scim2-server 0.8.2__tar.gz → 0.8.3__tar.gz

{scim2_server-0.8.2 → scim2_server-0.8.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: scim2-server
-Version: 0.8.2
+Version: 0.8.3
 Summary: SCIM server core for any storage and web framework
 Keywords: scim,scim2,provisioning,rfc7643,rfc7644
 Author: Yaal Coop, Christian Friedrich Coors

{scim2_server-0.8.2 → scim2_server-0.8.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.8.2"
+version = "0.8.3"
 description = "SCIM server core for any storage and web framework"
 readme = "README.md"
 keywords = [

{scim2_server-0.8.2 → scim2_server-0.8.3}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "scim2-server"
-version = "0.8.2"
+version = "0.8.3"
 description = "SCIM server core for any storage and web framework"
 authors = [
     {name="Yaal Coop", email="contact@yaal.coop"},

{scim2_server-0.8.2 → scim2_server-0.8.3}/scim2_server/memory.py

@@ -22,6 +22,8 @@ from scim2_models import ScimFilter
 from scim2_models import SearchRequest
 from scim2_models import Uniqueness
 from scim2_models import UniquenessException
+from scim2_models.path import CompareOperator
+from scim2_models.path import Comparison
 
 from scim2_server.storage import AsyncScimStorage
 from scim2_server.storage import ScimStorage
@@ -142,11 +144,59 @@ def _decode(value: Any) -> Any:
         raise InvalidCursorException from None
 
 
+Key = tuple[str | None, str]
+
+
+def _key(resource: Resource[Any]) -> Key:
+    """Return the resource type and the identifier a resource is stored under.
+
+    Per RFC 7643 §3.1, meta.resourceType holds the name of the resource
+    type, which may differ from its id.
+    """
+    assert resource.meta is not None
+    return resource.meta.resource_type, cast(str, resource.id)
+
+
+def _equality(scim_filter: ScimFilter[Any] | None) -> AttributeBinding | None:
+    """Return the attribute a filter compares to a string with eq, if it holds a single string."""
+    if scim_filter is None or scim_filter.model is None:
+        return None
+    node = scim_filter.ast
+    if (
+        not isinstance(node, Comparison)
+        or node.op != CompareOperator.eq
+        or not isinstance(node.value, str)
+    ):
+        return None
+    binding = scim_filter.resolve_comparison(node.attr_path, strict=False)
+    if binding is None or binding.is_multivalued or binding.target_type is not str:
+        return None
+    return binding
+
+
+def _hashable(value: Any) -> Any:
+    """Return a form of a value that a dict can hold as a key.
+
+    Lists and models cannot be hashed, so they are held by their
+    representation.
+    """
+    try:
+        hash(value)
+    except TypeError:
+        return repr(value)
+    return value
+
+
 class InMemoryStorage(ScimStorage):
     """A storage keeping the resources in memory, for tests, debugging and demos.
 
-    It is not optimized for performance: a search walks every resource. A
-    lock serializes every access, so it can serve a threaded server.
+    It indexes the resources by identifier and the unique values. A search
+    walks every resource of the searched types, unless it compares a single
+    string attribute to a string with ``eq``. A lock serializes every access,
+    so it can serve a threaded server.
+
+    It indexes the values under the policy in effect when they were written,
+    so it serves the resources of a single policy.
 
     :param clock: Return the date of a write, for ``meta.created`` and
         ``meta.lastModified``. Pass a fixed clock to get predictable dates.
@@ -155,11 +205,36 @@ class InMemoryStorage(ScimStorage):
     supports_cursors = True
 
     def __init__(self, clock: Callable[[], datetime.datetime] = utcnow) -> None:
-        self.resources: list[Resource[Any]] = []
+        self._resources: dict[str | None, dict[str, Resource[Any]]] = {}
+        self._owners: dict[str, dict[Any, Key]] = {}
+        self._unique_values: dict[Key, dict[str, Any]] = {}
+        self._equalities: dict[
+            str | None, dict[AttributeBinding, dict[Any, set[str]]]
+        ] = {}
+        self._equal_values: dict[Key, dict[AttributeBinding, Any]] = {}
         self.clock = clock
         self.lock = RLock()
         self.versions = itertools.count(1)
 
+    @property
+    def resources(self) -> list[Resource[Any]]:
+        """The stored resources."""
+        return [
+            resource
+            for resources in self._resources.values()
+            for resource in resources.values()
+        ]
+
+    @resources.setter
+    def resources(self, resources: list[Resource[Any]]) -> None:
+        self._resources = {}
+        self._owners = {}
+        self._unique_values = {}
+        self._equalities = {}
+        self._equal_values = {}
+        for resource in resources:
+            self._store(resource, self._values_of(resource))
+
     def generate_id(self, resource_type: ResourceType, resource: Resource[Any]) -> str:
         """Return the identifier of a new resource.
 
@@ -189,9 +264,7 @@ class InMemoryStorage(ScimStorage):
         response_parameters: ResponseParameters[Any] | None = None,
     ) -> Resource[Any]:
         with self.lock:
-            return self.resources[self._index(resource_type, resource_id)].model_copy(
-                deep=True
-            )
+            return self._stored(resource_type, resource_id).model_copy(deep=True)
 
     def search(
         self,
@@ -201,19 +274,20 @@ class InMemoryStorage(ScimStorage):
         position: Any = None,
     ) -> SearchPage:
         with self.lock:
-            candidates = [
-                resource.model_copy(deep=True)
-                for resource in self.resources
-                if any(self._is_of_type(resource, rt) for rt in resource_types)
-            ]
+            names = list(dict.fromkeys(rt.name for rt in resource_types))
+            scim_filter = search_request.filter
+            candidates = self._candidates(names, scim_filter)
 
-        scim_filter = search_request.filter
-        if scim_filter is not None and not scim_filter.models and candidates:
-            models = tuple(dict.fromkeys(type(r) for r in candidates))
-            scim_filter = parametrize(ScimFilter, Union[models])(str(scim_filter))  # noqa: UP007
+            if scim_filter is not None and not scim_filter.models and candidates:
+                models = tuple(dict.fromkeys(type(r) for r in candidates))
+                scim_filter = parametrize(ScimFilter, Union[models])(str(scim_filter))  # noqa: UP007
 
-        found = [r for r in candidates if scim_filter is None or scim_filter.match(r)]
-        return _page(search_request, position, found)
+            found = [
+                r for r in candidates if scim_filter is None or scim_filter.match(r)
+            ]
+            page = _page(search_request, position, found)
+            page.resources = [r.model_copy(deep=True) for r in page.resources]
+            return page
 
     def create(
         self, resource_type: ResourceType, resource: Resource[Any]
@@ -228,8 +302,9 @@ class InMemoryStorage(ScimStorage):
                 last_modified=now,
                 version=self.next_version(),
             )
-            self._check_uniqueness(resource)
-            self.resources.append(resource)
+            values = self._values_of(resource)
+            self._check_uniqueness(resource, values)
+            self._store(resource, values)
             return resource.model_copy(deep=True)
 
     def update(
@@ -240,8 +315,7 @@ class InMemoryStorage(ScimStorage):
         expected_version: str | None = None,
     ) -> Resource[Any]:
         with self.lock:
-            index = self._index(resource_type, resource.id)
-            stored = self.resources[index]
+            stored = self._stored(resource_type, resource.id)
             self._check_version(stored, expected_version)
 
             updated = type(resource).model_validate(resource.model_dump())
@@ -253,8 +327,9 @@ class InMemoryStorage(ScimStorage):
                     "version": self.next_version(),
                 }
             )
-            self._check_uniqueness(updated)
-            self.resources[index] = updated
+            values = self._values_of(updated)
+            self._check_uniqueness(updated, values)
+            self._store(updated, values)
             return updated.model_copy(deep=True)
 
     def delete(
@@ -265,26 +340,83 @@ class InMemoryStorage(ScimStorage):
         expected_version: str | None = None,
     ) -> None:
         with self.lock:
-            index = self._index(resource_type, resource_id)
-            self._check_version(self.resources[index], expected_version)
-            del self.resources[index]
+            stored = self._stored(resource_type, resource_id)
+            self._check_version(stored, expected_version)
+            self._remove(_key(stored))
 
-    def _is_of_type(self, resource: Resource[Any], resource_type: ResourceType) -> bool:
-        """Tell whether a resource belongs to a resource type.
+    def _candidates(
+        self, names: list[str | None], scim_filter: ScimFilter[Any] | None
+    ) -> list[Resource[Any]]:
+        """Return the resources a search walks.
 
-        Per RFC 7643 §3.1, meta.resourceType holds the name of the resource
-        type, which may differ from its id.
+        A search on a single resource type, comparing a single string
+        attribute to a string with eq, walks only the resources holding an
+        equal value. The values are indexed on the first such search.
         """
-        assert resource.meta is not None
-        return resource.meta.resource_type == resource_type.name
-
-    def _index(self, resource_type: ResourceType, resource_id: str | None) -> int:
-        for index, resource in enumerate(self.resources):
-            if self._is_of_type(resource, resource_type) and resource.id == resource_id:
-                return index
-        raise NotFoundException(
-            detail=f"{resource_type.name} {resource_id!r} not found"
-        )
+        binding = _equality(scim_filter) if len(names) == 1 else None
+        if binding is None:
+            return [
+                resource
+                for name in names
+                for resource in self._resources.get(name, {}).values()
+            ]
+
+        node = cast(Comparison, cast(ScimFilter[Any], scim_filter).ast)
+        try:
+            value = binding.comparable(node.value)
+        except ValueError:
+            return []
+        resources = self._resources.get(names[0], {})
+        ids = self._equality_index(names[0], binding).get(value, set())
+        return [resources[resource_id] for resource_id in ids]
+
+    def _equality_index(
+        self, name: str | None, binding: AttributeBinding
+    ) -> dict[Any, set[str]]:
+        """Return the identifiers of the resources of a type, by the value of an attribute."""
+        indexes = self._equalities.setdefault(name, {})
+        if binding not in indexes:
+            indexes[binding] = {}
+            for resource in self._resources.get(name, {}).values():
+                self._index_equality(resource, binding)
+        return indexes[binding]
+
+    def _index_equality(
+        self, resource: Resource[Any], binding: AttributeBinding
+    ) -> None:
+        key = _key(resource)
+        value = self._comparable_value(resource, binding)
+        self._equal_values.setdefault(key, {})[binding] = value
+        self._equalities[key[0]][binding].setdefault(value, set()).add(key[1])
+
+    def _store(self, resource: Resource[Any], values: dict[str, Any]) -> None:
+        """Keep a resource under its resource type and its identifier, and index its values."""
+        key = _key(resource)
+        self._remove(key)
+        self._resources.setdefault(key[0], {})[key[1]] = resource
+        self._unique_values[key] = values
+        for urn, value in values.items():
+            self._owners.setdefault(urn, {})[value] = key
+        for binding in self._equalities.get(key[0], {}):
+            self._index_equality(resource, binding)
+
+    def _remove(self, key: Key) -> None:
+        """Forget a resource and its indexed values."""
+        self._resources.get(key[0], {}).pop(key[1], None)
+        for urn, value in self._unique_values.pop(key, {}).items():
+            del self._owners[urn][value]
+        for binding, value in self._equal_values.pop(key, {}).items():
+            self._equalities[key[0]][binding][value].discard(key[1])
+
+    def _stored(
+        self, resource_type: ResourceType, resource_id: str | None
+    ) -> Resource[Any]:
+        try:
+            return self._resources[resource_type.name][cast(str, resource_id)]
+        except KeyError:
+            raise NotFoundException(
+                detail=f"{resource_type.name} {resource_id!r} not found"
+            ) from None
 
     @staticmethod
     def _check_version(resource: Resource[Any], expected_version: str | None) -> None:
@@ -292,32 +424,42 @@ class InMemoryStorage(ScimStorage):
         if expected_version is not None and resource.meta.version != expected_version:
             raise PreconditionFailedException
 
-    def _check_uniqueness(self, resource: Resource[Any]) -> None:
-        """Refuse a resource sharing a unique value with another one of the same schema.
+    def _check_uniqueness(
+        self, resource: Resource[Any], values: dict[str, Any]
+    ) -> None:
+        """Refuse a resource sharing a unique value with another resource."""
+        key = _key(resource)
+        for urn, value in values.items():
+            if self._owners.get(urn, {}).get(value, key) != key:
+                raise UniquenessException()
+
+    def _values_of(self, resource: Resource[Any]) -> dict[str, Any]:
+        """Return the unique values of a resource, by the URN of their attribute.
 
         Per RFC 7643 erratum 8279, the uniqueness applies to the resources
         using the schema that declares the attribute, whatever their resource
-        type. A missing value never clashes, as a SQL NULL does not.
+        type. The URN of an attribute holds its schema, so two resources clash
+        when they hold the same value under the same URN. A missing value
+        never clashes, as a SQL NULL does not.
+
+        The values are compared under the policy of the write that stored
+        them, so a storage serves the resources of a single policy.
         """
         unique_paths = parametrize(Path, type(resource)).iter_paths(
             include_subattributes=False,
             uniqueness=[Uniqueness.server, Uniqueness.global_],
         )
+        values = {}
         for path in unique_paths:
             attribute = cast(AttributeBinding, path.resolve())
-            value = self._unique_value(resource, attribute)
-            if value is None:
-                continue
-            for existing_resource in self.resources:
-                if (
-                    existing_resource.id != resource.id
-                    and self._unique_value(existing_resource, attribute) == value
-                ):
-                    raise UniquenessException()
+            value = self._comparable_value(resource, attribute)
+            if value is not None:
+                values[attribute.urn] = _hashable(value)
+        return values
 
     @staticmethod
-    def _unique_value(resource: Resource[Any], attribute: AttributeBinding) -> Any:
-        """Return the value a resource holds for a unique attribute, in the form it is compared in.
+    def _comparable_value(resource: Resource[Any], attribute: AttributeBinding) -> Any:
+        """Return the value a resource holds for an attribute, in the form it is compared in.
 
         A resource whose schemas do not declare the attribute holds no value.
         A string the policy cannot compare is equal to no other value, so it

{scim2_server-0.8.2 → scim2_server-0.8.3}/scim2_server/testing.py

@@ -501,6 +501,25 @@ class ScimStorageContract:
             storage.update(user_type, user)
         assert storage.get(user_type, user.id).user_name == "jsmith"
 
+    def test_update_frees_the_former_unique_values(
+        self, storage: Any, user_type: ResourceType, user_model: Any
+    ) -> None:
+        """A userName a resource gave up can be taken by another resource."""
+        (user,) = self.create_users(storage, user_type, user_model, "bjensen")
+        user.user_name = "babs"
+        storage.update(user_type, user)
+
+        self.create_users(storage, user_type, user_model, "bjensen")
+
+    def test_delete_frees_the_unique_values(
+        self, storage: Any, user_type: ResourceType, user_model: Any
+    ) -> None:
+        """The userName of a deleted resource can be taken by a new resource."""
+        (user,) = self.create_users(storage, user_type, user_model, "bjensen")
+        storage.delete(user_type, user.id)
+
+        self.create_users(storage, user_type, user_model, "bjensen")
+
     def test_search_a_resource_type(
         self,
         storage: Any,