scim2-server 0.2.0__tar.gz → 0.3.0__tar.gz

{scim2_server-0.2.0 → scim2_server-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: scim2-server
-Version: 0.2.0
+Version: 0.3.0
 Summary: Lightweight SCIM2 server prototype
 Keywords: scim,scim2,provisioning,rfc7643,rfc7644
 Author: Yaal Coop, Christian Friedrich Coors
@@ -208,7 +208,6 @@ License:                                  Apache License
             limitations under the License.
 Classifier: Intended Audience :: Developers
 Classifier: Development Status :: 4 - Beta
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
@@ -218,10 +217,9 @@ Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Environment :: Web Environment
 Classifier: Programming Language :: Python
 Classifier: Operating System :: OS Independent
-Requires-Dist: scim2-filter-parser>=0.7.0
-Requires-Dist: scim2-models>=0.6.1
+Requires-Dist: scim2-models>=0.9.0
 Requires-Dist: werkzeug>=3.0.3
-Requires-Python: >=3.10
+Requires-Python: >=3.11
 Project-URL: repository, https://github.com/python-scim/scim2-server
 Project-URL: funding, https://github.com/sponsors/python-scim
 Description-Content-Type: text/markdown
@@ -229,7 +227,7 @@ Description-Content-Type: text/markdown
 # scim2-server
 
 This is an example WSGI-SCIM server using [scim2-models](https://github.com/python-scim/scim2-models).
-It utilizes [werkzeug](https://werkzeug.palletsprojects.com/) and [scim2-filter-parser](https://github.com/15five/scim2-filter-parser) and keeps all resources in-memory,
+It utilizes [werkzeug](https://werkzeug.palletsprojects.com/) and keeps all resources in-memory,
 they are lost once the process exits.
 
 ## Features
@@ -241,20 +239,20 @@ they are lost once the process exits.
 - [x] Unique Constraints
 - [x] HTTP PATCH (Add/Remove/Replace)
 - [x] Sorting
-
-The only optional feature currently missing is support for Bulk operations ([RFC 7644, Section 3.7](https://datatracker.ietf.org/doc/html/rfc7644#section-3.7)).
+- [x] Bulk operations ([RFC 7644, Section 3.7](https://datatracker.ietf.org/doc/html/rfc7644#section-3.7))
 
 ## Usage
 
 ```shell
-$ scim2-server [-h] [--schema SCHEMA] [--resource-type RESOURCE_TYPE] [--bearer-token BEARER_TOKEN] [--hostname HOSTNAME] [--port PORT] [--reverse-proxy] [--dump-resources DUMP_RESOURCES] [--debug]
+$ scim2-server [-h] [--schema SCHEMA] [--resource-type RESOURCE_TYPE] [--service-provider-config SERVICE_PROVIDER_CONFIG] [--bearer-token BEARER_TOKEN] [--hostname HOSTNAME] [--port PORT] [--reverse-proxy] [--dump-resources DUMP_RESOURCES] [--debug]
 ```
 
 - `-h`/`--help`: Show help message
 - `--reverse-proxy`: Allow using the provider behind a Reverse Proxy (required for URL rewriting).
 - `--schema`: Register schemas from specified JSON file. If not provided, loads the default schemas from RFC 7643.
 - `--resource-type`: Register resource types from specified JSON file. If not provided, loads the default resource types from RFC 7643.
-- `--bearer-token`: Registers a bearer token that can be used for accessing the service. If no tokens are provided, anonymous access without authentication is allowed.
+- `--service-provider-config`: Load the service provider configuration from specified JSON file. If not provided, loads the default configuration.
+- `--bearer-token`: Registers a bearer token that can be used for accessing the service, and announces the bearer token authentication scheme. If no tokens are provided, anonymous access without authentication is allowed.
 - `--hostname`: The hostname to listen on. Defaults to `127.0.0.1`.
 - `--port`: The port to listen on. Defaults to `8080`.
 - `--dump-resources`: Dump a JSON document containing all resources when the provider exits normally.

{scim2_server-0.2.0 → scim2_server-0.3.0}/README.md

@@ -1,7 +1,7 @@
 # scim2-server
 
 This is an example WSGI-SCIM server using [scim2-models](https://github.com/python-scim/scim2-models).
-It utilizes [werkzeug](https://werkzeug.palletsprojects.com/) and [scim2-filter-parser](https://github.com/15five/scim2-filter-parser) and keeps all resources in-memory,
+It utilizes [werkzeug](https://werkzeug.palletsprojects.com/) and keeps all resources in-memory,
 they are lost once the process exits.
 
 ## Features
@@ -13,20 +13,20 @@ they are lost once the process exits.
 - [x] Unique Constraints
 - [x] HTTP PATCH (Add/Remove/Replace)
 - [x] Sorting
-
-The only optional feature currently missing is support for Bulk operations ([RFC 7644, Section 3.7](https://datatracker.ietf.org/doc/html/rfc7644#section-3.7)).
+- [x] Bulk operations ([RFC 7644, Section 3.7](https://datatracker.ietf.org/doc/html/rfc7644#section-3.7))
 
 ## Usage
 
 ```shell
-$ scim2-server [-h] [--schema SCHEMA] [--resource-type RESOURCE_TYPE] [--bearer-token BEARER_TOKEN] [--hostname HOSTNAME] [--port PORT] [--reverse-proxy] [--dump-resources DUMP_RESOURCES] [--debug]
+$ scim2-server [-h] [--schema SCHEMA] [--resource-type RESOURCE_TYPE] [--service-provider-config SERVICE_PROVIDER_CONFIG] [--bearer-token BEARER_TOKEN] [--hostname HOSTNAME] [--port PORT] [--reverse-proxy] [--dump-resources DUMP_RESOURCES] [--debug]
 ```
 
 - `-h`/`--help`: Show help message
 - `--reverse-proxy`: Allow using the provider behind a Reverse Proxy (required for URL rewriting).
 - `--schema`: Register schemas from specified JSON file. If not provided, loads the default schemas from RFC 7643.
 - `--resource-type`: Register resource types from specified JSON file. If not provided, loads the default resource types from RFC 7643.
-- `--bearer-token`: Registers a bearer token that can be used for accessing the service. If no tokens are provided, anonymous access without authentication is allowed.
+- `--service-provider-config`: Load the service provider configuration from specified JSON file. If not provided, loads the default configuration.
+- `--bearer-token`: Registers a bearer token that can be used for accessing the service, and announces the bearer token authentication scheme. If no tokens are provided, anonymous access without authentication is allowed.
 - `--hostname`: The hostname to listen on. Defaults to `127.0.0.1`.
 - `--port`: The port to listen on. Defaults to `8080`.
 - `--dump-resources`: Dump a JSON document containing all resources when the provider exits normally.

{scim2_server-0.2.0 → scim2_server-0.3.0}/pyproject.toml

@@ -1,10 +1,10 @@
 [build-system]
-requires = ["uv_build>=0.12.16,<0.13.0"]
+requires = ["uv_build>=0.12.13,<0.13.0"]
 build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.2.0"
+version = "0.3.0"
 description = "Lightweight SCIM2 server prototype"
 readme = "README.md"
 keywords = [
@@ -17,7 +17,6 @@ keywords = [
 classifiers = [
     "Intended Audience :: Developers",
     "Development Status :: 4 - Beta",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
@@ -28,10 +27,9 @@ classifiers = [
     "Programming Language :: Python",
     "Operating System :: OS Independent",
 ]
-requires-python = ">= 3.10"
+requires-python = ">= 3.11"
 dependencies = [
-    "scim2-filter-parser>=0.7.0",
-    "scim2-models>=0.6.1",
+    "scim2-models>=0.9.0",
     "werkzeug>=3.0.3",
 ]
 
@@ -55,14 +53,25 @@ scim2-server = "scim2_server.cli:main"
 
 [dependency-groups]
 dev = [
-    "httpx>=0.27.0",
+    "httpx2>=2.0.0",
     "pytest>=8.2.2",
-    "pytest-coverage>=0.0",
+    "pytest-cov>=6.0.0",
     "prek>=0.1.0",
     "time-machine>=2.14.2",
     "tox-uv>=1.16.0",
 ]
 
+[tool.uv]
+exclude-newer = "14 days"
+
+[tool.uv.exclude-newer-package]
+scim2-models = false
+scim2-client = false
+scim2-server = false
+scim2-cli = false
+scim2-tester = false
+pytest-scim2-server = false
+
 [tool.uv.build-backend]
 module-root = ""
 
@@ -125,7 +134,6 @@ doctest_optionflags = "ALLOW_UNICODE IGNORE_EXCEPTION_DETAIL ELLIPSIS"
 requires = ["tox>=4.19"]
 env_list = [
     "style",
-    "py310",
     "py311",
     "py312",
     "py313",

{scim2_server-0.2.0 → scim2_server-0.3.0}/pyproject.toml.orig

@@ -1,10 +1,10 @@
 [build-system]
-requires = ["uv_build>=0.12.16,<0.13.0"]
+requires = ["uv_build>=0.12.13,<0.13.0"]
 build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.2.0"
+version = "0.3.0"
 description = "Lightweight SCIM2 server prototype"
 authors = [
     {name="Yaal Coop", email="contact@yaal.coop"},
@@ -16,7 +16,6 @@ keywords = ["scim", "scim2", "provisioning", "rfc7643", "rfc7644"]
 classifiers = [
     "Intended Audience :: Developers",
     "Development Status :: 4 - Beta",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
@@ -28,10 +27,9 @@ classifiers = [
     "Operating System :: OS Independent",
 ]
 
-requires-python = ">= 3.10"
+requires-python = ">= 3.11"
 dependencies = [
-    "scim2-filter-parser>=0.7.0",
-    "scim2-models>=0.6.1",
+    "scim2-models>=0.9.0",
     "werkzeug>=3.0.3",
 ]
 
@@ -44,14 +42,18 @@ scim2-server = "scim2_server.cli:main"
 
 [dependency-groups]
 dev = [
-    "httpx>=0.27.0",
+    "httpx2>=2.0.0",
     "pytest>=8.2.2",
-    "pytest-coverage>=0.0",
+    "pytest-cov>=6.0.0",
     "prek>=0.1.0",
     "time-machine>=2.14.2",
     "tox-uv>=1.16.0",
 ]
 
+[tool.uv]
+exclude-newer = "14 days"
+exclude-newer-package = { scim2-models = false, scim2-client = false, scim2-server = false, scim2-cli = false, scim2-tester = false, pytest-scim2-server = false }
+
 [tool.uv.build-backend]
 module-root = ""
 
@@ -111,7 +113,6 @@ doctest_optionflags= "ALLOW_UNICODE IGNORE_EXCEPTION_DETAIL ELLIPSIS"
 requires = ["tox>=4.19"]
 env_list = [
     "style",
-    "py310",
     "py311",
     "py312",
     "py313",

scim2_server-0.3.0/scim2_server/backend.py

@@ -0,0 +1,315 @@
+import dataclasses
+import datetime
+import pickle
+import uuid
+from inspect import isclass
+from threading import Lock
+from typing import Any
+from typing import Union
+
+from scim2_models import BaseModel
+from scim2_models import CaseExact
+from scim2_models import Extension
+from scim2_models import Meta
+from scim2_models import Resource
+from scim2_models import ResourceType
+from scim2_models import ScimFilter
+from scim2_models import SearchRequest
+from scim2_models import Uniqueness
+from scim2_models import UniquenessException
+from werkzeug.http import generate_etag
+
+
+class Backend:
+    """The base class for a SCIM provider backend.
+
+    A backend only stores resources: what the service serves is described by the
+    :class:`~scim2_models.ScimProvider` of the application.
+    """
+
+    def __enter__(self):
+        """Allow the backend to be used as a context manager.
+
+        This enables support for transactions.
+        """
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        """Exit the transaction."""
+        pass
+
+    def query_resources(
+        self,
+        search_request: SearchRequest,
+        resource_type: ResourceType | None = None,
+    ) -> tuple[int, list[Resource]]:
+        """Query the backend for a set of resources.
+
+        :param search_request: SearchRequest instance describing the
+            query.
+        :param resource_type: The resource type to query. If None, all
+            resource types are queried.
+        :return: A tuple of "total results" and a List of found
+            Resources. The List must contain a copy of resources.
+            Mutating elements in the List must not modify the data
+            stored in the backend.
+        :raises TooManyException: If the backend only supports querying
+            for one resource type at a time, setting resource_type to
+            None the backend may raise TooManyException.
+        """
+        raise NotImplementedError
+
+    def get_resource(
+        self, resource_type: ResourceType, object_id: str
+    ) -> Resource | None:
+        """Query the backend for a resources by its ID.
+
+        :param resource_type: The resource type to get the object from.
+        :param object_id: ID of the object to get.
+        :return: The resource object if it exists, None otherwise. The
+            resource must be a copy, modifying it must not change the
+            data stored in the backend.
+        """
+        raise NotImplementedError
+
+    def delete_resource(self, resource_type: ResourceType, object_id: str) -> bool:
+        """Delete a resource.
+
+        :param resource_type: The resource type to delete the object
+            from.
+        :param object_id: ID of the object to delete.
+        :return: True if the resource was deleted, False otherwise.
+        """
+        raise NotImplementedError
+
+    def create_resource(
+        self, resource_type: ResourceType, resource: Resource
+    ) -> Resource | None:
+        """Create a resource.
+
+        :param resource_type: The resource type to create.
+        :param resource: Resource to create.
+        :return: The created resource. Creation should set system-
+            defined attributes (ID, Metadata). May be the same object
+            that is passed in.
+        """
+        raise NotImplementedError
+
+    def update_resource(
+        self, resource_type: ResourceType, resource: Resource
+    ) -> Resource | None:
+        """Update a resource. The resource is identified by its ID.
+
+        :param resource_type: The resource type to update.
+        :param resource: Resource to update.
+        :return: The updated resource. Updating should update the
+            "meta.lastModified" data. May be the same object that is
+            passed in.
+        """
+        raise NotImplementedError
+
+
+class InMemoryBackend(Backend):
+    """An example in-memory backend for the SCIM provider.
+
+    It is not optimized for performance. Many operations are O(n) or
+    worse, whereas they would perform better with an actual production
+    database in the backend. This is intentional to keep the
+    implementation simple.
+    """
+
+    @dataclasses.dataclass(frozen=True)
+    class UniquenessDescriptor:
+        """Used to mimic uniqueness constraints e.g. from a SQL database."""
+
+        extension: str | None
+        field_name: str
+        case_exact: bool
+        schema: str
+
+        def is_declared_by(self, resource: Resource) -> bool:
+            """Tell whether the model of a resource holds the schema of the attribute."""
+            model = type(resource)
+            return self.schema == model.__schema__ or (
+                self.schema in model.get_extension_models()
+            )
+
+        def get_attribute(self, resource: Resource) -> Any:
+            holder = getattr(resource, self.extension) if self.extension else resource
+            value = getattr(holder, self.field_name, None) if holder else None
+            if isinstance(value, str) and not self.case_exact:
+                return value.casefold()
+            return value
+
+    @classmethod
+    def collect_unique_attrs(
+        cls, model: type[BaseModel], extension: str | None = None
+    ) -> list[UniquenessDescriptor]:
+        """Return the uniqueness constraints the annotations of a model declare.
+
+        The ``id`` is left out: the backend issues it, so it cannot clash.
+        """
+        descriptors = [
+            cls.UniquenessDescriptor(
+                extension,
+                field_name,
+                model.get_field_annotation(field_name, CaseExact) == CaseExact.true,
+                str(model.__schema__),
+            )
+            for field_name in model.model_fields
+            if field_name != "id"
+            and model.get_field_annotation(field_name, Uniqueness) != Uniqueness.none
+        ]
+        for field_name in model.model_fields:
+            root_type = model.get_field_root_type(field_name)
+            if isclass(root_type) and issubclass(root_type, Extension):
+                descriptors.extend(cls.collect_unique_attrs(root_type, field_name))
+        return descriptors
+
+    def __init__(self):
+        super().__init__()
+        self.resources: list[Resource] = []
+        self.lock: Lock = Lock()
+
+    def __enter__(self):
+        """See super docs.
+
+        The InMemoryBackend uses a simple Lock to synchronize all
+        access.
+        """
+        super().__enter__()
+        self.lock.acquire()
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        super().__exit__(exc_type, exc_val, exc_tb)
+        self.lock.release()
+
+    def query_resources(
+        self,
+        search_request: SearchRequest,
+        resource_type: ResourceType | None = None,
+    ) -> tuple[int, list[Resource]]:
+        start_index = (search_request.start_index or 1) - 1
+
+        candidates = [
+            r
+            for r in self.resources
+            if resource_type is None or self._is_of_type(r, resource_type)
+        ]
+
+        scim_filter = search_request.filter
+        if scim_filter is not None and not scim_filter.models and candidates:
+            models = tuple(dict.fromkeys(type(r) for r in candidates))
+            scim_filter = ScimFilter[Union[models]](str(scim_filter))  # noqa: UP007
+
+        found_resources = [
+            r for r in candidates if scim_filter is None or scim_filter.match(r)
+        ]
+
+        found_resources = search_request.sort(found_resources)
+
+        total_results = len(found_resources)
+        found_resources = found_resources[start_index:]
+        if search_request.count is not None:
+            found_resources = found_resources[: search_request.count]
+        return total_results, found_resources
+
+    def _is_of_type(self, resource: Resource, resource_type: ResourceType) -> bool:
+        """Tell whether a resource belongs to a resource type.
+
+        RFC 7643 §3.1 has meta.resourceType carry the name of the resource type,
+        which may differ from its id.
+        """
+        return resource.meta.resource_type == resource_type.name
+
+    def _get_resource_idx(
+        self, resource_type: ResourceType, object_id: str
+    ) -> int | None:
+        return next(
+            (
+                idx
+                for idx, r in enumerate(self.resources)
+                if self._is_of_type(r, resource_type) and r.id == object_id
+            ),
+            None,
+        )
+
+    def get_resource(
+        self, resource_type: ResourceType, object_id: str
+    ) -> Resource | None:
+        resource_dict_idx = self._get_resource_idx(resource_type, object_id)
+        if resource_dict_idx is not None:
+            return self.resources[resource_dict_idx].model_copy(deep=True)
+        return None
+
+    def delete_resource(self, resource_type: ResourceType, object_id: str) -> bool:
+        found = self.get_resource(resource_type, object_id)
+        if found:
+            self.resources = [
+                r
+                for r in self.resources
+                if not (self._is_of_type(r, resource_type) and r.id == object_id)
+            ]
+            return True
+        return False
+
+    def create_resource(
+        self, resource_type: ResourceType, resource: Resource
+    ) -> Resource | None:
+        resource = resource.model_copy(deep=True)
+        resource.id = uuid.uuid4().hex
+        utcnow = datetime.datetime.now(datetime.UTC)
+        resource.meta = Meta(
+            resource_type=resource_type.name,
+            created=utcnow,
+            last_modified=utcnow,
+            location="/v2" + resource_type.endpoint + "/" + resource.id,
+        )
+        self._touch_resource(resource, utcnow)
+        self._check_uniqueness(resource)
+        self.resources.append(resource)
+        return resource
+
+    def _check_uniqueness(self, resource: Resource):
+        """Refuse a resource sharing a unique value with another one of the same schema.
+
+        RFC 7643 erratum 8279 scopes the uniqueness to the resources using the
+        schema that declares the attribute, whatever their resource type. A
+        missing value never clashes, as a SQL NULL does not.
+        """
+        for unique_attribute in self.collect_unique_attrs(type(resource)):
+            value = unique_attribute.get_attribute(resource)
+            if value is None:
+                continue
+            for existing_resource in self.resources:
+                if (
+                    unique_attribute.is_declared_by(existing_resource)
+                    and existing_resource.id != resource.id
+                    and unique_attribute.get_attribute(existing_resource) == value
+                ):
+                    raise UniquenessException()
+
+    @staticmethod
+    def _touch_resource(resource: Resource, last_modified: datetime.datetime):
+        """Touches a resource (updates last_modified and version).
+
+        Version is generated by hashing last_modified. Another option
+        would be to hash the entire resource instead.
+        """
+        resource.meta.last_modified = last_modified
+        etag = generate_etag(pickle.dumps(resource.meta.last_modified))
+        resource.meta.version = f'W/"{etag}"'
+
+    def update_resource(
+        self, resource_type: ResourceType, resource: Resource
+    ) -> Resource | None:
+        found_res_idx = self._get_resource_idx(resource_type, resource.id)
+        if found_res_idx is not None:
+            updated_resource = type(resource).model_validate(resource.model_dump())
+            self._touch_resource(updated_resource, datetime.datetime.now(datetime.UTC))
+
+            self._check_uniqueness(updated_resource)
+            self.resources[found_res_idx] = updated_resource
+            return updated_resource
+        return None