fix: send attributes and excludedAttributes as comma-separated values

Author: azmeuk

doc/changelog.rst

@@ -1,6 +1,15 @@
 Changelog
 =========
 
+[Unreleased]
+------------
+
+Fixed
+^^^^^
+- ``attributes`` and ``excludedAttributes`` are sent in the query string as comma-separated
+  values, per :rfc:`7644#section-3.9`. They used to be sent as repeated parameters, and some
+  servers only read the first value.
+
 [0.11.1] - 2026-10-01
 ---------------------
 

scim2_client/client.py

@@ -175,6 +175,18 @@ def _resource_url(endpoint: str, id: str) -> str:
     return f"{endpoint}/{quote(id, safe=_PATH_SEGMENT_SAFE)}"
 
 
+def _join_list_values(params: dict[str, Any]) -> dict[str, Any]:
+    """Send the list query parameters as comma-separated values (RFC 7644 §3.9).
+
+    Empty lists are left out of the query string.
+    """
+    return {
+        key: ",".join(map(str, value)) if isinstance(value, list) else value
+        for key, value in params.items()
+        if value != []
+    }
+
+
 @dataclass
 class RequestPayload:
     request_kwargs: dict[str, Any]
@@ -1100,7 +1112,7 @@ def _request_kwargs(self, method: str, req: RequestPayload) -> dict[str, Any]:
         """Build the arguments a prepared request is sent with."""
         body: dict[str, Any] = {}
         if method == "GET" and req.payload:
-            body = self._query_kwargs(req.payload)
+            body = self._query_kwargs(_join_list_values(req.payload))
 
         elif method not in ("GET", "DELETE"):
             body = {"json": req.payload}

tests/engines/test_werkzeug.py

@@ -105,6 +105,25 @@ def test_werkzeug_query_with_attributes(scim_client):
     assert result.title is None
 
 
+def test_werkzeug_query_list_parameters_are_comma_separated():
+    """List query parameters are sent as comma-separated values (RFC 7644 §3.9)."""
+    query_strings = []
+
+    @Request.application
+    def application(request):
+        query_strings.append(request.query_string.decode())
+        return Response(
+            '{"schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"], "totalResults": 0}',
+            content_type="application/scim+json",
+        )
+
+    scim_client = TestSCIMClient(
+        client=Client(application), provider=ScimProvider(models=[User])
+    )
+    scim_client.query(User, SearchRequest(attributes=["displayName", "title"]))
+    assert query_strings == ["attributes=displayName%2Ctitle"]
+
+
 def test_no_json():
     """Test that pages that do not return JSON raise an UnexpectedContentFormatException error."""
 

tests/test_query.py

@@ -638,7 +638,7 @@ def test_response_bad_content_type(sync_client):
 
 
 def test_search_request(httpserver, sync_client):
-    query_string = "attributes=userName&attributes=displayName&filter=userName+Eq+%22john%22&sortBy=userName&sortOrder=ascending&startIndex=1&count=10"
+    query_string = "attributes=userName%2CdisplayName&filter=userName+Eq+%22john%22&sortBy=userName&sortOrder=ascending&startIndex=1&count=10"
 
     httpserver.expect_request(
         "/Users/with-qs", query_string=query_string
@@ -673,7 +673,7 @@ def test_search_request(httpserver, sync_client):
 
 def test_query_parameters(httpserver, sync_client):
     """ResponseParameters can be used instead of SearchRequest for single-resource queries."""
-    query_string = "attributes=userName&attributes=displayName"
+    query_string = "attributes=userName%2CdisplayName"
 
     httpserver.expect_request(
         "/Users/with-rp", query_string=query_string
@@ -698,6 +698,23 @@ def test_query_parameters(httpserver, sync_client):
     assert response.id == "with-rp"
 
 
+def test_query_empty_list_parameters_are_not_sent(httpserver, sync_client):
+    """Empty attribute lists are left out of the query string."""
+    httpserver.expect_request(
+        "/Users/with-empty", query_string="attributes=userName"
+    ).respond_with_json(
+        {
+            "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
+            "id": "with-empty",
+            "userName": "bjensen@example.com",
+        },
+        status=200,
+    )
+    params = ResponseParameters(attributes=["userName"], excluded_attributes=[])
+    response = sync_client.query(User, "with-empty", params)
+    assert response.id == "with-empty"
+
+
 def test_query_parameters_dict(httpserver, sync_client):
     """Query parameters given as a dict are sent to the server."""
     sync_client.query(
@@ -752,8 +769,11 @@ def test_invalid_query_parameters_dict(sync_client):
 
 
 def test_query_dont_check_request_payload(httpserver, sync_client):
-    """Raw dict payloads are forwarded as-is when check_request_payload is False."""
-    query_string = "attributes=userName&attributes=displayName&excluded_attributes=timezone&excluded_attributes=phoneNumbers&filter=userName+Eq+%22john%22&sort_by=userName&sort_order=ascending&start_index=1&count=10"
+    """Raw dict payloads are forwarded unvalidated when check_request_payload is False.
+
+    List values are sent as comma-separated values.
+    """
+    query_string = "attributes=userName%2CdisplayName&excluded_attributes=timezone%2CphoneNumbers&filter=userName+Eq+%22john%22&sort_by=userName&sort_order=ascending&start_index=1&count=10"
 
     httpserver.expect_request(
         "/Users/with-qs", query_string=query_string