scim2-server 0.6.2__tar.gz → 0.7.1__tar.gz

{scim2_server-0.6.2 → scim2_server-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: scim2-server
-Version: 0.6.2
+Version: 0.7.1
 Summary: SCIM server core for any storage and web framework
 Keywords: scim,scim2,provisioning,rfc7643,rfc7644
 Author: Yaal Coop, Christian Friedrich Coors
@@ -217,11 +217,13 @@ Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Environment :: Web Environment
 Classifier: Programming Language :: Python
 Classifier: Operating System :: OS Independent
-Requires-Dist: scim2-models>=0.10.6
+Requires-Dist: scim2-models>=0.12.1
+Requires-Dist: precis-i18n>=1.1.2 ; extra == 'precis'
 Requires-Dist: pytest>=9.1.1 ; extra == 'testing'
 Requires-Python: >=3.11
 Project-URL: repository, https://github.com/python-scim/scim2-server
 Project-URL: funding, https://github.com/sponsors/python-scim
+Provides-Extra: precis
 Provides-Extra: testing
 Description-Content-Type: text/markdown
 

{scim2_server-0.6.2 → scim2_server-0.7.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.6.2"
+version = "0.7.1"
 description = "SCIM server core for any storage and web framework"
 readme = "README.md"
 keywords = [
@@ -28,7 +28,7 @@ classifiers = [
     "Operating System :: OS Independent",
 ]
 requires-python = ">= 3.11"
-dependencies = ["scim2-models>=0.10.6"]
+dependencies = ["scim2-models>=0.12.1"]
 
 [[project.authors]]
 name = "Yaal Coop"
@@ -43,6 +43,7 @@ file = "LICENSE"
 
 [project.optional-dependencies]
 testing = ["pytest>=9.1.1"]
+precis = ["precis-i18n>=1.1.2"]
 
 [project.urls]
 repository = "https://github.com/python-scim/scim2-server"
@@ -60,8 +61,9 @@ dev = [
     "time-machine>=2.14.2",
     "tox-uv>=1.16.0",
     "aiosqlite>=0.22.1",
+    "precis-i18n>=1.1.2",
     "mypy>=2.3.1",
-    "scim2-client[werkzeug]>=0.11.2",
+    "scim2-client>=0.12.0",
     "scim2-tester>=0.5.1",
     "werkzeug>=3.0.3",
 ]

{scim2_server-0.6.2 → scim2_server-0.7.1}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.6.2"
+version = "0.7.1"
 description = "SCIM server core for any storage and web framework"
 authors = [
     {name="Yaal Coop", email="contact@yaal.coop"},
@@ -29,13 +29,16 @@ classifiers = [
 
 requires-python = ">= 3.11"
 dependencies = [
-    "scim2-models>=0.10.6",
+    "scim2-models>=0.12.1",
 ]
 
 [project.optional-dependencies]
 testing = [
     "pytest>=9.1.1",
 ]
+precis = [
+    "precis-i18n>=1.1.2",
+]
 
 [project.urls]
 repository = "https://github.com/python-scim/scim2-server"
@@ -53,8 +56,9 @@ dev = [
     "time-machine>=2.14.2",
     "tox-uv>=1.16.0",
     "aiosqlite>=0.22.1",
+    "precis-i18n>=1.1.2",
     "mypy>=2.3.1",
-    "scim2-client[werkzeug]>=0.11.2",
+    "scim2-client>=0.12.0",
     "scim2-tester>=0.5.1",
     "werkzeug>=3.0.3",
 ]

{scim2_server-0.6.2 → scim2_server-0.7.1}/scim2_server/handler.py

@@ -15,6 +15,7 @@ from scim2_server.routing import Operation
 from scim2_server.service import ScimService
 from scim2_server.storage import AsyncScimStorage
 from scim2_server.storage import ScimStorage
+from scim2_server.storage import projection
 
 
 class ScimHandler:
@@ -75,7 +76,9 @@ class ScimHandler:
             )
             with self.storage.operation():
                 resource = self.storage.get(
-                    resource_type, cast(str, target.resource_id)
+                    resource_type,
+                    cast(str, target.resource_id),
+                    **projection(self.storage, response_parameters),
                 )
             response = self.service.query_response(
                 request.base_url,
@@ -398,7 +401,9 @@ class AsyncScimHandler:
             )
             async with self.storage.operation():
                 resource = await self.storage.get(
-                    resource_type, cast(str, target.resource_id)
+                    resource_type,
+                    cast(str, target.resource_id),
+                    **projection(self.storage, response_parameters),
                 )
             response = self.service.query_response(
                 request.base_url,

{scim2_server-0.6.2 → scim2_server-0.7.1}/scim2_server/memory.py

@@ -16,6 +16,7 @@ from scim2_models import Path
 from scim2_models import PreconditionFailedException
 from scim2_models import Resource
 from scim2_models import ResourceType
+from scim2_models import ResponseParameters
 from scim2_models import ScimFilter
 from scim2_models import SearchRequest
 from scim2_models import Uniqueness
@@ -23,6 +24,7 @@ from scim2_models import UniquenessException
 
 from scim2_server.storage import AsyncScimStorage
 from scim2_server.storage import ScimStorage
+from scim2_server.storage import projection
 from scim2_server.utils import parametrize
 
 
@@ -68,7 +70,13 @@ class InMemoryStorage(ScimStorage):
         with self.lock:
             yield
 
-    def get(self, resource_type: ResourceType, resource_id: str) -> Resource[Any]:
+    def get(
+        self,
+        resource_type: ResourceType,
+        resource_id: str,
+        *,
+        response_parameters: ResponseParameters[Any] | None = None,
+    ) -> Resource[Any]:
         with self.lock:
             return self.resources[self._index(resource_type, resource_id)].model_copy(
                 deep=True
@@ -203,13 +211,16 @@ class InMemoryStorage(ScimStorage):
         """Return the value a resource holds for a unique attribute, in the form it is compared in.
 
         A resource whose schemas do not declare the attribute holds no value.
+        A string the policy cannot compare is equal to no other value, so it
+        is held as missing too.
         """
         value = parametrize(Path, type(resource))(attribute.urn).get(
             resource, strict=False
         )
-        if isinstance(value, str) and not attribute.case_exact:
-            return value.casefold()
-        return value
+        try:
+            return attribute.comparable(value)
+        except ValueError:
+            return None
 
 
 class AsyncInMemoryStorage(AsyncScimStorage):
@@ -233,8 +244,18 @@ class AsyncInMemoryStorage(AsyncScimStorage):
         """The stored resources."""
         return self.storage.resources
 
-    async def get(self, resource_type: ResourceType, resource_id: str) -> Resource[Any]:
-        return self.storage.get(resource_type, resource_id)
+    async def get(
+        self,
+        resource_type: ResourceType,
+        resource_id: str,
+        *,
+        response_parameters: ResponseParameters[Any] | None = None,
+    ) -> Resource[Any]:
+        return self.storage.get(
+            resource_type,
+            resource_id,
+            **projection(self.storage, response_parameters),
+        )
 
     async def search(
         self, resource_types: list[ResourceType], search_request: SearchRequest[Any]

{scim2_server-0.6.2 → scim2_server-0.7.1}/scim2_server/resources/default-service-provider-config.json

@@ -22,6 +22,5 @@
     },
     "etag": {
         "supported": true
-    },
-    "authenticationSchemes": []
+    }
 }

{scim2_server-0.6.2 → scim2_server-0.7.1}/scim2_server/service.py

@@ -122,7 +122,6 @@ def patch_only_config() -> ServiceProviderConfig:
         change_password=ChangePassword(supported=False),
         sort=Sort(supported=False),
         etag=ETag(supported=False),
-        authentication_schemes=[],
     )
 
 

{scim2_server-0.6.2 → scim2_server-0.7.1}/scim2_server/storage.py

@@ -1,3 +1,5 @@
+import inspect
+import warnings
 from abc import ABC
 from abc import abstractmethod
 from contextlib import AbstractAsyncContextManager
@@ -7,9 +9,39 @@ from typing import Any
 
 from scim2_models import Resource
 from scim2_models import ResourceType
+from scim2_models import ResponseParameters
 from scim2_models import SearchRequest
 
 
+def takes_response_parameters(storage_class: type) -> bool:
+    """Tell whether the ``get`` method of a storage accepts ``response_parameters``, and warn when it does not."""
+    parameters = inspect.signature(storage_class.get).parameters.values()  # type: ignore[attr-defined]
+    if any(
+        parameter.name == "response_parameters"
+        or parameter.kind is inspect.Parameter.VAR_KEYWORD
+        for parameter in parameters
+    ):
+        return True
+    warnings.warn(
+        f"{storage_class.__qualname__}.get should accept a response_parameters "
+        "keyword argument. scim2-server 0.9 will require it.",
+        DeprecationWarning,
+        # takes_response_parameters, __init_subclass__, ABCMeta.__new__, then the class statement
+        stacklevel=4,
+    )
+    return False
+
+
+def projection(
+    storage: "ScimStorage | AsyncScimStorage",
+    response_parameters: ResponseParameters[Any] | None,
+) -> dict[str, Any]:
+    """Return the arguments that pass the response parameters to the get method of a storage, if it accepts them."""
+    if not storage._get_takes_response_parameters:
+        return {}
+    return {"response_parameters": response_parameters}
+
+
 class ScimStorage(ABC):
     """Where a SCIM server reads and writes its resources.
 
@@ -40,10 +72,35 @@ class ScimStorage(ABC):
       calling the storage.
     """
 
+    _get_takes_response_parameters = True
+
+    def __init_subclass__(cls, **kwargs: Any) -> None:
+        super().__init_subclass__(**kwargs)
+        cls._get_takes_response_parameters = takes_response_parameters(cls)
+
     @abstractmethod
-    def get(self, resource_type: ResourceType, resource_id: str) -> Resource[Any]:
+    def get(
+        self,
+        resource_type: ResourceType,
+        resource_id: str,
+        *,
+        response_parameters: ResponseParameters[Any] | None = None,
+    ) -> Resource[Any]:
         """Return a resource.
 
+        The server passes ``response_parameters`` when it returns the resource
+        to the client, for a GET request. The storage may then leave out the
+        attributes the response does not keep, for instance to avoid loading
+        the members of a group. It must return every attribute the response
+        keeps. :meth:`Path.iter_paths <scim2_models.Path.iter_paths>` gives
+        them. The server applies the parameters to the response anyway.
+        Without ``response_parameters``, the storage returns the whole
+        resource.
+
+        A ``get`` method without ``response_parameters`` is deprecated, and
+        raises a :class:`DeprecationWarning`. The server then does not pass
+        the parameters. scim2-server 0.9 will require it.
+
         :raises ~scim2_models.NotFoundException: When no resource of this type
             has this identifier.
         """
@@ -135,8 +192,20 @@ class AsyncScimStorage(ABC):
     which :class:`~scim2_server.testing.AsyncScimStorageContract` checks.
     """
 
+    _get_takes_response_parameters = True
+
+    def __init_subclass__(cls, **kwargs: Any) -> None:
+        super().__init_subclass__(**kwargs)
+        cls._get_takes_response_parameters = takes_response_parameters(cls)
+
     @abstractmethod
-    async def get(self, resource_type: ResourceType, resource_id: str) -> Resource[Any]:
+    async def get(
+        self,
+        resource_type: ResourceType,
+        resource_id: str,
+        *,
+        response_parameters: ResponseParameters[Any] | None = None,
+    ) -> Resource[Any]:
         """Return a resource. See :meth:`ScimStorage.get`."""
 
     @abstractmethod

{scim2_server-0.6.2 → scim2_server-0.7.1}/scim2_server/testing.py

@@ -29,16 +29,19 @@ from typing import Union
 from typing import cast
 
 import pytest
+from scim2_models import Context
 from scim2_models import NotFoundException
 from scim2_models import PreconditionFailedException
 from scim2_models import Resource
 from scim2_models import ResourceType
+from scim2_models import ResponseParameters
 from scim2_models import ScimProvider
 from scim2_models import SearchRequest
 from scim2_models import UniquenessException
 
 from scim2_server.storage import AsyncScimStorage
 from scim2_server.storage import ScimStorage
+from scim2_server.storage import projection
 from scim2_server.utils import load_default_provider
 from scim2_server.utils import parametrize
 
@@ -198,6 +201,52 @@ class ScimStorageContract:
         with pytest.raises(NotFoundException):
             storage.get(group_type, user.id)
 
+    @pytest.mark.parametrize(
+        "parameters",
+        [
+            {"excludedAttributes": "members"},
+            {"excludedAttributes": "members.display"},
+            {"attributes": "displayName"},
+            {"attributes": "members.value"},
+        ],
+    )
+    def test_get_keeps_what_the_response_returns(
+        self,
+        storage: Any,
+        user_type: ResourceType,
+        group_type: ResourceType,
+        user_model: Any,
+        group_model: Any,
+        parameters: dict[str, str],
+    ) -> None:
+        """A resource read with response parameters gives the same response as the whole resource."""
+        (user,) = self.create_users(storage, user_type, user_model, "bjensen")
+        group = storage.create(
+            group_type,
+            group_model.model_validate(
+                {
+                    "displayName": "Admins",
+                    "members": [{"value": user.id, "display": "bjensen"}],
+                }
+            ),
+        )
+        response_parameters = parametrize(
+            ResponseParameters, group_model
+        ).model_validate(parameters)
+
+        whole = storage.get(group_type, group.id)
+        projected = storage.get(
+            group_type, group.id, **projection(storage, response_parameters)
+        )
+
+        assert projected.model_dump(
+            scim_ctx=Context.RESOURCE_QUERY_RESPONSE,
+            response_parameters=response_parameters,
+        ) == whole.model_dump(
+            scim_ctx=Context.RESOURCE_QUERY_RESPONSE,
+            response_parameters=response_parameters,
+        )
+
     def test_update_replaces_the_stored_resource(
         self, storage: Any, user_type: ResourceType, user_model: Any
     ) -> None:
@@ -492,8 +541,20 @@ class BlockingStorage(ScimStorage):
     def run(self, coroutine: Coroutine[Any, Any, T]) -> T:
         return self.runner.run(coroutine)
 
-    def get(self, resource_type: ResourceType, resource_id: str) -> Resource[Any]:
-        return self.run(self.storage.get(resource_type, resource_id))
+    def get(
+        self,
+        resource_type: ResourceType,
+        resource_id: str,
+        *,
+        response_parameters: ResponseParameters[Any] | None = None,
+    ) -> Resource[Any]:
+        return self.run(
+            self.storage.get(
+                resource_type,
+                resource_id,
+                **projection(self.storage, response_parameters),
+            )
+        )
 
     def search(
         self, resource_types: list[ResourceType], search_request: SearchRequest[Any]

{scim2_server-0.6.2 → scim2_server-0.7.1}/scim2_server/testserver/cli.py

@@ -87,6 +87,12 @@ def build_parser() -> argparse.ArgumentParser:
         help="Accept a static bearer token, and announce the bearer token scheme. "
         "Can be repeated. Without it, the server accepts every request.",
     )
+    parser.add_argument(
+        "--precis",
+        action="store_true",
+        help="Compare the usernames and the passwords with the PRECIS profiles of "
+        "RFC 8265, and refuse the values they do not allow. Needs the precis extra.",
+    )
     parser.add_argument(
         "--hostname",
         default="127.0.0.1",
@@ -169,7 +175,20 @@ def main() -> None:
             BEARER_TOKEN_SCHEME,
         ]
 
-    provider = ScimProvider.from_discovery(schemas, resource_types, config=config)
+    policy = None
+    if args.precis:
+        try:
+            # Imported on demand, so that the server runs without the precis extra.
+            from scim2_server.testserver.precis import PRECIS_POLICY
+        except ModuleNotFoundError:
+            parser.error(
+                "--precis needs the precis extra: pip install 'scim2-server[precis]'"
+            )
+        policy = PRECIS_POLICY
+
+    provider = ScimProvider.from_discovery(
+        schemas, resource_types, config=config, policy=policy
+    )
 
     storages: dict[str | None, InMemoryStorage] = {}
 

scim2_server-0.7.1/scim2_server/testserver/precis.py

@@ -0,0 +1,29 @@
+"""The PRECIS comparison of the ``--precis`` option of the ``scim2-server`` command."""
+
+from typing import Any
+
+from precis_i18n import get_profile
+from scim2_models import ScimPolicy
+from scim2_models import default_comparison_key
+
+USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User"
+
+PROFILES = {
+    f"{USER_SCHEMA}:userName": get_profile("UsernameCaseMapped"),
+    f"{USER_SCHEMA}:password": get_profile("OpaqueString"),
+}
+
+
+def precis_comparison_key(binding: Any, value: str) -> str:
+    """Compare the usernames and the passwords with the PRECIS profiles of RFC 8265.
+
+    Per RFC 7644 §5, the usernames and the passwords are prepared with PRECIS
+    before they are compared. The other strings are compared as by default.
+    """
+    profile = PROFILES.get(binding.urn)
+    if profile is None:
+        return default_comparison_key(binding, value)
+    return str(profile.enforce(value))
+
+
+PRECIS_POLICY = ScimPolicy(comparison_key=precis_comparison_key)