scimitar 2.3.0 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3904e389b3b00b4c49df6d9267cc0b5413613ed56b544ee888dd4b3bfa9d7489
-  data.tar.gz: 93b14676bda6d86d4add6c0bcbf8ae6415ff49177b384f2b75571a304485d87f
+  metadata.gz: bccee840f0dc82854974e8d90d19189ae133f4281142c5de89107230b413041b
+  data.tar.gz: 014cbf547dd861c26489aa13d5ab2c75f5826ed24ca3c98d7eb71b76d98994b1
 SHA512:
-  metadata.gz: f1fad29d6ba090ad00b55bdf59f1050aacd1858d4e511e726d3fa501a37389e57777cd2cb2253c20972106e567a3f4b5e07ecd53a17723dcab2517f0c8ab99cf
-  data.tar.gz: 30a1c3ad4c6653b347cf00228cad99b88a3dc4a2da45fe311b61d0a0f2d08db723fabf2041e3d72f1d1cea28d633c540322394841723bdd8db7d805e49819eb4
+  metadata.gz: 1619af4e575d6701471820c52e39719fd96b311b45b2c5d9907bc147253cf5904926677901d0e778865d71768405774bf7082d8a641bcc4b33c9ef3c4183ec28
+  data.tar.gz: 3b435a7ff4343945de4436c8f6c3e52d4f714e00bdde594074f7dd064befc9d28836946195df80cdae50aa0751f0761dce8cf926b83203efd909b86538f67351

data/app/models/scimitar/resources/mixin.rb

@@ -901,14 +901,86 @@ module Scimitar
                   else
                     altering_hash[path_component] = value
                   end
+
                 when 'replace'
                   if path_component == 'root'
                     altering_hash[path_component].merge!(value)
                   else
                     altering_hash[path_component] = value
                   end
+
+                # The array check handles payloads seen from e.g. Microsoft for
+                # remove-user-from-group, where contrary to examples in the RFC
+                # which would imply "payload removes all users", there is the
+                # clear intent to remove just one.
+                #
+                # https://www.rfc-editor.org/rfc/rfc7644#section-3.5.2.2
+                # https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups#update-group-remove-members
+                #
+                # Since remove-all in the face of remove-one is destructive, we
+                # do a special check here to see if there's an array value for
+                # the array path that the payload yielded. If so, we can match
+                # each value against array items and remove just those items.
+                #
+                # There is an additional special case to handle a bad example
+                # from Salesforce:
+                #
+                #   https://help.salesforce.com/s/articleView?id=sf.identity_scim_manage_groups.htm&type=5
+                #
                 when 'remove'
-                  altering_hash.delete(path_component)
+                  if altering_hash[path_component].is_a?(Array) && value.present?
+
+                    # Handle bad Salesforce example. That might be simply a
+                    # documentation error, but just in case...
+                    #
+                    value = value.values.first if (
+                      path_component&.downcase == 'members' &&
+                      value.is_a?(Hash)                     &&
+                      value.keys.size == 1                  &&
+                      value.keys.first&.downcase == 'members'
+                    )
+
+                    # The Microsoft example provides an array of values, but we
+                    # may as well cope with a value specified 'flat'. Promote
+                    # such a thing to an Array to simplify the following code.
+                    #
+                    value = [value] unless value.is_a?(Array)
+
+                    # For each value item, delete matching array entries. The
+                    # concept of "matching" is:
+                    #
+                    # * For simple non-Hash values (if possible) just delete on
+                    #   an exact match
+                    #
+                    # * For Hash-based values, only delete if all 'patch' keys
+                    #   are present in the resource and all values thus match.
+                    #
+                    # Special case to ignore '$ref' from the Microsoft payload.
+                    #
+                    # Note coercion to strings to account for SCIM vs the usual
+                    # tricky case of underlying implementations with (say)
+                    # integer primary keys, which all end up as strings anyway.
+                    #
+                    value.each do | value_item |
+                      altering_hash[path_component].delete_if do | item |
+                        if item.is_a?(Hash) && value_item.is_a?(Hash)
+                          matched_all = true
+                          value_item.each do | value_key, value_value |
+                            next if value_key == '$ref'
+                            if ! item.key?(value_key) || item[value_key]&.to_s != value_value&.to_s
+                              matched_all = false
+                            end
+                          end
+                          matched_all
+                        else
+                          item&.to_s == value_item&.to_s
+                        end
+                      end
+                    end
+                  else
+                    altering_hash.delete(path_component)
+                  end
+
               end
             end
           end

data/lib/scimitar/version.rb

@@ -3,11 +3,11 @@ module Scimitar
   # Gem version. If this changes, be sure to re-run "bundle install" or
   # "bundle update".
   #
-  VERSION = '2.3.0'
+  VERSION = '2.4.0'
 
   # Date for VERSION. If this changes, be sure to re-run "bundle install"
   # or "bundle update".
   #
-  DATE = '2023-01-17'
+  DATE = '2023-01-27'
 
 end

data/spec/apps/dummy/config/routes.rb

@@ -15,6 +15,7 @@ Rails.application.routes.draw do
 
   get    'Groups',     to: 'mock_groups#index'
   get    'Groups/:id', to: 'mock_groups#show'
+  patch  'Groups/:id', to: 'mock_groups#update'
 
   # For testing blocks passed to ActiveRecordBackedResourcesController#destroy
   #

data/spec/models/scimitar/resources/mixin_spec.rb

@@ -1230,6 +1230,595 @@ RSpec.describe Scimitar::Resources::Mixin do
 
                 expect(scim_hash).to_not have_key('emails')
               end
+
+              # What we expect:
+              #
+              # https://www.rfc-editor.org/rfc/rfc7644#section-3.5.2.2
+              # https://docs.snowflake.com/en/user-guide/scim-intro.html#patch-scim-v2-groups-id
+              #
+              # ...vs accounting for the unusual payloads we sometimes get,
+              # tested here.
+              #
+              context 'special cases' do
+
+                # https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups#update-group-remove-members
+                #
+                context 'Microsoft-style payload' do
+                  context 'removing a user from a group' do
+                    it 'removes identified user' do
+                      path      = [ 'members' ]
+                      value     = [ { '$ref' => nil, 'value' => 'f648f8d5ea4e4cd38e9c' } ]
+                      scim_hash = {
+                        'displayname' => 'Mock group',
+                        'members'     => [
+                          {
+                            'value'   => '50ca93d04ab0c2de4772',
+                            'display' => 'Ingrid Smith',
+                            'type'    => 'User'
+                          },
+                          {
+                            'value'   => 'f648f8d5ea4e4cd38e9c',
+                            'display' => 'Fred Smith',
+                            'type'    => 'User'
+                          },
+                          {
+                            'value'   => 'a774d480e8112101375b',
+                            'display' => 'Taylor Smith',
+                            'type'    => 'User'
+                          }
+                        ]
+                      }.with_indifferent_case_insensitive_access()
+
+                      @instance.send(
+                        :from_patch_backend!,
+                        nature:        'remove',
+                        path:          path,
+                        value:         value,
+                        altering_hash: scim_hash
+                      )
+
+                      expect(scim_hash).to eql({
+                        'displayname' => 'Mock group',
+                        'members'     => [
+                          {
+                            'value'   => '50ca93d04ab0c2de4772',
+                            'display' => 'Ingrid Smith',
+                            'type'    => 'User'
+                          },
+                          {
+                            'value'   => 'a774d480e8112101375b',
+                            'display' => 'Taylor Smith',
+                            'type'    => 'User'
+                          }
+                        ]
+                      })
+                    end
+
+                    it 'removes multiple identified users' do
+                      path      = [ 'members' ]
+                      value     = [
+                        { '$ref' => nil, 'value' => 'f648f8d5ea4e4cd38e9c' },
+                        { '$ref' => nil, 'value' => '50ca93d04ab0c2de4772' }
+                      ]
+                      scim_hash = {
+                        'displayname' => 'Mock group',
+                        'members'     => [
+                          {
+                            'value'   => '50ca93d04ab0c2de4772',
+                            'display' => 'Ingrid Smith',
+                            'type'    => 'User'
+                          },
+                          {
+                            'value'   => 'f648f8d5ea4e4cd38e9c',
+                            'display' => 'Fred Smith',
+                            'type'    => 'User'
+                          },
+                          {
+                            'value'   => 'a774d480e8112101375b',
+                            'display' => 'Taylor Smith',
+                            'type'    => 'User'
+                          }
+                        ]
+                      }.with_indifferent_case_insensitive_access()
+
+                      @instance.send(
+                        :from_patch_backend!,
+                        nature:        'remove',
+                        path:          path,
+                        value:         value,
+                        altering_hash: scim_hash
+                      )
+
+                      expect(scim_hash).to eql({
+                        'displayname' => 'Mock group',
+                        'members'     => [
+                          {
+                            'value'   => 'a774d480e8112101375b',
+                            'display' => 'Taylor Smith',
+                            'type'    => 'User'
+                          }
+                        ]
+                      })
+                    end
+
+                    it 'removes all users individually without error' do
+                      path      = [ 'members' ]
+                      value     = [ { '$ref' => nil, 'value' => 'f648f8d5ea4e4cd38e9c' } ]
+                      scim_hash = {
+                        'displayname' => 'Mock group',
+                        'members'     => [
+                          {
+                            'value'   => 'f648f8d5ea4e4cd38e9c',
+                            'display' => 'Fred Smith',
+                            'type'    => 'User'
+                          }
+                        ]
+                      }.with_indifferent_case_insensitive_access()
+
+                      @instance.send(
+                        :from_patch_backend!,
+                        nature:        'remove',
+                        path:          path,
+                        value:         value,
+                        altering_hash: scim_hash
+                      )
+
+                      expect(scim_hash).to eql({
+                        'displayname' => 'Mock group',
+                        'members'     => []
+                      })
+                    end
+
+                    it 'can match on multiple attributes' do
+                      path      = [ 'members' ]
+                      value     = [ { '$ref' => nil, 'value' => 'f648f8d5ea4e4cd38e9c', 'type' => 'User' } ]
+                      scim_hash = {
+                        'displayname' => 'Mock group',
+                        'members'     => [
+                          {
+                            'value'   => 'f648f8d5ea4e4cd38e9c',
+                            'display' => 'Fred Smith',
+                            'type'    => 'User'
+                          }
+                        ]
+                      }.with_indifferent_case_insensitive_access()
+
+                      @instance.send(
+                        :from_patch_backend!,
+                        nature:        'remove',
+                        path:          path,
+                        value:         value,
+                        altering_hash: scim_hash
+                      )
+
+                      expect(scim_hash).to eql({
+                        'displayname' => 'Mock group',
+                        'members'     => []
+                      })
+                    end
+
+                    it 'ignores unrecognised users' do
+                      path      = [ 'members' ]
+                      value     = [ { '$ref' => nil, 'value' => '11b054a9c85216ed9356' } ]
+                      scim_hash = {
+                        'displayname' => 'Mock group',
+                        'members'     => [
+                          {
+                            'value'   => 'f648f8d5ea4e4cd38e9c',
+                            'display' => 'Fred Smith',
+                            'type'    => 'User'
+                          }
+                        ]
+                      }.with_indifferent_case_insensitive_access()
+
+                      @instance.send(
+                        :from_patch_backend!,
+                        nature:        'remove',
+                        path:          path,
+                        value:         value,
+                        altering_hash: scim_hash
+                      )
+
+                      # The 'value' mismatched, so the user was not removed.
+                      #
+                      expect(scim_hash).to eql({
+                        'displayname' => 'Mock group',
+                        'members'     => [
+                          {
+                            'value'   => 'f648f8d5ea4e4cd38e9c',
+                            'display' => 'Fred Smith',
+                            'type'    => 'User'
+                          }
+                        ]
+                      })
+                    end
+
+                    it 'ignores a mismatch on (for example) "type"' do
+                      path      = [ 'members' ]
+                      value     = [ { '$ref' => nil, 'value' => 'f648f8d5ea4e4cd38e9c', 'type' => 'Group' } ]
+                      scim_hash = {
+                        'displayname' => 'Mock group',
+                        'members'     => [
+                          {
+                            'value'   => 'f648f8d5ea4e4cd38e9c',
+                            'display' => 'Fred Smith',
+                            'type'    => 'User'
+                          }
+                        ]
+                      }.with_indifferent_case_insensitive_access()
+
+                      @instance.send(
+                        :from_patch_backend!,
+                        nature:        'remove',
+                        path:          path,
+                        value:         value,
+                        altering_hash: scim_hash
+                      )
+
+                      # Type 'Group' mismatches 'User', so the user was not
+                      # removed.
+                      #
+                      expect(scim_hash).to eql({
+                        'displayname' => 'Mock group',
+                        'members'     => [
+                          {
+                            'value'   => 'f648f8d5ea4e4cd38e9c',
+                            'display' => 'Fred Smith',
+                            'type'    => 'User'
+                          }
+                        ]
+                      })
+                    end
+
+                    it 'matches keys case-insensitive' do
+                      path      = [ 'members' ]
+                      value     = [ { '$ref' => nil, 'VALUe' => 'f648f8d5ea4e4cd38e9c' } ]
+                      scim_hash = {
+                        'displayname' => 'Mock group',
+                        'memBERS'     => [
+                          {
+                            'vaLUe'   => 'f648f8d5ea4e4cd38e9c',
+                            'display' => 'Fred Smith',
+                            'type'    => 'User'
+                          }
+                        ]
+                      }.with_indifferent_case_insensitive_access()
+
+                      @instance.send(
+                        :from_patch_backend!,
+                        nature:        'remove',
+                        path:          path,
+                        value:         value,
+                        altering_hash: scim_hash
+                      )
+
+                      expect(scim_hash).to eql({
+                        'displayname' => 'Mock group',
+                        'members'     => []
+                      })
+                    end
+
+                    it 'matches values case-sensitive' do
+                      path      = [ 'members' ]
+                      value     = [ { '$ref' => nil, 'value' => 'f648f8d5ea4e4cd38e9c', 'type' => 'USER' } ]
+                      scim_hash = {
+                        'displayname' => 'Mock group',
+                        'members'     => [
+                          {
+                            'value'   => 'f648f8d5ea4e4cd38e9c',
+                            'display' => 'Fred Smith',
+                            'type'    => 'User'
+                          }
+                        ]
+                      }.with_indifferent_case_insensitive_access()
+
+                      @instance.send(
+                        :from_patch_backend!,
+                        nature:        'remove',
+                        path:          path,
+                        value:         value,
+                        altering_hash: scim_hash
+                      )
+
+                      # USER mismatchs User, so the user was not removed.
+                      #
+                      expect(scim_hash).to eql({
+                        'displayname' => 'Mock group',
+                        'members'     => [
+                          {
+                            'value'   => 'f648f8d5ea4e4cd38e9c',
+                            'display' => 'Fred Smith',
+                            'type'    => 'User'
+                          }
+                        ]
+                      })
+                    end
+                  end # "context 'removing a user from a group' do"
+
+                  context 'generic use' do
+                    it 'removes matched items' do
+                      path      = [ 'emails' ]
+                      value     = [ { 'type' => 'work' } ]
+                      scim_hash = {
+                        'emails' => [
+                          {
+                            'type' => 'home',
+                            'value' => 'home@test.com'
+                          },
+                          {
+                            'type' => 'work',
+                            'value' => 'work@test.com'
+                          }
+                        ]
+                      }.with_indifferent_case_insensitive_access()
+
+                      @instance.send(
+                        :from_patch_backend!,
+                        nature:        'remove',
+                        path:          path,
+                        value:         value,
+                        altering_hash: scim_hash
+                      )
+
+                      expect(scim_hash).to eql({
+                        'emails' => [
+                          {
+                            'type' => 'home',
+                            'value' => 'home@test.com'
+                          }
+                        ]
+                      })
+                    end
+
+                    it 'ignores unmatched items' do
+                      path      = [ 'emails' ]
+                      value     = [ { 'type' => 'missing' } ]
+                      scim_hash = {
+                        'emails' => [
+                          {
+                            'type' => 'home',
+                            'value' => 'home@test.com'
+                          },
+                          {
+                            'type' => 'work',
+                            'value' => 'work@test.com'
+                          }
+                        ]
+                      }.with_indifferent_case_insensitive_access()
+
+                      @instance.send(
+                        :from_patch_backend!,
+                        nature:        'remove',
+                        path:          path,
+                        value:         value,
+                        altering_hash: scim_hash
+                      )
+
+                      expect(scim_hash).to eql({
+                        'emails' => [
+                          {
+                            'type' => 'home',
+                            'value' => 'home@test.com'
+                          },
+                          {
+                            'type' => 'work',
+                            'value' => 'work@test.com'
+                          }
+                        ]
+                      })
+                    end
+
+                    it 'compares string forms' do
+                      path      = [ 'test' ]
+                      value     = [
+                        { 'active' => true,    'value' => '12' },
+                        { 'active' => 'false', 'value' => 42   }
+                      ]
+                      scim_hash = {
+                        'test' => [
+                          {
+                            'active' => 'true',
+                            'value' => 12
+                          },
+                          {
+                            'active' => false,
+                            'value' => '42'
+                          }
+                        ]
+                      }.with_indifferent_case_insensitive_access()
+
+                      @instance.send(
+                        :from_patch_backend!,
+                        nature:        'remove',
+                        path:          path,
+                        value:         value,
+                        altering_hash: scim_hash
+                      )
+
+                      expect(scim_hash).to eql({'test' => []})
+                    end
+
+                    it 'handles a singular to-remove value rather than an array' do
+                      path      = [ 'emails' ]
+                      value     = { 'type' => 'work' }
+                      scim_hash = {
+                        'emails' => [
+                          {
+                            'type' => 'home',
+                            'value' => 'home@test.com'
+                          },
+                          {
+                            'type' => 'work',
+                            'value' => 'work@test.com'
+                          }
+                        ]
+                      }.with_indifferent_case_insensitive_access()
+
+                      @instance.send(
+                        :from_patch_backend!,
+                        nature:        'remove',
+                        path:          path,
+                        value:         value,
+                        altering_hash: scim_hash
+                      )
+
+                      expect(scim_hash).to eql({
+                        'emails' => [
+                          {
+                            'type' => 'home',
+                            'value' => 'home@test.com'
+                          }
+                        ]
+                      })
+                    end
+
+                    it 'handles simple values rather than object (Hash) values' do
+                      path      = [ 'test' ]
+                      value     = 42
+                      scim_hash = {
+                        'test' => [
+                          '21',
+                          '42',
+                          '15'
+                        ]
+                      }.with_indifferent_case_insensitive_access()
+
+                      @instance.send(
+                        :from_patch_backend!,
+                        nature:        'remove',
+                        path:          path,
+                        value:         value,
+                        altering_hash: scim_hash
+                      )
+
+                      expect(scim_hash).to eql({
+                        'test' => [
+                          '21',
+                          '15'
+                        ]
+                      })
+                    end
+                  end
+                end # "context 'Microsoft-style payload' do"
+
+                # https://help.salesforce.com/s/articleView?id=sf.identity_scim_manage_groups.htm&type=5
+                #
+                context 'Salesforce-style payload' do
+                  it 'removes identified user' do
+                    path      = [ 'members' ]
+                    value     = { 'members' => [ { '$ref' => nil, 'value' => 'f648f8d5ea4e4cd38e9c' } ] }
+                    scim_hash = {
+                      'displayname' => 'Mock group',
+                      'members'     => [
+                        {
+                          'value'   => '50ca93d04ab0c2de4772',
+                          'display' => 'Ingrid Smith',
+                          'type'    => 'User'
+                        },
+                        {
+                          'value'   => 'f648f8d5ea4e4cd38e9c',
+                          'display' => 'Fred Smith',
+                          'type'    => 'User'
+                        }
+                      ]
+                    }.with_indifferent_case_insensitive_access()
+
+                    @instance.send(
+                      :from_patch_backend!,
+                      nature:        'remove',
+                      path:          path,
+                      value:         value,
+                      altering_hash: scim_hash
+                    )
+
+                    expect(scim_hash).to eql({
+                      'displayname' => 'Mock group',
+                      'members'     => [
+                        {
+                          'value'   => '50ca93d04ab0c2de4772',
+                          'display' => 'Ingrid Smith',
+                          'type'    => 'User'
+                        }
+                      ]
+                    })
+                  end
+
+                  it 'matches the "members" key case-insensitive' do
+                    path      = [ 'members' ]
+                    value     = { 'MEMBERS' => [ { '$ref' => nil, 'value' => 'f648f8d5ea4e4cd38e9c' } ] }
+                    scim_hash = {
+                      'displayname' => 'Mock group',
+                      'members'     => [
+                        {
+                          'value'   => 'f648f8d5ea4e4cd38e9c',
+                          'display' => 'Fred Smith',
+                          'type'    => 'User'
+                        },
+                        {
+                          'value'   => 'a774d480e8112101375b',
+                          'display' => 'Taylor Smith',
+                          'type'    => 'User'
+                        }
+                      ]
+                    }.with_indifferent_case_insensitive_access()
+
+                    @instance.send(
+                      :from_patch_backend!,
+                      nature:        'remove',
+                      path:          path,
+                      value:         value,
+                      altering_hash: scim_hash
+                    )
+
+                    expect(scim_hash).to eql({
+                      'displayname' => 'Mock group',
+                      'members'     => [
+                        {
+                          'value'   => 'a774d480e8112101375b',
+                          'display' => 'Taylor Smith',
+                          'type'    => 'User'
+                        }
+                      ]
+                    })
+                  end
+
+                  it 'ignores unrecognised users' do
+                    path      = [ 'members' ]
+                    value     = { 'members' => [ { '$ref' => nil, 'value' => '11b054a9c85216ed9356' } ] }
+                    scim_hash = {
+                      'displayname' => 'Mock group',
+                      'members'     => [
+                        {
+                          'value'   => 'f648f8d5ea4e4cd38e9c',
+                          'display' => 'Fred Smith',
+                          'type'    => 'User'
+                        }
+                      ]
+                    }.with_indifferent_case_insensitive_access()
+
+                    @instance.send(
+                      :from_patch_backend!,
+                      nature:        'remove',
+                      path:          path,
+                      value:         value,
+                      altering_hash: scim_hash
+                    )
+
+                    # The 'value' mismatched, so the user was not removed.
+                    #
+                    expect(scim_hash).to eql({
+                      'displayname' => 'Mock group',
+                      'members'     => [
+                        {
+                          'value'   => 'f648f8d5ea4e4cd38e9c',
+                          'display' => 'Fred Smith',
+                          'type'    => 'User'
+                        }
+                      ]
+                    })
+                  end
+                end # "context 'Salesforce-style payload' do"
+              end # "context 'special cases' do"
             end # context 'when prior value already exists' do
 
             context 'when value is not present' do
@@ -1954,7 +2543,7 @@ RSpec.describe Scimitar::Resources::Mixin do
                 :from_patch_backend!,
                 nature:        'remove',
                 path:          ['complex[type eq "type1"]', 'data', 'nested[nature eq "nature2"]', 'info'],
-                value:         [{ 'deeper' => 'addition' }],
+                value:         nil,
                 altering_hash: scim_hash
               )
 

data/spec/requests/active_record_backed_resources_controller_spec.rb

@@ -691,6 +691,142 @@ RSpec.describe Scimitar::ActiveRecordBackedResourcesController do
       result = JSON.parse(response.body)
       expect(result['status']).to eql('404')
     end
+
+    context 'when removing users from groups' do
+      before :each do
+        @g1.mock_users << @u1
+        @g1.mock_users << @u2
+        @g1.mock_users << @u3
+
+        # (Self-check) Verify group representation
+        #
+        get "/Groups/#{@g1.id}", params: { format: :scim }
+
+        expect(response.status).to eql(200)
+        result = JSON.parse(response.body)
+
+        expect(result['members'].map { |m| m['value'] }.sort()).to eql(MockUser.pluck(:primary_key).sort())
+      end
+
+      it 'can remove all users' do
+        expect {
+          expect {
+            patch "/Groups/#{@g1.id}", params: {
+              format: :scim,
+              Operations: [
+                {
+                  op: 'remove',
+                  path: 'members'
+                }
+              ]
+            }
+          }.to_not change { MockUser.count }
+        }.to_not change { MockGroup.count }
+
+        get "/Groups/#{@g1.id}", params: { format: :scim }
+
+        expect(response.status).to eql(200)
+        result = JSON.parse(response.body)
+
+        expect(result['members']).to be_empty
+        expect(@g1.reload().mock_users).to be_empty
+      end
+
+      # Define via 'let':
+      #
+      # * Hash 'payload', to send via 'patch'
+      # * MockUser 'removed_user', which is the user that should be removed
+      #
+      shared_examples 'a user remover' do
+        it 'which removes the identified user' do
+          expect {
+            expect {
+              patch "/Groups/#{@g1.id}", params: payload()
+            }.to_not change { MockUser.count }
+          }.to_not change { MockGroup.count }
+
+          expected_remaining_user_ids = MockUser
+            .where.not(primary_key: removed_user().id)
+            .pluck(:primary_key)
+            .sort()
+
+          get "/Groups/#{@g1.id}", params: { format: :scim }
+
+          expect(response.status).to eql(200)
+          result = JSON.parse(response.body)
+
+          expect(result['members'].map { |m| m['value'] }.sort()).to eql(expected_remaining_user_ids)
+          expect(@g1.reload().mock_users.map(&:primary_key).sort()).to eql(expected_remaining_user_ids)
+        end
+      end
+
+      # https://www.rfc-editor.org/rfc/rfc7644#section-3.5.2.2
+      #
+      context 'and using an RFC-compliant payload' do
+        let(:removed_user) { @u2 }
+        let(:payload) do
+          {
+            format: :scim,
+            Operations: [
+              {
+                op: 'remove',
+                path: "members[value eq \"#{removed_user().primary_key}\"]",
+              }
+            ]
+          }
+        end
+
+        it_behaves_like 'a user remover'
+      end # context 'and using an RFC-compliant payload' do
+
+      # https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups#update-group-remove-members
+      #
+      context 'and using a Microsoft variant payload' do
+        let(:removed_user) { @u2 }
+        let(:payload) do
+          {
+            format: :scim,
+            Operations: [
+              {
+                op: 'remove',
+                path: 'members',
+                value: [{
+                  '$ref' => nil,
+                  'value' => removed_user().primary_key
+                }]
+              }
+            ]
+          }
+        end
+
+        it_behaves_like 'a user remover'
+      end # context 'and using a Microsoft variant payload' do
+
+      # https://help.salesforce.com/s/articleView?id=sf.identity_scim_manage_groups.htm&type=5
+      #
+      context 'and using a Salesforce variant payload' do
+        let(:removed_user) { @u2 }
+        let(:payload) do
+          {
+            format: :scim,
+            Operations: [
+              {
+                op: 'remove',
+                path: 'members',
+                value: {
+                  'members' => [{
+                    '$ref' => nil,
+                    'value' => removed_user().primary_key
+                  }]
+                }
+              }
+            ]
+          }
+        end
+
+        it_behaves_like 'a user remover'
+      end # context 'and using a Salesforce variant payload' do
+    end # "context 'when removing users from groups' do"
   end # "context '#update' do"
 
   # ===========================================================================

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: scimitar
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 2.4.0
 platform: ruby
 authors:
 - RIPA Global
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-17 00:00:00.000000000 Z
+date: 2023-01-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails