search

RIPAGlobal / scimitar

A SCIM v2 API endpoint implementation
MIT License
61 stars 43 forks source link

Attributes never returned are lost on creates and updates #105

Closed xjunior closed 7 months ago

xjunior commented 8 months ago

Attributes never returned are erased – set to nil – in updates, and are lost when creating a resource.

This is happening since we started never returning the password attribute via the return = "never" mechanism in https://github.com/RIPAGlobal/scimitar/commit/413280a141f8987c4609b39b0b8503d2cfd6efa5.

At https://github.com/RIPAGlobal/scimitar/blob/v2.7.1/app/models/scimitar/resources/mixin.rb#L420, ci_scim_hash no longer contains the password, but after all operations are applied, an all attributes update is done on https://github.com/RIPAGlobal/scimitar/blob/v2.7.1/app/models/scimitar/resources/mixin.rb#L494 using from_scim, targeting all attributes in the resource, including those never returned, and emptying them.

This pull request includes a test case demonstrating the issue: https://github.com/RIPAGlobal/scimitar/pull/103

pond commented 7 months ago

Fixed in v2.7.2 / v1.8.2.