scim2-server 0.3.2__tar.gz → 0.3.3__tar.gz

{scim2_server-0.3.2 → scim2_server-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: scim2-server
-Version: 0.3.2
+Version: 0.3.3
 Summary: Lightweight SCIM2 server prototype
 Keywords: scim,scim2,provisioning,rfc7643,rfc7644
 Author: Yaal Coop, Christian Friedrich Coors

{scim2_server-0.3.2 → scim2_server-0.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.3.2"
+version = "0.3.3"
 description = "Lightweight SCIM2 server prototype"
 readme = "README.md"
 keywords = [

{scim2_server-0.3.2 → scim2_server-0.3.3}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.3.2"
+version = "0.3.3"
 description = "Lightweight SCIM2 server prototype"
 authors = [
     {name="Yaal Coop", email="contact@yaal.coop"},

{scim2_server-0.3.2 → scim2_server-0.3.3}/scim2_server/provider.py

@@ -36,6 +36,7 @@ from werkzeug import Response
 from werkzeug.datastructures import ETags
 from werkzeug.exceptions import Forbidden
 from werkzeug.exceptions import HTTPException
+from werkzeug.exceptions import MethodNotAllowed
 from werkzeug.exceptions import NotFound
 from werkzeug.exceptions import NotImplemented as WerkzeugNotImplemented
 from werkzeug.exceptions import PreconditionFailed
@@ -43,6 +44,7 @@ from werkzeug.exceptions import RequestEntityTooLarge
 from werkzeug.exceptions import Unauthorized
 from werkzeug.http import parse_etags
 from werkzeug.http import unquote_etag
+from werkzeug.routing import BaseConverter
 from werkzeug.routing import Map
 from werkzeug.routing import Rule
 from werkzeug.routing.exceptions import RequestRedirect
@@ -79,6 +81,20 @@ BULK_SUCCESS_STATUS = {
 }
 
 
+class ResourceEndpointConverter(BaseConverter):
+    """Match a resource endpoint, but not the endpoints RFC 7644 reserves nor the version prefix.
+
+    A request with a method a reserved endpoint does not support then gets a
+    405 answer, instead of being routed to a resource type of that name.
+    """
+
+    # A reserved name followed by the end of the path segment is refused.
+    regex = (
+        r"(?!(?:ServiceProviderConfig|ResourceTypes|Schemas|Bulk|Me|v2)(?![^/]))[^/]+"
+    )
+    part_isolating = True
+
+
 class SCIMApplication:
     """A WSGI application implementing a SCIM provider (server)."""
 
@@ -123,17 +139,17 @@ class SCIMApplication:
                     methods=("GET", "POST", "PUT", "PATCH", "DELETE"),
                 ),
                 Rule(
-                    f"{prefix}/<string:resource_endpoint>",
+                    f"{prefix}/<resource_endpoint:resource_endpoint>",
                     endpoint="resource",
                     methods=("GET", "POST"),
                 ),
                 Rule(
-                    f"{prefix}/<string:resource_endpoint>/.search",
+                    f"{prefix}/<resource_endpoint:resource_endpoint>/.search",
                     endpoint="resource_search",
                     methods=("POST",),
                 ),
                 Rule(
-                    f"{prefix}/<string:resource_endpoint>/<string:resource_id>",
+                    f"{prefix}/<resource_endpoint:resource_endpoint>/<string:resource_id>",
                     endpoint="single_resource",
                     methods=("GET", "PUT", "PATCH", "DELETE"),
                 ),
@@ -148,7 +164,9 @@ class SCIMApplication:
             for prefix in ("", "/v2")
         )
 
-        self.url_map = Map(rules)
+        self.url_map = Map(
+            rules, converters={"resource_endpoint": ResourceEndpointConverter}
+        )
 
     def get_model(self, resource_type: ResourceType) -> type[Resource[Any]]:
         """Return the model of a resource type, its extensions included."""
@@ -811,7 +829,11 @@ class SCIMApplication:
             self.log.exception(e)
             return e.get_response(environ)
         except Exception as e:
-            return self.make_error(self.error_from(e))
+            response = self.make_error(self.error_from(e))
+            if isinstance(e, MethodNotAllowed) and e.valid_methods:
+                # RFC 9110 §15.5.6: a 405 answer lists the supported methods.
+                response.headers["Allow"] = ", ".join(sorted(e.valid_methods))
+            return response
 
     def __call__(
         self, environ: "WSGIEnvironment", start_response: "StartResponse"