scimitar 2.2.0 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce356c067dc4636a1540eec905c21730c6d37d7831725ed5fd914b0a62e7f1e7
-  data.tar.gz: 979360b39861dc14e5d202ab580774e6164f9818b0358a8bcc47e06c6a6462c3
+  metadata.gz: bccee840f0dc82854974e8d90d19189ae133f4281142c5de89107230b413041b
+  data.tar.gz: 014cbf547dd861c26489aa13d5ab2c75f5826ed24ca3c98d7eb71b76d98994b1
 SHA512:
-  metadata.gz: 78eeeab146e8a18f265643bc99a32a461a7972b2971309421f4cbfa1751fabe0ad99a84037f8f2000ef5da90ae7282bf16c66fa34e26ed83e4ae2510248df651
-  data.tar.gz: 15af818f707e5a7db410abd57fe342258c016fdf6fef79af12e384481f7730bdea7a22983e3fd662317e73437fdb0c491a651639479539a8029eebe3dd8d3ab6
+  metadata.gz: 1619af4e575d6701471820c52e39719fd96b311b45b2c5d9907bc147253cf5904926677901d0e778865d71768405774bf7082d8a641bcc4b33c9ef3c4183ec28
+  data.tar.gz: 3b435a7ff4343945de4436c8f6c3e52d4f714e00bdde594074f7dd064befc9d28836946195df80cdae50aa0751f0761dce8cf926b83203efd909b86538f67351

data/app/controllers/scimitar/active_record_backed_resources_controller.rb

@@ -21,6 +21,8 @@ module Scimitar
 
     rescue_from ActiveRecord::RecordNotFound, with: :handle_resource_not_found # See Scimitar::ApplicationController
 
+    before_action :obtain_id_column_name_from_attribute_map
+
     # GET (list)
     #
     def index
@@ -37,13 +39,13 @@ module Scimitar
       pagination_info = scim_pagination_info(query.count())
 
       page_of_results = query
-        .order(id: :asc)
+        .order(@id_column => :asc)
         .offset(pagination_info.offset)
         .limit(pagination_info.limit)
         .to_a()
 
       super(pagination_info, page_of_results) do | record |
-        record.to_scim(location: url_for(action: :show, id: record.id))
+        record_to_scim(record)
       end
     end
 
@@ -52,7 +54,7 @@ module Scimitar
     def show
       super do |record_id|
         record = self.find_record(record_id)
-        record.to_scim(location: url_for(action: :show, id: record_id))
+        record_to_scim(record)
       end
     end
 
@@ -64,7 +66,7 @@ module Scimitar
           record = self.storage_class().new
           record.from_scim!(scim_hash: scim_resource.as_json())
           self.save!(record)
-          record.to_scim(location: url_for(action: :show, id: record.id))
+          record_to_scim(record)
         end
       end
     end
@@ -77,7 +79,7 @@ module Scimitar
           record = self.find_record(record_id)
           record.from_scim!(scim_hash: scim_resource.as_json())
           self.save!(record)
-          record.to_scim(location: url_for(action: :show, id: record.id))
+          record_to_scim(record)
         end
       end
     end
@@ -90,7 +92,7 @@ module Scimitar
           record = self.find_record(record_id)
           record.from_scim_patch!(patch_hash: patch_hash)
           self.save!(record)
-          record.to_scim(location: url_for(action: :show, id: record.id))
+          record_to_scim(record)
         end
       end
     end
@@ -138,7 +140,14 @@ module Scimitar
       # +record_id+:: Record ID (SCIM schema 'id' value - "our" ID).
       #
       def find_record(record_id)
-        self.storage_scope().find(record_id)
+        self.storage_scope().find_by!(@id_column => record_id)
+      end
+
+      # DRY up controller actions - pass a record; returns the SCIM
+      # representation, with a "show" location specified via #url_for.
+      #
+      def record_to_scim(record)
+        record.to_scim(location: url_for(action: :show, id: record.send(@id_column)))
       end
 
       # Save a record, dealing with validation exceptions by raising SCIM
@@ -177,5 +186,16 @@ module Scimitar
         end
       end
 
+      # Called via +before_action+ - stores in @id_column the name of whatever
+      # model column is used to store the record ID, via
+      # Scimitar::Resources::Mixin::scim_attributes_map.
+      #
+      # Default is <tt>:id</tt>.
+      #
+      def obtain_id_column_name_from_attribute_map
+        attrs      = storage_class().scim_attributes_map() || {}
+        @id_column = attrs[:id] || :id
+      end
+
   end
 end

data/app/models/scimitar/resources/mixin.rb

@@ -901,14 +901,86 @@ module Scimitar
                   else
                     altering_hash[path_component] = value
                   end
+
                 when 'replace'
                   if path_component == 'root'
                     altering_hash[path_component].merge!(value)
                   else
                     altering_hash[path_component] = value
                   end
+
+                # The array check handles payloads seen from e.g. Microsoft for
+                # remove-user-from-group, where contrary to examples in the RFC
+                # which would imply "payload removes all users", there is the
+                # clear intent to remove just one.
+                #
+                # https://www.rfc-editor.org/rfc/rfc7644#section-3.5.2.2
+                # https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups#update-group-remove-members
+                #
+                # Since remove-all in the face of remove-one is destructive, we
+                # do a special check here to see if there's an array value for
+                # the array path that the payload yielded. If so, we can match
+                # each value against array items and remove just those items.
+                #
+                # There is an additional special case to handle a bad example
+                # from Salesforce:
+                #
+                #   https://help.salesforce.com/s/articleView?id=sf.identity_scim_manage_groups.htm&type=5
+                #
                 when 'remove'
-                  altering_hash.delete(path_component)
+                  if altering_hash[path_component].is_a?(Array) && value.present?
+
+                    # Handle bad Salesforce example. That might be simply a
+                    # documentation error, but just in case...
+                    #
+                    value = value.values.first if (
+                      path_component&.downcase == 'members' &&
+                      value.is_a?(Hash)                     &&
+                      value.keys.size == 1                  &&
+                      value.keys.first&.downcase == 'members'
+                    )
+
+                    # The Microsoft example provides an array of values, but we
+                    # may as well cope with a value specified 'flat'. Promote
+                    # such a thing to an Array to simplify the following code.
+                    #
+                    value = [value] unless value.is_a?(Array)
+
+                    # For each value item, delete matching array entries. The
+                    # concept of "matching" is:
+                    #
+                    # * For simple non-Hash values (if possible) just delete on
+                    #   an exact match
+                    #
+                    # * For Hash-based values, only delete if all 'patch' keys
+                    #   are present in the resource and all values thus match.
+                    #
+                    # Special case to ignore '$ref' from the Microsoft payload.
+                    #
+                    # Note coercion to strings to account for SCIM vs the usual
+                    # tricky case of underlying implementations with (say)
+                    # integer primary keys, which all end up as strings anyway.
+                    #
+                    value.each do | value_item |
+                      altering_hash[path_component].delete_if do | item |
+                        if item.is_a?(Hash) && value_item.is_a?(Hash)
+                          matched_all = true
+                          value_item.each do | value_key, value_value |
+                            next if value_key == '$ref'
+                            if ! item.key?(value_key) || item[value_key]&.to_s != value_value&.to_s
+                              matched_all = false
+                            end
+                          end
+                          matched_all
+                        else
+                          item&.to_s == value_item&.to_s
+                        end
+                      end
+                    end
+                  else
+                    altering_hash.delete(path_component)
+                  end
+
               end
             end
           end

data/lib/scimitar/version.rb

@@ -3,11 +3,11 @@ module Scimitar
   # Gem version. If this changes, be sure to re-run "bundle install" or
   # "bundle update".
   #
-  VERSION = '2.2.0'
+  VERSION = '2.4.0'
 
   # Date for VERSION. If this changes, be sure to re-run "bundle install"
   # or "bundle update".
   #
-  DATE = '2023-01-13'
+  DATE = '2023-01-27'
 
 end

data/spec/apps/dummy/app/controllers/mock_groups_controller.rb

@@ -1,4 +1,4 @@
-class MockUsersController < Scimitar::ActiveRecordBackedResourcesController
+class MockGroupsController < Scimitar::ActiveRecordBackedResourcesController
 
   protected
 

data/spec/apps/dummy/app/models/mock_group.rb

@@ -58,7 +58,7 @@ class MockGroup < ActiveRecord::Base
 
           case type.downcase
             when 'user'
-              MockUser.find_by_id(id)
+              MockUser.find_by_primary_key(id)
             when 'group'
               MockGroup.find_by_id(id)
             else

data/spec/apps/dummy/app/models/mock_user.rb

@@ -1,11 +1,13 @@
 class MockUser < ActiveRecord::Base
 
+  self.primary_key = :primary_key
+
   # ===========================================================================
   # TEST ATTRIBUTES - see db/migrate/20210304014602_create_mock_users.rb etc.
   # ===========================================================================
 
   READWRITE_ATTRS = %w{
-    id
+    primary_key
     scim_uid
     username
     first_name
@@ -38,7 +40,7 @@ class MockUser < ActiveRecord::Base
 
   def self.scim_attributes_map
     return {
-      id:         :id,
+      id:         :primary_key,
       externalId: :scim_uid,
       userName:   :username,
       name:       {
@@ -92,7 +94,7 @@ class MockUser < ActiveRecord::Base
 
   def self.scim_queryable_attributes
     return {
-      'id'                => { column: :id },
+      'id'                => { column: :primary_key },
       'externalId'        => { column: :scim_uid },
       'meta.lastModified' => { column: :updated_at },
       'name.givenName'    => { column: :first_name },

data/spec/apps/dummy/config/routes.rb

@@ -6,12 +6,16 @@
 Rails.application.routes.draw do
   mount Scimitar::Engine, at: '/'
 
-  get    'Users',     to: 'mock_users#index'
-  get    'Users/:id', to: 'mock_users#show'
-  post   'Users',     to: 'mock_users#create'
-  put    'Users/:id', to: 'mock_users#replace'
-  patch  'Users/:id', to: 'mock_users#update'
-  delete 'Users/:id', to: 'mock_users#destroy'
+  get    'Users',      to: 'mock_users#index'
+  get    'Users/:id',  to: 'mock_users#show'
+  post   'Users',      to: 'mock_users#create'
+  put    'Users/:id',  to: 'mock_users#replace'
+  patch  'Users/:id',  to: 'mock_users#update'
+  delete 'Users/:id',  to: 'mock_users#destroy'
+
+  get    'Groups',     to: 'mock_groups#index'
+  get    'Groups/:id', to: 'mock_groups#show'
+  patch  'Groups/:id', to: 'mock_groups#update'
 
   # For testing blocks passed to ActiveRecordBackedResourcesController#destroy
   #

data/spec/apps/dummy/db/migrate/20210304014602_create_mock_users.rb

@@ -1,6 +1,7 @@
 class CreateMockUsers < ActiveRecord::Migration[6.1]
   def change
-    create_table :mock_users do |t|
+    create_table :mock_users, id: :uuid, primary_key: :primary_key do |t|
+      t.timestamps
 
       t.text :scim_uid
       t.text :username
@@ -9,7 +10,6 @@ class CreateMockUsers < ActiveRecord::Migration[6.1]
       t.text :work_email_address
       t.text :home_email_address
       t.text :work_phone_number
-
     end
   end
 end

data/spec/apps/dummy/db/migrate/20210308044214_create_join_table_mock_groups_mock_users.rb

@@ -1,8 +1,13 @@
 class CreateJoinTableMockGroupsMockUsers < ActiveRecord::Migration[6.1]
   def change
-    create_join_table :mock_groups, :mock_users do |t|
-      t.index [:mock_group_id, :mock_user_id]
-      t.index [:mock_user_id, :mock_group_id]
+    create_table :mock_groups_users, id: false do | t |
+      t.references :mock_group, foreign_key: true, type: :int8, index: true, null: false
+      t.references :mock_user,                     type: :uuid, index: true, null: false, primary_key: :primary_key
+
+      # The 'foreign_key:' option (used above) only works for 'id' column names
+      # but the test data has a column named 'primary_key' for 'mock_users'.
+      #
+      t.foreign_key :mock_users, primary_key: :primary_key
     end
   end
 end

data/spec/apps/dummy/db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.0].define(version: 2023_01_09_012729) do
+ActiveRecord::Schema[7.0].define(version: 2021_03_08_044214) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
 
@@ -23,12 +23,14 @@ ActiveRecord::Schema[7.0].define(version: 2023_01_09_012729) do
 
   create_table "mock_groups_users", id: false, force: :cascade do |t|
     t.bigint "mock_group_id", null: false
-    t.bigint "mock_user_id", null: false
-    t.index ["mock_group_id", "mock_user_id"], name: "index_mock_groups_users_on_mock_group_id_and_mock_user_id"
-    t.index ["mock_user_id", "mock_group_id"], name: "index_mock_groups_users_on_mock_user_id_and_mock_group_id"
+    t.uuid "mock_user_id", null: false
+    t.index ["mock_group_id"], name: "index_mock_groups_users_on_mock_group_id"
+    t.index ["mock_user_id"], name: "index_mock_groups_users_on_mock_user_id"
   end
 
-  create_table "mock_users", force: :cascade do |t|
+  create_table "mock_users", primary_key: "primary_key", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
     t.text "scim_uid"
     t.text "username"
     t.text "first_name"
@@ -36,8 +38,8 @@ ActiveRecord::Schema[7.0].define(version: 2023_01_09_012729) do
     t.text "work_email_address"
     t.text "home_email_address"
     t.text "work_phone_number"
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
   end
 
+  add_foreign_key "mock_groups_users", "mock_groups"
+  add_foreign_key "mock_groups_users", "mock_users", primary_key: "primary_key"
 end

data/spec/models/scimitar/lists/query_parser_spec.rb

@@ -405,19 +405,19 @@ RSpec.describe Scimitar::Lists::QueryParser do
       query = @instance.to_activerecord_query(MockUser.all)
 
       expect(query.count).to eql(1)
-      expect(query.pluck(:id)).to eql([user_1.id])
+      expect(query.pluck(:primary_key)).to eql([user_1.primary_key])
 
       @instance.parse('name.givenName sw J') # First name starts with 'J'
       query = @instance.to_activerecord_query(MockUser.all)
 
       expect(query.count).to eql(2)
-      expect(query.pluck(:id)).to match_array([user_1.id, user_2.id])
+      expect(query.pluck(:primary_key)).to match_array([user_1.primary_key, user_2.primary_key])
 
       @instance.parse('name.familyName ew he') # Last name ends with 'he'
       query = @instance.to_activerecord_query(MockUser.all)
 
       expect(query.count).to eql(1)
-      expect(query.pluck(:id)).to eql([user_2.id])
+      expect(query.pluck(:primary_key)).to eql([user_2.primary_key])
 
       # Test presence
 
@@ -425,7 +425,7 @@ RSpec.describe Scimitar::Lists::QueryParser do
       query = @instance.to_activerecord_query(MockUser.all)
 
       expect(query.count).to eql(2)
-      expect(query.pluck(:id)).to match_array([user_1.id, user_2.id])
+      expect(query.pluck(:primary_key)).to match_array([user_1.primary_key, user_2.primary_key])
 
       # Test a simple not-equals, but use a custom starting scope. Note that
       # the query would find "user_3" *except* there is no first name defined
@@ -435,7 +435,7 @@ RSpec.describe Scimitar::Lists::QueryParser do
       query = @instance.to_activerecord_query(MockUser.where.not('first_name' => 'John'))
 
       expect(query.count).to eql(1)
-      expect(query.pluck(:id)).to match_array([user_1.id])
+      expect(query.pluck(:primary_key)).to match_array([user_1.primary_key])
     end
 
     context 'when mapped to multiple columns' do
@@ -499,7 +499,7 @@ RSpec.describe Scimitar::Lists::QueryParser do
           query = @instance.to_activerecord_query(MockUser.all)
 
           expect(query.count).to eql(1)
-          expect(query.pluck(:id)).to match_array([user_2.id])
+          expect(query.pluck(:primary_key)).to match_array([user_2.primary_key])
         end
       end # "context 'simple AND' do"
 
@@ -520,7 +520,7 @@ RSpec.describe Scimitar::Lists::QueryParser do
           query = @instance.to_activerecord_query(MockUser.all)
 
           expect(query.count).to eql(2)
-          expect(query.pluck(:id)).to match_array([user_1.id, user_2.id])
+          expect(query.pluck(:primary_key)).to match_array([user_1.primary_key, user_2.primary_key])
         end
       end # "context 'simple OR' do"
 
@@ -546,7 +546,7 @@ RSpec.describe Scimitar::Lists::QueryParser do
           query = @instance.to_activerecord_query(MockUser.all)
 
           expect(query.count).to eql(3)
-          expect(query.pluck(:id)).to match_array([user_1.id, user_2.id, user_3.id])
+          expect(query.pluck(:primary_key)).to match_array([user_1.primary_key, user_2.primary_key, user_3.primary_key])
         end
       end # "context 'combined AND and OR' do"