slack-objects 0.3.0__tar.gz → 0.4.0__tar.gz

{slack_objects-0.3.0 → slack_objects-0.4.0}/.github/workflows/publish-pypi.yml

@@ -3,6 +3,12 @@ name: Publish to PyPI
 on:
   release:
     types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to build and publish (e.g. v0.3.0). Run this from the default branch."
+        required: true
+        type: string
 
 jobs:
   build-and-publish:
@@ -19,7 +25,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.release.tag_name }}
+          ref: ${{ github.event.release.tag_name || inputs.tag }}
 
       - uses: actions/setup-python@v5
         with:

{slack_objects-0.3.0 → slack_objects-0.4.0}/.github/workflows/publish-testpypi.yml

@@ -3,6 +3,12 @@ name: Publish to TestPyPI
 on:
   release:
     types: [prereleased]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to build and publish to TestPyPI (e.g. v0.4.0-rc1). Run this from the default branch."
+        required: true
+        type: string
 
 jobs:
   build-and-publish:
@@ -19,7 +25,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.release.tag_name }}
+          ref: ${{ github.event.release.tag_name || inputs.tag }}
 
       - uses: actions/setup-python@v5
         with:

{slack_objects-0.3.0 → slack_objects-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: slack-objects
-Version: 0.3.0
+Version: 0.4.0
 Summary: Opinionated, testable Python wrappers for Slack’s Web, Admin, and SCIM APIs, organized by object domain (users, conversations, messages, files, workspaces, and IdP groups). Designed for automation and administration workflows.
 Author-email: "Marcos E. Mercado" <marcos_elias@hotmail.com>
 Keywords: slack,objects,classes,slack objects,utilities,slack utilities,slack object types,slack types,types
@@ -197,5 +197,6 @@ explicit per-call tier → method-specific override → prefix rule → `default
 - `resolve_user_id` accepts flexible identifiers (user ID, email, or @username) and verifies existence via Web API + SCIM fallback
 - `is_user_authorized` supports IdP-group-based authorization checks with configurable read/write access levels
 - SCIM user operations are available on `Users`: create, deactivate, reactivate, update attributes, update email, and convert to multi-channel guest
+- SCIM group operations are available on `IDP_groups`: list groups, get a group and its members, check membership, and remove selected members. `get_group()` (and so `members`, `get_members()`, and `is_member()`) raises `RuntimeError` when Slack returns an incomplete or malformed member list, rather than returning a short list that would make users look like non-members. `remove_members(["U111", "U222"])` sends a targeted PATCH (v1 or v2) that leaves other members and group fields untouched. It accepts a non-empty list of up to 5,000 unique user IDs (Slack's recommended SCIM batch size), raises on HTTP errors, and returns a `ScimResponse` whose `ok` callers must check. It changes the group in Slack only, not in Entra/Okta, so upstream provisioning may restore members
 - Discovery API is used for `Users.get_channels` and `Conversations.get_members` (requires appropriate token scopes)
 - `Users.get_channels(include_channels_user_left=True)` and `Conversations.get_members(include_members_who_left=True)` opt into historical data; both default to `False` so the common case makes fewer paginated calls

{slack_objects-0.3.0 → slack_objects-0.4.0}/README.md

@@ -176,5 +176,6 @@ explicit per-call tier → method-specific override → prefix rule → `default
 - `resolve_user_id` accepts flexible identifiers (user ID, email, or @username) and verifies existence via Web API + SCIM fallback
 - `is_user_authorized` supports IdP-group-based authorization checks with configurable read/write access levels
 - SCIM user operations are available on `Users`: create, deactivate, reactivate, update attributes, update email, and convert to multi-channel guest
+- SCIM group operations are available on `IDP_groups`: list groups, get a group and its members, check membership, and remove selected members. `get_group()` (and so `members`, `get_members()`, and `is_member()`) raises `RuntimeError` when Slack returns an incomplete or malformed member list, rather than returning a short list that would make users look like non-members. `remove_members(["U111", "U222"])` sends a targeted PATCH (v1 or v2) that leaves other members and group fields untouched. It accepts a non-empty list of up to 5,000 unique user IDs (Slack's recommended SCIM batch size), raises on HTTP errors, and returns a `ScimResponse` whose `ok` callers must check. It changes the group in Slack only, not in Entra/Okta, so upstream provisioning may restore members
 - Discovery API is used for `Users.get_channels` and `Conversations.get_members` (requires appropriate token scopes)
 - `Users.get_channels(include_channels_user_left=True)` and `Conversations.get_members(include_members_who_left=True)` opt into historical data; both default to `False` so the common case makes fewer paginated calls

{slack_objects-0.3.0 → slack_objects-0.4.0}/src/slack_objects/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.3.0'
-__version_tuple__ = version_tuple = (0, 3, 0)
+__version__ = version = '0.4.0'
+__version_tuple__ = version_tuple = (0, 4, 0)
 
-__commit_id__ = commit_id = 'g88ac46367'
+__commit_id__ = commit_id = 'g9f01c906c'

{slack_objects-0.3.0 → slack_objects-0.4.0}/src/slack_objects/config.py

@@ -14,6 +14,10 @@ CONVERSATION_ID_RE = re.compile(r"^[CGD][A-Z0-9]+$")
 # "+" precedes "\-" in the character class so it is not read as a range.
 EMAIL_RE = re.compile(r"^[\w.+\-]+@[\w.\-]+\.\w+$")
 
+# Slack accepts up to 15,000 members per SCIM Groups write but recommends batches
+# of no more than 5,000. https://docs.slack.dev/reference/scim-api/#patch-groups-id
+SCIM_GROUP_MEMBER_BATCH_LIMIT = 5000
+
 
 class RateTier(float, Enum):
 	"""

{slack_objects-0.3.0 → slack_objects-0.4.0}/src/slack_objects/idp_groups.py

@@ -15,6 +15,7 @@ This module implements the following functionality:
 - get a single group's full SCIM record (name, members, metadata)
 - get members of a given group
 - check whether a user is a member of a group
+- remove selected members without replacing the group's membership
 
 Design decisions
 ----------------
@@ -24,6 +25,8 @@ Design decisions
 - ``get_group()`` is the single read path for GET Groups/{id}; ``get_members()``,
   ``is_member()`` and the ``display_name``/``members`` properties all compose on it
   so the endpoint is only ever called from one place.
+- ``get_group()`` raises on incomplete or malformed member lists instead of returning
+  them, so callers never mistake missing data for non-membership.
 - Attributes are loaded lazily (like ``Users``): binding a group_id does no network I/O,
   the fetch happens on first property access or on ``refresh()``.
 - This module is SCIM-only. For Slack-native usergroups, see ``usergroups.py``.
@@ -35,6 +38,7 @@ from typing import Any, Dict, List, Optional
 import requests
 
 from .base import SlackObjectBase
+from .config import SCIM_GROUP_MEMBER_BATCH_LIMIT, USER_ID_RE
 from .scim_base import ScimMixin, ScimResponse, validate_scim_id
 
 
@@ -146,6 +150,44 @@ class IDP_groups(ScimMixin, SlackObjectBase):
         # Pass params only when set, so the default call is byte-for-byte the legacy request.
         return self._scim_request(path=f"Groups/{group_id}", method="GET", params=params or None)      # https://docs.slack.dev/reference/scim-api/#get-groups-id
 
+    def _scim_group_remove_members(self, group_id: str, user_ids: List[str]) -> ScimResponse:
+        """
+        Wrapper for PATCH Groups/{id} that removes only the specified members.
+        Builds the version-specific payload (v2 PatchOp ``remove`` or v1 ``operation: delete``).
+        """
+        validate_scim_id(group_id, "group_id")
+        if not isinstance(user_ids, list) or not user_ids:
+            raise ValueError("user_ids must be a non-empty list of Slack user IDs")
+        for user_id in user_ids:
+            if not isinstance(user_id, str) or not USER_ID_RE.fullmatch(user_id):
+                raise ValueError(f"Invalid user_id: {user_id!r}")
+        unique_ids = list(dict.fromkeys(user_ids))
+        if len(unique_ids) > SCIM_GROUP_MEMBER_BATCH_LIMIT:
+            raise ValueError(
+                f"Remove no more than {SCIM_GROUP_MEMBER_BATCH_LIMIT} unique members per call "
+                "(Slack's recommended SCIM batch size)"
+            )
+
+        scim_version = self.cfg.scim_version
+        if scim_version == "v2":
+            payload: Dict[str, Any] = {
+                "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+                "Operations": [{
+                    "op": "remove",
+                    "path": "members",
+                    "value": [{"value": uid} for uid in unique_ids],
+                }],
+            }
+        elif scim_version == "v1":
+            payload = {
+                "schemas": ["urn:scim:schemas:core:1.0"],
+                "members": [{"value": uid, "operation": "delete"} for uid in unique_ids],
+            }
+        else:
+            raise NotImplementedError(f"Invalid SCIM version: {scim_version}")
+
+        return self._scim_request(path=f"Groups/{group_id}", method="PATCH", payload=payload)      # https://docs.slack.dev/reference/scim-api/#patch-groups-id
+
     # ---------- public helpers ----------
 
     def get_groups(self, fetch_count: int = 1000) -> List[Dict[str, str]]:
@@ -204,15 +246,23 @@ class IDP_groups(ScimMixin, SlackObjectBase):
         the remaining member pages are fetched and merged, so large groups are not
         silently truncated.
 
+        The record is validated before it is returned, because a short or malformed
+        member list would otherwise look like users are not members. A missing
+        ``members`` field is treated as an empty group.
+
         Raises:
             requests.HTTPError on non-2xx responses.
+            RuntimeError when the response is for a different group, a member list is
+            malformed, or the members stop before ``totalResults``.
         """
         gid = self._resolve_group_id(group_id)
 
         # First request sends no pagination params, so it is identical to the legacy call.
         # Copy so callers mutating the result cannot corrupt our cached attributes.
         group = dict(self._scim_group_get(gid).data)
-        members: List[Dict[str, str]] = list(group.get("members") or [])
+        if group.get("id") != gid:
+            raise RuntimeError(f"SCIM GET Groups/{gid} returned a record for {group.get('id')!r}")
+        members = self._validated_members(gid, group.get("members"))
 
         # totalResults is only present when the server actually paged the members;
         # when it is absent the single response is complete and we skip the loop.
@@ -222,15 +272,31 @@ class IDP_groups(ScimMixin, SlackObjectBase):
                 # SCIM startIndex is 1-based, and the server chooses the first page size,
                 # so derive the cursor from what we already have rather than from fetch_count.
                 start_index = len(members) + 1
-                page_members = self._scim_group_get(gid, count=fetch_count, start_index=start_index).data.get("members") or []
-                # An empty page means the server has nothing more; stop rather than loop forever.
+                page = self._scim_group_get(gid, count=fetch_count, start_index=start_index).data
+                page_members = self._validated_members(gid, page.get("members"))
+                # An empty page before totalResults means the list is incomplete; raise
+                # rather than loop forever or return a list that is silently short.
                 if not page_members:
-                    break
+                    raise RuntimeError(
+                        f"Incomplete member list for group {gid}: got {len(members)} of {total_results}"
+                    )
                 members.extend(page_members)
 
         group["members"] = members
         return group
 
+    @staticmethod
+    def _validated_members(group_id: str, members: Any) -> List[Dict[str, str]]:
+        """Return a copy of a SCIM ``members`` page, raising RuntimeError if it is malformed."""
+        if members is None:
+            return []
+        if not isinstance(members, list):
+            raise RuntimeError(f"Malformed member list for group {group_id}: expected a list")
+        for member in members:
+            if not isinstance(member, dict) or not isinstance(member.get("value"), str) or not member["value"]:
+                raise RuntimeError(f"Malformed member entry for group {group_id}: {member!r}")
+        return list(members)
+
     def get_members(self, group_id: Optional[str] = None) -> List[Dict[str, str]]:
         """
         Return group members via SCIM (GET Groups/{id}) as a list of dicts `{'value': <user_id>, 'display': <name>}`.
@@ -255,6 +321,9 @@ class IDP_groups(ScimMixin, SlackObjectBase):
 
         Each call fetches the group unless its attributes are already cached, so when
         testing many users bind the group once (or hoist ``get_members()`` out of the loop).
+
+        Raises the same errors as ``get_group()``, so an incomplete member list is never
+        reported as "not a member".
         """
         members = self.get_members(group_id=group_id)
         for member in members:
@@ -262,3 +331,30 @@ class IDP_groups(ScimMixin, SlackObjectBase):
             if member.get("value") == user_id:
                 return True
         return False
+
+    def remove_members(self, user_ids: List[str], group_id: Optional[str] = None) -> ScimResponse:
+        """
+        Remove selected Slack users from a passed or bound IdP group (via SCIM PATCH).
+
+        Never uses PUT or DELETE Groups, so other members and group fields are left
+        untouched. Accepts at most ``SCIM_GROUP_MEMBER_BATCH_LIMIT`` unique user IDs;
+        an empty list is rejected so a call can never be an unqualified removal.
+        This changes Slack's group, not the upstream identity provider.
+
+        Cached attributes for the group are invalidated after every attempt, including
+        transport failures where the server may still have applied the change.
+
+        Returns:
+            ScimResponse; callers must check ``ok``.
+
+        Raises:
+            ValueError on invalid IDs or batch size.
+            NotImplementedError on an unsupported SCIM version.
+            requests.HTTPError on non-2xx responses.
+        """
+        gid = self._resolve_group_id(group_id)
+        try:
+            return self._scim_group_remove_members(gid, user_ids)
+        finally:
+            if self.attributes.get("id") == gid:
+                self.attributes = {}

{slack_objects-0.3.0 → slack_objects-0.4.0}/src/slack_objects.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: slack-objects
-Version: 0.3.0
+Version: 0.4.0
 Summary: Opinionated, testable Python wrappers for Slack’s Web, Admin, and SCIM APIs, organized by object domain (users, conversations, messages, files, workspaces, and IdP groups). Designed for automation and administration workflows.
 Author-email: "Marcos E. Mercado" <marcos_elias@hotmail.com>
 Keywords: slack,objects,classes,slack objects,utilities,slack utilities,slack object types,slack types,types
@@ -197,5 +197,6 @@ explicit per-call tier → method-specific override → prefix rule → `default
 - `resolve_user_id` accepts flexible identifiers (user ID, email, or @username) and verifies existence via Web API + SCIM fallback
 - `is_user_authorized` supports IdP-group-based authorization checks with configurable read/write access levels
 - SCIM user operations are available on `Users`: create, deactivate, reactivate, update attributes, update email, and convert to multi-channel guest
+- SCIM group operations are available on `IDP_groups`: list groups, get a group and its members, check membership, and remove selected members. `get_group()` (and so `members`, `get_members()`, and `is_member()`) raises `RuntimeError` when Slack returns an incomplete or malformed member list, rather than returning a short list that would make users look like non-members. `remove_members(["U111", "U222"])` sends a targeted PATCH (v1 or v2) that leaves other members and group fields untouched. It accepts a non-empty list of up to 5,000 unique user IDs (Slack's recommended SCIM batch size), raises on HTTP errors, and returns a `ScimResponse` whose `ok` callers must check. It changes the group in Slack only, not in Entra/Okta, so upstream provisioning may restore members
 - Discovery API is used for `Users.get_channels` and `Conversations.get_members` (requires appropriate token scopes)
 - `Users.get_channels(include_channels_user_left=True)` and `Conversations.get_members(include_members_who_left=True)` opt into historical data; both default to `False` so the common case makes fewer paginated calls

{slack_objects-0.3.0 → slack_objects-0.4.0}/src/slack_objects.egg-info/scm_file_list.json

@@ -1,68 +1,68 @@
 {
   "files": [
-    "pyproject.toml",
+    ".github/copilot-instructions.md",
+    ".github/workflows/ci.yml",
+    ".github/workflows/publish-pypi.yml",
+    ".github/workflows/publish-testpypi.yml",
+    ".gitignore",
     "LICENSE",
     "README.md",
+    "pyproject.toml",
     "pytest.ini",
-    ".gitignore",
-    ".github/copilot-instructions.md",
-    ".github/workflows/publish-testpypi.yml",
-    ".github/workflows/publish-pypi.yml",
-    ".github/workflows/ci.yml",
-    "tests/live_test_config.example.json",
-    "tests/conftest.py",
-    "tests/UnitTests/usergroups_test.py",
-    "tests/UnitTests/rate_limits_unit_test.py",
-    "tests/UnitTests/files_unit_test.py",
-    "tests/UnitTests/idp_groups_unit_test.py",
-    "tests/UnitTests/messages_unit_test.py",
-    "tests/UnitTests/workspaces_unit_test.py",
-    "tests/UnitTests/users_unit_test.py",
-    "tests/UnitTests/conversations_unit_test.py",
-    "tests/UnitTests/config_unit_test.py",
-    "tests/SCIM/test_scim_users_make_guest_live.py",
-    "tests/SCIM/test_scim_users_update_email_live.py",
-    "tests/SCIM/test_scim_users_reactivate_live.py",
+    "src/slack_objects/__init__.py",
+    "src/slack_objects/api_caller.py",
+    "src/slack_objects/base.py",
+    "src/slack_objects/client.py",
+    "src/slack_objects/config.py",
+    "src/slack_objects/conversations.py",
+    "src/slack_objects/files.py",
+    "src/slack_objects/idp_groups.py",
+    "src/slack_objects/messages.py",
+    "src/slack_objects/rate_limits.py",
+    "src/slack_objects/scim_base.py",
+    "src/slack_objects/usergroups.py",
+    "src/slack_objects/users.py",
+    "src/slack_objects/workspaces.py",
+    "tests/Examples/examples_config.example.json",
+    "tests/Examples/users_search_by_email_example.py",
+    "tests/Examples/users_test_AzureKeyVault.py",
     "tests/SCIM/conftest_live.py",
-    "tests/SCIM/test_scim_users_update_attribute_live.py",
-    "tests/SCIM/test_scim_users_input_validation_live.py",
     "tests/SCIM/run_all_scim_users_live_tests.py",
+    "tests/SCIM/test_scim_idp_groups_live.py",
     "tests/SCIM/test_scim_users_create_live.py",
     "tests/SCIM/test_scim_users_deactivate_live.py",
-    "tests/SCIM/test_scim_idp_groups_live.py",
-    "tests/Smoke/idp_groups_smoke_test.py",
-    "tests/Smoke/security_smoke_test.py",
-    "tests/Smoke/api_caller_smoke_test.py",
-    "tests/Smoke/run_all_smoke.py",
+    "tests/SCIM/test_scim_users_input_validation_live.py",
+    "tests/SCIM/test_scim_users_make_guest_live.py",
+    "tests/SCIM/test_scim_users_reactivate_live.py",
+    "tests/SCIM/test_scim_users_update_attribute_live.py",
+    "tests/SCIM/test_scim_users_update_email_live.py",
     "tests/Smoke/_smoke_harness.py",
-    "tests/Smoke/users_smoke_test.py",
-    "tests/Smoke/files_smoke_test.py",
-    "tests/Smoke/workspaces_smoke_test.py",
+    "tests/Smoke/api_caller_smoke_test.py",
     "tests/Smoke/conversations_smoke_test.py",
+    "tests/Smoke/files_smoke_test.py",
+    "tests/Smoke/idp_groups_smoke_test.py",
     "tests/Smoke/messages_smoke_test.py",
+    "tests/Smoke/run_all_smoke.py",
+    "tests/Smoke/security_smoke_test.py",
     "tests/Smoke/usergroups_smoke_test.py",
-    "tests/Users/test_users_read_live.py",
+    "tests/Smoke/users_smoke_test.py",
+    "tests/Smoke/workspaces_smoke_test.py",
+    "tests/UnitTests/config_unit_test.py",
+    "tests/UnitTests/conversations_unit_test.py",
+    "tests/UnitTests/files_unit_test.py",
+    "tests/UnitTests/idp_groups_unit_test.py",
+    "tests/UnitTests/messages_unit_test.py",
+    "tests/UnitTests/rate_limits_unit_test.py",
+    "tests/UnitTests/usergroups_test.py",
+    "tests/UnitTests/users_unit_test.py",
+    "tests/UnitTests/workspaces_unit_test.py",
     "tests/Users/conftest_live.py",
-    "tests/Users/test_users_input_validation_live.py",
     "tests/Users/run_all_users_live_tests.py",
-    "tests/Users/test_users_classification_live.py",
     "tests/Users/test_users_admin_live.py",
-    "tests/Examples/users_search_by_email_example.py",
-    "tests/Examples/users_test_AzureKeyVault.py",
-    "tests/Examples/examples_config.example.json",
-    "src/slack_objects/workspaces.py",
-    "src/slack_objects/usergroups.py",
-    "src/slack_objects/conversations.py",
-    "src/slack_objects/messages.py",
-    "src/slack_objects/users.py",
-    "src/slack_objects/config.py",
-    "src/slack_objects/__init__.py",
-    "src/slack_objects/client.py",
-    "src/slack_objects/files.py",
-    "src/slack_objects/api_caller.py",
-    "src/slack_objects/scim_base.py",
-    "src/slack_objects/rate_limits.py",
-    "src/slack_objects/base.py",
-    "src/slack_objects/idp_groups.py"
+    "tests/Users/test_users_classification_live.py",
+    "tests/Users/test_users_input_validation_live.py",
+    "tests/Users/test_users_read_live.py",
+    "tests/conftest.py",
+    "tests/live_test_config.example.json"
   ]
 }

slack_objects-0.4.0/src/slack_objects.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.4.0",
+  "distance": 0,
+  "node": "g9f01c906cc9ebefca926498b5941219e987efe6a",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-11-11"
+}

{slack_objects-0.3.0 → slack_objects-0.4.0}/tests/Smoke/_smoke_harness.py

@@ -286,7 +286,10 @@ class FakeScimSession:
         # --- SCIM Groups endpoints (used by IDP_groups) ---
         # Group detail (IDP_groups.get_members / is_member)
         if "Groups/" in url:
-            return Resp({"members": [{"value": "U1", "display": "User One"}, {"value": "U2", "display": "User Two"}]})
+            return Resp({
+                "id": url.rsplit("/", 1)[-1],
+                "members": [{"value": "U1", "display": "User One"}, {"value": "U2", "display": "User Two"}],
+            })
 
         # Group list
         # SCIM startIndex is 1-based; return all in one page here

{slack_objects-0.3.0 → slack_objects-0.4.0}/tests/UnitTests/idp_groups_unit_test.py

@@ -24,7 +24,9 @@ from typing import Any, Dict, Optional, Tuple
 import json
 import logging
 
+import pytest
 import requests
+from slack_objects.config import SCIM_GROUP_MEMBER_BATCH_LIMIT
 from slack_objects.rate_limits import RateLimitPolicy
 
 
@@ -353,6 +355,53 @@ def test_get_group_merges_paginated_members():
     assert calls[1]["startIndex"] == 3
 
 
+def _group_with_pages(*pages):
+    """Return an IDP_groups whose successive GET Groups/{id} calls return *pages* in order."""
+    from slack_objects.idp_groups import IDP_groups
+
+    sess = FakeScimSession({})
+    responses = iter(pages)
+    sess.request = lambda method, url, **kwargs: FakeResponse(200, next(responses))  # type: ignore[method-assign]
+    idp = IDP_groups(cfg=DummyConfig(), client=DummySlackClient(), logger=logging.getLogger("test"), api=DummyApiCaller(), scim_session=sess)
+    idp.rate_policy = RateLimitPolicy(method_overrides={}, prefix_rules={}, default=0.0)
+    return idp
+
+
+def test_get_group_raises_when_member_pages_stop_early():
+    idp = _group_with_pages(
+        {"id": "S123", "totalResults": 3, "members": [{"value": "U111"}, {"value": "U222"}]},
+        {"id": "S123", "totalResults": 3, "members": []},
+    )
+    with pytest.raises(RuntimeError, match="Incomplete member list for group S123: got 2 of 3"):
+        idp.get_group("S123", fetch_count=2)
+
+
+def test_is_member_raises_instead_of_reporting_non_member_on_incomplete_list():
+    idp = _group_with_pages(
+        {"id": "S123", "totalResults": 2, "members": [{"value": "U111"}]},
+        {"id": "S123", "totalResults": 2},
+    )
+    with pytest.raises(RuntimeError, match="Incomplete"):
+        idp.is_member("U222", group_id="S123")
+
+
+@pytest.mark.parametrize("payload,match", [
+    ({"id": "S999", "members": []}, "returned a record for 'S999'"),
+    ({}, "returned a record for None"),
+    ({"id": "S123", "members": "U111"}, "expected a list"),
+    ({"id": "S123", "members": [{"display": "No ID"}]}, "Malformed member entry"),
+    ({"id": "S123", "members": ["U111"]}, "Malformed member entry"),
+])
+def test_get_group_rejects_malformed_records(payload, match):
+    with pytest.raises(RuntimeError, match=match):
+        _group_with_pages(payload).get_group("S123")
+
+
+def test_get_group_treats_missing_members_as_empty_group():
+    group = _group_with_pages({"id": "S123", "displayName": "Empty"}).get_group("S123")
+    assert group["members"] == []
+
+
 # -----------------------------
 # Optional "factory-style" demo
 # -----------------------------
@@ -397,6 +446,127 @@ def test_factory_style_if_available():
     assert bound.is_member("U1") is True
 
 
+# -----------------------------
+# Member removal
+# -----------------------------
+
+@pytest.fixture
+def removal_group():
+    from slack_objects.idp_groups import IDP_groups
+
+    cfg = DummyConfig()
+    group = IDP_groups(
+        cfg=cfg, client=DummySlackClient(), logger=logging.getLogger("test"),
+        api=DummyApiCaller(), scim_session=FakeScimSession({}), group_id="S123",
+    )
+    group.rate_policy = RateLimitPolicy(method_overrides={}, prefix_rules={}, default=0.0)
+    return group
+
+
+@pytest.mark.parametrize("version", ["v1", "v2"])
+def test_remove_members_exact_payload_and_cache_invalidation(removal_group, version):
+    group = removal_group
+    group.cfg.scim_version = version
+    url = f"{_scim_base(group.cfg)}Groups/S123"
+    remaining = {"id": "S123", "displayName": "Admins", "members": [{"value": "U333"}]}
+    group.scim_session.routes = {("PATCH", url): (200, remaining), ("GET", url): (200, remaining)}
+    group.attributes = {"id": "S123", "members": [{"value": "U111"}, {"value": "U333"}]}
+
+    response = group.remove_members(["U111", "U222", "U111"])
+
+    expected = (
+        {"schemas": ["urn:scim:schemas:core:1.0"], "members": [
+            {"value": "U111", "operation": "delete"}, {"value": "U222", "operation": "delete"},
+        ]} if version == "v1" else
+        {"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": [{
+            "op": "remove", "path": "members", "value": [{"value": "U111"}, {"value": "U222"}],
+        }]}
+    )
+    assert response.ok
+    assert group.scim_session.calls == [("PATCH", url, None, expected)]
+    assert group.attributes == {}
+    assert group.members == [{"value": "U333"}]
+    assert len(group.scim_session.calls) == 2
+
+
+@pytest.mark.parametrize("user_ids", [[], "U111", ["../U111"], [""], [None], ["S123"], ["U111", "bad\"id"]])
+def test_remove_members_rejects_invalid_input_without_http(removal_group, user_ids):
+    with pytest.raises(ValueError):
+        removal_group.remove_members(user_ids)
+    assert removal_group.scim_session.calls == []
+
+
+def test_remove_members_requires_valid_group_and_version(removal_group):
+    with pytest.raises(ValueError):
+        removal_group.remove_members(["U111"], "../S123")
+    removal_group.group_id = None
+    with pytest.raises(ValueError):
+        removal_group.remove_members(["U111"])
+    removal_group.group_id = "S123"
+    removal_group.cfg.scim_version = "v3"
+    with pytest.raises(NotImplementedError, match="Invalid SCIM version"):
+        removal_group.remove_members(["U111"])
+    assert removal_group.scim_session.calls == []
+
+
+def test_remove_members_enforces_batch_limit(removal_group):
+    with pytest.raises(ValueError, match=str(SCIM_GROUP_MEMBER_BATCH_LIMIT)):
+        removal_group.remove_members([f"U{i}" for i in range(SCIM_GROUP_MEMBER_BATCH_LIMIT + 1)])
+    assert removal_group.scim_session.calls == []
+
+
+@pytest.mark.parametrize("version", ["v1", "v2"])
+def test_remove_members_accepts_exactly_batch_limit_unique_ids(removal_group, version):
+    group = removal_group
+    group.cfg.scim_version = version
+    url = f"{_scim_base(group.cfg)}Groups/S123"
+    group.scim_session.routes = {("PATCH", url): (204, {})}
+    ids = [f"U{i}" for i in range(SCIM_GROUP_MEMBER_BATCH_LIMIT)]
+    assert group.remove_members(ids + ids).ok
+    payload = group.scim_session.calls[0][3]
+    members = payload["members"] if version == "v1" else payload["Operations"][0]["value"]
+    assert len(members) == SCIM_GROUP_MEMBER_BATCH_LIMIT
+    assert [member["value"] for member in members] == ids
+
+
+@pytest.mark.parametrize("status,payload", [(400, {"Errors": [{"description": "denied"}]}), (200, {"Errors": [{"description": "failed"}]})])
+def test_remove_members_surfaces_errors_and_invalidates_cache(removal_group, status, payload):
+    group = removal_group
+    group.attributes = {"id": "S123", "members": [{"value": "U111"}]}
+    url = f"{_scim_base(group.cfg)}Groups/S123"
+    group.scim_session.routes = {("PATCH", url): (status, payload)}
+    if status == 400:
+        with pytest.raises(requests.HTTPError):
+            group.remove_members(["U111"])
+    else:
+        assert not group.remove_members(["U111"]).ok
+    assert group.attributes == {}
+
+
+def test_remove_members_explicit_group_does_not_invalidate_other_group(removal_group):
+    group = removal_group
+    cached = {"id": "S123", "members": [{"value": "U111"}]}
+    group.attributes = cached
+    url = f"{_scim_base(group.cfg)}Groups/S456"
+    group.scim_session.routes = {("PATCH", url): (204, {})}
+    assert group.remove_members(["U111"], group_id="S456").ok
+    assert group.attributes == cached
+    assert group.scim_session.calls[0][1] == url
+
+
+def test_remove_members_transport_failure_invalidates_cache(removal_group, monkeypatch):
+    group = removal_group
+    group.attributes = {"id": "S123", "members": [{"value": "U111"}]}
+
+    def timeout(*args, **kwargs):
+        raise requests.Timeout("Timed out after sending PATCH")
+
+    monkeypatch.setattr(group.scim_session, "request", timeout)
+    with pytest.raises(requests.Timeout):
+        group.remove_members(["U111"])
+    assert group.attributes == {}
+
+
 # -----------------------------
 # Script mode
 # -----------------------------

slack_objects-0.3.0/src/slack_objects.egg-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "0.3.0",
-  "distance": 0,
-  "node": "g88ac46367071865a9bb07d9ae48e7cc6116f5b72",
-  "dirty": false,
-  "branch": "HEAD",
-  "node_date": "2026-08-06"
-}