fix: make the password case-exact

Author: azmeuk

doc/changelog.rst

@@ -1,6 +1,16 @@
 Changelog
 =========
 
+[Unreleased]
+------------
+
+Security
+^^^^^^^^
+- The ``password`` of a :class:`~scim2_models.User` is case-exact, so ``password eq "SECRET"``
+  no longer matches ``secret``. RFC 7643 declares it case-insensitive, but compares passwords
+  by salted hash (:rfc:`RFC7643 §4.1.1 <7643#section-4.1.1>`), and the rules of
+  :rfc:`RFC7644 §5 <7644#section-5>` keep the case of passwords.
+
 [0.9.0] - 2026-09-27
 --------------------
 

samples/rfc7643-8.7.1-schema-user.json

@@ -200,7 +200,7 @@
       "multiValued": false,
       "description": "The User's cleartext password.  This attribute is intended to be used as a means to specify an initial password when creating a new User or to reset an existing User'spassword.",
       "required": false,
-      "caseExact": false,
+      "caseExact": true,
       "mutability": "writeOnly",
       "returned": "never",
       "uniqueness": "none"

scim2_models/resources/user.py

@@ -295,7 +295,9 @@ class User(Resource[AnyExtension]):
     active: bool | None = None
     """A Boolean value indicating the User's administrative status."""
 
-    password: Annotated[str | None, Mutability.write_only, Returned.never] = None
+    password: Annotated[
+        str | None, Mutability.write_only, Returned.never, CaseExact.true
+    ] = None
     """The User's cleartext password."""
 
     emails: list[Email] | None = None

tests/test_dynamic_resources.py

@@ -401,7 +401,7 @@ def test_make_user_model_from_schema(load_sample):
         == "The User's cleartext password.  This attribute is intended to be used as a means to specify an initial password when creating a new User or to reset an existing User'spassword."
     )
     assert User.get_field_annotation("password", Required) == Required.false
-    assert User.get_field_annotation("password", CaseExact) == CaseExact.false
+    assert User.get_field_annotation("password", CaseExact) == CaseExact.true
     assert User.get_field_annotation("password", Mutability) == Mutability.write_only
     assert User.get_field_annotation("password", Returned) == Returned.never
     assert User.get_field_annotation("password", Uniqueness) == Uniqueness.none

tests/test_filter_semantics.py

@@ -373,6 +373,15 @@ def test_a_write_only_attribute_takes_an_equality_or_a_presence_test(filter_):
     ScimFilter[User](filter_)._validate_semantics()
 
 
+def test_a_password_is_compared_with_its_case():
+    """RFC7643 §4.1.1 compares passwords by salted hash, which keeps the case."""
+    user = User(user_name="bjensen", password="Secret")
+
+    assert ScimFilter[User]('password eq "Secret"').match(user)
+    assert not ScimFilter[User]('password eq "secret"').match(user)
+    assert not ScimFilter[User]('password eq "SECRET"').match(user)
+
+
 @pytest.mark.parametrize("filter_", ['lock.code sw "x"', 'vault.label sw "x"'])
 def test_a_write_only_attribute_is_refused_through_a_complex_attribute(filter_):
     """A write-only sub-attribute, or the sub-attribute of a write-only one, is refused."""