scim2-server 0.3.1__tar.gz → 0.3.3__tar.gz

{scim2_server-0.3.1 → scim2_server-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: scim2-server
-Version: 0.3.1
+Version: 0.3.3
 Summary: Lightweight SCIM2 server prototype
 Keywords: scim,scim2,provisioning,rfc7643,rfc7644
 Author: Yaal Coop, Christian Friedrich Coors

{scim2_server-0.3.1 → scim2_server-0.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.3.1"
+version = "0.3.3"
 description = "Lightweight SCIM2 server prototype"
 readme = "README.md"
 keywords = [
@@ -59,6 +59,7 @@ dev = [
     "prek>=0.1.0",
     "time-machine>=2.14.2",
     "tox-uv>=1.16.0",
+    "mypy>=2.3.1",
 ]
 
 [tool.uv]
@@ -75,6 +76,15 @@ pytest-scim2-server = false
 [tool.uv.build-backend]
 module-root = ""
 
+[tool.mypy]
+plugins = ["pydantic.mypy"]
+files = ["scim2_server"]
+strict = true
+
+[tool.pydantic-mypy]
+init_forbid_extra = true
+init_typed = true
+
 [tool.coverage.run]
 source = [
     "scim2_server",
@@ -93,6 +103,7 @@ exclude_lines = [
     "@pytest.mark.xfail",
     "pragma: no cover",
     "raise NotImplementedError",
+    "if TYPE_CHECKING:",
     '\.\.\.\s*$',
 ]
 

{scim2_server-0.3.1 → scim2_server-0.3.3}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.3.1"
+version = "0.3.3"
 description = "Lightweight SCIM2 server prototype"
 authors = [
     {name="Yaal Coop", email="contact@yaal.coop"},
@@ -48,6 +48,7 @@ dev = [
     "prek>=0.1.0",
     "time-machine>=2.14.2",
     "tox-uv>=1.16.0",
+    "mypy>=2.3.1",
 ]
 
 [tool.uv]
@@ -57,6 +58,17 @@ exclude-newer-package = { scim2-models = false, scim2-client = false, scim2-serv
 [tool.uv.build-backend]
 module-root = ""
 
+[tool.mypy]
+plugins = [
+  "pydantic.mypy"
+]
+files = ["scim2_server"]
+strict = true
+
+[tool.pydantic-mypy]
+init_forbid_extra = true
+init_typed = true
+
 [tool.coverage.run]
 source = [
     "scim2_server",
@@ -71,6 +83,7 @@ exclude_lines = [
     "@pytest.mark.xfail",
     "pragma: no cover",
     "raise NotImplementedError",
+    "if TYPE_CHECKING:",
     "\\.\\.\\.\\s*$", # ignore ellipsis
 ]
 

{scim2_server-0.3.1 → scim2_server-0.3.3}/scim2_server/backend.py

@@ -2,7 +2,9 @@ import datetime
 import pickle
 import uuid
 from threading import Lock
+from types import TracebackType
 from typing import Any
+from typing import Self
 from typing import Union
 from typing import cast
 
@@ -17,6 +19,8 @@ from scim2_models import Uniqueness
 from scim2_models import UniquenessException
 from werkzeug.http import generate_etag
 
+from scim2_server.utils import parametrize
+
 
 class Backend:
     """The base class for a SCIM provider backend.
@@ -25,22 +29,27 @@ class Backend:
     :class:`~scim2_models.ScimProvider` of the application.
     """
 
-    def __enter__(self):
+    def __enter__(self) -> Self:
         """Allow the backend to be used as a context manager.
 
         This enables support for transactions.
         """
         return self
 
-    def __exit__(self, exc_type, exc_val, exc_tb):
+    def __exit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
+    ) -> None:
         """Exit the transaction."""
         pass
 
     def query_resources(
         self,
-        search_request: SearchRequest,
+        search_request: SearchRequest[Any],
         resource_type: ResourceType | None = None,
-    ) -> tuple[int, list[Resource]]:
+    ) -> tuple[int, list[Resource[Any]]]:
         """Query the backend for a set of resources.
 
         :param search_request: SearchRequest instance describing the
@@ -59,7 +68,7 @@ class Backend:
 
     def get_resource(
         self, resource_type: ResourceType, object_id: str
-    ) -> Resource | None:
+    ) -> Resource[Any] | None:
         """Query the backend for a resources by its ID.
 
         :param resource_type: The resource type to get the object from.
@@ -81,8 +90,8 @@ class Backend:
         raise NotImplementedError
 
     def create_resource(
-        self, resource_type: ResourceType, resource: Resource
-    ) -> Resource | None:
+        self, resource_type: ResourceType, resource: Resource[Any]
+    ) -> Resource[Any]:
         """Create a resource.
 
         :param resource_type: The resource type to create.
@@ -94,15 +103,15 @@ class Backend:
         raise NotImplementedError
 
     def update_resource(
-        self, resource_type: ResourceType, resource: Resource
-    ) -> Resource | None:
+        self, resource_type: ResourceType, resource: Resource[Any]
+    ) -> Resource[Any] | None:
         """Update a resource. The resource is identified by its ID.
 
         :param resource_type: The resource type to update.
         :param resource: Resource to update.
-        :return: The updated resource. Updating should update the
-            "meta.lastModified" data. May be the same object that is
-            passed in.
+        :return: The updated resource, or None if no resource has its ID.
+            Updating should update the "meta.lastModified" data. May be
+            the same object that is passed in.
         """
         raise NotImplementedError
 
@@ -116,12 +125,12 @@ class InMemoryBackend(Backend):
     implementation simple.
     """
 
-    def __init__(self):
+    def __init__(self) -> None:
         super().__init__()
-        self.resources: list[Resource] = []
+        self.resources: list[Resource[Any]] = []
         self.lock: Lock = Lock()
 
-    def __enter__(self):
+    def __enter__(self) -> Self:
         """See super docs.
 
         The InMemoryBackend uses a simple Lock to synchronize all
@@ -131,15 +140,20 @@ class InMemoryBackend(Backend):
         self.lock.acquire()
         return self
 
-    def __exit__(self, exc_type, exc_val, exc_tb):
+    def __exit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
+    ) -> None:
         super().__exit__(exc_type, exc_val, exc_tb)
         self.lock.release()
 
     def query_resources(
         self,
-        search_request: SearchRequest,
+        search_request: SearchRequest[Any],
         resource_type: ResourceType | None = None,
-    ) -> tuple[int, list[Resource]]:
+    ) -> tuple[int, list[Resource[Any]]]:
         start_index = (search_request.start_index or 1) - 1
 
         candidates = [
@@ -151,7 +165,7 @@ class InMemoryBackend(Backend):
         scim_filter = search_request.filter
         if scim_filter is not None and not scim_filter.models and candidates:
             models = tuple(dict.fromkeys(type(r) for r in candidates))
-            scim_filter = ScimFilter[Union[models]](str(scim_filter))  # noqa: UP007
+            scim_filter = parametrize(ScimFilter, Union[models])(str(scim_filter))  # noqa: UP007
 
         found_resources = [
             r for r in candidates if scim_filter is None or scim_filter.match(r)
@@ -165,16 +179,17 @@ class InMemoryBackend(Backend):
             found_resources = found_resources[: search_request.count]
         return total_results, found_resources
 
-    def _is_of_type(self, resource: Resource, resource_type: ResourceType) -> bool:
+    def _is_of_type(self, resource: Resource[Any], resource_type: ResourceType) -> bool:
         """Tell whether a resource belongs to a resource type.
 
         RFC 7643 §3.1 has meta.resourceType carry the name of the resource type,
         which may differ from its id.
         """
+        assert resource.meta is not None
         return resource.meta.resource_type == resource_type.name
 
     def _get_resource_idx(
-        self, resource_type: ResourceType, object_id: str
+        self, resource_type: ResourceType, object_id: str | None
     ) -> int | None:
         return next(
             (
@@ -187,7 +202,7 @@ class InMemoryBackend(Backend):
 
     def get_resource(
         self, resource_type: ResourceType, object_id: str
-    ) -> Resource | None:
+    ) -> Resource[Any] | None:
         resource_dict_idx = self._get_resource_idx(resource_type, object_id)
         if resource_dict_idx is not None:
             return self.resources[resource_dict_idx].model_copy(deep=True)
@@ -205,11 +220,12 @@ class InMemoryBackend(Backend):
         return False
 
     def create_resource(
-        self, resource_type: ResourceType, resource: Resource
-    ) -> Resource | None:
+        self, resource_type: ResourceType, resource: Resource[Any]
+    ) -> Resource[Any]:
         resource = resource.model_copy(deep=True)
         resource.id = uuid.uuid4().hex
         utcnow = datetime.datetime.now(datetime.UTC)
+        assert resource_type.endpoint is not None
         resource.meta = Meta(
             resource_type=resource_type.name,
             created=utcnow,
@@ -221,14 +237,14 @@ class InMemoryBackend(Backend):
         self.resources.append(resource)
         return resource
 
-    def _check_uniqueness(self, resource: Resource):
+    def _check_uniqueness(self, resource: Resource[Any]) -> None:
         """Refuse a resource sharing a unique value with another one of the same schema.
 
         RFC 7643 erratum 8279 scopes the uniqueness to the resources using the
         schema that declares the attribute, whatever their resource type. A
         missing value never clashes, as a SQL NULL does not.
         """
-        unique_paths = Path[type(resource)].iter_paths(
+        unique_paths = parametrize(Path, type(resource)).iter_paths(
             include_subattributes=False,
             uniqueness=[Uniqueness.server, Uniqueness.global_],
         )
@@ -245,30 +261,35 @@ class InMemoryBackend(Backend):
                     raise UniquenessException()
 
     @staticmethod
-    def _unique_value(resource: Resource, attribute: AttributeBinding) -> Any:
+    def _unique_value(resource: Resource[Any], attribute: AttributeBinding) -> Any:
         """Return the value a resource holds for a unique attribute, in the form it is compared in.
 
         A resource whose schemas do not declare the attribute holds no value.
         """
-        value = Path[type(resource)](attribute.urn).get(resource, strict=False)
+        value = parametrize(Path, type(resource))(attribute.urn).get(
+            resource, strict=False
+        )
         if isinstance(value, str) and not attribute.case_exact:
             return value.casefold()
         return value
 
     @staticmethod
-    def _touch_resource(resource: Resource, last_modified: datetime.datetime):
+    def _touch_resource(
+        resource: Resource[Any], last_modified: datetime.datetime
+    ) -> None:
         """Touches a resource (updates last_modified and version).
 
         Version is generated by hashing last_modified. Another option
         would be to hash the entire resource instead.
         """
+        assert resource.meta is not None
         resource.meta.last_modified = last_modified
         etag = generate_etag(pickle.dumps(resource.meta.last_modified))
         resource.meta.version = f'W/"{etag}"'
 
     def update_resource(
-        self, resource_type: ResourceType, resource: Resource
-    ) -> Resource | None:
+        self, resource_type: ResourceType, resource: Resource[Any]
+    ) -> Resource[Any] | None:
         found_res_idx = self._get_resource_idx(resource_type, resource.id)
         if found_res_idx is not None:
             updated_resource = type(resource).model_validate(resource.model_dump())

{scim2_server-0.3.1 → scim2_server-0.3.3}/scim2_server/bulk.py

@@ -9,11 +9,12 @@ from werkzeug.exceptions import Conflict
 
 BULK_ID_PREFIX = "bulkId:"
 
-Resolver = Callable[[BulkOperation], BulkOperation]
+Resolver = Callable[[BulkOperation[Resource[Any]]], BulkOperation[Resource[Any]]]
 """Replaces the bulkId references of an operation."""
 
 OperationRunner = Callable[
-    [BulkOperation, Resolver], tuple[dict[str, Any], Resource | None]
+    [BulkOperation[Resource[Any]], Resolver],
+    tuple[dict[str, Any], Resource[Any] | None],
 ]
 """Applies an operation once resolved, and returns its outcome and the resource it acted on."""
 
@@ -50,8 +51,8 @@ def replace_bulk_ids(value: Any, replace: Callable[[str], str]) -> Any:
 
 
 def resolve_operation(
-    operation: BulkOperation, replace: Callable[[str], str]
-) -> BulkOperation:
+    operation: BulkOperation[Resource[Any]], replace: Callable[[str], str]
+) -> BulkOperation[Resource[Any]]:
     """Replace the "bulkId:" references of the path and the data of a bulk operation."""
     updates: dict[str, Any] = {}
     if operation.path is not None:
@@ -79,7 +80,7 @@ class BulkJob:
 
     def __init__(
         self,
-        operations: list[BulkOperation],
+        operations: list[BulkOperation[Resource[Any]]],
         fail_on_errors: int | None,
         run: OperationRunner,
     ):
@@ -87,7 +88,7 @@ class BulkJob:
         self.operations = operations
         self.fail_on_errors = fail_on_errors
         self.results: dict[int, dict[str, Any]] = {}
-        self.created: dict[str, Resource] = {}
+        self.created: dict[str, Resource[Any]] = {}
         self.running: set[int] = set()
         self.errors = 0
 
@@ -145,7 +146,7 @@ class BulkJob:
         return bulk_id is not None and self.creations.get(bulk_id) == index
 
     @staticmethod
-    def references(operation: BulkOperation) -> list[str]:
+    def references(operation: BulkOperation[Resource[Any]]) -> list[str]:
         """Return the bulkIds an operation references."""
         bulk_ids: list[str] = []
 
@@ -156,7 +157,9 @@ class BulkJob:
         resolve_operation(operation, collect)
         return bulk_ids
 
-    def resolve(self, index: int, operation: BulkOperation) -> BulkOperation:
+    def resolve(
+        self, index: int, operation: BulkOperation[Resource[Any]]
+    ) -> BulkOperation[Resource[Any]]:
         """Replace the bulkId references of an operation with the identifiers of the created resources.
 
         :raises Conflict: When a referenced resource was not created, as

{scim2_server-0.3.1 → scim2_server-0.3.3}/scim2_server/cli.py

@@ -2,8 +2,12 @@ import argparse
 import json
 import logging
 import pprint
+from collections.abc import Iterable
+from typing import TYPE_CHECKING
 
 from scim2_models import AuthenticationScheme
+from scim2_models import External
+from scim2_models import Reference
 from scim2_models import ResourceType
 from scim2_models import Schema
 from scim2_models import ScimProvider
@@ -16,25 +20,32 @@ from scim2_server.utils import load_default_resource_types
 from scim2_server.utils import load_default_schemas
 from scim2_server.utils import load_default_service_provider_config
 
+if TYPE_CHECKING:
+    from _typeshed.wsgi import StartResponse
+    from _typeshed.wsgi import WSGIApplication
+    from _typeshed.wsgi import WSGIEnvironment
+
 BEARER_TOKEN_SCHEME = AuthenticationScheme(
-    type="oauthbearertoken",
+    type=AuthenticationScheme.Type.oauthbearertoken,
     name="bearer_token",
     description="HTTP Bearer Token",
-    spec_uri="https://datatracker.ietf.org/doc/html/rfc6750",
+    spec_uri=Reference[External]("https://datatracker.ietf.org/doc/html/rfc6750"),
 )
 
 
-def log_environ(handler):
+def log_environ(handler: "WSGIApplication") -> "WSGIApplication":
     """Build a simple decorator to log all WSGI environment variables."""
 
-    def _inner(environ, start_fn):
+    def _inner(
+        environ: "WSGIEnvironment", start_fn: "StartResponse"
+    ) -> Iterable[bytes]:
         logging.getLogger("log_environ").debug(pprint.pformat(environ))
         return handler(environ, start_fn)
 
     return _inner
 
 
-def main():
+def main() -> None:
     parser = argparse.ArgumentParser()
     parser.add_argument(
         "--schema", type=argparse.FileType("r"), help="Schema definitions"
@@ -71,12 +82,14 @@ def main():
 
     from werkzeug.serving import run_simple
 
+    schemas: Iterable[Schema]
     if args.schema is None:
         schemas = load_default_schemas().values()
     else:
         with args.schema:
             schemas = [Schema.model_validate(sc) for sc in json.load(args.schema)]
 
+    resource_types: Iterable[ResourceType]
     if args.resource_type is None:
         resource_types = load_default_resource_types().values()
     else:
@@ -108,17 +121,21 @@ def main():
         for bearer_token in args.bearer_token:
             app.register_bearer_token(bearer_token)
 
+    wsgi_app: WSGIApplication = app
     if args.debug:
-        app = log_environ(app)
+        wsgi_app = log_environ(wsgi_app)
     if args.reverse_proxy:
-        app = ProxyFix(app, x_for=1, x_proto=1, x_host=1, x_port=1, x_prefix=1)
+        wsgi_app = ProxyFix(
+            wsgi_app, x_for=1, x_proto=1, x_host=1, x_port=1, x_prefix=1
+        )
 
     run_simple(
         args.hostname,
         args.port,
-        app,
+        wsgi_app,
         use_debugger=args.debug,
         use_reloader=args.debug,
+        threaded=True,
     )
 
     if args.dump_resources:

{scim2_server-0.3.1 → scim2_server-0.3.3}/scim2_server/provider.py

@@ -1,7 +1,10 @@
 import itertools
 import json
 import logging
+from collections.abc import Iterable
+from typing import TYPE_CHECKING
 from typing import Any
+from typing import TypeVar
 from typing import Union
 from typing import cast
 from urllib.parse import urljoin
@@ -33,6 +36,7 @@ from werkzeug import Response
 from werkzeug.datastructures import ETags
 from werkzeug.exceptions import Forbidden
 from werkzeug.exceptions import HTTPException
+from werkzeug.exceptions import MethodNotAllowed
 from werkzeug.exceptions import NotFound
 from werkzeug.exceptions import NotImplemented as WerkzeugNotImplemented
 from werkzeug.exceptions import PreconditionFailed
@@ -40,6 +44,7 @@ from werkzeug.exceptions import RequestEntityTooLarge
 from werkzeug.exceptions import Unauthorized
 from werkzeug.http import parse_etags
 from werkzeug.http import unquote_etag
+from werkzeug.routing import BaseConverter
 from werkzeug.routing import Map
 from werkzeug.routing import Rule
 from werkzeug.routing.exceptions import RequestRedirect
@@ -48,6 +53,11 @@ from scim2_server.backend import Backend
 from scim2_server.bulk import BulkJob
 from scim2_server.bulk import Resolver
 from scim2_server.utils import load_default_service_provider_config
+from scim2_server.utils import parametrize
+
+if TYPE_CHECKING:
+    from _typeshed.wsgi import StartResponse
+    from _typeshed.wsgi import WSGIEnvironment
 
 SEARCH_REQUEST_PARAMETERS = (
     "attributes",
@@ -59,6 +69,10 @@ SEARCH_REQUEST_PARAMETERS = (
     "count",
 )
 
+DiscoveryResourceT = TypeVar(
+    "DiscoveryResourceT", ResourceType, Schema, ServiceProviderConfig
+)
+
 BULK_SUCCESS_STATUS = {
     BulkOperation.Method.post: 201,
     BulkOperation.Method.put: 200,
@@ -67,11 +81,25 @@ BULK_SUCCESS_STATUS = {
 }
 
 
+class ResourceEndpointConverter(BaseConverter):
+    """Match a resource endpoint, but not the endpoints RFC 7644 reserves nor the version prefix.
+
+    A request with a method a reserved endpoint does not support then gets a
+    405 answer, instead of being routed to a resource type of that name.
+    """
+
+    # A reserved name followed by the end of the path segment is refused.
+    regex = (
+        r"(?!(?:ServiceProviderConfig|ResourceTypes|Schemas|Bulk|Me|v2)(?![^/]))[^/]+"
+    )
+    part_isolating = True
+
+
 class SCIMApplication:
     """A WSGI application implementing a SCIM provider (server)."""
 
     def __init__(self, backend: Backend, provider: ScimProvider):
-        self.bearer_tokens = set()
+        self.bearer_tokens: set[str] = set()
         self.backend = backend
         self.provider = provider
         self.config = provider.config or load_default_service_provider_config()
@@ -111,17 +139,17 @@ class SCIMApplication:
                     methods=("GET", "POST", "PUT", "PATCH", "DELETE"),
                 ),
                 Rule(
-                    f"{prefix}/<string:resource_endpoint>",
+                    f"{prefix}/<resource_endpoint:resource_endpoint>",
                     endpoint="resource",
                     methods=("GET", "POST"),
                 ),
                 Rule(
-                    f"{prefix}/<string:resource_endpoint>/.search",
+                    f"{prefix}/<resource_endpoint:resource_endpoint>/.search",
                     endpoint="resource_search",
                     methods=("POST",),
                 ),
                 Rule(
-                    f"{prefix}/<string:resource_endpoint>/<string:resource_id>",
+                    f"{prefix}/<resource_endpoint:resource_endpoint>/<string:resource_id>",
                     endpoint="single_resource",
                     methods=("GET", "PUT", "PATCH", "DELETE"),
                 ),
@@ -136,13 +164,15 @@ class SCIMApplication:
             for prefix in ("", "/v2")
         )
 
-        self.url_map = Map(rules)
+        self.url_map = Map(
+            rules, converters={"resource_endpoint": ResourceEndpointConverter}
+        )
 
-    def get_model(self, resource_type: ResourceType) -> type[Resource]:
+    def get_model(self, resource_type: ResourceType) -> type[Resource[Any]]:
         """Return the model of a resource type, its extensions included."""
-        return cast(type[Resource], self.provider.model_for(resource_type))
+        return cast(type[Resource[Any]], self.provider.model_for(resource_type))
 
-    def get_models(self) -> list[type[Resource]]:
+    def get_models(self) -> list[type[Resource[Any]]]:
         """Return the models of every resource type."""
         return [self.get_model(rt) for rt in self.provider.resource_types]
 
@@ -152,7 +182,7 @@ class SCIMApplication:
             (
                 resource_type
                 for resource_type in self.provider.resource_types
-                if resource_type.endpoint.lstrip("/").casefold()
+                if (resource_type.endpoint or "").lstrip("/").casefold()
                 == endpoint.lstrip("/").casefold()
             ),
             None,
@@ -163,12 +193,13 @@ class SCIMApplication:
         """Whether the configuration declares the resources versioned with ETags."""
         return bool(self.config.etag and self.config.etag.supported)
 
-    def publish(self, request: Request, resource: Resource) -> Resource:
+    def publish(self, request: Request, resource: Resource[Any]) -> Resource[Any]:
         """Return a copy of a resource in the form sent to the client.
 
         Its location is made absolute from the URL the client requested, and
         its version is left out when the service does not support ETags.
         """
+        assert resource.meta is not None
         update: dict[str, Any] = {
             "location": urljoin(request.url + "/", resource.meta.location)
         }
@@ -179,13 +210,14 @@ class SCIMApplication:
         )
 
     @staticmethod
-    def etag_header(resource: Resource) -> dict[str, str]:
+    def etag_header(resource: Resource[Any]) -> dict[str, str]:
         """Return the ETag header of a published resource, if it has a version."""
+        assert resource.meta is not None
         return {"ETag": resource.meta.version} if resource.meta.version else {}
 
     def check_preconditions(
         self,
-        resource: Resource,
+        resource: Resource[Any],
         method: str,
         if_match: ETags | None = None,
         if_none_match: ETags | None = None,
@@ -199,11 +231,13 @@ class SCIMApplication:
         :return: :data:`False` when a GET should answer 304 Not Modified.
         :raises PreconditionFailed: When the method must not be performed.
         """
+        assert resource.meta is not None
         # A service that does not support ETags has no tag to match: RFC 7232
         # §3.1 fails an If-Match listing tags, and lets "*" pass.
         version, _ = (
             unquote_etag(resource.meta.version) if self.etag_supported else (None, None)
         )
+        version = version or ""
         # RFC 7232 §3.1 compares If-Match strongly, which would never match
         # the weak ETags RFC 7644 §3.14 recommends and sends in its example.
         if if_match and not if_match.contains_weak(version):
@@ -218,7 +252,7 @@ class SCIMApplication:
 
     def get_existing_resource(
         self, resource_type: ResourceType, resource_id: str
-    ) -> Resource:
+    ) -> Resource[Any]:
         """Return a stored resource.
 
         :raises NotFound: When no resource of this type has this identifier.
@@ -228,7 +262,7 @@ class SCIMApplication:
             raise NotFound
         return resource
 
-    def create(self, resource_type: ResourceType, payload: Any) -> Resource:
+    def create(self, resource_type: ResourceType, payload: Any) -> Resource[Any]:
         """Validate a creation payload and store the new resource."""
         resource = self.get_model(resource_type).model_validate(
             payload, scim_ctx=Context.RESOURCE_CREATION_REQUEST
@@ -242,7 +276,7 @@ class SCIMApplication:
         payload: Any,
         if_match: ETags | None = None,
         if_none_match: ETags | None = None,
-    ) -> Resource:
+    ) -> Resource[Any]:
         """Replace a stored resource with a payload and return the stored result."""
         resource = self.get_existing_resource(resource_type, resource_id)
         self.check_preconditions(resource, "PUT", if_match, if_none_match)
@@ -253,7 +287,7 @@ class SCIMApplication:
         # A PUT that changes nothing keeps meta.lastModified and the ETag.
         if not replacement.replace(resource):
             return resource
-        return self.backend.update_resource(resource_type, replacement)
+        return self.update(resource_type, replacement)
 
     def patch(
         self,
@@ -262,17 +296,31 @@ class SCIMApplication:
         payload: Any,
         if_match: ETags | None = None,
         if_none_match: ETags | None = None,
-    ) -> Resource:
+    ) -> Resource[Any]:
         """Apply a PATCH payload to a stored resource and return the stored result."""
         self.ensure_supported(self.config.patch, "PATCH")
-        patch_operation = PatchOp[self.get_model(resource_type)].model_validate(payload)
+        patch_operation = parametrize(
+            PatchOp, self.get_model(resource_type)
+        ).model_validate(payload)
         resource = self.get_existing_resource(resource_type, resource_id)
         self.check_preconditions(resource, "PATCH", if_match, if_none_match)
 
         # A PATCH that changes nothing keeps meta.lastModified and the ETag.
         if not patch_operation.patch(resource):
             return resource
-        return self.backend.update_resource(resource_type, resource)
+        return self.update(resource_type, resource)
+
+    def update(
+        self, resource_type: ResourceType, resource: Resource[Any]
+    ) -> Resource[Any]:
+        """Store an updated resource and return the stored result.
+
+        :raises NotFound: When the backend no longer has the resource.
+        """
+        updated = self.backend.update_resource(resource_type, resource)
+        if updated is None:
+            raise NotFound
+        return updated
 
     def delete(
         self,
@@ -287,7 +335,7 @@ class SCIMApplication:
         self.backend.delete_resource(resource_type, resource_id)
 
     def call_single_resource(
-        self, request: Request, resource_endpoint: str, resource_id: str, **kwargs
+        self, request: Request, resource_endpoint: str, resource_id: str, **kwargs: Any
     ) -> Response:
         resource_type = self.get_resource_type_by_endpoint(resource_endpoint)
         if not resource_type:
@@ -369,10 +417,10 @@ class SCIMApplication:
 
     @staticmethod
     def get_response_parameters(
-        request: Request, model: type[Resource]
-    ) -> ResponseParameters:
+        request: Request, model: type[Resource[Any]]
+    ) -> ResponseParameters[Any]:
         """Parse the "attributes" and "excludedAttributes" HTTP request parameters."""
-        return ResponseParameters[model].model_validate(
+        return parametrize(ResponseParameters, model).model_validate(
             {
                 key: request.args[key]
                 for key in ("attributes", "excludedAttributes")
@@ -381,8 +429,8 @@ class SCIMApplication:
         )
 
     def build_search_request(
-        self, request: Request, models: list[type[Resource]]
-    ) -> SearchRequest:
+        self, request: Request, models: list[type[Resource[Any]]]
+    ) -> SearchRequest[Any]:
         """Construct a SearchRequest object from a werkzeug request.
 
         :param request: werkzeug request
@@ -410,9 +458,10 @@ class SCIMApplication:
         if parameters & {"sortby", "sortorder"}:
             self.ensure_supported(self.config.sort, "Sorting")
 
-        search_request = SearchRequest[Union[tuple(models)]].model_validate(  # noqa: UP007
-            payload, scim_ctx=Context.SEARCH_REQUEST
-        )
+        search_request = parametrize(
+            SearchRequest,
+            Union[tuple(models)],  # noqa: UP007
+        ).model_validate(payload, scim_ctx=Context.SEARCH_REQUEST)
         search_request.start_index = search_request.start_index or 1
         max_results = self.config.filter.max_results if self.config.filter else None
         if max_results is not None and (
@@ -421,7 +470,9 @@ class SCIMApplication:
             search_request.count = max_results
         return search_request
 
-    def query_resource(self, request: Request, resource: ResourceType | None):
+    def query_resource(
+        self, request: Request, resource: ResourceType | None
+    ) -> ListResponse[Resource[Any]]:
         models = self.get_models() if resource is None else [self.get_model(resource)]
         search_request = self.build_search_request(request, models)
 
@@ -438,7 +489,7 @@ class SCIMApplication:
             for s in results
         ]
 
-        return ListResponse[Union[tuple(self.get_models())]](  # noqa: UP007
+        return parametrize(ListResponse, Union[tuple(self.get_models())])(  # noqa: UP007
             total_results=total_results,
             items_per_page=len(resources),
             start_index=search_request.start_index,
@@ -446,7 +497,7 @@ class SCIMApplication:
         )
 
     def call_resource(
-        self, request: Request, resource_endpoint: str, **kwargs
+        self, request: Request, resource_endpoint: str, **kwargs: Any
     ) -> Response:
         resource_type = self.get_resource_type_by_endpoint(resource_endpoint)
         if not resource_type:
@@ -463,6 +514,7 @@ class SCIMApplication:
                 created_resource = self.publish(
                     request, self.create(resource_type, request.json)
                 )
+                assert created_resource.meta is not None
                 return self.make_response(
                     created_resource.model_dump(
                         scim_ctx=Context.RESOURCE_CREATION_RESPONSE
@@ -471,7 +523,7 @@ class SCIMApplication:
                     headers={"Location": created_resource.meta.location},
                 )
 
-    def call_query_all(self, request: Request, **kwargs) -> Response:
+    def call_query_all(self, request: Request, **kwargs: Any) -> Response:
         return self.make_response(
             self.query_resource(request, None).model_dump(
                 scim_ctx=Context.RESOURCE_QUERY_RESPONSE,
@@ -479,7 +531,7 @@ class SCIMApplication:
         )
 
     def call_resource_search(
-        self, request: Request, resource_endpoint: str, **kwargs
+        self, request: Request, resource_endpoint: str, **kwargs: Any
     ) -> Response:
         resource_type = self.get_resource_type_by_endpoint(resource_endpoint)
         if not resource_type:
@@ -493,7 +545,7 @@ class SCIMApplication:
     @staticmethod
     def ensure_supported(
         capability: Patch | Bulk | Filter | Sort | None, operation: str
-    ):
+    ) -> None:
         """Refuse with a 501 an operation the configuration does not declare supported.
 
         RFC 7644 §3.12 answers 501 when the service provider does not support
@@ -502,23 +554,38 @@ class SCIMApplication:
         if capability is None or not capability.supported:
             raise WerkzeugNotImplemented(f"{operation} is not supported")
 
-    def call_bulk(self, request: Request, **kwargs) -> Response:
+    @staticmethod
+    def ensure_payload_size(request: Request, max_payload_size: int) -> None:
+        """Refuse with a 413 a payload larger than max_payload_size, without reading more than that.
+
+        :raises RequestEntityTooLarge: When the payload is too large.
+        """
+        # Werkzeug refuses a Content-Length above the limit, but silently cuts a
+        # streamed body at the limit. One extra byte tells a cut body apart.
+        request.max_content_length = max_payload_size + 1
+        try:
+            too_large = len(request.get_data()) > max_payload_size
+        except RequestEntityTooLarge:
+            too_large = True
+
+        if too_large:
+            raise RequestEntityTooLarge(
+                f"The payload exceeds the maxPayloadSize ({max_payload_size} bytes)"
+            )
+
+    def call_bulk(self, request: Request, **kwargs: Any) -> Response:
         """Implement the /Bulk endpoint (RFC 7644 §3.7)."""
         self.ensure_supported(self.config.bulk, "Bulk")
         bulk = cast(Bulk, self.config.bulk)
 
-        if (
-            bulk.max_payload_size is not None
-            and len(request.get_data()) > bulk.max_payload_size
-        ):
-            raise RequestEntityTooLarge(
-                f"The payload exceeds the maxPayloadSize ({bulk.max_payload_size} bytes)"
-            )
+        if bulk.max_payload_size is not None:
+            self.ensure_payload_size(request, bulk.max_payload_size)
 
-        bulk_request = BulkRequest[Union[tuple(self.get_models())]].model_validate(  # noqa: UP007
-            request.json, scim_ctx=Context.BULK_REQUEST
-        )
-        operations = cast(list[BulkOperation], bulk_request.operations)
+        bulk_request = parametrize(
+            BulkRequest,
+            Union[tuple(self.get_models())],  # noqa: UP007
+        ).model_validate(request.json, scim_ctx=Context.BULK_REQUEST)
+        operations = cast(list[BulkOperation[Resource[Any]]], bulk_request.operations)
         if bulk.max_operations is not None and len(operations) > bulk.max_operations:
             raise RequestEntityTooLarge(
                 f"The number of operations exceeds the maxOperations ({bulk.max_operations})"
@@ -532,14 +599,17 @@ class SCIMApplication:
             ),
         ).run()
         return self.make_response(
-            BulkResponse[Union[tuple(self.get_models())]](  # noqa: UP007
-                operations=results
-            ).model_dump(scim_ctx=Context.BULK_RESPONSE)
+            parametrize(BulkResponse, Union[tuple(self.get_models())])  # noqa: UP007
+            .model_validate({"operations": results})
+            .model_dump(scim_ctx=Context.BULK_RESPONSE)
         )
 
     def run_bulk_operation(
-        self, request: Request, operation: BulkOperation, resolve: Resolver
-    ) -> tuple[dict[str, Any], Resource | None]:
+        self,
+        request: Request,
+        operation: BulkOperation[Resource[Any]],
+        resolve: Resolver,
+    ) -> tuple[dict[str, Any], Resource[Any] | None]:
         """Apply one operation of a bulk job.
 
         An operation that failed its validation keeps its error, once its
@@ -556,6 +626,7 @@ class SCIMApplication:
             operation = resolve(operation)
             resource_type = self.get_resource_type_by_endpoint(operation.endpoint or "")
             if resource_type is not None and operation.resource_id:
+                assert resource_type.endpoint is not None
                 result["location"] = urljoin(
                     request.url,
                     f"{resource_type.endpoint.strip('/')}/{operation.resource_id}",
@@ -573,18 +644,20 @@ class SCIMApplication:
             error = self.error_from(exception)
             return {**result, "status": error.status, "response": error}, None
 
+        assert operation.method is not None
         result["status"] = BULK_SUCCESS_STATUS[operation.method]
         if resource is None:
             return result, None
 
         resource = self.publish(request, resource)
+        assert resource.meta is not None
         result["location"] = resource.meta.location
         result["version"] = resource.meta.version
         return result, resource
 
     def apply_bulk_operation(
-        self, resource_type: ResourceType, operation: BulkOperation
-    ) -> Resource | None:
+        self, resource_type: ResourceType, operation: BulkOperation[Resource[Any]]
+    ) -> Resource[Any] | None:
         """Apply a validated bulk operation, and return the resource it acted on.
 
         The data of the operation is already validated, and the resource
@@ -596,10 +669,11 @@ class SCIMApplication:
                 detail="A POST path must target a resource type endpoint, other methods a resource"
             )
 
+        if operation.method == BulkOperation.Method.post or resource_id is None:
+            return self.create(resource_type, operation.data)
+
         if_match = parse_etags(operation.version) if operation.version else None
         match operation.method:
-            case BulkOperation.Method.post:
-                return self.create(resource_type, operation.data)
             case BulkOperation.Method.put:
                 return self.replace(
                     resource_type, resource_id, operation.data, if_match
@@ -610,7 +684,7 @@ class SCIMApplication:
                 self.delete(resource_type, resource_id, if_match)
                 return None
 
-    def call_me(self, request: Request, **kwargs):
+    def call_me(self, request: Request, **kwargs: Any) -> Response:
         """Implement the /Me endpoint.
 
         RFC 7644, Section 3.11 allows raising a 501 (Not Implemented) if
@@ -618,14 +692,14 @@ class SCIMApplication:
         """
         raise WerkzeugNotImplemented
 
-    def register_bearer_token(self, token: str):
+    def register_bearer_token(self, token: str) -> None:
         """Register a static bearer token for authentication.
 
         :param token: Bearer token
         """
         self.bearer_tokens.add(token)
 
-    def check_auth(self, request: Request):
+    def check_auth(self, request: Request) -> None:
         """Check the authorization headers."""
         if not self.bearer_tokens:
             return
@@ -636,7 +710,7 @@ class SCIMApplication:
             raise Unauthorized
 
     @staticmethod
-    def make_response(content, status=200, **kwargs) -> Response:
+    def make_response(content: Any, status: int = 200, **kwargs: Any) -> Response:
         """Construct a werkzeug response from any JSON-serializable content."""
         etag = None
         if content is not None:
@@ -667,17 +741,17 @@ class SCIMApplication:
             case _:
                 return Error(status=500, detail="Internal server error")
 
-    def make_error(self, error: Error):
+    def make_error(self, error: Error) -> Response:
         """Construct a werkzeug response from a SCIM Error."""
-        return self.make_response(error.model_dump(), status=int(error.status))
+        return self.make_response(error.model_dump(), status=int(error.status or 500))
 
     @staticmethod
-    def forbid_filter(request: Request):
+    def forbid_filter(request: Request) -> None:
         """RFC 7644, Section 4: "If a "filter" is provided, the service provider SHOULD respond with HTTP status code 403 (Forbidden)"."""
         if "filter" in request.args:
             raise Forbidden
 
-    def call_service_provider_config(self, request: Request, **kwargs):
+    def call_service_provider_config(self, request: Request, **kwargs: Any) -> Response:
         """Return the ServiceProviderConfig."""
         self.forbid_filter(request)
         return self.make_response(
@@ -685,12 +759,14 @@ class SCIMApplication:
         )
 
     @staticmethod
-    def locate(resource: ResourceType | Schema | ServiceProviderConfig, location: str):
+    def locate(resource: DiscoveryResourceT, location: str) -> DiscoveryResourceT:
         """Return a copy of a discovery resource carrying its meta."""
         meta = Meta(resource_type=type(resource).__name__, location=location)
         return resource.model_copy(update={"meta": meta})
 
-    def call_resource_type(self, request: Request, resource_type: str, **kwargs):
+    def call_resource_type(
+        self, request: Request, resource_type: str, **kwargs: Any
+    ) -> Response:
         """Return a single resource type."""
         self.forbid_filter(request)
         for res in self.provider.resource_types:
@@ -700,7 +776,7 @@ class SCIMApplication:
                 )
         raise NotFound
 
-    def call_schema(self, request: Request, schema_id: str):
+    def call_schema(self, request: Request, schema_id: str) -> Response:
         """Return a single schema."""
         self.forbid_filter(request)
         for res in self.provider.schemas:
@@ -710,7 +786,7 @@ class SCIMApplication:
                 )
         raise NotFound
 
-    def call_resource_types(self, request: Request, **kwargs):
+    def call_resource_types(self, request: Request, **kwargs: Any) -> Response:
         """Return a ListResponse of all known resource types."""
         self.forbid_filter(request)
         results = self.provider.resource_types
@@ -722,7 +798,7 @@ class SCIMApplication:
         ).model_dump()
         return self.make_response(resp)
 
-    def call_schemas(self, request: Request, **kwargs):
+    def call_schemas(self, request: Request, **kwargs: Any) -> Response:
         """Return a ListResponse of all known schemas."""
         self.forbid_filter(request)
         results = self.provider.schemas
@@ -734,7 +810,7 @@ class SCIMApplication:
         ).model_dump()
         return self.make_response(resp)
 
-    def wsgi_app(self, request: Request, environ):
+    def wsgi_app(self, request: Request, environ: "WSGIEnvironment") -> Response:
         try:
             urls = self.url_map.bind_to_environ(environ)
             endpoint, args = urls.match()
@@ -746,16 +822,22 @@ class SCIMApplication:
             # Wrap the entire call in a transaction. Should probably be optimized (use transaction only when necessary).
             # The provider makes its policy the one every payload is read under.
             with self.provider, self.backend:
-                response = getattr(self, f"call_{endpoint}")(request, **args)
+                response: Response = getattr(self, f"call_{endpoint}")(request, **args)
             return response
         except RequestRedirect as e:
             # urls.match may cause a redirect, handle it as a special case of HTTPException
             self.log.exception(e)
             return e.get_response(environ)
         except Exception as e:
-            return self.make_error(self.error_from(e))
+            response = self.make_error(self.error_from(e))
+            if isinstance(e, MethodNotAllowed) and e.valid_methods:
+                # RFC 9110 §15.5.6: a 405 answer lists the supported methods.
+                response.headers["Allow"] = ", ".join(sorted(e.valid_methods))
+            return response
 
-    def __call__(self, environ, start_response):
+    def __call__(
+        self, environ: "WSGIEnvironment", start_response: "StartResponse"
+    ) -> Iterable[bytes]:
         """Return the actual WSGI server implementation."""
         if environ.get("PATH_INFO", "").endswith(".scim"):
             # RFC 7644, Section 3.8

{scim2_server-0.3.1 → scim2_server-0.3.3}/scim2_server/utils.py

@@ -1,6 +1,8 @@
 import importlib.resources
 import json
 from typing import Any
+from typing import TypeVar
+from typing import cast
 
 from scim2_models import Resource
 from scim2_models import ResourceType
@@ -8,20 +10,29 @@ from scim2_models import Schema
 from scim2_models import ScimProvider
 from scim2_models import ServiceProviderConfig
 
+GenericT = TypeVar("GenericT")
+ResourceT = TypeVar("ResourceT", bound=Resource[Any])
+
+
+def parametrize(generic: type[GenericT], parameter: Any) -> type[GenericT]:
+    """Parametrize a generic class with a type only known at runtime."""
+    return cast("type[GenericT]", cast(Any, generic)[parameter])
+
 
 def load_json_resource(json_name: str) -> Any:
     """Load a JSON document from the scim2_server package resources."""
     fp = importlib.resources.files("scim2_server") / "resources" / json_name
-    with open(fp) as f:
+    with fp.open() as f:
         return json.load(f)
 
 
-def load_scim_resource(json_name: str, type_: type[Resource]):
+def load_scim_resource(json_name: str, type_: type[ResourceT]) -> dict[str, ResourceT]:
     """Load and validates a JSON document from the scim2_server package resources."""
     ret = {}
     definitions = load_json_resource(json_name)
     for d in definitions:
         model = type_.model_validate(d)
+        assert model.id is not None
         ret[model.id] = model
     return ret