scim2-server 0.3.0__tar.gz → 0.3.2__tar.gz

{scim2_server-0.3.0 → scim2_server-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: scim2-server
-Version: 0.3.0
+Version: 0.3.2
 Summary: Lightweight SCIM2 server prototype
 Keywords: scim,scim2,provisioning,rfc7643,rfc7644
 Author: Yaal Coop, Christian Friedrich Coors
@@ -217,7 +217,7 @@ Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Environment :: Web Environment
 Classifier: Programming Language :: Python
 Classifier: Operating System :: OS Independent
-Requires-Dist: scim2-models>=0.9.0
+Requires-Dist: scim2-models>=0.10.0
 Requires-Dist: werkzeug>=3.0.3
 Requires-Python: >=3.11
 Project-URL: repository, https://github.com/python-scim/scim2-server
@@ -239,7 +239,7 @@ they are lost once the process exits.
 - [x] Unique Constraints
 - [x] HTTP PATCH (Add/Remove/Replace)
 - [x] Sorting
-- [x] Bulk operations ([RFC 7644, Section 3.7](https://datatracker.ietf.org/doc/html/rfc7644#section-3.7))
+- [x] Bulk operations
 
 ## Usage
 

{scim2_server-0.3.0 → scim2_server-0.3.2}/README.md

@@ -13,7 +13,7 @@ they are lost once the process exits.
 - [x] Unique Constraints
 - [x] HTTP PATCH (Add/Remove/Replace)
 - [x] Sorting
-- [x] Bulk operations ([RFC 7644, Section 3.7](https://datatracker.ietf.org/doc/html/rfc7644#section-3.7))
+- [x] Bulk operations
 
 ## Usage
 

{scim2_server-0.3.0 → scim2_server-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.3.0"
+version = "0.3.2"
 description = "Lightweight SCIM2 server prototype"
 readme = "README.md"
 keywords = [
@@ -29,7 +29,7 @@ classifiers = [
 ]
 requires-python = ">= 3.11"
 dependencies = [
-    "scim2-models>=0.9.0",
+    "scim2-models>=0.10.0",
     "werkzeug>=3.0.3",
 ]
 
@@ -59,6 +59,7 @@ dev = [
     "prek>=0.1.0",
     "time-machine>=2.14.2",
     "tox-uv>=1.16.0",
+    "mypy>=2.3.1",
 ]
 
 [tool.uv]
@@ -75,6 +76,15 @@ pytest-scim2-server = false
 [tool.uv.build-backend]
 module-root = ""
 
+[tool.mypy]
+plugins = ["pydantic.mypy"]
+files = ["scim2_server"]
+strict = true
+
+[tool.pydantic-mypy]
+init_forbid_extra = true
+init_typed = true
+
 [tool.coverage.run]
 source = [
     "scim2_server",
@@ -93,6 +103,7 @@ exclude_lines = [
     "@pytest.mark.xfail",
     "pragma: no cover",
     "raise NotImplementedError",
+    "if TYPE_CHECKING:",
     '\.\.\.\s*$',
 ]
 

{scim2_server-0.3.0 → scim2_server-0.3.2}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.3.0"
+version = "0.3.2"
 description = "Lightweight SCIM2 server prototype"
 authors = [
     {name="Yaal Coop", email="contact@yaal.coop"},
@@ -29,7 +29,7 @@ classifiers = [
 
 requires-python = ">= 3.11"
 dependencies = [
-    "scim2-models>=0.9.0",
+    "scim2-models>=0.10.0",
     "werkzeug>=3.0.3",
 ]
 
@@ -48,6 +48,7 @@ dev = [
     "prek>=0.1.0",
     "time-machine>=2.14.2",
     "tox-uv>=1.16.0",
+    "mypy>=2.3.1",
 ]
 
 [tool.uv]
@@ -57,6 +58,17 @@ exclude-newer-package = { scim2-models = false, scim2-client = false, scim2-serv
 [tool.uv.build-backend]
 module-root = ""
 
+[tool.mypy]
+plugins = [
+  "pydantic.mypy"
+]
+files = ["scim2_server"]
+strict = true
+
+[tool.pydantic-mypy]
+init_forbid_extra = true
+init_typed = true
+
 [tool.coverage.run]
 source = [
     "scim2_server",
@@ -71,6 +83,7 @@ exclude_lines = [
     "@pytest.mark.xfail",
     "pragma: no cover",
     "raise NotImplementedError",
+    "if TYPE_CHECKING:",
     "\\.\\.\\.\\s*$", # ignore ellipsis
 ]
 

{scim2_server-0.3.0 → scim2_server-0.3.2}/scim2_server/backend.py

@@ -1,16 +1,16 @@
-import dataclasses
 import datetime
 import pickle
 import uuid
-from inspect import isclass
 from threading import Lock
+from types import TracebackType
 from typing import Any
+from typing import Self
 from typing import Union
+from typing import cast
 
-from scim2_models import BaseModel
-from scim2_models import CaseExact
-from scim2_models import Extension
+from scim2_models import AttributeBinding
 from scim2_models import Meta
+from scim2_models import Path
 from scim2_models import Resource
 from scim2_models import ResourceType
 from scim2_models import ScimFilter
@@ -19,6 +19,8 @@ from scim2_models import Uniqueness
 from scim2_models import UniquenessException
 from werkzeug.http import generate_etag
 
+from scim2_server.utils import parametrize
+
 
 class Backend:
     """The base class for a SCIM provider backend.
@@ -27,22 +29,27 @@ class Backend:
     :class:`~scim2_models.ScimProvider` of the application.
     """
 
-    def __enter__(self):
+    def __enter__(self) -> Self:
         """Allow the backend to be used as a context manager.
 
         This enables support for transactions.
         """
         return self
 
-    def __exit__(self, exc_type, exc_val, exc_tb):
+    def __exit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
+    ) -> None:
         """Exit the transaction."""
         pass
 
     def query_resources(
         self,
-        search_request: SearchRequest,
+        search_request: SearchRequest[Any],
         resource_type: ResourceType | None = None,
-    ) -> tuple[int, list[Resource]]:
+    ) -> tuple[int, list[Resource[Any]]]:
         """Query the backend for a set of resources.
 
         :param search_request: SearchRequest instance describing the
@@ -61,7 +68,7 @@ class Backend:
 
     def get_resource(
         self, resource_type: ResourceType, object_id: str
-    ) -> Resource | None:
+    ) -> Resource[Any] | None:
         """Query the backend for a resources by its ID.
 
         :param resource_type: The resource type to get the object from.
@@ -83,8 +90,8 @@ class Backend:
         raise NotImplementedError
 
     def create_resource(
-        self, resource_type: ResourceType, resource: Resource
-    ) -> Resource | None:
+        self, resource_type: ResourceType, resource: Resource[Any]
+    ) -> Resource[Any]:
         """Create a resource.
 
         :param resource_type: The resource type to create.
@@ -96,15 +103,15 @@ class Backend:
         raise NotImplementedError
 
     def update_resource(
-        self, resource_type: ResourceType, resource: Resource
-    ) -> Resource | None:
+        self, resource_type: ResourceType, resource: Resource[Any]
+    ) -> Resource[Any] | None:
         """Update a resource. The resource is identified by its ID.
 
         :param resource_type: The resource type to update.
         :param resource: Resource to update.
-        :return: The updated resource. Updating should update the
-            "meta.lastModified" data. May be the same object that is
-            passed in.
+        :return: The updated resource, or None if no resource has its ID.
+            Updating should update the "meta.lastModified" data. May be
+            the same object that is passed in.
         """
         raise NotImplementedError
 
@@ -118,60 +125,12 @@ class InMemoryBackend(Backend):
     implementation simple.
     """
 
-    @dataclasses.dataclass(frozen=True)
-    class UniquenessDescriptor:
-        """Used to mimic uniqueness constraints e.g. from a SQL database."""
-
-        extension: str | None
-        field_name: str
-        case_exact: bool
-        schema: str
-
-        def is_declared_by(self, resource: Resource) -> bool:
-            """Tell whether the model of a resource holds the schema of the attribute."""
-            model = type(resource)
-            return self.schema == model.__schema__ or (
-                self.schema in model.get_extension_models()
-            )
-
-        def get_attribute(self, resource: Resource) -> Any:
-            holder = getattr(resource, self.extension) if self.extension else resource
-            value = getattr(holder, self.field_name, None) if holder else None
-            if isinstance(value, str) and not self.case_exact:
-                return value.casefold()
-            return value
-
-    @classmethod
-    def collect_unique_attrs(
-        cls, model: type[BaseModel], extension: str | None = None
-    ) -> list[UniquenessDescriptor]:
-        """Return the uniqueness constraints the annotations of a model declare.
-
-        The ``id`` is left out: the backend issues it, so it cannot clash.
-        """
-        descriptors = [
-            cls.UniquenessDescriptor(
-                extension,
-                field_name,
-                model.get_field_annotation(field_name, CaseExact) == CaseExact.true,
-                str(model.__schema__),
-            )
-            for field_name in model.model_fields
-            if field_name != "id"
-            and model.get_field_annotation(field_name, Uniqueness) != Uniqueness.none
-        ]
-        for field_name in model.model_fields:
-            root_type = model.get_field_root_type(field_name)
-            if isclass(root_type) and issubclass(root_type, Extension):
-                descriptors.extend(cls.collect_unique_attrs(root_type, field_name))
-        return descriptors
-
-    def __init__(self):
+    def __init__(self) -> None:
         super().__init__()
-        self.resources: list[Resource] = []
+        self.resources: list[Resource[Any]] = []
         self.lock: Lock = Lock()
 
-    def __enter__(self):
+    def __enter__(self) -> Self:
         """See super docs.
 
         The InMemoryBackend uses a simple Lock to synchronize all
@@ -181,15 +140,20 @@ class InMemoryBackend(Backend):
         self.lock.acquire()
         return self
 
-    def __exit__(self, exc_type, exc_val, exc_tb):
+    def __exit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
+    ) -> None:
         super().__exit__(exc_type, exc_val, exc_tb)
         self.lock.release()
 
     def query_resources(
         self,
-        search_request: SearchRequest,
+        search_request: SearchRequest[Any],
         resource_type: ResourceType | None = None,
-    ) -> tuple[int, list[Resource]]:
+    ) -> tuple[int, list[Resource[Any]]]:
         start_index = (search_request.start_index or 1) - 1
 
         candidates = [
@@ -201,7 +165,7 @@ class InMemoryBackend(Backend):
         scim_filter = search_request.filter
         if scim_filter is not None and not scim_filter.models and candidates:
             models = tuple(dict.fromkeys(type(r) for r in candidates))
-            scim_filter = ScimFilter[Union[models]](str(scim_filter))  # noqa: UP007
+            scim_filter = parametrize(ScimFilter, Union[models])(str(scim_filter))  # noqa: UP007
 
         found_resources = [
             r for r in candidates if scim_filter is None or scim_filter.match(r)
@@ -215,16 +179,17 @@ class InMemoryBackend(Backend):
             found_resources = found_resources[: search_request.count]
         return total_results, found_resources
 
-    def _is_of_type(self, resource: Resource, resource_type: ResourceType) -> bool:
+    def _is_of_type(self, resource: Resource[Any], resource_type: ResourceType) -> bool:
         """Tell whether a resource belongs to a resource type.
 
         RFC 7643 §3.1 has meta.resourceType carry the name of the resource type,
         which may differ from its id.
         """
+        assert resource.meta is not None
         return resource.meta.resource_type == resource_type.name
 
     def _get_resource_idx(
-        self, resource_type: ResourceType, object_id: str
+        self, resource_type: ResourceType, object_id: str | None
     ) -> int | None:
         return next(
             (
@@ -237,7 +202,7 @@ class InMemoryBackend(Backend):
 
     def get_resource(
         self, resource_type: ResourceType, object_id: str
-    ) -> Resource | None:
+    ) -> Resource[Any] | None:
         resource_dict_idx = self._get_resource_idx(resource_type, object_id)
         if resource_dict_idx is not None:
             return self.resources[resource_dict_idx].model_copy(deep=True)
@@ -255,11 +220,12 @@ class InMemoryBackend(Backend):
         return False
 
     def create_resource(
-        self, resource_type: ResourceType, resource: Resource
-    ) -> Resource | None:
+        self, resource_type: ResourceType, resource: Resource[Any]
+    ) -> Resource[Any]:
         resource = resource.model_copy(deep=True)
         resource.id = uuid.uuid4().hex
         utcnow = datetime.datetime.now(datetime.UTC)
+        assert resource_type.endpoint is not None
         resource.meta = Meta(
             resource_type=resource_type.name,
             created=utcnow,
@@ -271,39 +237,59 @@ class InMemoryBackend(Backend):
         self.resources.append(resource)
         return resource
 
-    def _check_uniqueness(self, resource: Resource):
+    def _check_uniqueness(self, resource: Resource[Any]) -> None:
         """Refuse a resource sharing a unique value with another one of the same schema.
 
         RFC 7643 erratum 8279 scopes the uniqueness to the resources using the
         schema that declares the attribute, whatever their resource type. A
         missing value never clashes, as a SQL NULL does not.
         """
-        for unique_attribute in self.collect_unique_attrs(type(resource)):
-            value = unique_attribute.get_attribute(resource)
+        unique_paths = parametrize(Path, type(resource)).iter_paths(
+            include_subattributes=False,
+            uniqueness=[Uniqueness.server, Uniqueness.global_],
+        )
+        for path in unique_paths:
+            attribute = cast(AttributeBinding, path.resolve())
+            value = self._unique_value(resource, attribute)
             if value is None:
                 continue
             for existing_resource in self.resources:
                 if (
-                    unique_attribute.is_declared_by(existing_resource)
-                    and existing_resource.id != resource.id
-                    and unique_attribute.get_attribute(existing_resource) == value
+                    existing_resource.id != resource.id
+                    and self._unique_value(existing_resource, attribute) == value
                 ):
                     raise UniquenessException()
 
     @staticmethod
-    def _touch_resource(resource: Resource, last_modified: datetime.datetime):
+    def _unique_value(resource: Resource[Any], attribute: AttributeBinding) -> Any:
+        """Return the value a resource holds for a unique attribute, in the form it is compared in.
+
+        A resource whose schemas do not declare the attribute holds no value.
+        """
+        value = parametrize(Path, type(resource))(attribute.urn).get(
+            resource, strict=False
+        )
+        if isinstance(value, str) and not attribute.case_exact:
+            return value.casefold()
+        return value
+
+    @staticmethod
+    def _touch_resource(
+        resource: Resource[Any], last_modified: datetime.datetime
+    ) -> None:
         """Touches a resource (updates last_modified and version).
 
         Version is generated by hashing last_modified. Another option
         would be to hash the entire resource instead.
         """
+        assert resource.meta is not None
         resource.meta.last_modified = last_modified
         etag = generate_etag(pickle.dumps(resource.meta.last_modified))
         resource.meta.version = f'W/"{etag}"'
 
     def update_resource(
-        self, resource_type: ResourceType, resource: Resource
-    ) -> Resource | None:
+        self, resource_type: ResourceType, resource: Resource[Any]
+    ) -> Resource[Any] | None:
         found_res_idx = self._get_resource_idx(resource_type, resource.id)
         if found_res_idx is not None:
             updated_resource = type(resource).model_validate(resource.model_dump())

{scim2_server-0.3.0 → scim2_server-0.3.2}/scim2_server/bulk.py

@@ -1,55 +1,72 @@
 from collections.abc import Callable
 from typing import Any
 
+from pydantic import BaseModel
+from scim2_models import BulkOperation
 from scim2_models import InvalidValueException
 from scim2_models import Resource
 from werkzeug.exceptions import Conflict
 
 BULK_ID_PREFIX = "bulkId:"
 
-Resolver = Callable[[Any], Any]
-"""Replaces the bulkId references of a raw operation."""
+Resolver = Callable[[BulkOperation[Resource[Any]]], BulkOperation[Resource[Any]]]
+"""Replaces the bulkId references of an operation."""
 
-OperationRunner = Callable[[Any, Resolver], tuple[dict[str, Any], Resource | None]]
-"""Applies a raw operation once resolved, and returns its outcome and the resource it acted on."""
-
-
-def raw_attribute(payload: Any, name: str) -> Any:
-    """Return an attribute of a raw payload, whose names are case insensitive."""
-    if not isinstance(payload, dict):
-        return None
-    return next(
-        (value for key, value in payload.items() if key.casefold() == name.casefold()),
-        None,
-    )
+OperationRunner = Callable[
+    [BulkOperation[Resource[Any]], Resolver],
+    tuple[dict[str, Any], Resource[Any] | None],
+]
+"""Applies an operation once resolved, and returns its outcome and the resource it acted on."""
 
 
 def replace_bulk_ids(value: Any, replace: Callable[[str], str]) -> Any:
-    """Replace every "bulkId:" reference of a raw value."""
+    """Replace every "bulkId:" reference of a value.
+
+    A value without reference is returned as it is. Models are copied with
+    only the changed fields, so the fields the client set stay the same.
+    """
     if isinstance(value, str) and value.startswith(BULK_ID_PREFIX):
         return replace(value.removeprefix(BULK_ID_PREFIX))
+
     if isinstance(value, list):
-        return [replace_bulk_ids(item, replace) for item in value]
+        items = [replace_bulk_ids(item, replace) for item in value]
+        changed = any(new is not old for new, old in zip(items, value, strict=True))
+        return items if changed else value
+
     if isinstance(value, dict):
-        return {key: replace_bulk_ids(item, replace) for key, item in value.items()}
+        entries = {key: replace_bulk_ids(item, replace) for key, item in value.items()}
+        changed = any(entries[key] is not item for key, item in value.items())
+        return entries if changed else value
+
+    if isinstance(value, BaseModel):
+        updates = {}
+        for name in type(value).model_fields:
+            field = getattr(value, name)
+            replaced = replace_bulk_ids(field, replace)
+            if replaced is not field:
+                updates[name] = replaced
+        return value.model_copy(update=updates) if updates else value
+
     return value
 
 
-def resolve_operation(payload: Any, replace: Callable[[str], str]) -> Any:
-    """Replace the "bulkId:" references of the path and the data of a raw bulk operation."""
-    if not isinstance(payload, dict):
-        return payload
+def resolve_operation(
+    operation: BulkOperation[Resource[Any]], replace: Callable[[str], str]
+) -> BulkOperation[Resource[Any]]:
+    """Replace the "bulkId:" references of the path and the data of a bulk operation."""
+    updates: dict[str, Any] = {}
+    if operation.path is not None:
+        path = "/".join(
+            replace_bulk_ids(segment, replace) for segment in operation.path.split("/")
+        )
+        if path != operation.path:
+            updates["path"] = path
 
-    resolved = {}
-    for key, value in payload.items():
-        if key.casefold() == "path" and isinstance(value, str):
-            value = "/".join(
-                replace_bulk_ids(segment, replace) for segment in value.split("/")
-            )
-        elif key.casefold() == "data":
-            value = replace_bulk_ids(value, replace)
-        resolved[key] = value
-    return resolved
+    data = replace_bulk_ids(operation.data, replace)
+    if data is not operation.data:
+        updates["data"] = data
+
+    return operation.model_copy(update=updates) if updates else operation
 
 
 class BulkJob:
@@ -63,7 +80,7 @@ class BulkJob:
 
     def __init__(
         self,
-        operations: list[Any],
+        operations: list[BulkOperation[Resource[Any]]],
         fail_on_errors: int | None,
         run: OperationRunner,
     ):
@@ -71,15 +88,17 @@ class BulkJob:
         self.operations = operations
         self.fail_on_errors = fail_on_errors
         self.results: dict[int, dict[str, Any]] = {}
-        self.created: dict[str, Resource] = {}
+        self.created: dict[str, Resource[Any]] = {}
         self.running: set[int] = set()
         self.errors = 0
 
         self.creations: dict[str, int] = {}
-        for index, payload in enumerate(operations):
-            bulk_id = raw_attribute(payload, "bulkId")
-            if raw_attribute(payload, "method") == "POST" and isinstance(bulk_id, str):
-                self.creations.setdefault(bulk_id, index)
+        for index, operation in enumerate(operations):
+            if (
+                operation.method == BulkOperation.Method.post
+                and operation.bulk_id is not None
+            ):
+                self.creations.setdefault(operation.bulk_id, index)
 
     @property
     def stopped(self) -> bool:
@@ -105,15 +124,15 @@ class BulkJob:
         if index in self.results or index in self.running or self.stopped:
             return
 
-        payload = self.operations[index]
+        operation = self.operations[index]
         self.running.add(index)
-        for bulk_id in self.references(payload):
+        for bulk_id in self.references(operation):
             if bulk_id in self.creations:
                 self.run_operation(self.creations[bulk_id])
 
         if not self.stopped:
             result, resource = self.run_resolved(
-                payload, lambda payload: self.resolve(index, payload)
+                operation, lambda operation: self.resolve(index, operation)
             )
             self.results[index] = result
             if result["status"] >= 400:
@@ -127,7 +146,7 @@ class BulkJob:
         return bulk_id is not None and self.creations.get(bulk_id) == index
 
     @staticmethod
-    def references(payload: Any) -> list[str]:
+    def references(operation: BulkOperation[Resource[Any]]) -> list[str]:
         """Return the bulkIds an operation references."""
         bulk_ids: list[str] = []
 
@@ -135,23 +154,24 @@ class BulkJob:
             bulk_ids.append(bulk_id)
             return bulk_id
 
-        resolve_operation(payload, collect)
+        resolve_operation(operation, collect)
         return bulk_ids
 
-    def resolve(self, index: int, payload: Any) -> Any:
+    def resolve(
+        self, index: int, operation: BulkOperation[Resource[Any]]
+    ) -> BulkOperation[Resource[Any]]:
         """Replace the bulkId references of an operation with the identifiers of the created resources.
 
         :raises Conflict: When a referenced resource was not created, as
             RFC 7644 §3.7.1 allows for circular references.
         """
-        bulk_id = raw_attribute(payload, "bulkId")
         if (
-            raw_attribute(payload, "method") == "POST"
-            and isinstance(bulk_id, str)
-            and not self.is_creation(index, bulk_id)
+            operation.method == BulkOperation.Method.post
+            and operation.bulk_id is not None
+            and not self.is_creation(index, operation.bulk_id)
         ):
             raise InvalidValueException(
-                detail=f"The bulkId {bulk_id} is not unique in the request"
+                detail=f"The bulkId {operation.bulk_id} is not unique in the request"
             )
 
         def replace(bulk_id: str) -> str:
@@ -161,4 +181,4 @@ class BulkJob:
                 raise Conflict(f"The bulkId {bulk_id} is part of a circular reference")
             raise Conflict(f"No resource was created with the bulkId {bulk_id}")
 
-        return resolve_operation(payload, replace)
+        return resolve_operation(operation, replace)