim_rails/scim_groups_controller.rb

@@ -9,17 +9,19 @@ module ScimRails
         )
 
         groups = @company
-          .public_send(ScimRails.config.scim_groups_scope)
-          .where(
-            "#{ScimRails.config.scim_groups_model.connection.quote_column_name(query.attribute)} #{query.operator} ?",
-            query.parameter
-          )
-          .order(ScimRails.config.scim_groups_list_order)
+                 .public_send(ScimRails.config.scim_groups_scope)
+                 .where(
+                   "#{ScimRails.config.scim_groups_model
+                               .connection.quote_column_name(query.attribute)}
+                               #{query.operator} ?",
+                   query.parameter
+                 )
+                 .order(ScimRails.config.scim_groups_list_order)
       else
         groups = @company
-          .public_send(ScimRails.config.scim_groups_scope)
-          .preload(:users)
-          .order(ScimRails.config.scim_groups_list_order)
+                 .public_send(ScimRails.config.scim_groups_scope)
+                 .preload(:users)
+                 .order(ScimRails.config.scim_groups_list_order)
       end
 
       counts = ScimCount.new(
@@ -33,64 +35,75 @@ module ScimRails
 
     def show
       group = @company
-        .public_send(ScimRails.config.scim_groups_scope)
-        .find(params[:id])
+              .public_send(ScimRails.config.scim_groups_scope)
+              .find(params[:id])
       json_scim_response(object: group)
     end
 
     def create
       group = @company
-        .public_send(ScimRails.config.scim_groups_scope)
-        .create!(permitted_group_params)
+              .public_send(ScimRails.config.scim_groups_scope)
+              .create!(permitted_group_params)
 
       json_scim_response(object: group, status: :created)
     end
 
     def put_update
       group = @company
-        .public_send(ScimRails.config.scim_groups_scope)
-        .find(params[:id])
+              .public_send(ScimRails.config.scim_groups_scope)
+              .find(params[:id])
       group.update!(permitted_group_params)
       json_scim_response(object: group)
     end
 
+    def patch_update
+      group = @company
+              .public_send(ScimRails.config.scim_groups_scope)
+              .find(params[:id])
+      patch = ScimPatch.new(params, ScimRails.config.mutable_group_attributes_schema)
+      patch.save(group)
+
+      json_scim_response(object: group)
+    end
+
     def destroy
       unless ScimRails.config.group_destroy_method
         raise ScimRails::ExceptionHandler::UnsupportedDeleteRequest
       end
+
       group = @company
-        .public_send(ScimRails.config.scim_groups_scope)
-        .find(params[:id])
+              .public_send(ScimRails.config.scim_groups_scope)
+              .find(params[:id])
       group.public_send(ScimRails.config.group_destroy_method)
       head :no_content
     end
 
     private
 
-    def permitted_group_params
-      converted = mutable_attributes.each.with_object({}) do |attribute, hash|
-        hash[attribute] = find_value_for(attribute)
-      end
-      return converted unless params[:members]
+      def permitted_group_params
+        converted = mutable_attributes.each.with_object({}) do |attribute, hash|
+          hash[attribute] = find_value_for(attribute)
+        end
+        return converted unless params[:members]
 
-      converted.merge(member_params)
-    end
+        converted.merge(member_params)
+      end
 
-    def member_params
-      {
-        ScimRails.config.group_member_relation_attribute =>
-          params[:members].map do |member|
-            member[ScimRails.config.group_member_relation_schema.keys.first]
-          end
-      }
-    end
+      def member_params
+        {
+          ScimRails.config.group_member_relation_attribute =>
+            params[:members].map do |member|
+              member[ScimRails.config.group_member_relation_schema.keys.first]
+            end,
+        }
+      end
 
-    def mutable_attributes
-      ScimRails.config.mutable_group_attributes
-    end
+      def mutable_attributes
+        ScimRails.config.mutable_group_attributes
+      end
 
-    def controller_schema
-      ScimRails.config.mutable_group_attributes_schema
-    end
+      def controller_schema
+        ScimRails.config.mutable_group_attributes_schema
+      end
   end
 end

data/app/controllers/scim_rails/scim_users_controller.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
 module ScimRails
-  class ScimUsersController < ScimRails::ApplicationController # rubocop:disable Metrics/ClassLength
-    # rubocop:disable Metrics/AbcSize
-    # rubocop:disable Metrics/MethodLength
+  class ScimUsersController < ScimRails::ApplicationController
+
+
     def index
       if params[:filter].present?
         query = ScimRails::ScimQueryParser.new(
@@ -11,17 +11,17 @@ module ScimRails
         )
 
         users = @company
-          .public_send(ScimRails.config.scim_users_scope)
-          .where(
-            "#{ScimRails.config.scim_users_model
+                .public_send(ScimRails.config.scim_users_scope)
+                .where(
+                  "#{ScimRails.config.scim_users_model
               .connection.quote_column_name(query.attribute)} #{query.operator} ?",
-            query.parameter
-          )
-          .order(ScimRails.config.scim_users_list_order)
+                  query.parameter
+                )
+                .order(ScimRails.config.scim_users_list_order)
       else
         users = @company
-          .public_send(ScimRails.config.scim_users_scope)
-          .order(ScimRails.config.scim_users_list_order)
+                .public_send(ScimRails.config.scim_users_scope)
+                .order(ScimRails.config.scim_users_list_order)
       end
 
       counts = ScimCount.new(
@@ -36,22 +36,22 @@ module ScimRails
     def create
       if ScimRails.config.scim_user_prevent_update_on_create
         user = @company
-          .public_send(ScimRails.config.scim_users_scope)
-          .create!(permitted_user_params)
+               .public_send(ScimRails.config.scim_users_scope)
+               .create!(permitted_user_params)
       else
         username_key = ScimRails.config.queryable_user_attributes[:userName]
         find_by_username = {}
         find_by_username[username_key] = permitted_user_params[username_key]
         user = @company
-          .public_send(ScimRails.config.scim_users_scope)
-          .find_or_create_by(find_by_username)
+               .public_send(ScimRails.config.scim_users_scope)
+               .find_or_create_by(find_by_username)
         user.update!(permitted_user_params)
       end
       update_status(user) unless put_active_param.nil?
       json_scim_response(object: user, status: :created)
     end
-    # rubocop:enable Metrics/AbcSize
-    # rubocop:enable Metrics/MethodLength
+
+
 
     def show
       user = @company.public_send(ScimRails.config.scim_users_scope).find(params[:id])
@@ -68,8 +68,7 @@ module ScimRails
     def patch_update
       user = @company.public_send(ScimRails.config.scim_users_scope).find(params[:id])
       patch = ScimPatch.new(params, ScimRails.config.mutable_user_attributes_schema)
-      patch.apply(user)
-      user.save
+      patch.save(user)
 
       # update_status(user)
       json_scim_response(object: user)
@@ -97,9 +96,9 @@ module ScimRails
         active = patch_active_param if active.nil?
 
         case active
-        when true, "true", 1
+        when true, 'true', 1
           true
-        when false, "false", 0
+        when false, 'false', 0
           false
         else
           raise ActiveRecord::RecordInvalid
@@ -115,19 +114,19 @@ module ScimRails
           raise ScimRails::ExceptionHandler::UnsupportedPatchRequest
         end
 
-        operations = params["Operations"] || {}
+        operations = params['Operations'] || {}
 
         valid_operation = operations.find(handle_invalid) do |operation|
           valid_patch_operation?(operation)
         end
 
-        valid_operation.dig("value", "active")
+        valid_operation.dig('value', 'active')
       end
 
       def valid_patch_operation?(operation)
-        operation["op"].casecmp("replace") &&
-          operation["value"] &&
-          [true, false].include?(operation["value"]["active"])
+        operation['op'].casecmp('replace') &&
+          operation['value'] &&
+          [true, false].include?(operation['value']['active'])
       end
   end
 end

data/app/libraries/scim_patch.rb

@@ -6,23 +6,29 @@ class ScimPatch
 
   def initialize(params, mutable_attributes_schema)
     # FIXME: raise proper error.
-    unless params["schemas"] == ["urn:ietf:params:scim:api:messages:2.0:PatchOp"]
+    unless params['schemas'] == ['urn:ietf:params:scim:api:messages:2.0:PatchOp']
       raise StandardError
     end
-    if params["Operations"].nil?
+    if params['Operations'].nil?
       raise ScimRails::ExceptionHandler::UnsupportedPatchRequest
     end
 
-    @operations = params["Operations"].map do |operation|
-      ScimPatchOperation.new(operation["op"], operation["path"], operation["value"],
+    @operations = params['Operations'].map do |operation|
+      ScimPatchOperation.new(operation['op'], operation['path'], operation['value'],
                              mutable_attributes_schema)
     end
   end
 
-  def apply(model)
-    @operations.each do |operation|
-      operation.apply(model)
+  def save(model)
+    model.transaction do
+      @operations.each do |operation|
+        operation.save(model)
+      end
     end
-    model
+    model.save if model.changed?
+  rescue ActiveRecord::RecordNotFound
+    raise
+  rescue StandardError
+    raise ScimRails::ExceptionHandler::UnsupportedPatchRequest
   end
 end

data/app/libraries/scim_patch_operation.rb

@@ -19,18 +19,43 @@ class ScimPatchOperation
     @value = value
   end
 
-  # WIP
-  def apply(model)
+
+
+
+  def save(model)
+    if @path_scim == 'members' # Only members are supported for value is an array
+      update_member_ids = @value.map do |v|
+        v[ScimRails.config.group_member_relation_schema.keys.first]
+      end
+
+      current_member_ids = model
+                           .public_send(ScimRails.config.group_member_relation_attribute)
+      case @op
+      when :add
+        member_ids = current_member_ids.concat(update_member_ids)
+      when :replace
+        member_ids = current_member_ids.concat(update_member_ids)
+      when :remove
+        member_ids = current_member_ids - update_member_ids
+      end
+
+      # Only the member addition process is saved by each ids
+      model.public_send("#{ScimRails.config.group_member_relation_attribute}=",
+                        member_ids.uniq)
+      return
+    end
+
     case @op
-    when :add
-      model.attributes = { @path_sp => @value }
-    when :replace
+    when :add, :replace
       model.attributes = { @path_sp => @value }
     when :remove
       model.attributes = { @path_sp => nil }
     end
   end
 
+
+
+
   private
 
     def convert_path(path, mutable_attributes_schema)
@@ -47,8 +72,8 @@ class ScimPatchOperation
       #
       #   Library ignores filter conditions (like [type eq "work"])
       #   and always uses the first element of the array
-      dig_keys = path.gsub(/\[(.+?)\]/, ".0").split(".").map do |step|
-        step == "0" ? 0 : step.to_sym
+      dig_keys = path.gsub(/\[(.+?)\]/, '.0').split('.').map do |step|
+        step == '0' ? 0 : step.to_sym
       end
       mutable_attributes_schema.dig(*dig_keys)
     end

data/app/models/scim_rails/scim_query_parser.rb

@@ -5,7 +5,7 @@ module ScimRails
     attr_accessor :query_elements, :query_attributes
 
     def initialize(query_string, queryable_attributes)
-      self.query_elements = query_string.split
+      self.query_elements = query_string.gsub(/\[(.+?)\]/, ".0").split
       self.query_attributes = queryable_attributes
     end
 
@@ -13,9 +13,11 @@ module ScimRails
       attribute = query_elements[0]
       raise ScimRails::ExceptionHandler::InvalidQuery if attribute.blank?
 
-      attribute = attribute.to_sym
+      dig_keys = attribute.split(".").map do |step|
+        step == "0" ? 0 : step.to_sym
+      end
 
-      mapped_attribute = query_attributes[attribute]
+      mapped_attribute = query_attributes.dig(*dig_keys)
       raise ScimRails::ExceptionHandler::InvalidQuery if mapped_attribute.blank?
 
       mapped_attribute

data/config/routes.rb

@@ -8,5 +8,6 @@ ScimRails::Engine.routes.draw do
   post   'scim/v2/Groups',     action: :create,        controller: 'scim_groups'
   get    'scim/v2/Groups/:id', action: :show,          controller: 'scim_groups'
   put    'scim/v2/Groups/:id', action: :put_update,    controller: 'scim_groups'
+  patch  'scim/v2/Groups/:id', action: :patch_update,  controller: 'scim_groups'
   delete 'scim/v2/Groups/:id', action: :destroy,       controller: 'scim_groups'
 end

data/lib/scim_rails/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ScimRails
-  VERSION = "0.5.0"
+  VERSION = '0.6.0'
 end

data/spec/controllers/scim_rails/scim_groups_controller_spec.rb

@@ -1,32 +1,32 @@
 # frozen_string_literal: true
 
-require "spec_helper"
+require 'spec_helper'
 
 RSpec.describe ScimRails::ScimGroupsController, type: :controller do
   include AuthHelper
 
   routes { ScimRails::Engine.routes }
 
-  describe "index" do
+  describe 'index' do
     let(:company) { create(:company) }
 
-    context "when unauthorized" do
-      it "returns scim+json content type" do
+    context 'when unauthorized' do
+      it 'returns scim+json content type' do
         get :index, as: :json
 
-        expect(response.media_type).to eq "application/scim+json"
+        expect(response.media_type).to eq 'application/scim+json'
       end
 
-      it "fails with no credentials" do
+      it 'fails with no credentials' do
         get :index, as: :json
 
         expect(response.status).to eq 401
       end
 
-      it "fails with invalid credentials" do
-        request.env["HTTP_AUTHORIZATION"] =
+      it 'fails with invalid credentials' do
+        request.env['HTTP_AUTHORIZATION'] =
           ActionController::HttpAuthentication::Basic
-          .encode_credentials("unauthorized", "123456")
+          .encode_credentials('unauthorized', '123456')
 
         get :index, as: :json
 
@@ -34,58 +34,58 @@ RSpec.describe ScimRails::ScimGroupsController, type: :controller do
       end
     end
 
-    context "when authorized" do
+    context 'when authorized' do
       before :each do
         http_login(company)
       end
 
-      it "returns scim+json content type" do
+      it 'returns scim+json content type' do
         get :index, as: :json
 
-        expect(response.media_type).to eq "application/scim+json"
+        expect(response.media_type).to eq 'application/scim+json'
       end
 
-      it "is successful with valid credentials" do
+      it 'is successful with valid credentials' do
         get :index, as: :json
 
         expect(response.status).to eq 200
       end
 
-      it "returns all results" do
+      it 'returns all results' do
         create_list(:group, 5, company: company)
 
         get :index, as: :json
         response_body = JSON.parse(response.body)
-        expect(response_body.dig("schemas", 0)).to(
-          eq "urn:ietf:params:scim:api:messages:2.0:ListResponse"
+        expect(response_body.dig('schemas', 0)).to(
+          eq 'urn:ietf:params:scim:api:messages:2.0:ListResponse'
         )
-        expect(response_body["totalResults"]).to eq 5
+        expect(response_body['totalResults']).to eq 5
       end
 
-      it "defaults to 100 results" do
+      it 'defaults to 100 results' do
         create_list(:group, 300, company: company)
 
         get :index, as: :json
         response_body = JSON.parse(response.body)
-        expect(response_body["totalResults"]).to eq 300
-        expect(response_body["Resources"].count).to eq 100
+        expect(response_body['totalResults']).to eq 300
+        expect(response_body['Resources'].count).to eq 100
       end
 
-      it "paginates results" do
+      it 'paginates results' do
         create_list(:group, 400, company: company)
         expect(company.groups.first.id).to eq 1
 
         get :index, params: {
           startIndex: 101,
-          count: 200
+          count: 200,
         }, as: :json
         response_body = JSON.parse(response.body)
-        expect(response_body["totalResults"]).to eq 400
-        expect(response_body["Resources"].count).to eq 200
-        expect(response_body.dig("Resources", 0, "id")).to eq 101
+        expect(response_body['totalResults']).to eq 400
+        expect(response_body['Resources'].count).to eq 200
+        expect(response_body.dig('Resources', 0, 'id')).to eq 101
       end
 
-      it "paginates results by configurable scim_groups_list_order" do
+      it 'paginates results by configurable scim_groups_list_order' do
         allow(ScimRails.config).to(
           receive(:scim_groups_list_order).and_return(created_at: :desc)
         )
@@ -95,69 +95,69 @@ RSpec.describe ScimRails::ScimGroupsController, type: :controller do
 
         get :index, params: {
           startIndex: 1,
-          count: 10
+          count: 10,
         }, as: :json
         response_body = JSON.parse(response.body)
-        expect(response_body["totalResults"]).to eq 400
-        expect(response_body["Resources"].count).to eq 10
-        expect(response_body.dig("Resources", 0, "id")).to eq 400
+        expect(response_body['totalResults']).to eq 400
+        expect(response_body['Resources'].count).to eq 10
+        expect(response_body.dig('Resources', 0, 'id')).to eq 400
       end
 
-      it "filters results by provided displayName filter" do
-        create(:group, name: "Foo", company: company)
-        create(:group, name: "Bar", company: company)
+      it 'filters results by provided displayName filter' do
+        create(:group, name: 'Foo', company: company)
+        create(:group, name: 'Bar', company: company)
 
         get :index, params: {
-          filter: "displayName eq Bar"
+          filter: 'displayName eq Bar',
         }, as: :json
         response_body = JSON.parse(response.body)
-        expect(response_body["totalResults"]).to eq 1
-        expect(response_body["Resources"].count).to eq 1
-        expect(response_body.dig("Resources", 0, "displayName")).to eq "Bar"
+        expect(response_body['totalResults']).to eq 1
+        expect(response_body['Resources'].count).to eq 1
+        expect(response_body.dig('Resources', 0, 'displayName')).to eq 'Bar'
       end
 
-      it "returns no results for unfound filter parameters" do
+      it 'returns no results for unfound filter parameters' do
         get :index, params: {
-          filter: "displayName eq fake_not_there"
+          filter: 'displayName eq fake_not_there',
         }, as: :json
         response_body = JSON.parse(response.body)
-        expect(response_body["totalResults"]).to eq 0
-        expect(response_body["Resources"].count).to eq 0
+        expect(response_body['totalResults']).to eq 0
+        expect(response_body['Resources'].count).to eq 0
       end
 
-      it "returns no results for undefined filter queries" do
+      it 'returns no results for undefined filter queries' do
         get :index, params: {
-          filter: "address eq 101 Nowhere USA"
+          filter: 'address eq 101 Nowhere USA',
         }, as: :json
         expect(response.status).to eq 400
         response_body = JSON.parse(response.body)
-        expect(response_body.dig("schemas", 0)).to(
-          eq "urn:ietf:params:scim:api:messages:2.0:Error"
+        expect(response_body.dig('schemas', 0)).to(
+          eq 'urn:ietf:params:scim:api:messages:2.0:Error'
         )
       end
     end
   end
 
-  describe "show" do
+  describe 'show' do
     let(:company) { create(:company) }
 
-    context "when unauthorized" do
-      it "returns scim+json content type" do
+    context 'when unauthorized' do
+      it 'returns scim+json content type' do
         get :show, params: { id: 1 }, as: :json
 
-        expect(response.media_type).to eq "application/scim+json"
+        expect(response.media_type).to eq 'application/scim+json'
       end
 
-      it "fails with no credentials" do
+      it 'fails with no credentials' do
         get :show, params: { id: 1 }, as: :json
 
         expect(response.status).to eq 401
       end
 
-      it "fails with invalid credentials" do
-        request.env["HTTP_AUTHORIZATION"] =
+      it 'fails with invalid credentials' do
+        request.env['HTTP_AUTHORIZATION'] =
           ActionController::HttpAuthentication::Basic
-          .encode_credentials("unauthorized", "123456")
+          .encode_credentials('unauthorized', '123456')
 
         get :show, params: { id: 1 }, as: :json
 
@@ -165,31 +165,31 @@ RSpec.describe ScimRails::ScimGroupsController, type: :controller do
       end
     end
 
-    context "when authorized" do
+    context 'when authorized' do
       before :each do
         http_login(company)
       end
 
-      it "returns scim+json content type" do
+      it 'returns scim+json content type' do
         get :show, params: { id: 1 }, as: :json
 
-        expect(response.media_type).to eq "application/scim+json"
+        expect(response.media_type).to eq 'application/scim+json'
       end
 
-      it "is successful with valid credentials" do
+      it 'is successful with valid credentials' do
         create(:group, id: 1, company: company)
         get :show, params: { id: 1 }, as: :json
 
         expect(response.status).to eq 200
       end
 
-      it "returns :not_found for id that cannot be found" do
-        get :show, params: { id: "fake_id" }, as: :json
+      it 'returns :not_found for id that cannot be found' do
+        get :show, params: { id: 'fake_id' }, as: :json
 
         expect(response.status).to eq 404
       end
 
-      it "returns :not_found for a correct id but unauthorized company" do
+      it 'returns :not_found for a correct id but unauthorized company' do
         new_company = create(:company)
         create(:group, company: new_company, id: 1)
 
@@ -200,26 +200,26 @@ RSpec.describe ScimRails::ScimGroupsController, type: :controller do
     end
   end
 
-  describe "create" do
+  describe 'create' do
     let(:company) { create(:company) }
 
-    context "when unauthorized" do
-      it "returns scim+json content type" do
+    context 'when unauthorized' do
+      it 'returns scim+json content type' do
         post :create, as: :json
 
-        expect(response.media_type).to eq "application/scim+json"
+        expect(response.media_type).to eq 'application/scim+json'
       end
 
-      it "fails with no credentials" do
+      it 'fails with no credentials' do
         post :create, as: :json
 
         expect(response.status).to eq 401
       end
 
-      it "fails with invalid credentials" do
-        request.env["HTTP_AUTHORIZATION"] =
+      it 'fails with invalid credentials' do
+        request.env['HTTP_AUTHORIZATION'] =
           ActionController::HttpAuthentication::Basic
-          .encode_credentials("unauthorized", "123456")
+          .encode_credentials('unauthorized', '123456')
 
         post :create, as: :json
 
@@ -227,107 +227,107 @@ RSpec.describe ScimRails::ScimGroupsController, type: :controller do
       end
     end
 
-    context "when authorized" do
+    context 'when authorized' do
       before :each do
         http_login(company)
       end
 
-      it "returns scim+json content type" do
+      it 'returns scim+json content type' do
         post :create, params: {
-          displayName: "Test Group",
-          members: []
+          displayName: 'Test Group',
+          members: [],
         }, as: :json
 
-        expect(response.media_type).to eq "application/scim+json"
+        expect(response.media_type).to eq 'application/scim+json'
       end
 
-      it "is successful with valid credentials" do
+      it 'is successful with valid credentials' do
         expect(company.groups.count).to eq 0
 
         post :create, params: {
-          displayName: "Test Group",
-          members: []
+          displayName: 'Test Group',
+          members: [],
         }, as: :json
 
         expect(response.status).to eq 201
         expect(company.groups.count).to eq 1
         group = company.groups.first
         expect(group.persisted?).to eq true
-        expect(group.name).to eq "Test Group"
+        expect(group.name).to eq 'Test Group'
         expect(group.users).to eq []
       end
 
-      it "ignores unconfigured params" do
+      it 'ignores unconfigured params' do
         post :create, params: {
-          displayName: "Test Group",
-          department: "Best Department",
-          members: []
+          displayName: 'Test Group',
+          department: 'Best Department',
+          members: [],
         }, as: :json
 
         expect(response.status).to eq 201
         expect(company.groups.count).to eq 1
       end
 
-      it "returns 422 if required params are missing" do
+      it 'returns 422 if required params are missing' do
         post :create, params: {
-          members: []
+          members: [],
         }, as: :json
 
         expect(response.status).to eq 422
         expect(company.users.count).to eq 0
       end
 
-      it "returns 409 if group already exists" do
-        create(:group, name: "Test Group", company: company)
+      it 'returns 409 if group already exists' do
+        create(:group, name: 'Test Group', company: company)
 
         post :create, params: {
-          displayName: "Test Group",
-          members: []
+          displayName: 'Test Group',
+          members: [],
         }, as: :json
 
         expect(response.status).to eq 409
         expect(company.groups.count).to eq 1
       end
 
-      it "creates group" do
+      it 'creates group' do
         users = create_list(:user, 3, company: company)
 
         post :create, params: {
-          displayName: "Test Group",
+          displayName: 'Test Group',
           members: users.map do |user|
             { value: user.id.to_s, display: user.email }
-          end
+          end,
         }, as: :json
 
         expect(response.status).to eq 201
         expect(company.groups.count).to eq 1
         group = company.groups.first
-        expect(group.name).to eq "Test Group"
+        expect(group.name).to eq 'Test Group'
         expect(group.users.count).to eq 3
       end
     end
   end
 
-  describe "put update" do
+  describe 'put update' do
     let(:company) { create(:company) }
 
-    context "when unauthorized" do
-      it "returns scim+json content type" do
+    context 'when unauthorized' do
+      it 'returns scim+json content type' do
         put :put_update, params: { id: 1 }, as: :json
 
-        expect(response.media_type).to eq "application/scim+json"
+        expect(response.media_type).to eq 'application/scim+json'
       end
 
-      it "fails with no credentials" do
+      it 'fails with no credentials' do
         put :put_update, params: { id: 1 }, as: :json
 
         expect(response.status).to eq 401
       end
 
-      it "fails with invalid credentials" do
-        request.env["HTTP_AUTHORIZATION"] =
+      it 'fails with invalid credentials' do
+        request.env['HTTP_AUTHORIZATION'] =
           ActionController::HttpAuthentication::Basic
-          .encode_credentials("unauthorized", "123456")
+          .encode_credentials('unauthorized', '123456')
 
         put :put_update, params: { id: 1 }, as: :json
 
@@ -335,26 +335,26 @@ RSpec.describe ScimRails::ScimGroupsController, type: :controller do
       end
     end
 
-    context "when authorized" do
+    context 'when authorized' do
       let!(:group) { create(:group, id: 1, company: company) }
 
       before :each do
         http_login(company)
       end
 
-      it "returns scim+json content type" do
+      it 'returns scim+json content type' do
         put :put_update, params: put_params, as: :json
 
-        expect(response.media_type).to eq "application/scim+json"
+        expect(response.media_type).to eq 'application/scim+json'
       end
 
-      it "is successful with with valid credentials" do
+      it 'is successful with with valid credentials' do
         put :put_update, params: put_params, as: :json
 
         expect(response.status).to eq 200
       end
 
-      it "can add and delete Users from a Group at once" do
+      it 'can add and delete Users from a Group at once' do
         user1 = create(:user, company: company, groups: [group])
         user2 = create(:user, company: company)
 
@@ -365,13 +365,13 @@ RSpec.describe ScimRails::ScimGroupsController, type: :controller do
         expect(response.status).to eq 200
       end
 
-      it "returns :not_found for id that cannot be found" do
-        put :put_update, params: { id: "fake_id" }, as: :json
+      it 'returns :not_found for id that cannot be found' do
+        put :put_update, params: { id: 'fake_id' }, as: :json
 
         expect(response.status).to eq 404
       end
 
-      it "returns :not_found for a correct id but unauthorized company" do
+      it 'returns :not_found for a correct id but unauthorized company' do
         new_company = create(:company)
         create(:group, company: new_company, id: 1000)
 
@@ -380,10 +380,10 @@ RSpec.describe ScimRails::ScimGroupsController, type: :controller do
         expect(response.status).to eq 404
       end
 
-      it "returns 422 with incomplete request" do
+      it 'returns 422 with incomplete request' do
         put :put_update, params: {
           id: 1,
-          members: []
+          members: [],
         }, as: :json
 
         expect(response.status).to eq 422
@@ -391,26 +391,105 @@ RSpec.describe ScimRails::ScimGroupsController, type: :controller do
     end
   end
 
-  describe "destroy" do
+  describe 'patch update' do
     let(:company) { create(:company) }
 
-    context "when unauthorized" do
-      it "returns scim+json content type" do
+    context 'when authorized' do
+      let!(:group) { create(:group, id: 1, company: company) }
+      let(:user1) { create(:user, company: company, groups: [group]) }
+      let(:user2) { create(:user, company: company) }
+
+      before :each do
+        http_login(company)
+      end
+
+      it 'returns scim+json content type' do
+        patch :patch_update, params: patch_params, as: :json
+
+        expect(response.media_type).to eq 'application/scim+json'
+      end
+
+      it 'can change displayName of group' do
+        expect do
+          patch :patch_update, params: {
+            id: group.id,
+            schemas: ['urn:ietf:params:scim:api:messages:2.0:PatchOp'],
+            Operations: [{
+              op: 'Replace',
+              path: 'displayName',
+              value: 'changed'
+            }]
+          }, as: :json
+        end.to change { group.reload.name }.to('changed')
+
+        expect(response.status).to eq 200
+      end
+
+      it 'can add Users from a Group' do
+        expect do
+          patch :patch_update, params: patch_params(user_id: user2.id), as: :json
+        end.to change { group.reload.users }.from([user1]).to([user1, user2])
+
+        expect(response.status).to eq 200
+      end
+
+      it 'can delete Users from a Group' do
+        user1 = create(:user, company: company, groups: [group])
+        user2 = create(:user, company: company, groups: [group])
+
+        expect do
+          put :patch_update, params: patch_params(user_id: user2.id, op: 'Remove'),
+                             as: :json
+        end.to change { group.reload.users }.from([user1, user2]).to([user1])
+
+        expect(response.status).to eq 200
+      end
+
+      it 'returns :not_found for id that cannot be found' do
+        patch :patch_update, params:  patch_params(user_id: 0), as: :json
+
+        expect(response.status).to eq 404
+      end
+
+      it 'rollback if even one cannot be saved' do
+        expect do
+          patch :patch_update, params: {
+            id: group.id,
+            schemas: ['urn:ietf:params:scim:api:messages:2.0:PatchOp'],
+            Operations: [{
+              op: 'Add',
+              path: 'members',
+              value: [
+                { value: user2.id },
+                { value: 0 }
+              ],
+            }],
+          }, as: :json
+        end.to_not change { group.reload.users.count }
+      end
+    end
+  end
+
+  describe 'destroy' do
+    let(:company) { create(:company) }
+
+    context 'when unauthorized' do
+      it 'returns scim+json content type' do
         delete :destroy, params: { id: 1 }, as: :json
 
-        expect(response.media_type).to eq "application/scim+json"
+        expect(response.media_type).to eq 'application/scim+json'
       end
 
-      it "fails with no credentials" do
+      it 'fails with no credentials' do
         delete :destroy, params: { id: 1 }, as: :json
 
         expect(response.status).to eq 401
       end
 
-      it "fails with invalid credentials" do
-        request.env["HTTP_AUTHORIZATION"] =
+      it 'fails with invalid credentials' do
+        request.env['HTTP_AUTHORIZATION'] =
           ActionController::HttpAuthentication::Basic
-          .encode_credentials("unauthorized", "123456")
+          .encode_credentials('unauthorized', '123456')
 
         delete :destroy, params: { id: 1 }, as: :json
 
@@ -418,39 +497,39 @@ RSpec.describe ScimRails::ScimGroupsController, type: :controller do
       end
     end
 
-    context "when authorized" do
+    context 'when authorized' do
       let!(:group) { create(:group, id: 1, company: company) }
 
       before :each do
         http_login(company)
       end
 
-      context "when Group destroy method is configured" do
+      context 'when Group destroy method is configured' do
         before do
           allow(ScimRails.config).to(
             receive(:group_destroy_method).and_return(:destroy!)
           )
         end
 
-        it "returns empty response" do
+        it 'returns empty response' do
           delete :destroy, params: { id: 1 }, as: :json
 
           expect(response.body).to be_empty
         end
 
-        it "is successful with valid credentials" do
+        it 'is successful with valid credentials' do
           delete :destroy, params: { id: 1 }, as: :json
 
           expect(response.status).to eq 204
         end
 
-        it "returns :not_found for id that cannot be found" do
-          delete :destroy, params: { id: "fake_id" }, as: :json
+        it 'returns :not_found for id that cannot be found' do
+          delete :destroy, params: { id: 'fake_id' }, as: :json
 
           expect(response.status).to eq 404
         end
 
-        it "returns :not_found for a correct id but unauthorized company" do
+        it 'returns :not_found for a correct id but unauthorized company' do
           new_company = create(:company)
           create(:group, company: new_company, id: 1000)
 
@@ -459,7 +538,7 @@ RSpec.describe ScimRails::ScimGroupsController, type: :controller do
           expect(response.status).to eq 404
         end
 
-        it "successfully deletes Group" do
+        it 'successfully deletes Group' do
           expect do
             delete :destroy, params: { id: 1 }, as: :json
           end.to change { company.groups.reload.count }.from(1).to(0)
@@ -468,8 +547,8 @@ RSpec.describe ScimRails::ScimGroupsController, type: :controller do
         end
       end
 
-      context "when Group destroy method is not configured" do
-        it "does not delete Group" do
+      context 'when Group destroy method is not configured' do
+        it 'does not delete Group' do
           allow(ScimRails.config).to(
             receive(:group_destroy_method).and_return(nil)
           )
@@ -484,11 +563,27 @@ RSpec.describe ScimRails::ScimGroupsController, type: :controller do
     end
   end
 
-  def put_params(name: "Test Group", users: [])
+  def put_params(name: 'Test Group', users: [])
     {
       id: 1,
       displayName: name,
-      members: users.map { |user| { value: user.id.to_s, display: user.email } }
+      members: users.map { |user| { value: user.id.to_s, display: user.email } },
+    }
+  end
+
+  # rubocop:disable Metrics/MethodLength
+  def patch_params(user_id: 1, op: 'Add')
+    {
+      id: 1,
+      schemas: ['urn:ietf:params:scim:api:messages:2.0:PatchOp'],
+      Operations: [{
+        op: op,
+        path: 'members',
+        value: [{
+          value: user_id,
+        }],
+      }],
     }
   end
+  # rubocop:enable Metrics/MethodLength
 end

data/spec/dummy/bin/setup

@@ -22,6 +22,8 @@ chdir APP_ROOT do
   # unless File.exist?('config/database.yml')
   #   cp 'config/database.yml.sample', 'config/database.yml'
   # end
+  puts "\n== Reset migration =="
+  system! 'bin/rails db:migrate:reset'
 
   puts "\n== Preparing database =="
   system! 'bin/rails db:setup'

data/spec/dummy/db/seeds.rb

@@ -4,6 +4,11 @@ company = Company.create(
   api_token: 1
 )
 
+group = Group.create(
+  company: company,
+  name: 'Test Group'
+)
+
 1.upto(1000) do |n|
   User.create(
     company: company,

data/spec/models/scim_query_parser_spec.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe ScimRails::ScimQueryParser do
+
+  let(:query_string) { 'userName eq "taro"' }
+  let(:queryable_attributes) {
+    {
+      userName: :name,
+      emails: [
+        {
+          value: :email
+        }
+      ]
+    }
+  }
+  let(:parser) { described_class.new(query_string, queryable_attributes) }
+
+  describe '#attribute' do
+    context 'userName' do
+      it { expect(parser.attribute).to eq :name }
+    end
+
+    context 'emails[type eq "work"].value' do
+      let(:query_string) { 'emails[type eq "work"].value eq "taro@example.com"' }
+      it { expect(parser.attribute).to eq :email }
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: scimaenaga
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Studist Corporation
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-12-06 00:00:00.000000000 Z
+date: 2021-12-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -237,6 +237,7 @@ files:
 - spec/lib/scim_rails/encoder_spec.rb
 - spec/libraries/scim_patch_operation_spec.rb
 - spec/libraries/scim_patch_spec.rb
+- spec/models/scim_query_parser_spec.rb
 - spec/spec_helper.rb
 - spec/support/auth_helper.rb
 - spec/support/factory_bot.rb
@@ -343,3 +344,4 @@ test_files:
 - spec/factories/group.rb
 - spec/factories/company.rb
 - spec/spec_helper.rb
+- spec/models/scim_query_parser_spec.rb