scim2-server 0.3.0__tar.gz → 0.3.1__tar.gz

{scim2_server-0.3.0 → scim2_server-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: scim2-server
-Version: 0.3.0
+Version: 0.3.1
 Summary: Lightweight SCIM2 server prototype
 Keywords: scim,scim2,provisioning,rfc7643,rfc7644
 Author: Yaal Coop, Christian Friedrich Coors
@@ -217,7 +217,7 @@ Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Environment :: Web Environment
 Classifier: Programming Language :: Python
 Classifier: Operating System :: OS Independent
-Requires-Dist: scim2-models>=0.9.0
+Requires-Dist: scim2-models>=0.10.0
 Requires-Dist: werkzeug>=3.0.3
 Requires-Python: >=3.11
 Project-URL: repository, https://github.com/python-scim/scim2-server
@@ -239,7 +239,7 @@ they are lost once the process exits.
 - [x] Unique Constraints
 - [x] HTTP PATCH (Add/Remove/Replace)
 - [x] Sorting
-- [x] Bulk operations ([RFC 7644, Section 3.7](https://datatracker.ietf.org/doc/html/rfc7644#section-3.7))
+- [x] Bulk operations
 
 ## Usage
 

{scim2_server-0.3.0 → scim2_server-0.3.1}/README.md

@@ -13,7 +13,7 @@ they are lost once the process exits.
 - [x] Unique Constraints
 - [x] HTTP PATCH (Add/Remove/Replace)
 - [x] Sorting
-- [x] Bulk operations ([RFC 7644, Section 3.7](https://datatracker.ietf.org/doc/html/rfc7644#section-3.7))
+- [x] Bulk operations
 
 ## Usage
 

{scim2_server-0.3.0 → scim2_server-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.3.0"
+version = "0.3.1"
 description = "Lightweight SCIM2 server prototype"
 readme = "README.md"
 keywords = [
@@ -29,7 +29,7 @@ classifiers = [
 ]
 requires-python = ">= 3.11"
 dependencies = [
-    "scim2-models>=0.9.0",
+    "scim2-models>=0.10.0",
     "werkzeug>=3.0.3",
 ]
 

{scim2_server-0.3.0 → scim2_server-0.3.1}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.3.0"
+version = "0.3.1"
 description = "Lightweight SCIM2 server prototype"
 authors = [
     {name="Yaal Coop", email="contact@yaal.coop"},
@@ -29,7 +29,7 @@ classifiers = [
 
 requires-python = ">= 3.11"
 dependencies = [
-    "scim2-models>=0.9.0",
+    "scim2-models>=0.10.0",
     "werkzeug>=3.0.3",
 ]
 

{scim2_server-0.3.0 → scim2_server-0.3.1}/scim2_server/backend.py

@@ -1,16 +1,14 @@
-import dataclasses
 import datetime
 import pickle
 import uuid
-from inspect import isclass
 from threading import Lock
 from typing import Any
 from typing import Union
+from typing import cast
 
-from scim2_models import BaseModel
-from scim2_models import CaseExact
-from scim2_models import Extension
+from scim2_models import AttributeBinding
 from scim2_models import Meta
+from scim2_models import Path
 from scim2_models import Resource
 from scim2_models import ResourceType
 from scim2_models import ScimFilter
@@ -118,54 +116,6 @@ class InMemoryBackend(Backend):
     implementation simple.
     """
 
-    @dataclasses.dataclass(frozen=True)
-    class UniquenessDescriptor:
-        """Used to mimic uniqueness constraints e.g. from a SQL database."""
-
-        extension: str | None
-        field_name: str
-        case_exact: bool
-        schema: str
-
-        def is_declared_by(self, resource: Resource) -> bool:
-            """Tell whether the model of a resource holds the schema of the attribute."""
-            model = type(resource)
-            return self.schema == model.__schema__ or (
-                self.schema in model.get_extension_models()
-            )
-
-        def get_attribute(self, resource: Resource) -> Any:
-            holder = getattr(resource, self.extension) if self.extension else resource
-            value = getattr(holder, self.field_name, None) if holder else None
-            if isinstance(value, str) and not self.case_exact:
-                return value.casefold()
-            return value
-
-    @classmethod
-    def collect_unique_attrs(
-        cls, model: type[BaseModel], extension: str | None = None
-    ) -> list[UniquenessDescriptor]:
-        """Return the uniqueness constraints the annotations of a model declare.
-
-        The ``id`` is left out: the backend issues it, so it cannot clash.
-        """
-        descriptors = [
-            cls.UniquenessDescriptor(
-                extension,
-                field_name,
-                model.get_field_annotation(field_name, CaseExact) == CaseExact.true,
-                str(model.__schema__),
-            )
-            for field_name in model.model_fields
-            if field_name != "id"
-            and model.get_field_annotation(field_name, Uniqueness) != Uniqueness.none
-        ]
-        for field_name in model.model_fields:
-            root_type = model.get_field_root_type(field_name)
-            if isclass(root_type) and issubclass(root_type, Extension):
-                descriptors.extend(cls.collect_unique_attrs(root_type, field_name))
-        return descriptors
-
     def __init__(self):
         super().__init__()
         self.resources: list[Resource] = []
@@ -278,18 +228,33 @@ class InMemoryBackend(Backend):
         schema that declares the attribute, whatever their resource type. A
         missing value never clashes, as a SQL NULL does not.
         """
-        for unique_attribute in self.collect_unique_attrs(type(resource)):
-            value = unique_attribute.get_attribute(resource)
+        unique_paths = Path[type(resource)].iter_paths(
+            include_subattributes=False,
+            uniqueness=[Uniqueness.server, Uniqueness.global_],
+        )
+        for path in unique_paths:
+            attribute = cast(AttributeBinding, path.resolve())
+            value = self._unique_value(resource, attribute)
             if value is None:
                 continue
             for existing_resource in self.resources:
                 if (
-                    unique_attribute.is_declared_by(existing_resource)
-                    and existing_resource.id != resource.id
-                    and unique_attribute.get_attribute(existing_resource) == value
+                    existing_resource.id != resource.id
+                    and self._unique_value(existing_resource, attribute) == value
                 ):
                     raise UniquenessException()
 
+    @staticmethod
+    def _unique_value(resource: Resource, attribute: AttributeBinding) -> Any:
+        """Return the value a resource holds for a unique attribute, in the form it is compared in.
+
+        A resource whose schemas do not declare the attribute holds no value.
+        """
+        value = Path[type(resource)](attribute.urn).get(resource, strict=False)
+        if isinstance(value, str) and not attribute.case_exact:
+            return value.casefold()
+        return value
+
     @staticmethod
     def _touch_resource(resource: Resource, last_modified: datetime.datetime):
         """Touches a resource (updates last_modified and version).

{scim2_server-0.3.0 → scim2_server-0.3.1}/scim2_server/bulk.py

@@ -1,55 +1,71 @@
 from collections.abc import Callable
 from typing import Any
 
+from pydantic import BaseModel
+from scim2_models import BulkOperation
 from scim2_models import InvalidValueException
 from scim2_models import Resource
 from werkzeug.exceptions import Conflict
 
 BULK_ID_PREFIX = "bulkId:"
 
-Resolver = Callable[[Any], Any]
-"""Replaces the bulkId references of a raw operation."""
+Resolver = Callable[[BulkOperation], BulkOperation]
+"""Replaces the bulkId references of an operation."""
 
-OperationRunner = Callable[[Any, Resolver], tuple[dict[str, Any], Resource | None]]
-"""Applies a raw operation once resolved, and returns its outcome and the resource it acted on."""
-
-
-def raw_attribute(payload: Any, name: str) -> Any:
-    """Return an attribute of a raw payload, whose names are case insensitive."""
-    if not isinstance(payload, dict):
-        return None
-    return next(
-        (value for key, value in payload.items() if key.casefold() == name.casefold()),
-        None,
-    )
+OperationRunner = Callable[
+    [BulkOperation, Resolver], tuple[dict[str, Any], Resource | None]
+]
+"""Applies an operation once resolved, and returns its outcome and the resource it acted on."""
 
 
 def replace_bulk_ids(value: Any, replace: Callable[[str], str]) -> Any:
-    """Replace every "bulkId:" reference of a raw value."""
+    """Replace every "bulkId:" reference of a value.
+
+    A value without reference is returned as it is. Models are copied with
+    only the changed fields, so the fields the client set stay the same.
+    """
     if isinstance(value, str) and value.startswith(BULK_ID_PREFIX):
         return replace(value.removeprefix(BULK_ID_PREFIX))
+
     if isinstance(value, list):
-        return [replace_bulk_ids(item, replace) for item in value]
+        items = [replace_bulk_ids(item, replace) for item in value]
+        changed = any(new is not old for new, old in zip(items, value, strict=True))
+        return items if changed else value
+
     if isinstance(value, dict):
-        return {key: replace_bulk_ids(item, replace) for key, item in value.items()}
+        entries = {key: replace_bulk_ids(item, replace) for key, item in value.items()}
+        changed = any(entries[key] is not item for key, item in value.items())
+        return entries if changed else value
+
+    if isinstance(value, BaseModel):
+        updates = {}
+        for name in type(value).model_fields:
+            field = getattr(value, name)
+            replaced = replace_bulk_ids(field, replace)
+            if replaced is not field:
+                updates[name] = replaced
+        return value.model_copy(update=updates) if updates else value
+
     return value
 
 
-def resolve_operation(payload: Any, replace: Callable[[str], str]) -> Any:
-    """Replace the "bulkId:" references of the path and the data of a raw bulk operation."""
-    if not isinstance(payload, dict):
-        return payload
+def resolve_operation(
+    operation: BulkOperation, replace: Callable[[str], str]
+) -> BulkOperation:
+    """Replace the "bulkId:" references of the path and the data of a bulk operation."""
+    updates: dict[str, Any] = {}
+    if operation.path is not None:
+        path = "/".join(
+            replace_bulk_ids(segment, replace) for segment in operation.path.split("/")
+        )
+        if path != operation.path:
+            updates["path"] = path
 
-    resolved = {}
-    for key, value in payload.items():
-        if key.casefold() == "path" and isinstance(value, str):
-            value = "/".join(
-                replace_bulk_ids(segment, replace) for segment in value.split("/")
-            )
-        elif key.casefold() == "data":
-            value = replace_bulk_ids(value, replace)
-        resolved[key] = value
-    return resolved
+    data = replace_bulk_ids(operation.data, replace)
+    if data is not operation.data:
+        updates["data"] = data
+
+    return operation.model_copy(update=updates) if updates else operation
 
 
 class BulkJob:
@@ -63,7 +79,7 @@ class BulkJob:
 
     def __init__(
         self,
-        operations: list[Any],
+        operations: list[BulkOperation],
         fail_on_errors: int | None,
         run: OperationRunner,
     ):
@@ -76,10 +92,12 @@ class BulkJob:
         self.errors = 0
 
         self.creations: dict[str, int] = {}
-        for index, payload in enumerate(operations):
-            bulk_id = raw_attribute(payload, "bulkId")
-            if raw_attribute(payload, "method") == "POST" and isinstance(bulk_id, str):
-                self.creations.setdefault(bulk_id, index)
+        for index, operation in enumerate(operations):
+            if (
+                operation.method == BulkOperation.Method.post
+                and operation.bulk_id is not None
+            ):
+                self.creations.setdefault(operation.bulk_id, index)
 
     @property
     def stopped(self) -> bool:
@@ -105,15 +123,15 @@ class BulkJob:
         if index in self.results or index in self.running or self.stopped:
             return
 
-        payload = self.operations[index]
+        operation = self.operations[index]
         self.running.add(index)
-        for bulk_id in self.references(payload):
+        for bulk_id in self.references(operation):
             if bulk_id in self.creations:
                 self.run_operation(self.creations[bulk_id])
 
         if not self.stopped:
             result, resource = self.run_resolved(
-                payload, lambda payload: self.resolve(index, payload)
+                operation, lambda operation: self.resolve(index, operation)
             )
             self.results[index] = result
             if result["status"] >= 400:
@@ -127,7 +145,7 @@ class BulkJob:
         return bulk_id is not None and self.creations.get(bulk_id) == index
 
     @staticmethod
-    def references(payload: Any) -> list[str]:
+    def references(operation: BulkOperation) -> list[str]:
         """Return the bulkIds an operation references."""
         bulk_ids: list[str] = []
 
@@ -135,23 +153,22 @@ class BulkJob:
             bulk_ids.append(bulk_id)
             return bulk_id
 
-        resolve_operation(payload, collect)
+        resolve_operation(operation, collect)
         return bulk_ids
 
-    def resolve(self, index: int, payload: Any) -> Any:
+    def resolve(self, index: int, operation: BulkOperation) -> BulkOperation:
         """Replace the bulkId references of an operation with the identifiers of the created resources.
 
         :raises Conflict: When a referenced resource was not created, as
             RFC 7644 §3.7.1 allows for circular references.
         """
-        bulk_id = raw_attribute(payload, "bulkId")
         if (
-            raw_attribute(payload, "method") == "POST"
-            and isinstance(bulk_id, str)
-            and not self.is_creation(index, bulk_id)
+            operation.method == BulkOperation.Method.post
+            and operation.bulk_id is not None
+            and not self.is_creation(index, operation.bulk_id)
         ):
             raise InvalidValueException(
-                detail=f"The bulkId {bulk_id} is not unique in the request"
+                detail=f"The bulkId {operation.bulk_id} is not unique in the request"
             )
 
         def replace(bulk_id: str) -> str:
@@ -161,4 +178,4 @@ class BulkJob:
                 raise Conflict(f"The bulkId {bulk_id} is part of a circular reference")
             raise Conflict(f"No resource was created with the bulkId {bulk_id}")
 
-        return resolve_operation(payload, replace)
+        return resolve_operation(operation, replace)

{scim2_server-0.3.0 → scim2_server-0.3.1}/scim2_server/provider.py

@@ -47,7 +47,6 @@ from werkzeug.routing.exceptions import RequestRedirect
 from scim2_server.backend import Backend
 from scim2_server.bulk import BulkJob
 from scim2_server.bulk import Resolver
-from scim2_server.bulk import raw_attribute
 from scim2_server.utils import load_default_service_provider_config
 
 SEARCH_REQUEST_PARAMETERS = (
@@ -251,7 +250,9 @@ class SCIMApplication:
         replacement = self.get_model(resource_type).model_validate(
             payload, scim_ctx=Context.RESOURCE_REPLACEMENT_REQUEST
         )
-        replacement.replace(resource)
+        # A PUT that changes nothing keeps meta.lastModified and the ETag.
+        if not replacement.replace(resource):
+            return resource
         return self.backend.update_resource(resource_type, replacement)
 
     def patch(
@@ -514,7 +515,10 @@ class SCIMApplication:
                 f"The payload exceeds the maxPayloadSize ({bulk.max_payload_size} bytes)"
             )
 
-        bulk_request, operations = self.read_bulk_request(request.json)
+        bulk_request = BulkRequest[Union[tuple(self.get_models())]].model_validate(  # noqa: UP007
+            request.json, scim_ctx=Context.BULK_REQUEST
+        )
+        operations = cast(list[BulkOperation], bulk_request.operations)
         if bulk.max_operations is not None and len(operations) > bulk.max_operations:
             raise RequestEntityTooLarge(
                 f"The number of operations exceeds the maxOperations ({bulk.max_operations})"
@@ -523,7 +527,9 @@ class SCIMApplication:
         results = BulkJob(
             operations,
             bulk_request.fail_on_errors,
-            lambda payload, resolve: self.run_bulk_operation(request, payload, resolve),
+            lambda operation, resolve: self.run_bulk_operation(
+                request, operation, resolve
+            ),
         ).run()
         return self.make_response(
             BulkResponse[Union[tuple(self.get_models())]](  # noqa: UP007
@@ -531,51 +537,38 @@ class SCIMApplication:
             ).model_dump(scim_ctx=Context.BULK_RESPONSE)
         )
 
-    def read_bulk_request(self, payload: Any) -> tuple[BulkRequest, list[Any]]:
-        """Validate the envelope of a bulk request, and return it with its raw operations.
-
-        Each operation is validated on its own, so an invalid operation only
-        fails itself (RFC 7644 §3.7.3).
-        """
-        key = (
-            next((key for key in payload if key.casefold() == "operations"), None)
-            if isinstance(payload, dict)
-            else None
-        )
-        operations = payload[key] if key else None
-        envelope = {**payload, key: []} if isinstance(operations, list) else payload
-        bulk_request = BulkRequest[Union[tuple(self.get_models())]].model_validate(  # noqa: UP007
-            envelope, scim_ctx=Context.BULK_REQUEST
-        )
-        return bulk_request, cast(list[Any], operations)
-
     def run_bulk_operation(
-        self, request: Request, payload: Any, resolve: Resolver
+        self, request: Request, operation: BulkOperation, resolve: Resolver
     ) -> tuple[dict[str, Any], Resource | None]:
         """Apply one operation of a bulk job.
 
+        An operation that failed its validation keeps its error, once its
+        references are resolved to locate it.
+
         :return: The outcome of the operation, and the resource it created or updated.
         """
-        method = raw_attribute(payload, "method")
-        bulk_id = raw_attribute(payload, "bulkId")
         result: dict[str, Any] = {
-            "method": method
-            if method in [member.value for member in BulkOperation.Method]
-            else None,
-            "bulk_id": bulk_id if isinstance(bulk_id, str) else None,
+            "method": operation.method,
+            "bulk_id": operation.bulk_id,
         }
 
         try:
-            payload = resolve(payload)
-            resource_type, resource_id = self.get_bulk_target(payload)
-            if resource_id:
+            operation = resolve(operation)
+            resource_type = self.get_resource_type_by_endpoint(operation.endpoint or "")
+            if resource_type is not None and operation.resource_id:
                 result["location"] = urljoin(
-                    request.url, f"{resource_type.endpoint.strip('/')}/{resource_id}"
+                    request.url,
+                    f"{resource_type.endpoint.strip('/')}/{operation.resource_id}",
                 )
-            operation = BulkOperation[self.get_model(resource_type)].model_validate(
-                payload, scim_ctx=Context.BULK_REQUEST
+            if isinstance(operation.response, Error):
+                return {
+                    **result,
+                    "status": operation.status,
+                    "response": operation.response,
+                }, None
+            resource = self.apply_bulk_operation(
+                cast(ResourceType, resource_type), operation
             )
-            resource = self.apply_bulk_operation(resource_type, resource_id, operation)
         except Exception as exception:
             error = self.error_from(exception)
             return {**result, "status": error.status, "response": error}, None
@@ -589,34 +582,15 @@ class SCIMApplication:
         result["version"] = resource.meta.version
         return result, resource
 
-    def get_bulk_target(self, payload: Any) -> tuple[ResourceType, str]:
-        """Return the resource type and the resource identifier of a bulk operation path.
-
-        :raises NotFound: When the path does not start with a resource type endpoint.
-        """
-        path = raw_attribute(payload, "path")
-        if not isinstance(path, str):
-            raise InvalidValueException(
-                detail="path is required for request operations"
-            )
-
-        endpoint, _, resource_id = path.lstrip("/").partition("/")
-        resource_type = self.get_resource_type_by_endpoint(endpoint)
-        if resource_type is None:
-            raise NotFound
-        return resource_type, resource_id
-
     def apply_bulk_operation(
-        self,
-        resource_type: ResourceType,
-        resource_id: str,
-        operation: BulkOperation,
+        self, resource_type: ResourceType, operation: BulkOperation
     ) -> Resource | None:
         """Apply a validated bulk operation, and return the resource it acted on.
 
         The data of the operation is already validated, and the resource
         operations take it as it is.
         """
+        resource_id = operation.resource_id
         if (operation.method == BulkOperation.Method.post) == bool(resource_id):
             raise InvalidValueException(
                 detail="A POST path must target a resource type endpoint, other methods a resource"