fix: respect the primary attribute unique truthy value when generating random values

Author: azmeuk

doc/changelog.rst

@@ -8,6 +8,7 @@ Fixed
 ^^^^^
 - Error and critical check results directly raise an exception when ``raise_exceptions=True``.
 - Use ``ComplexAttribute`` instead of ``MultiValuedComplexAttribute`` to generate data.
+- Respect the ``primary`` attribute unique truthy value when generating random values.
 
 [0.2.2] - 2025-08-13
 --------------------

scim2_tester/filling.py

@@ -171,6 +171,8 @@ def fill_with_random_values(
         value = generate_random_value(context, urn=urn, model=type(obj))
         set_value_by_urn(obj, urn, value)
 
+    fix_primary_attributes(obj)
+
     return obj
 
 
@@ -194,3 +196,30 @@ def fill_complex_attribute_with_random_values(
         ):
             obj.value = ref.rsplit("/", 1)[-1]
     return obj
+
+
+def fix_primary_attributes(obj: Resource[Any]) -> None:
+    """Fix primary attributes to respect RFC 7643 constraints.
+
+    Ensures that for multi-valued attributes with 'primary' sub-attributes:
+    - If the list has one item, sets primary=True
+    - If the list has multiple items, exactly one has primary=True and others primary=False
+    - If the list is empty, does nothing
+
+    According to RFC 7643 §2.4: The primary attribute value "true" MUST appear no more than once.
+    """
+    for field_name, _field_info in type(obj).model_fields.items():
+        attr_value = getattr(obj, field_name, None)
+        if not attr_value or not isinstance(attr_value, list) or len(attr_value) == 0:
+            continue
+
+        first_item = attr_value[0]
+        if not hasattr(first_item, "primary"):
+            continue
+
+        if len(attr_value) == 1:
+            attr_value[0].primary = True
+        else:
+            primary_index = random.randint(0, len(attr_value) - 1)
+            for i, item in enumerate(attr_value):
+                item.primary = i == primary_index

tests/test_filling.py

@@ -3,11 +3,14 @@
 from typing import Literal
 from unittest.mock import patch
 
+from scim2_models import Email
 from scim2_models import Group
+from scim2_models import PhoneNumber
 from scim2_models import User
 from scim2_models.resources.user import X509Certificate
 
 from scim2_tester.filling import fill_with_random_values
+from scim2_tester.filling import fix_primary_attributes
 from scim2_tester.filling import generate_random_value
 from scim2_tester.filling import get_model_from_ref_type
 from scim2_tester.filling import get_random_example_value
@@ -123,8 +126,6 @@ def test_generate_random_value_with_examples(testing_context):
 
 def test_generate_random_value_phone_number(testing_context):
     """Generates phone numbers correctly."""
-    from scim2_models import PhoneNumber
-
     value = generate_random_value(testing_context, "phoneNumbers.value", PhoneNumber)
 
     assert isinstance(value, str)
@@ -191,8 +192,33 @@ def test_generate_random_value_reference_external(testing_context):
 
 def test_generate_random_value_default_string(testing_context):
     """Generates default string values."""
-    from scim2_models import User
-
     value = generate_random_value(testing_context, "title", User)
 
     assert isinstance(value, str)
+
+
+def test_fix_primary_attributes_single_object():
+    """Ensures single email gets primary=True."""
+    user = User(user_name="test")
+    user.emails = [Email(value="[email protected]", type=Email.Type.work)]
+
+    fix_primary_attributes(user)
+
+    assert len(user.emails) == 1
+    assert user.emails[0].primary is True
+
+
+def test_fix_primary_attributes_multiple_objects():
+    """Ensures exactly one email has primary=True when multiple exist."""
+    user = User(user_name="test")
+    user.emails = [
+        Email(value="[email protected]", type=Email.Type.work),
+        Email(value="[email protected]", type=Email.Type.home),
+        Email(value="[email protected]", type=Email.Type.other),
+    ]
+
+    fix_primary_attributes(user)
+
+    assert len(user.emails) == 3
+    primary_count = sum(1 for email in user.emails if email.primary)
+    assert primary_count == 1