Skip to content

PatchOp model is too permissive #93

@Meow-Knight

Description

@Meow-Knight

🚀 Description

The PatchOp model currently allows inputs that do not conform strictly to the SCIM specification. This can lead to unexpected behavior or unvalidated data being processed.

⚙️ Current Behavior

Input:
>>> patch_instance = PatchOp.model_validate(dict(schemas=["abcd1234", "1234abcd"]))
>>> patch_instance.schemas
Output:
['abcd1234', '1234abcd']

⚠️ Issues

  • The schemas field accepts any list of strings and doesn't enforce the exact expected value.
  • The operations field is optional and allows None or an empty list, which should not be valid.

🚩 Expected Behavior

  • schemas should strictly equal ["urn:ietf:params:scim:api:messages:2.0:PatchOp"].
  • operations should be a required field and must contain at least one PatchOperation item.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions