fix: do not wrap singular value in slice for patch with value expression

internal/patch/patch.go

@@ -100,8 +100,9 @@ func NewValidator(patchReq []byte, s schema.Schema, extensions ...schema.Schema)
 }
 
 // Validate validates the PATCH operation. Unknown attributes in complex values are ignored. The returned interface
-// contains a (sanitised) version of given value based on the attribute it targets. Multi-valued attributes will always
-// be returned wrapped in a slice, even if it is just one value that was defined within the operation.
+// contains a (sanitised) version of given value based on the attribute it targets. Multi-valued attributes are
+// returned wrapped in a slice, unless a value expression is present in the path (e.g. addresses[type eq "work"]),
+// in which case a singular value is returned unwrapped as it targets a specific matched element.
 func (v OperationValidator) Validate() (interface{}, error) {
 	switch v.Op {
 	case OperationAdd, OperationReplace:

internal/patch/replace_test.go

@@ -92,5 +92,5 @@ func Example_replaceWorkAddress() {
 	validator, _ := NewValidator(operation, schema.CoreUserSchema())
 	fmt.Println(validator.Validate())
 	// Output:
-	// [map[country:BE locality:ExampleCity postalCode:0001 primary:true streetAddress:ExampleStreet 1 type:work]] <nil>
+	// map[country:BE locality:ExampleCity postalCode:0001 primary:true streetAddress:ExampleStreet 1 type:work] <nil>
 }

internal/patch/update.go

@@ -62,5 +62,11 @@ func (v OperationValidator) validateUpdate() (interface{}, error) {
 	if scimErr != nil {
 		return nil, scimErr
 	}
+	// When a value expression is present (e.g. addresses[type eq "work"]),
+	// the value replaces the matched element and should not be wrapped in a
+	// slice. Only wrap when replacing the entire multi-valued attribute.
+	if v.Path != nil && v.Path.ValueExpression != nil {
+		return attr, nil
+	}
 	return []interface{}{attr}, nil
 }

internal/patch/update_test.go

@@ -131,3 +131,33 @@ func TestOperationValidator_ValidateUpdate(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateUpdate_SingularValueNotWrapped(t *testing.T) {
+	// RFC 7644 Section 3.5.2.3 (page 43): "If the target location is a
+	// multi-valued attribute and a value selection ("valuePath") filter is
+	// specified that matches one or more values of the multi-valued attribute,
+	// then all matching record values SHALL be replaced."
+	//
+	// The singular value should NOT be wrapped in a slice, as it represents the
+	// replacement for matched records.
+	// https://github.com/elimity-com/scim/issues/188
+	op, _ := json.Marshal(map[string]interface{}{
+		"op":    "replace",
+		"path":  `complexMultiValued[attr1 eq "value"]`,
+		"value": map[string]interface{}{"attr1": "new"},
+	})
+	validator, err := NewValidator(op, patchSchema, patchSchemaExtension)
+	if err != nil {
+		t.Fatal(err)
+	}
+	v, err := validator.Validate()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := v.([]interface{}); ok {
+		t.Error("singular value with value expression should not be wrapped in a slice")
+	}
+	if _, ok := v.(map[string]interface{}); !ok {
+		t.Errorf("expected map[string]interface{}, got %T", v)
+	}
+}