scimitar 1.3.3 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 382f2feb979c655de91c1d30bf1fa8bb5347059abe376839758a9b34992f8616
-  data.tar.gz: d1d8f8c32a92f4b879699a995b4e1746b7b778d782ab3101695e59891a107606
+  metadata.gz: dd0d129e52cd7cbe3fe52fec4c4033cd45f4d2071da5d495863b1f3f78685fd5
+  data.tar.gz: 5531cdfc4786043513f9539c2fce43bfdebbec26a6e9964d93b13c6ea00710b0
 SHA512:
-  metadata.gz: 87373dddf17fe6791e7464c228e688338267bf1a230cd2ab1d69372185ea3adcf165b969872e0e05556ba28b1e9e1581ddaac5639f89235bd7f19da081ff3e7f
-  data.tar.gz: ae79056e07500c1b195807a9a3f12755895f47a4383c7451208a2956b79ec02e600a8c915fa8a600cccce559c16b5c62f73e081ced2e09e8bee5da63910a2a1e
+  metadata.gz: d1914b8fe68cdc6077369f22a03f7e688790f5b239738e18508e0aeaa68055ee1e197ebc4fe8b512903d07b926de64d64817b26c6ef9b9ace2594abc85f01e62
+  data.tar.gz: de0d305d512d646f43e581b5116c2f316eaa2b9ddb0426f1b12522a668e2a7c811a5e9d6aee82e82fadb534b5e1a5cacca303701a7f7d1791de188d73b55740c

data/app/controllers/scimitar/active_record_backed_resources_controller.rb

@@ -21,6 +21,8 @@ module Scimitar
 
     rescue_from ActiveRecord::RecordNotFound, with: :handle_resource_not_found # See Scimitar::ApplicationController
 
+    before_action :obtain_id_column_name_from_attribute_map
+
     # GET (list)
     #
     def index
@@ -37,13 +39,13 @@ module Scimitar
       pagination_info = scim_pagination_info(query.count())
 
       page_of_results = query
-        .order(id: :asc)
+        .order(@id_column => :asc)
         .offset(pagination_info.offset)
         .limit(pagination_info.limit)
         .to_a()
 
       super(pagination_info, page_of_results) do | record |
-        record.to_scim(location: url_for(action: :show, id: record.id))
+        record_to_scim(record)
       end
     end
 
@@ -52,7 +54,7 @@ module Scimitar
     def show
       super do |record_id|
         record = self.find_record(record_id)
-        record.to_scim(location: url_for(action: :show, id: record_id))
+        record_to_scim(record)
       end
     end
 
@@ -64,7 +66,7 @@ module Scimitar
           record = self.storage_class().new
           record.from_scim!(scim_hash: scim_resource.as_json())
           self.save!(record)
-          record.to_scim(location: url_for(action: :show, id: record.id))
+          record_to_scim(record)
         end
       end
     end
@@ -77,7 +79,7 @@ module Scimitar
           record = self.find_record(record_id)
           record.from_scim!(scim_hash: scim_resource.as_json())
           self.save!(record)
-          record.to_scim(location: url_for(action: :show, id: record.id))
+          record_to_scim(record)
         end
       end
     end
@@ -90,7 +92,7 @@ module Scimitar
           record = self.find_record(record_id)
           record.from_scim_patch!(patch_hash: patch_hash)
           self.save!(record)
-          record.to_scim(location: url_for(action: :show, id: record.id))
+          record_to_scim(record)
         end
       end
     end
@@ -138,7 +140,14 @@ module Scimitar
       # +record_id+:: Record ID (SCIM schema 'id' value - "our" ID).
       #
       def find_record(record_id)
-        self.storage_scope().find(record_id)
+        self.storage_scope().find_by!(@id_column => record_id)
+      end
+
+      # DRY up controller actions - pass a record; returns the SCIM
+      # representation, with a "show" location specified via #url_for.
+      #
+      def record_to_scim(record)
+        record.to_scim(location: url_for(action: :show, id: record.send(@id_column)))
       end
 
       # Save a record, dealing with validation exceptions by raising SCIM
@@ -177,5 +186,16 @@ module Scimitar
         end
       end
 
+      # Called via +before_action+ - stores in @id_column the name of whatever
+      # model column is used to store the record ID, via
+      # Scimitar::Resources::Mixin::scim_attributes_map.
+      #
+      # Default is <tt>:id</tt>.
+      #
+      def obtain_id_column_name_from_attribute_map
+        attrs      = storage_class().scim_attributes_map() || {}
+        @id_column = attrs[:id] || :id
+      end
+
   end
 end

data/app/models/scimitar/resources/mixin.rb

@@ -901,14 +901,86 @@ module Scimitar
                   else
                     altering_hash[path_component] = value
                   end
+
                 when 'replace'
                   if path_component == 'root'
                     altering_hash[path_component].merge!(value)
                   else
                     altering_hash[path_component] = value
                   end
+
+                # The array check handles payloads seen from e.g. Microsoft for
+                # remove-user-from-group, where contrary to examples in the RFC
+                # which would imply "payload removes all users", there is the
+                # clear intent to remove just one.
+                #
+                # https://www.rfc-editor.org/rfc/rfc7644#section-3.5.2.2
+                # https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups#update-group-remove-members
+                #
+                # Since remove-all in the face of remove-one is destructive, we
+                # do a special check here to see if there's an array value for
+                # the array path that the payload yielded. If so, we can match
+                # each value against array items and remove just those items.
+                #
+                # There is an additional special case to handle a bad example
+                # from Salesforce:
+                #
+                #   https://help.salesforce.com/s/articleView?id=sf.identity_scim_manage_groups.htm&type=5
+                #
                 when 'remove'
-                  altering_hash.delete(path_component)
+                  if altering_hash[path_component].is_a?(Array) && value.present?
+
+                    # Handle bad Salesforce example. That might be simply a
+                    # documentation error, but just in case...
+                    #
+                    value = value.values.first if (
+                      path_component&.downcase == 'members' &&
+                      value.is_a?(Hash)                     &&
+                      value.keys.size == 1                  &&
+                      value.keys.first&.downcase == 'members'
+                    )
+
+                    # The Microsoft example provides an array of values, but we
+                    # may as well cope with a value specified 'flat'. Promote
+                    # such a thing to an Array to simplify the following code.
+                    #
+                    value = [value] unless value.is_a?(Array)
+
+                    # For each value item, delete matching array entries. The
+                    # concept of "matching" is:
+                    #
+                    # * For simple non-Hash values (if possible) just delete on
+                    #   an exact match
+                    #
+                    # * For Hash-based values, only delete if all 'patch' keys
+                    #   are present in the resource and all values thus match.
+                    #
+                    # Special case to ignore '$ref' from the Microsoft payload.
+                    #
+                    # Note coercion to strings to account for SCIM vs the usual
+                    # tricky case of underlying implementations with (say)
+                    # integer primary keys, which all end up as strings anyway.
+                    #
+                    value.each do | value_item |
+                      altering_hash[path_component].delete_if do | item |
+                        if item.is_a?(Hash) && value_item.is_a?(Hash)
+                          matched_all = true
+                          value_item.each do | value_key, value_value |
+                            next if value_key == '$ref'
+                            if ! item.key?(value_key) || item[value_key]&.to_s != value_value&.to_s
+                              matched_all = false
+                            end
+                          end
+                          matched_all
+                        else
+                          item&.to_s == value_item&.to_s
+                        end
+                      end
+                    end
+                  else
+                    altering_hash.delete(path_component)
+                  end
+
               end
             end
           end

data/lib/scimitar/version.rb

@@ -3,11 +3,11 @@ module Scimitar
   # Gem version. If this changes, be sure to re-run "bundle install" or
   # "bundle update".
   #
-  VERSION = '1.3.3'
+  VERSION = '1.5.0'
 
   # Date for VERSION. If this changes, be sure to re-run "bundle install"
   # or "bundle update".
   #
-  DATE = '2023-01-10'
+  DATE = '2023-01-27'
 
 end

data/spec/apps/dummy/app/controllers/mock_groups_controller.rb

@@ -1,4 +1,4 @@
-class MockUsersController < Scimitar::ActiveRecordBackedResourcesController
+class MockGroupsController < Scimitar::ActiveRecordBackedResourcesController
 
   protected
 

data/spec/apps/dummy/app/models/mock_group.rb

@@ -58,7 +58,7 @@ class MockGroup < ActiveRecord::Base
 
           case type.downcase
             when 'user'
-              MockUser.find_by_id(id)
+              MockUser.find_by_primary_key(id)
             when 'group'
               MockGroup.find_by_id(id)
             else

data/spec/apps/dummy/app/models/mock_user.rb

@@ -5,7 +5,7 @@ class MockUser < ActiveRecord::Base
   # ===========================================================================
 
   READWRITE_ATTRS = %w{
-    id
+    primary_key
     scim_uid
     username
     first_name
@@ -38,7 +38,7 @@ class MockUser < ActiveRecord::Base
 
   def self.scim_attributes_map
     return {
-      id:         :id,
+      id:         :primary_key,
       externalId: :scim_uid,
       userName:   :username,
       name:       {
@@ -92,7 +92,7 @@ class MockUser < ActiveRecord::Base
 
   def self.scim_queryable_attributes
     return {
-      'id'                => { column: :id },
+      'id'                => { column: :primary_key },
       'externalId'        => { column: :scim_uid },
       'meta.lastModified' => { column: :updated_at },
       'name.givenName'    => { column: :first_name },

data/spec/apps/dummy/config/routes.rb

@@ -13,6 +13,10 @@ Rails.application.routes.draw do
   patch  'Users/:id', to: 'mock_users#update'
   delete 'Users/:id', to: 'mock_users#destroy'
 
+  get    'Groups',     to: 'mock_groups#index'
+  get    'Groups/:id', to: 'mock_groups#show'
+  patch  'Groups/:id', to: 'mock_groups#update'
+
   # For testing blocks passed to ActiveRecordBackedResourcesController#destroy
   #
   delete 'CustomDestroyUsers/:id', to: 'custom_destroy_mock_users#destroy'

data/spec/apps/dummy/db/migrate/20210304014602_create_mock_users.rb

@@ -1,6 +1,7 @@
 class CreateMockUsers < ActiveRecord::Migration[6.1]
   def change
-    create_table :mock_users do |t|
+    create_table :mock_users, id: :uuid, primary_key: :primary_key do |t|
+      t.timestamps
 
       t.text :scim_uid
       t.text :username
@@ -9,7 +10,6 @@ class CreateMockUsers < ActiveRecord::Migration[6.1]
       t.text :work_email_address
       t.text :home_email_address
       t.text :work_phone_number
-
     end
   end
 end

data/spec/apps/dummy/db/migrate/20210308044214_create_join_table_mock_groups_mock_users.rb

@@ -1,8 +1,13 @@
 class CreateJoinTableMockGroupsMockUsers < ActiveRecord::Migration[6.1]
   def change
-    create_join_table :mock_groups, :mock_users do |t|
-      t.index [:mock_group_id, :mock_user_id]
-      t.index [:mock_user_id, :mock_group_id]
+    create_table :mock_groups_users, id: false do | t |
+      t.references :mock_group, foreign_key: true, type: :int8, index: true, null: false
+      t.references :mock_user,                     type: :uuid, index: true, null: false, primary_key: :primary_key
+
+      # The 'foreign_key:' option (used above) only works for 'id' column names
+      # but the test data has a column named 'primary_key' for 'mock_users'.
+      #
+      t.foreign_key :mock_users, primary_key: :primary_key
     end
   end
 end

data/spec/apps/dummy/db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2023_01_09_012729) do
+ActiveRecord::Schema.define(version: 2021_03_08_044214) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -24,12 +24,14 @@ ActiveRecord::Schema.define(version: 2023_01_09_012729) do
 
   create_table "mock_groups_users", id: false, force: :cascade do |t|
     t.bigint "mock_group_id", null: false
-    t.bigint "mock_user_id", null: false
-    t.index ["mock_group_id", "mock_user_id"], name: "index_mock_groups_users_on_mock_group_id_and_mock_user_id"
-    t.index ["mock_user_id", "mock_group_id"], name: "index_mock_groups_users_on_mock_user_id_and_mock_group_id"
+    t.uuid "mock_user_id", null: false
+    t.index ["mock_group_id"], name: "index_mock_groups_users_on_mock_group_id"
+    t.index ["mock_user_id"], name: "index_mock_groups_users_on_mock_user_id"
   end
 
-  create_table "mock_users", force: :cascade do |t|
+  create_table "mock_users", primary_key: "primary_key", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.datetime "created_at", precision: 6, null: false
+    t.datetime "updated_at", precision: 6, null: false
     t.text "scim_uid"
     t.text "username"
     t.text "first_name"
@@ -37,8 +39,8 @@ ActiveRecord::Schema.define(version: 2023_01_09_012729) do
     t.text "work_email_address"
     t.text "home_email_address"
     t.text "work_phone_number"
-    t.datetime "created_at", precision: 6, null: false
-    t.datetime "updated_at", precision: 6, null: false
   end
 
+  add_foreign_key "mock_groups_users", "mock_groups"
+  add_foreign_key "mock_groups_users", "mock_users", primary_key: "primary_key"
 end

data/spec/models/scimitar/lists/query_parser_spec.rb

@@ -405,19 +405,19 @@ RSpec.describe Scimitar::Lists::QueryParser do
       query = @instance.to_activerecord_query(MockUser.all)
 
       expect(query.count).to eql(1)
-      expect(query.pluck(:id)).to eql([user_1.id])
+      expect(query.pluck(:primary_key)).to eql([user_1.id])
 
       @instance.parse('name.givenName sw J') # First name starts with 'J'
       query = @instance.to_activerecord_query(MockUser.all)
 
       expect(query.count).to eql(2)
-      expect(query.pluck(:id)).to match_array([user_1.id, user_2.id])
+      expect(query.pluck(:primary_key)).to match_array([user_1.primary_key, user_2.primary_key])
 
       @instance.parse('name.familyName ew he') # Last name ends with 'he'
       query = @instance.to_activerecord_query(MockUser.all)
 
       expect(query.count).to eql(1)
-      expect(query.pluck(:id)).to eql([user_2.id])
+      expect(query.pluck(:primary_key)).to eql([user_2.primary_key])
 
       # Test presence
 
@@ -425,7 +425,7 @@ RSpec.describe Scimitar::Lists::QueryParser do
       query = @instance.to_activerecord_query(MockUser.all)
 
       expect(query.count).to eql(2)
-      expect(query.pluck(:id)).to match_array([user_1.id, user_2.id])
+      expect(query.pluck(:primary_key)).to match_array([user_1.primary_key, user_2.primary_key])
 
       # Test a simple not-equals, but use a custom starting scope. Note that
       # the query would find "user_3" *except* there is no first name defined
@@ -435,7 +435,7 @@ RSpec.describe Scimitar::Lists::QueryParser do
       query = @instance.to_activerecord_query(MockUser.where.not('first_name' => 'John'))
 
       expect(query.count).to eql(1)
-      expect(query.pluck(:id)).to match_array([user_1.id])
+      expect(query.pluck(:primary_key)).to match_array([user_1.primary_key])
     end
 
     context 'when mapped to multiple columns' do
@@ -499,7 +499,7 @@ RSpec.describe Scimitar::Lists::QueryParser do
           query = @instance.to_activerecord_query(MockUser.all)
 
           expect(query.count).to eql(1)
-          expect(query.pluck(:id)).to match_array([user_2.id])
+          expect(query.pluck(:primary_key)).to match_array([user_2.primary_key])
         end
       end # "context 'simple AND' do"
 
@@ -520,7 +520,7 @@ RSpec.describe Scimitar::Lists::QueryParser do
           query = @instance.to_activerecord_query(MockUser.all)
 
           expect(query.count).to eql(2)
-          expect(query.pluck(:id)).to match_array([user_1.id, user_2.id])
+          expect(query.pluck(:primary_key)).to match_array([user_1.primary_key, user_2.primary_key])
         end
       end # "context 'simple OR' do"
 
@@ -546,7 +546,7 @@ RSpec.describe Scimitar::Lists::QueryParser do
           query = @instance.to_activerecord_query(MockUser.all)
 
           expect(query.count).to eql(3)
-          expect(query.pluck(:id)).to match_array([user_1.id, user_2.id, user_3.id])
+          expect(query.pluck(:primary_key)).to match_array([user_1.primary_key, user_2.primary_key, user_3.primary_key])
         end
       end # "context 'combined AND and OR' do"