scim2-server 0.2.0__tar.gz → 0.3.1__tar.gz

{scim2_server-0.2.0 → scim2_server-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: scim2-server
-Version: 0.2.0
+Version: 0.3.1
 Summary: Lightweight SCIM2 server prototype
 Keywords: scim,scim2,provisioning,rfc7643,rfc7644
 Author: Yaal Coop, Christian Friedrich Coors
@@ -208,7 +208,6 @@ License:                                  Apache License
             limitations under the License.
 Classifier: Intended Audience :: Developers
 Classifier: Development Status :: 4 - Beta
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
@@ -218,10 +217,9 @@ Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Environment :: Web Environment
 Classifier: Programming Language :: Python
 Classifier: Operating System :: OS Independent
-Requires-Dist: scim2-filter-parser>=0.7.0
-Requires-Dist: scim2-models>=0.6.1
+Requires-Dist: scim2-models>=0.10.0
 Requires-Dist: werkzeug>=3.0.3
-Requires-Python: >=3.10
+Requires-Python: >=3.11
 Project-URL: repository, https://github.com/python-scim/scim2-server
 Project-URL: funding, https://github.com/sponsors/python-scim
 Description-Content-Type: text/markdown
@@ -229,7 +227,7 @@ Description-Content-Type: text/markdown
 # scim2-server
 
 This is an example WSGI-SCIM server using [scim2-models](https://github.com/python-scim/scim2-models).
-It utilizes [werkzeug](https://werkzeug.palletsprojects.com/) and [scim2-filter-parser](https://github.com/15five/scim2-filter-parser) and keeps all resources in-memory,
+It utilizes [werkzeug](https://werkzeug.palletsprojects.com/) and keeps all resources in-memory,
 they are lost once the process exits.
 
 ## Features
@@ -241,20 +239,20 @@ they are lost once the process exits.
 - [x] Unique Constraints
 - [x] HTTP PATCH (Add/Remove/Replace)
 - [x] Sorting
-
-The only optional feature currently missing is support for Bulk operations ([RFC 7644, Section 3.7](https://datatracker.ietf.org/doc/html/rfc7644#section-3.7)).
+- [x] Bulk operations
 
 ## Usage
 
 ```shell
-$ scim2-server [-h] [--schema SCHEMA] [--resource-type RESOURCE_TYPE] [--bearer-token BEARER_TOKEN] [--hostname HOSTNAME] [--port PORT] [--reverse-proxy] [--dump-resources DUMP_RESOURCES] [--debug]
+$ scim2-server [-h] [--schema SCHEMA] [--resource-type RESOURCE_TYPE] [--service-provider-config SERVICE_PROVIDER_CONFIG] [--bearer-token BEARER_TOKEN] [--hostname HOSTNAME] [--port PORT] [--reverse-proxy] [--dump-resources DUMP_RESOURCES] [--debug]
 ```
 
 - `-h`/`--help`: Show help message
 - `--reverse-proxy`: Allow using the provider behind a Reverse Proxy (required for URL rewriting).
 - `--schema`: Register schemas from specified JSON file. If not provided, loads the default schemas from RFC 7643.
 - `--resource-type`: Register resource types from specified JSON file. If not provided, loads the default resource types from RFC 7643.
-- `--bearer-token`: Registers a bearer token that can be used for accessing the service. If no tokens are provided, anonymous access without authentication is allowed.
+- `--service-provider-config`: Load the service provider configuration from specified JSON file. If not provided, loads the default configuration.
+- `--bearer-token`: Registers a bearer token that can be used for accessing the service, and announces the bearer token authentication scheme. If no tokens are provided, anonymous access without authentication is allowed.
 - `--hostname`: The hostname to listen on. Defaults to `127.0.0.1`.
 - `--port`: The port to listen on. Defaults to `8080`.
 - `--dump-resources`: Dump a JSON document containing all resources when the provider exits normally.

{scim2_server-0.2.0 → scim2_server-0.3.1}/README.md

@@ -1,7 +1,7 @@
 # scim2-server
 
 This is an example WSGI-SCIM server using [scim2-models](https://github.com/python-scim/scim2-models).
-It utilizes [werkzeug](https://werkzeug.palletsprojects.com/) and [scim2-filter-parser](https://github.com/15five/scim2-filter-parser) and keeps all resources in-memory,
+It utilizes [werkzeug](https://werkzeug.palletsprojects.com/) and keeps all resources in-memory,
 they are lost once the process exits.
 
 ## Features
@@ -13,20 +13,20 @@ they are lost once the process exits.
 - [x] Unique Constraints
 - [x] HTTP PATCH (Add/Remove/Replace)
 - [x] Sorting
-
-The only optional feature currently missing is support for Bulk operations ([RFC 7644, Section 3.7](https://datatracker.ietf.org/doc/html/rfc7644#section-3.7)).
+- [x] Bulk operations
 
 ## Usage
 
 ```shell
-$ scim2-server [-h] [--schema SCHEMA] [--resource-type RESOURCE_TYPE] [--bearer-token BEARER_TOKEN] [--hostname HOSTNAME] [--port PORT] [--reverse-proxy] [--dump-resources DUMP_RESOURCES] [--debug]
+$ scim2-server [-h] [--schema SCHEMA] [--resource-type RESOURCE_TYPE] [--service-provider-config SERVICE_PROVIDER_CONFIG] [--bearer-token BEARER_TOKEN] [--hostname HOSTNAME] [--port PORT] [--reverse-proxy] [--dump-resources DUMP_RESOURCES] [--debug]
 ```
 
 - `-h`/`--help`: Show help message
 - `--reverse-proxy`: Allow using the provider behind a Reverse Proxy (required for URL rewriting).
 - `--schema`: Register schemas from specified JSON file. If not provided, loads the default schemas from RFC 7643.
 - `--resource-type`: Register resource types from specified JSON file. If not provided, loads the default resource types from RFC 7643.
-- `--bearer-token`: Registers a bearer token that can be used for accessing the service. If no tokens are provided, anonymous access without authentication is allowed.
+- `--service-provider-config`: Load the service provider configuration from specified JSON file. If not provided, loads the default configuration.
+- `--bearer-token`: Registers a bearer token that can be used for accessing the service, and announces the bearer token authentication scheme. If no tokens are provided, anonymous access without authentication is allowed.
 - `--hostname`: The hostname to listen on. Defaults to `127.0.0.1`.
 - `--port`: The port to listen on. Defaults to `8080`.
 - `--dump-resources`: Dump a JSON document containing all resources when the provider exits normally.

{scim2_server-0.2.0 → scim2_server-0.3.1}/pyproject.toml

@@ -1,10 +1,10 @@
 [build-system]
-requires = ["uv_build>=0.12.16,<0.13.0"]
+requires = ["uv_build>=0.12.13,<0.13.0"]
 build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.2.0"
+version = "0.3.1"
 description = "Lightweight SCIM2 server prototype"
 readme = "README.md"
 keywords = [
@@ -17,7 +17,6 @@ keywords = [
 classifiers = [
     "Intended Audience :: Developers",
     "Development Status :: 4 - Beta",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
@@ -28,10 +27,9 @@ classifiers = [
     "Programming Language :: Python",
     "Operating System :: OS Independent",
 ]
-requires-python = ">= 3.10"
+requires-python = ">= 3.11"
 dependencies = [
-    "scim2-filter-parser>=0.7.0",
-    "scim2-models>=0.6.1",
+    "scim2-models>=0.10.0",
     "werkzeug>=3.0.3",
 ]
 
@@ -55,14 +53,25 @@ scim2-server = "scim2_server.cli:main"
 
 [dependency-groups]
 dev = [
-    "httpx>=0.27.0",
+    "httpx2>=2.0.0",
     "pytest>=8.2.2",
-    "pytest-coverage>=0.0",
+    "pytest-cov>=6.0.0",
     "prek>=0.1.0",
     "time-machine>=2.14.2",
     "tox-uv>=1.16.0",
 ]
 
+[tool.uv]
+exclude-newer = "14 days"
+
+[tool.uv.exclude-newer-package]
+scim2-models = false
+scim2-client = false
+scim2-server = false
+scim2-cli = false
+scim2-tester = false
+pytest-scim2-server = false
+
 [tool.uv.build-backend]
 module-root = ""
 
@@ -125,7 +134,6 @@ doctest_optionflags = "ALLOW_UNICODE IGNORE_EXCEPTION_DETAIL ELLIPSIS"
 requires = ["tox>=4.19"]
 env_list = [
     "style",
-    "py310",
     "py311",
     "py312",
     "py313",

{scim2_server-0.2.0 → scim2_server-0.3.1}/pyproject.toml.orig

@@ -1,10 +1,10 @@
 [build-system]
-requires = ["uv_build>=0.12.16,<0.13.0"]
+requires = ["uv_build>=0.12.13,<0.13.0"]
 build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.2.0"
+version = "0.3.1"
 description = "Lightweight SCIM2 server prototype"
 authors = [
     {name="Yaal Coop", email="contact@yaal.coop"},
@@ -16,7 +16,6 @@ keywords = ["scim", "scim2", "provisioning", "rfc7643", "rfc7644"]
 classifiers = [
     "Intended Audience :: Developers",
     "Development Status :: 4 - Beta",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
@@ -28,10 +27,9 @@ classifiers = [
     "Operating System :: OS Independent",
 ]
 
-requires-python = ">= 3.10"
+requires-python = ">= 3.11"
 dependencies = [
-    "scim2-filter-parser>=0.7.0",
-    "scim2-models>=0.6.1",
+    "scim2-models>=0.10.0",
     "werkzeug>=3.0.3",
 ]
 
@@ -44,14 +42,18 @@ scim2-server = "scim2_server.cli:main"
 
 [dependency-groups]
 dev = [
-    "httpx>=0.27.0",
+    "httpx2>=2.0.0",
     "pytest>=8.2.2",
-    "pytest-coverage>=0.0",
+    "pytest-cov>=6.0.0",
     "prek>=0.1.0",
     "time-machine>=2.14.2",
     "tox-uv>=1.16.0",
 ]
 
+[tool.uv]
+exclude-newer = "14 days"
+exclude-newer-package = { scim2-models = false, scim2-client = false, scim2-server = false, scim2-cli = false, scim2-tester = false, pytest-scim2-server = false }
+
 [tool.uv.build-backend]
 module-root = ""
 
@@ -111,7 +113,6 @@ doctest_optionflags= "ALLOW_UNICODE IGNORE_EXCEPTION_DETAIL ELLIPSIS"
 requires = ["tox>=4.19"]
 env_list = [
     "style",
-    "py310",
     "py311",
     "py312",
     "py313",

scim2_server-0.3.1/scim2_server/backend.py

@@ -0,0 +1,280 @@
+import datetime
+import pickle
+import uuid
+from threading import Lock
+from typing import Any
+from typing import Union
+from typing import cast
+
+from scim2_models import AttributeBinding
+from scim2_models import Meta
+from scim2_models import Path
+from scim2_models import Resource
+from scim2_models import ResourceType
+from scim2_models import ScimFilter
+from scim2_models import SearchRequest
+from scim2_models import Uniqueness
+from scim2_models import UniquenessException
+from werkzeug.http import generate_etag
+
+
+class Backend:
+    """The base class for a SCIM provider backend.
+
+    A backend only stores resources: what the service serves is described by the
+    :class:`~scim2_models.ScimProvider` of the application.
+    """
+
+    def __enter__(self):
+        """Allow the backend to be used as a context manager.
+
+        This enables support for transactions.
+        """
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        """Exit the transaction."""
+        pass
+
+    def query_resources(
+        self,
+        search_request: SearchRequest,
+        resource_type: ResourceType | None = None,
+    ) -> tuple[int, list[Resource]]:
+        """Query the backend for a set of resources.
+
+        :param search_request: SearchRequest instance describing the
+            query.
+        :param resource_type: The resource type to query. If None, all
+            resource types are queried.
+        :return: A tuple of "total results" and a List of found
+            Resources. The List must contain a copy of resources.
+            Mutating elements in the List must not modify the data
+            stored in the backend.
+        :raises TooManyException: If the backend only supports querying
+            for one resource type at a time, setting resource_type to
+            None the backend may raise TooManyException.
+        """
+        raise NotImplementedError
+
+    def get_resource(
+        self, resource_type: ResourceType, object_id: str
+    ) -> Resource | None:
+        """Query the backend for a resources by its ID.
+
+        :param resource_type: The resource type to get the object from.
+        :param object_id: ID of the object to get.
+        :return: The resource object if it exists, None otherwise. The
+            resource must be a copy, modifying it must not change the
+            data stored in the backend.
+        """
+        raise NotImplementedError
+
+    def delete_resource(self, resource_type: ResourceType, object_id: str) -> bool:
+        """Delete a resource.
+
+        :param resource_type: The resource type to delete the object
+            from.
+        :param object_id: ID of the object to delete.
+        :return: True if the resource was deleted, False otherwise.
+        """
+        raise NotImplementedError
+
+    def create_resource(
+        self, resource_type: ResourceType, resource: Resource
+    ) -> Resource | None:
+        """Create a resource.
+
+        :param resource_type: The resource type to create.
+        :param resource: Resource to create.
+        :return: The created resource. Creation should set system-
+            defined attributes (ID, Metadata). May be the same object
+            that is passed in.
+        """
+        raise NotImplementedError
+
+    def update_resource(
+        self, resource_type: ResourceType, resource: Resource
+    ) -> Resource | None:
+        """Update a resource. The resource is identified by its ID.
+
+        :param resource_type: The resource type to update.
+        :param resource: Resource to update.
+        :return: The updated resource. Updating should update the
+            "meta.lastModified" data. May be the same object that is
+            passed in.
+        """
+        raise NotImplementedError
+
+
+class InMemoryBackend(Backend):
+    """An example in-memory backend for the SCIM provider.
+
+    It is not optimized for performance. Many operations are O(n) or
+    worse, whereas they would perform better with an actual production
+    database in the backend. This is intentional to keep the
+    implementation simple.
+    """
+
+    def __init__(self):
+        super().__init__()
+        self.resources: list[Resource] = []
+        self.lock: Lock = Lock()
+
+    def __enter__(self):
+        """See super docs.
+
+        The InMemoryBackend uses a simple Lock to synchronize all
+        access.
+        """
+        super().__enter__()
+        self.lock.acquire()
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        super().__exit__(exc_type, exc_val, exc_tb)
+        self.lock.release()
+
+    def query_resources(
+        self,
+        search_request: SearchRequest,
+        resource_type: ResourceType | None = None,
+    ) -> tuple[int, list[Resource]]:
+        start_index = (search_request.start_index or 1) - 1
+
+        candidates = [
+            r
+            for r in self.resources
+            if resource_type is None or self._is_of_type(r, resource_type)
+        ]
+
+        scim_filter = search_request.filter
+        if scim_filter is not None and not scim_filter.models and candidates:
+            models = tuple(dict.fromkeys(type(r) for r in candidates))
+            scim_filter = ScimFilter[Union[models]](str(scim_filter))  # noqa: UP007
+
+        found_resources = [
+            r for r in candidates if scim_filter is None or scim_filter.match(r)
+        ]
+
+        found_resources = search_request.sort(found_resources)
+
+        total_results = len(found_resources)
+        found_resources = found_resources[start_index:]
+        if search_request.count is not None:
+            found_resources = found_resources[: search_request.count]
+        return total_results, found_resources
+
+    def _is_of_type(self, resource: Resource, resource_type: ResourceType) -> bool:
+        """Tell whether a resource belongs to a resource type.
+
+        RFC 7643 §3.1 has meta.resourceType carry the name of the resource type,
+        which may differ from its id.
+        """
+        return resource.meta.resource_type == resource_type.name
+
+    def _get_resource_idx(
+        self, resource_type: ResourceType, object_id: str
+    ) -> int | None:
+        return next(
+            (
+                idx
+                for idx, r in enumerate(self.resources)
+                if self._is_of_type(r, resource_type) and r.id == object_id
+            ),
+            None,
+        )
+
+    def get_resource(
+        self, resource_type: ResourceType, object_id: str
+    ) -> Resource | None:
+        resource_dict_idx = self._get_resource_idx(resource_type, object_id)
+        if resource_dict_idx is not None:
+            return self.resources[resource_dict_idx].model_copy(deep=True)
+        return None
+
+    def delete_resource(self, resource_type: ResourceType, object_id: str) -> bool:
+        found = self.get_resource(resource_type, object_id)
+        if found:
+            self.resources = [
+                r
+                for r in self.resources
+                if not (self._is_of_type(r, resource_type) and r.id == object_id)
+            ]
+            return True
+        return False
+
+    def create_resource(
+        self, resource_type: ResourceType, resource: Resource
+    ) -> Resource | None:
+        resource = resource.model_copy(deep=True)
+        resource.id = uuid.uuid4().hex
+        utcnow = datetime.datetime.now(datetime.UTC)
+        resource.meta = Meta(
+            resource_type=resource_type.name,
+            created=utcnow,
+            last_modified=utcnow,
+            location="/v2" + resource_type.endpoint + "/" + resource.id,
+        )
+        self._touch_resource(resource, utcnow)
+        self._check_uniqueness(resource)
+        self.resources.append(resource)
+        return resource
+
+    def _check_uniqueness(self, resource: Resource):
+        """Refuse a resource sharing a unique value with another one of the same schema.
+
+        RFC 7643 erratum 8279 scopes the uniqueness to the resources using the
+        schema that declares the attribute, whatever their resource type. A
+        missing value never clashes, as a SQL NULL does not.
+        """
+        unique_paths = Path[type(resource)].iter_paths(
+            include_subattributes=False,
+            uniqueness=[Uniqueness.server, Uniqueness.global_],
+        )
+        for path in unique_paths:
+            attribute = cast(AttributeBinding, path.resolve())
+            value = self._unique_value(resource, attribute)
+            if value is None:
+                continue
+            for existing_resource in self.resources:
+                if (
+                    existing_resource.id != resource.id
+                    and self._unique_value(existing_resource, attribute) == value
+                ):
+                    raise UniquenessException()
+
+    @staticmethod
+    def _unique_value(resource: Resource, attribute: AttributeBinding) -> Any:
+        """Return the value a resource holds for a unique attribute, in the form it is compared in.
+
+        A resource whose schemas do not declare the attribute holds no value.
+        """
+        value = Path[type(resource)](attribute.urn).get(resource, strict=False)
+        if isinstance(value, str) and not attribute.case_exact:
+            return value.casefold()
+        return value
+
+    @staticmethod
+    def _touch_resource(resource: Resource, last_modified: datetime.datetime):
+        """Touches a resource (updates last_modified and version).
+
+        Version is generated by hashing last_modified. Another option
+        would be to hash the entire resource instead.
+        """
+        resource.meta.last_modified = last_modified
+        etag = generate_etag(pickle.dumps(resource.meta.last_modified))
+        resource.meta.version = f'W/"{etag}"'
+
+    def update_resource(
+        self, resource_type: ResourceType, resource: Resource
+    ) -> Resource | None:
+        found_res_idx = self._get_resource_idx(resource_type, resource.id)
+        if found_res_idx is not None:
+            updated_resource = type(resource).model_validate(resource.model_dump())
+            self._touch_resource(updated_resource, datetime.datetime.now(datetime.UTC))
+
+            self._check_uniqueness(updated_resource)
+            self.resources[found_res_idx] = updated_resource
+            return updated_resource
+        return None

scim2_server-0.3.1/scim2_server/bulk.py

@@ -0,0 +1,181 @@
+from collections.abc import Callable
+from typing import Any
+
+from pydantic import BaseModel
+from scim2_models import BulkOperation
+from scim2_models import InvalidValueException
+from scim2_models import Resource
+from werkzeug.exceptions import Conflict
+
+BULK_ID_PREFIX = "bulkId:"
+
+Resolver = Callable[[BulkOperation], BulkOperation]
+"""Replaces the bulkId references of an operation."""
+
+OperationRunner = Callable[
+    [BulkOperation, Resolver], tuple[dict[str, Any], Resource | None]
+]
+"""Applies an operation once resolved, and returns its outcome and the resource it acted on."""
+
+
+def replace_bulk_ids(value: Any, replace: Callable[[str], str]) -> Any:
+    """Replace every "bulkId:" reference of a value.
+
+    A value without reference is returned as it is. Models are copied with
+    only the changed fields, so the fields the client set stay the same.
+    """
+    if isinstance(value, str) and value.startswith(BULK_ID_PREFIX):
+        return replace(value.removeprefix(BULK_ID_PREFIX))
+
+    if isinstance(value, list):
+        items = [replace_bulk_ids(item, replace) for item in value]
+        changed = any(new is not old for new, old in zip(items, value, strict=True))
+        return items if changed else value
+
+    if isinstance(value, dict):
+        entries = {key: replace_bulk_ids(item, replace) for key, item in value.items()}
+        changed = any(entries[key] is not item for key, item in value.items())
+        return entries if changed else value
+
+    if isinstance(value, BaseModel):
+        updates = {}
+        for name in type(value).model_fields:
+            field = getattr(value, name)
+            replaced = replace_bulk_ids(field, replace)
+            if replaced is not field:
+                updates[name] = replaced
+        return value.model_copy(update=updates) if updates else value
+
+    return value
+
+
+def resolve_operation(
+    operation: BulkOperation, replace: Callable[[str], str]
+) -> BulkOperation:
+    """Replace the "bulkId:" references of the path and the data of a bulk operation."""
+    updates: dict[str, Any] = {}
+    if operation.path is not None:
+        path = "/".join(
+            replace_bulk_ids(segment, replace) for segment in operation.path.split("/")
+        )
+        if path != operation.path:
+            updates["path"] = path
+
+    data = replace_bulk_ids(operation.data, replace)
+    if data is not operation.data:
+        updates["data"] = data
+
+    return operation.model_copy(update=updates) if updates else operation
+
+
+class BulkJob:
+    """Run the operations of a bulk request, and resolve their "bulkId:" references.
+
+    RFC 7644 §3.7.2 lets an operation reference a resource that another POST
+    of the same request creates. The operations run in the order of the
+    request, except that a POST runs before the first operation that
+    references it. The results keep the order of the request.
+    """
+
+    def __init__(
+        self,
+        operations: list[BulkOperation],
+        fail_on_errors: int | None,
+        run: OperationRunner,
+    ):
+        self.run_resolved = run
+        self.operations = operations
+        self.fail_on_errors = fail_on_errors
+        self.results: dict[int, dict[str, Any]] = {}
+        self.created: dict[str, Resource] = {}
+        self.running: set[int] = set()
+        self.errors = 0
+
+        self.creations: dict[str, int] = {}
+        for index, operation in enumerate(operations):
+            if (
+                operation.method == BulkOperation.Method.post
+                and operation.bulk_id is not None
+            ):
+                self.creations.setdefault(operation.bulk_id, index)
+
+    @property
+    def stopped(self) -> bool:
+        """Whether the job reached the number of errors the client accepts.
+
+        RFC 7644 §3.7.3: the job goes on despite failures, unless the client
+        caps the errors it accepts with "failOnErrors".
+        """
+        return (
+            self.errors > 0
+            and self.fail_on_errors is not None
+            and self.errors >= self.fail_on_errors
+        )
+
+    def run(self) -> list[dict[str, Any]]:
+        """Run every operation, and return the results of the operations that ran."""
+        for index in range(len(self.operations)):
+            self.run_operation(index)
+        return [self.results[index] for index in sorted(self.results)]
+
+    def run_operation(self, index: int) -> None:
+        """Run an operation, after the creations it references."""
+        if index in self.results or index in self.running or self.stopped:
+            return
+
+        operation = self.operations[index]
+        self.running.add(index)
+        for bulk_id in self.references(operation):
+            if bulk_id in self.creations:
+                self.run_operation(self.creations[bulk_id])
+
+        if not self.stopped:
+            result, resource = self.run_resolved(
+                operation, lambda operation: self.resolve(index, operation)
+            )
+            self.results[index] = result
+            if result["status"] >= 400:
+                self.errors += 1
+            elif resource is not None and self.is_creation(index, result["bulk_id"]):
+                self.created[result["bulk_id"]] = resource
+        self.running.discard(index)
+
+    def is_creation(self, index: int, bulk_id: str | None) -> bool:
+        """Whether an operation is the creation a bulkId references."""
+        return bulk_id is not None and self.creations.get(bulk_id) == index
+
+    @staticmethod
+    def references(operation: BulkOperation) -> list[str]:
+        """Return the bulkIds an operation references."""
+        bulk_ids: list[str] = []
+
+        def collect(bulk_id: str) -> str:
+            bulk_ids.append(bulk_id)
+            return bulk_id
+
+        resolve_operation(operation, collect)
+        return bulk_ids
+
+    def resolve(self, index: int, operation: BulkOperation) -> BulkOperation:
+        """Replace the bulkId references of an operation with the identifiers of the created resources.
+
+        :raises Conflict: When a referenced resource was not created, as
+            RFC 7644 §3.7.1 allows for circular references.
+        """
+        if (
+            operation.method == BulkOperation.Method.post
+            and operation.bulk_id is not None
+            and not self.is_creation(index, operation.bulk_id)
+        ):
+            raise InvalidValueException(
+                detail=f"The bulkId {operation.bulk_id} is not unique in the request"
+            )
+
+        def replace(bulk_id: str) -> str:
+            if bulk_id in self.created:
+                return str(self.created[bulk_id].id)
+            if self.creations.get(bulk_id) in self.running:
+                raise Conflict(f"The bulkId {bulk_id} is part of a circular reference")
+            raise Conflict(f"No resource was created with the bulkId {bulk_id}")
+
+        return resolve_operation(operation, replace)