scim2-server 0.1.0__py3-none-any.whl

scim2_server/backend.py

@@ -0,0 +1,398 @@
+import dataclasses
+import datetime
+import operator
+import pickle
+import uuid
+from threading import Lock
+from typing import Dict
+from typing import List
+from typing import Optional
+from typing import Tuple
+from typing import Union
+
+from scim2_filter_parser import lexer
+from scim2_filter_parser.parser import SCIMParser
+from scim2_models import Attribute
+from scim2_models import BaseModel
+from scim2_models import CaseExact
+from scim2_models import Error
+from scim2_models import Extension
+from scim2_models import Meta
+from scim2_models import Resource
+from scim2_models import ResourceType
+from scim2_models import Schema
+from scim2_models import SearchRequest
+from scim2_models import Uniqueness
+from werkzeug.http import generate_etag
+
+from scim2_server.filter import evaluate_filter
+from scim2_server.operators import ResolveSortOperator
+from scim2_server.utils import SCIMException
+from scim2_server.utils import get_by_alias
+
+
+class Backend:
+    """The base class for a SCIM provider backend."""
+
+    def __init__(self):
+        self.schemas: Dict[str, Schema] = {}
+        self.resource_types: Dict[str, ResourceType] = {}
+        self.resource_types_by_endpoint: Dict[str, ResourceType] = {}
+        self.models_dict: Dict[str, BaseModel] = {}
+
+    def __enter__(self):
+        """Allows the backend to be used as a context manager.
+
+        This enables support for transactions.
+        """
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        """Exits the transaction."""
+        pass
+
+    def register_schema(self, schema: Schema):
+        """Registers a Schema for use with the backend."""
+        self.schemas[schema.id] = schema
+
+    def get_schemas(self):
+        """Returns all schemas registered with the backend."""
+        return self.schemas.values()
+
+    def get_schema(self, schema_id: str) -> Optional[Schema]:
+        """Gets a schema by its id."""
+        return self.schemas.get(schema_id)
+
+    def register_resource_type(self, resource_type: ResourceType):
+        """Registers a ResourceType for use with the backend.
+
+        The schemas used for the resource and its extensions must have
+        been registered with the Backend beforehand.
+        """
+        if resource_type.schema_ not in self.schemas:
+            raise RuntimeError(f"Unknown schema: {resource_type.schema_}")
+        for resource_extension in resource_type.schema_extensions or []:
+            if resource_extension.schema_ not in self.schemas:
+                raise RuntimeError(f"Unknown schema: {resource_extension.schema_}")
+
+        self.resource_types[resource_type.id] = resource_type
+        self.resource_types_by_endpoint[resource_type.endpoint.lower()] = resource_type
+
+        extensions = [
+            Extension.from_schema(self.get_schema(se.schema_))
+            for se in resource_type.schema_extensions or []
+        ]
+        base_schema = self.get_schema(resource_type.schema_)
+        self.models_dict[resource_type.id] = Resource.from_schema(base_schema)
+        if extensions:
+            self.models_dict[resource_type.id] = self.models_dict[resource_type.id][
+                Union[*extensions]
+            ]
+
+    def get_resource_types(self):
+        """Returns all resource types registered with the backend."""
+        return self.resource_types.values()
+
+    def get_resource_type(self, resource_type_id: str) -> Optional[ResourceType]:
+        """Returns the resource type by its id."""
+        return self.resource_types.get(resource_type_id)
+
+    def get_resource_type_by_endpoint(self, endpoint: str) -> Optional[ResourceType]:
+        """Returns the resource type by its endpoint."""
+        return self.resource_types_by_endpoint.get(endpoint.lower())
+
+    def get_model(self, resource_type_id: str) -> Optional[BaseModel]:
+        """Returns the Pydantic Python model for a given resource type."""
+        return self.models_dict.get(resource_type_id)
+
+    def get_models(self):
+        """Returns all Pydantic Python models for all known resource types."""
+        return self.models_dict.values()
+
+    def query_resources(
+        self,
+        search_request: SearchRequest,
+        resource_type_id: Optional[str] = None,
+    ) -> Tuple[int, List[Resource]]:
+        """Queries the backend for a set of resources.
+
+        :param search_request: SearchRequest instance describing the
+            query.
+        :param resource_type_id: ID of the resource type to query. If
+            None, all resource types are queried.
+        :return: A tuple of "total results" and a List of found
+            Resources. The List must contain a copy of resources.
+            Mutating elements in the List must not modify the data
+            stored in the backend.
+        :raises SCIMException: If the backend only supports querying for
+            one resource type at a time, setting resource_type_id to
+            None the backend may raise a
+            SCIMException(Error.make_too_many_error()).
+        """
+        raise NotImplementedError
+
+    def get_resource(self, resource_type_id: str, object_id: str) -> Optional[Resource]:
+        """Queries the backend for a resources by its ID.
+
+        :param resource_type_id: ID of the resource type to get the
+            object from.
+        :param object_id: ID of the object to get.
+        :return: The resource object if it exists, None otherwise. The
+            resource must be a copy, modifying it must not change the
+            data stored in the backend.
+        """
+        raise NotImplementedError
+
+    def delete_resource(self, resource_type_id: str, object_id: str) -> bool:
+        """Deletes a resource.
+
+        :param resource_type_id: ID of the resource type to delete the
+            object from.
+        :param object_id: ID of the object to delete.
+        :return: True if the resource was deleted, False otherwise.
+        """
+        raise NotImplementedError
+
+    def create_resource(
+        self, resource_type_id: str, resource: Resource
+    ) -> Optional[Resource]:
+        """Creates a resource.
+
+        :param resource_type_id: ID of the resource type to create.
+        :param resource: Resource to create.
+        :return: The created resource. Creation should set system-
+            defined attributes (ID, Metadata). May be the same object
+            that is passed in.
+        """
+        raise NotImplementedError
+
+    def update_resource(
+        self, resource_type_id: str, resource: Resource
+    ) -> Optional[Resource]:
+        """Updates a resource. The resource is identified by its ID.
+
+        :param resource_type_id: ID of the resource type to update.
+        :param resource: Resource to update.
+        :return: The updated resource. Updating should update the
+            "meta.lastModified" data. May be the same object that is
+            passed in.
+        """
+        raise NotImplementedError
+
+
+class InMemoryBackend(Backend):
+    """This is an example in-memory backend for the SCIM provider.
+
+    It is not optimized for performance. Many operations are O(n) or
+    worse, whereas they would perform better with an actual production
+    database in the backend. This is intentional to keep the
+    implementation simple.
+    """
+
+    @dataclasses.dataclass
+    class UniquenessDescriptor:
+        """Used to mimic uniqueness constraints e.g. from a SQL database."""
+
+        schema: Optional[str]
+        attribute_name: str
+        case_exact: bool
+
+        def get_attribute(self, resource: Resource):
+            if self.schema is not None:
+                resource = getattr(resource, get_by_alias(resource, self.schema))
+            result = getattr(resource, get_by_alias(resource, self.attribute_name))
+            if not self.case_exact:
+                result = result.lower()
+            return result
+
+    @classmethod
+    def collect_unique_attrs(
+        cls, attributes: List[Attribute], schema: Optional[str]
+    ) -> List[UniquenessDescriptor]:
+        ret = []
+        for attr in attributes:
+            if attr.uniqueness != Uniqueness.none:
+                ret.append(
+                    cls.UniquenessDescriptor(
+                        schema, attr.name, attr.case_exact == CaseExact.true
+                    )
+                )
+        return ret
+
+    @classmethod
+    def collect_resource_unique_attrs(
+        cls, resource_type: ResourceType, schemas: Dict[str, Schema]
+    ) -> List[List[UniquenessDescriptor]]:
+        ret = cls.collect_unique_attrs(schemas[resource_type.schema_].attributes, None)
+        for extension in resource_type.schema_extensions or []:
+            ret.extend(
+                InMemoryBackend.collect_unique_attrs(
+                    schemas[extension.schema_].attributes, extension.schema_
+                )
+            )
+        return ret
+
+    def __init__(self):
+        super().__init__()
+        self.resources: List[Resource] = []
+        self.unique_attributes: Dict[str, List[List[str]]] = {}
+        self.lock: Lock = Lock()
+
+    def __enter__(self):
+        """See super docs.
+
+        The InMemoryBackend uses a simple Lock to synchronize all
+        access.
+        """
+        super().__enter__()
+        self.lock.acquire()
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        super().__exit__(exc_type, exc_val, exc_tb)
+        self.lock.release()
+
+    def register_resource_type(self, resource_type: ResourceType):
+        super().register_resource_type(resource_type)
+        self.unique_attributes[resource_type.id] = self.collect_resource_unique_attrs(
+            resource_type, self.schemas
+        )
+
+    def query_resources(
+        self,
+        search_request: SearchRequest,
+        resource_type_id: Optional[str] = None,
+    ) -> Tuple[int, List[Resource]]:
+        start_index = (search_request.start_index or 1) - 1
+
+        tree = None
+        if search_request.filter is not None:
+            token_stream = lexer.SCIMLexer().tokenize(search_request.filter)
+            tree = SCIMParser().parse(token_stream)
+
+        found_resources = [
+            r
+            for r in self.resources
+            if (resource_type_id is None or r.meta.resource_type == resource_type_id)
+            and (tree is None or evaluate_filter(r, tree))
+        ]
+
+        if search_request.sort_by is not None:
+            descending = search_request.sort_order == SearchRequest.SortOrder.descending
+            sort_operator = ResolveSortOperator(search_request.sort_by)
+
+            # To ensure that unset attributes are sorted last (when ascending, as defined in the RFC),
+            # we have to divide the result set into a set and unset subset.
+            unset_values = []
+            set_values = []
+            for resource in found_resources:
+                result = sort_operator(resource)
+                if result is None:
+                    unset_values.append(resource)
+                else:
+                    set_values.append((resource, result))
+
+            set_values.sort(key=operator.itemgetter(1), reverse=descending)
+            set_values = [value[0] for value in set_values]
+            if descending:
+                found_resources = unset_values + set_values
+            else:
+                found_resources = set_values + unset_values
+
+        found_resources = found_resources[start_index:]
+        if search_request.count is not None:
+            found_resources = found_resources[: search_request.count]
+        return len(found_resources), found_resources
+
+    def _get_resource_idx(self, resource_type_id: str, object_id: str) -> Optional[int]:
+        return next(
+            (
+                idx
+                for idx, r in enumerate(self.resources)
+                if r.meta.resource_type == resource_type_id and r.id == object_id
+            ),
+            None,
+        )
+
+    def get_resource(self, resource_type_id: str, object_id: str) -> Optional[Resource]:
+        resource_dict_idx = self._get_resource_idx(resource_type_id, object_id)
+        if resource_dict_idx is not None:
+            return self.resources[resource_dict_idx].model_copy(deep=True)
+        return None
+
+    def delete_resource(self, resource_type_id: str, object_id: str) -> bool:
+        found = self.get_resource(resource_type_id, object_id)
+        if found:
+            self.resources = [
+                r
+                for r in self.resources
+                if not (r.meta.resource_type == resource_type_id and r.id == object_id)
+            ]
+            return True
+        return False
+
+    def create_resource(
+        self, resource_type_id: str, resource: Resource
+    ) -> Optional[Resource]:
+        resource = resource.model_copy(deep=True)
+        resource.id = uuid.uuid4().hex
+        utcnow = datetime.datetime.now(datetime.UTC)
+        resource.meta = Meta(
+            resource_type=resource_type_id,
+            created=utcnow,
+            last_modified=utcnow,
+            location="/v2"
+            + self.resource_types[resource_type_id].endpoint
+            + "/"
+            + resource.id,
+        )
+        self._touch_resource(resource, utcnow)
+
+        for unique_attribute in self.unique_attributes[resource_type_id]:
+            new_value = unique_attribute.get_attribute(resource)
+            for existing_resource in self.resources:
+                if existing_resource.meta.resource_type == resource_type_id:
+                    existing_value = unique_attribute.get_attribute(existing_resource)
+                    if existing_value == new_value:
+                        raise SCIMException(Error.make_uniqueness_error())
+
+        self.resources.append(resource)
+        return resource
+
+    @staticmethod
+    def _touch_resource(resource: Resource, last_modified: datetime.datetime):
+        """Touches a resource (updates last_modified and version).
+
+        Version is generated by hashing last_modified. Another option
+        would be to hash the entire resource instead.
+        """
+        resource.meta.last_modified = last_modified
+        etag = generate_etag(pickle.dumps(resource.meta.last_modified))
+        resource.meta.version = f'W/"{etag}"'
+
+    def update_resource(
+        self, resource_type_id: str, resource: Resource
+    ) -> Optional[Resource]:
+        found_res_idx = self._get_resource_idx(resource_type_id, resource.id)
+        if found_res_idx is not None:
+            updated_resource = self.models_dict[resource_type_id].model_validate(
+                resource.model_dump()
+            )
+            self._touch_resource(updated_resource, datetime.datetime.now(datetime.UTC))
+
+            for unique_attribute in self.unique_attributes[resource_type_id]:
+                new_value = unique_attribute.get_attribute(updated_resource)
+                for existing_resource in self.resources:
+                    if (
+                        existing_resource.meta.resource_type == resource_type_id
+                        and existing_resource.id != updated_resource.id
+                    ):
+                        existing_value = unique_attribute.get_attribute(
+                            existing_resource
+                        )
+                        if existing_value == new_value:
+                            raise SCIMException(Error.make_uniqueness_error())
+
+            self.resources[found_res_idx] = updated_resource
+            return updated_resource
+        return None

scim2_server/cli.py

@@ -0,0 +1,98 @@
+import argparse
+import json
+import logging
+import pprint
+
+from scim2_models import ResourceType
+from scim2_models import Schema
+from werkzeug.middleware.proxy_fix import ProxyFix
+
+from scim2_server.backend import InMemoryBackend
+from scim2_server.provider import SCIMProvider
+from scim2_server.utils import load_default_resource_types
+from scim2_server.utils import load_default_schemas
+
+
+def log_environ(handler):
+    """A simple decorator to log all WSGI environment variables."""
+
+    def _inner(environ, start_fn):
+        logging.getLogger("log_environ").debug(pprint.pformat(environ))
+        return handler(environ, start_fn)
+
+    return _inner
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--schema", type=argparse.FileType("r"), help="Schema definitions"
+    )
+    parser.add_argument(
+        "--resource-type", type=argparse.FileType("r"), help="Resource Type definitions"
+    )
+    parser.add_argument("--bearer-token", action="append", help="Add Bearer Token")
+    parser.add_argument("--hostname", default="127.0.0.1", help="Hostname")
+    parser.add_argument("--port", default=8080, type=int, help="Port number")
+    parser.add_argument(
+        "--reverse-proxy",
+        action="store_true",
+        help='Allow running behind a reverse proxy (respect "X-Forwarded-*" HTTP headers)',
+    )
+    parser.add_argument(
+        "--dump-resources",
+        type=argparse.FileType("w"),
+        help="Dump resources to a JSON file on exit",
+    )
+    args = parser.parse_args()
+
+    logging.basicConfig(level=logging.DEBUG)
+
+    from werkzeug.serving import run_simple
+
+    backend = InMemoryBackend()
+    app = SCIMProvider(backend)
+
+    if args.schema is None:
+        for schema in load_default_schemas().values():
+            app.register_schema(schema)
+    else:
+        def_sch = json.load(args.schema)
+        for sc in def_sch:
+            schema = Schema.model_validate(sc)
+            app.register_schema(schema)
+        args.schema.close()
+
+    if args.resource_type is None:
+        for resource_type in load_default_resource_types().values():
+            app.register_resource_type(resource_type)
+    else:
+        def_rt = json.load(args.resource_type)
+        for rt in def_rt:
+            resource_type = ResourceType.model_validate(rt)
+            app.register_resource_type(resource_type)
+        args.resource_type.close()
+
+    if args.bearer_token is not None:
+        for bearer_token in args.bearer_token:
+            app.register_bearer_token(bearer_token)
+
+    app = log_environ(app)
+    if args.reverse_proxy:
+        app = ProxyFix(app, x_for=1, x_proto=1, x_host=1, x_port=1, x_prefix=1)
+
+    run_simple(
+        args.hostname,
+        args.port,
+        app,
+        use_debugger=True,
+        use_reloader=True,
+    )
+
+    if args.dump_resources:
+        with args.dump_resources as f:
+            f.write(json.dumps([r.model_dump() for r in backend.resources], indent=2))
+
+
+if __name__ == "__main__":
+    main()

scim2_server/filter.py

@@ -0,0 +1,128 @@
+from types import NoneType
+from typing import List
+
+from scim2_filter_parser import ast as scim2ast
+from scim2_models import BaseModel
+from scim2_models import CaseExact
+from scim2_models import Error
+
+from scim2_server.utils import SCIMException
+from scim2_server.utils import get_by_alias
+from scim2_server.utils import parse_new_value
+
+
+def evaluate_filter(
+    obj: BaseModel | List[BaseModel], tree: scim2ast.AST
+) -> bool | List[bool]:
+    """This implementation is limited by the specifics of the
+    scim2_filter_parser module.
+
+    It works well enough for simple cases, though. It should be re-
+    implemented in the future. Probably once
+    https://github.com/yaal-coop/scim2-models/issues/17
+    is implemented.
+    """
+    from scim2_server.operators import ResolveOperator
+    from scim2_server.operators import ResolveResult
+
+    match type(tree):
+        case scim2ast.Filter:
+            if tree.namespace is not None:
+                obj = ResolveOperator(tree.namespace.attr_name)(obj).get_values()
+            if isinstance(obj, List):
+                return [
+                    o
+                    for o in obj
+                    if bool(evaluate_filter(o, tree.expr)) != tree.negated
+                ]
+            return bool(evaluate_filter(obj, tree.expr)) != tree.negated
+        case scim2ast.LogExpr:
+            match tree.op:
+                case "and":
+                    return evaluate_filter(obj, tree.expr1) and evaluate_filter(
+                        obj, tree.expr2
+                    )
+                case _:  # "or"
+                    return evaluate_filter(obj, tree.expr1) or evaluate_filter(
+                        obj, tree.expr2
+                    )
+        case _:  # scim2ast.AttrExpr
+            path = tree.attr_path.attr_name
+            sub_attribute_name = None
+            if isinstance(path, scim2ast.Filter):
+                resolved = evaluate_filter(obj, path)
+                model = resolved[0]
+                attribute_name = ""
+
+                # FIXME: Best guesses since there is no way to know for sure by this point
+                case_sensitivity = CaseExact.false
+                sub_attribute_name = path.namespace.sub_attr.value
+            else:
+                if tree.attr_path.uri:
+                    path = tree.attr_path.uri + ":" + path
+                if tree.attr_path.sub_attr:
+                    path += "." + tree.attr_path.sub_attr.value
+                resolved = ResolveOperator(path)(obj)
+                case_sensitivity = resolved.get_field_annotation(CaseExact)
+                model = resolved.model
+                attribute_name = resolved.attribute
+
+            if isinstance(resolved, ResolveResult):
+                value = resolved.get_values()
+            else:
+                value = [
+                    getattr(v, get_by_alias(v, sub_attribute_name)) for v in resolved
+                ]
+
+            compare_value = None
+            if tree.comp_value:
+                if attribute_name:
+                    compare_value = parse_new_value(
+                        model, attribute_name, tree.comp_value.value
+                    )
+                else:
+                    compare_value = tree.comp_value.value
+            if not case_sensitivity and isinstance(value, str):
+                value = value.lower()
+                if compare_value:
+                    compare_value = compare_value.lower()
+
+            match tree.value:
+                case "eq":
+                    return value == compare_value
+                case "ne":
+                    return value != compare_value
+                case "sw":
+                    return value.startswith(compare_value)
+                case "ew":
+                    return value.endswith(compare_value)
+                case "pr":
+                    return bool(value)
+                case "co":
+                    if value is None:
+                        return False
+                    return compare_value in value
+                case "gt":
+                    check_comparable_value(value)
+                    return value > compare_value
+                case "lt":
+                    check_comparable_value(value)
+                    return value < compare_value
+                case "ge":
+                    check_comparable_value(value)
+                    return value >= compare_value
+                case _:  # "le"
+                    check_comparable_value(value)
+                    return value <= compare_value
+    return False
+
+
+def check_comparable_value(value):
+    """Certain values may not be compared in a filter, see RFC 7644, section
+    3.4.2.2:
+
+    "Boolean and Binary attributes SHALL cause a failed response (HTTP
+    status code 400) with "scimType" of "invalidFilter"."
+    """
+    if isinstance(value, (bytes, bool, NoneType)):
+        raise SCIMException(Error.make_invalid_filter_error())