Fix behavior when patch removes null uneditable fields

[azmeuk]

A mutability error should be raised when deleting read only and immutable fields, even if they are empty in the first place.

[ccoors]

This is one of the places where the spec unfortunately isn't very clear.

RFC 7644, Section 3.5.2.2

If an attribute is removed or becomes unassigned and is defined as a required attribute or a read-only attribute, the server SHALL return an HTTP response status code and a JSON detail error response as defined in Section 3.12, with a "scimType" error code of "mutability".

• is removed -> No, because it wasn't there to begin with
• becomes unassigned -> No, it was unassigned before

It really depends on where the implicit parentheses on that sentence are.

• If an attribute (is removed or becomes unassigned) and (is defined as a required attribute or a read-only attribute) -> no error
• If an attribute is removed or (becomes unassigned and is defined as a required attribute) or a read-only attribute -> error

I opted for the robustness principle ("be conservative in what you do, be liberal in what you accept from others"), so not raising an error since that would just potentially break some clients without providing any actual benefit.

[azmeuk]

Indeed, I am not 100% convinced by myself here :) I was motivated by RFC7644 §3.5.2 which sounds very general and don't make special cases for empty values:

Each operation against an attribute MUST be compatible with the
attribute's mutability and schema as defined in Sections 2.2 and 2.3
of [RFC7643]. For example, a client MUST NOT modify an attribute
that has mutability "readOnly" or "immutable".

But, is removing/nulling modifying?

I opted for the robustness principle ("be conservative in what you do, be liberal in what you accept from others"), so not raising an error since that would just potentially break some clients without providing any actual benefit.

Sounds fair, and in the end this is not a very important topic because data is not edited either way.

Maybe I'll ask on the SCIM mailing list to see what is the proper interpretation for this.