ldap-rest 0.0.1

package/README.md

@@ -0,0 +1,48 @@
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/linagora/ldap-rest)
+
+# LDAP-Rest
+
+Lite LinID directory manager is a lightweight directory manager that provides LDAP integration through a plugin-based architecture.
+This system enables directory management operations with configurable authentication, extensible functionality through events/hooks,
+and extensible REST API.
+
+Core plugins also provide plugins that ensure LDAP data consistency.
+
+## How it works
+
+All configuration is done via command-line arguments and/or environment variables.
+Example:
+
+```shell
+npx ldap-rest --ldap-base 'dc=example,dc=com' \
+    --ldap-dn 'cn=admin,dc=example,dc=com' --ldap-pwd admin \
+    --ldap-url ldap://localhost \
+    --plugin core/ldap/groups --ldap-group-base 'ou=groups,dc=example,dc=com' \
+    --plugin core/ldap/externalUsersInGroups
+```
+
+## Command-line options and environment variables
+
+[ToDo]
+
+See also [Typescript declarations](./src/config/args.ts).
+
+## Documentation
+
+### For Application Developers
+
+- **[Developer Guide](./docs/DEVELOPER_GUIDE.md)** - Complete guide for building web applications using LDAP-Rest APIs and browser libraries
+
+### For Plugin Developers
+
+- **[Contributing Guide](./CONTRIBUTING.md)** - How to contribute and develop plugins
+- [Plugins](./src/plugins/README.md)
+- [Hooks](./HOOKS.md)
+
+## Copyright and license
+
+[![Powered by LINAGORA](./docs/linagora.png)](https://linagora.com)
+
+Copyright 2025-present [LINAGORA](https://linagora.com)
+
+Licensed under [GNU AGPL-3.0](./LICENSE])

package/bin/cleanup-external-users.mjs

@@ -0,0 +1,219 @@
+#!/usr/bin/env node
+
+/**
+ * Cleanup script for external users that are no longer referenced in any group
+ *
+ * Usage:
+ *   cleanup-external-users.mjs [--dry-run] [--verbose] [--quiet]
+ *
+ * Options:
+ *   --dry-run    Show what would be deleted without actually deleting
+ *   --verbose    Show detailed information about each user checked
+ *   --quiet      Only show errors and deletions (WOULD DELETE in dry-run mode)
+ */
+
+import { parseConfig } from '../dist/lib/parseConfig.js';
+import configArgs from '../dist/config/args.js';
+import ldapActions from '../dist/lib/ldapActions.js';
+import { buildLogger } from '../dist/logger/winston.js';
+
+// Parse CLI arguments
+const args = process.argv.slice(2);
+
+if (args.includes('--help') || args.includes('-h')) {
+  console.log(`
+cleanup-external-users - Remove orphaned external users from LDAP
+
+Usage:
+  cleanup-external-users [OPTIONS]
+
+Description:
+  Removes external users from the contacts branch that are no longer
+  referenced in any group. Useful for maintaining a clean LDAP directory.
+
+Options:
+  --dry-run     Show what would be deleted without actually deleting
+  --verbose     Show detailed information about each user checked
+  --quiet       Only show errors and deletions (WOULD DELETE in dry-run mode)
+  --help, -h    Show this help message
+
+Examples:
+  # Preview what would be deleted
+  cleanup-external-users --dry-run
+
+  # Delete orphaned users with detailed output
+  cleanup-external-users --verbose
+
+  # Delete orphaned users silently (for cron)
+  cleanup-external-users --quiet
+
+  # Preview in quiet mode (only show what would be deleted)
+  cleanup-external-users --dry-run --quiet
+`);
+  process.exit(0);
+}
+
+const dryRun = args.includes('--dry-run');
+const verbose = args.includes('--verbose');
+const quiet = args.includes('--quiet');
+
+// Parse config
+const config = parseConfig(configArgs);
+const logger = buildLogger(config);
+
+// Simple LDAP wrapper to match what DM provides
+const server = {
+  config,
+  logger,
+  hooks: {},
+  loadedPlugins: {},
+  operationSequence: 0,
+};
+
+const ldap = new ldapActions(server);
+
+async function main() {
+  try {
+    if (!quiet) {
+      logger.info('Starting cleanup of external users');
+    }
+
+    if (!config.external_members_branch) {
+      logger.error('external_members_branch not configured');
+      process.exit(1);
+    }
+
+    if (!config.ldap_group_base) {
+      logger.error('ldap_group_base not configured');
+      process.exit(1);
+    }
+
+    if (dryRun && !quiet) {
+      logger.info('DRY RUN MODE - no changes will be made');
+    }
+
+    // Get all external users
+    if (!quiet) {
+      logger.info(
+        `Searching for external users in ${config.external_members_branch}`
+      );
+    }
+    const externalUsersResult = await ldap.search(
+      {
+        paged: false,
+        scope: 'one',
+        attributes: ['dn', 'mail'],
+      },
+      config.external_members_branch
+    );
+
+    const externalUsers = externalUsersResult.searchEntries;
+    if (!quiet) {
+      logger.info(`Found ${externalUsers.length} external users`);
+    }
+
+    if (externalUsers.length === 0) {
+      if (!quiet) {
+        logger.info('No external users to check');
+      }
+      return;
+    }
+
+    // Get all groups
+    if (!quiet) {
+      logger.info(`Searching for groups in ${config.ldap_group_base}`);
+    }
+    const groupsResult = await ldap.search(
+      {
+        paged: false,
+        scope: 'sub',
+        attributes: ['dn', config.ldap_group_member_attribute || 'member'],
+      },
+      config.ldap_group_base
+    );
+
+    const groups = groupsResult.searchEntries;
+    if (!quiet) {
+      logger.info(`Found ${groups.length} groups`);
+    }
+
+    // Build a set of all referenced member DNs
+    const memberAttr = config.ldap_group_member_attribute || 'member';
+    const referencedMembers = new Set();
+
+    for (const group of groups) {
+      const members = group[memberAttr];
+      if (members) {
+        const memberList = Array.isArray(members) ? members : [members];
+        memberList.forEach(member => {
+          // Normalize DN (remove spaces)
+          referencedMembers.add(member.replace(/\s/g, ''));
+        });
+      }
+    }
+
+    if (!quiet) {
+      logger.info(
+        `Found ${referencedMembers.size} unique member references across all groups`
+      );
+    }
+
+    // Check each external user
+    let toDelete = 0;
+    let kept = 0;
+
+    for (const user of externalUsers) {
+      const userDn = user.dn.replace(/\s/g, '');
+      const isReferenced = referencedMembers.has(userDn);
+
+      if (isReferenced) {
+        kept++;
+        if (verbose) {
+          logger.info(
+            `KEEP: ${user.dn} (${user.mail || 'no mail'}) - still referenced`
+          );
+        }
+      } else {
+        toDelete++;
+        if (dryRun) {
+          logger.info(
+            `WOULD DELETE: ${user.dn} (${user.mail || 'no mail'}) - not referenced`
+          );
+        } else {
+          if (!quiet) {
+            logger.info(`DELETING: ${user.dn} (${user.mail || 'no mail'})`);
+          }
+          try {
+            await ldap.del(user.dn);
+          } catch (err) {
+            logger.error(`Failed to delete ${user.dn}: ${err}`);
+          }
+        }
+      }
+    }
+
+    // Summary
+    if (!quiet) {
+      logger.info('');
+      logger.info('=== CLEANUP SUMMARY ===');
+      logger.info(`Total external users: ${externalUsers.length}`);
+      logger.info(`Kept (still referenced): ${kept}`);
+      logger.info(`${dryRun ? 'Would delete' : 'Deleted'}: ${toDelete}`);
+
+      if (dryRun && toDelete > 0) {
+        logger.info('');
+        logger.info('Run without --dry-run to actually delete these users');
+      }
+    }
+  } catch (err) {
+    logger.error(`Error during cleanup: ${err}`);
+    process.exit(1);
+  } finally {
+    process.exit(0);
+  }
+}
+
+main().catch(err => {
+  console.error('Fatal error:', err);
+  process.exit(1);
+});

package/bin/index.mjs

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+
+import { DM } from '../dist/bin/index.js';
+
+// Parse CLI arguments
+const args = process.argv.slice(2);
+
+if (args.includes('--help') || args.includes('-h')) {
+  console.log(`
+ldap-rest - Lightweight LDAP directory manager
+
+Usage:
+  ldap-rest [OPTIONS]
+
+Description:
+  Starts the ldap-rest server which provides a REST API and web interface
+  for managing LDAP directories. Configuration is done through environment
+  variables or command-line arguments.
+
+Main options:
+  --help, -h                Show this help message
+  --port PORT               Server port (default: 8080)
+  --ldap-url URL            LDAP server URL
+  --ldap-dn DN              LDAP bind DN
+  --ldap-pwd PASSWORD       LDAP bind password
+  --ldap-base BASE          LDAP base DN
+  --plugin PLUGIN           Load plugin (can be specified multiple times)
+  --api-prefix PREFIX       API prefix (default: /api)
+  --log-level LEVEL         Log level (error, warn, info, debug)
+
+See plugin documentation for additional options.
+
+Environment Variables:
+  All command-line options can also be set via environment variables
+  by prefixing with DM_ and using uppercase with underscores.
+  Example: --ldap-url becomes DM_LDAP_URL
+
+Examples:
+  # Start server with default configuration
+  npx ldap-rest
+
+  # Start with specific LDAP server
+  npx ldap-rest --ldap-url ldap://localhost:389
+
+  # Load specific plugins
+  npx ldap-rest --plugin ldapGroups --plugin ldapOrganization
+`);
+  process.exit(0);
+}
+
+const server = new DM();
+
+await server.ready;
+await server.run();

package/bin/sync-james.mjs

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+/**
+ * Sync utility to verify and fix consistency between LDAP and James
+ * Ensures James quotas match LDAP mailQuota values
+ * @author Generated with Claude Code
+ */
+
+import fetch from 'node-fetch';
+import { DM } from '../dist/bin/index.js';
+
+// Parse command line arguments
+const args = process.argv.slice(2);
+const quiet = args.includes('--quiet') || args.includes('-q');
+const dryRun = args.includes('--dry-run') || args.includes('-n');
+
+if (args.includes('--help') || args.includes('-h')) {
+  console.log(`
+Usage: sync-james [options]
+
+Synchronizes James quotas with LDAP mailQuota values.
+LDAP is considered the source of truth.
+
+Options:
+  --quiet, -q      Only show summary and errors
+  --dry-run, -n    Show what would be changed without making changes
+  --help, -h       Show this help message
+
+Environment variables:
+  DM_JAMES_WEBADMIN_URL    James WebAdmin URL (required)
+  DM_JAMES_WEBADMIN_TOKEN  James WebAdmin authentication token
+  DM_LDAP_BASE             LDAP search base
+  DM_MAIL_ATTRIBUTE        Mail attribute name (default: mail)
+  DM_QUOTA_ATTRIBUTE       Quota attribute name (default: mailQuota)
+`);
+  process.exit(0);
+}
+
+async function syncJamesQuotas() {
+  const dm = new DM();
+  await dm.ready;
+
+  const mailAttr = dm.config.mail_attribute || 'mail';
+  const quotaAttr = dm.config.quota_attribute || 'mailQuota';
+  const jamesUrl = dm.config.james_webadmin_url;
+  const jamesToken = dm.config.james_webadmin_token;
+
+  if (!jamesUrl) {
+    dm.logger.error('DM_JAMES_WEBADMIN_URL is not configured');
+    process.exit(1);
+  }
+
+  if (!quiet) {
+    dm.logger.info('Starting LDAP to James quota synchronization...');
+    dm.logger.info(`LDAP base: ${dm.config.ldap_base}`);
+    dm.logger.info(`James URL: ${jamesUrl}`);
+    if (dryRun) {
+      dm.logger.info('DRY RUN MODE: No changes will be made');
+    }
+    dm.logger.info('');
+  }
+
+  try {
+    // Search for all users with mail and quota attributes (paginated for large directories)
+    const resultGenerator = await dm.ldap.search({
+      paged: true,
+      filter: `(&(${mailAttr}=*)(${quotaAttr}=*))`,
+      attributes: [mailAttr, quotaAttr, 'dn'],
+    });
+
+    let checked = 0;
+    let synced = 0;
+    let errors = 0;
+
+    // Process results page by page
+    for await (const result of resultGenerator) {
+      if (!result.searchEntries || result.searchEntries.length === 0) {
+        continue;
+      }
+
+      if (!quiet) {
+        dm.logger.info(
+          `Processing batch of ${result.searchEntries.length} users...`
+        );
+      }
+
+      for (const entry of result.searchEntries) {
+        const dn = entry.dn;
+        const mail = Array.isArray(entry[mailAttr])
+          ? entry[mailAttr][0]
+          : entry[mailAttr];
+        const ldapQuota = Array.isArray(entry[quotaAttr])
+          ? Number(entry[quotaAttr][0])
+          : Number(entry[quotaAttr]);
+
+        if (!mail || isNaN(ldapQuota)) {
+          dm.logger.warn(`Skipping ${dn}: invalid mail or quota`);
+          continue;
+        }
+
+        checked++;
+
+        try {
+          // Get James quota
+          const getUrl = `${jamesUrl}/quota/users/${mail}/size`;
+          const headers = {};
+          if (jamesToken) {
+            headers.Authorization = `Bearer ${jamesToken}`;
+          }
+
+          const getRes = await fetch(getUrl, { method: 'GET', headers });
+
+          if (!getRes.ok) {
+            if (getRes.status === 404) {
+              dm.logger.warn(
+                `User ${mail} not found in James, skipping (DN: ${dn})`
+              );
+            } else {
+              dm.logger.error(
+                `Error getting quota for ${mail}: ${getRes.status} ${getRes.statusText}`
+              );
+              errors++;
+            }
+            continue;
+          }
+
+          const jamesQuota = Number(await getRes.text());
+
+          if (jamesQuota === ldapQuota) {
+            if (!quiet) {
+              dm.logger.info(`${mail}: quota OK (${ldapQuota})`);
+            }
+          } else {
+            dm.logger.warn(
+              `${mail}: quota mismatch - LDAP: ${ldapQuota}, James: ${jamesQuota}`
+            );
+            if (dryRun) {
+              dm.logger.info(`  Would update James quota to ${ldapQuota}`);
+              synced++;
+            } else {
+              if (!quiet) {
+                dm.logger.info(`  Updating James quota to ${ldapQuota}...`);
+              }
+
+              // Update James quota
+              const putUrl = `${jamesUrl}/quota/users/${mail}/size`;
+              const putRes = await fetch(putUrl, {
+                method: 'PUT',
+                headers,
+                body: ldapQuota.toString(),
+              });
+
+              if (putRes.ok) {
+                if (!quiet) {
+                  dm.logger.info(`  Updated successfully`);
+                }
+                synced++;
+              } else {
+                dm.logger.error(
+                  `  Failed to update: ${putRes.status} ${putRes.statusText}`
+                );
+                errors++;
+              }
+            }
+          }
+        } catch (err) {
+          dm.logger.error(`Error processing ${mail}: ${err.message}`);
+          errors++;
+        }
+      }
+    }
+
+    dm.logger.info('\n' + '='.repeat(60));
+    dm.logger.info('Synchronization summary:');
+    dm.logger.info(`  Users checked: ${checked}`);
+    dm.logger.info(`  Quotas ${dryRun ? 'needing sync' : 'synced'}: ${synced}`);
+    dm.logger.info(`  Errors: ${errors}`);
+    dm.logger.info('='.repeat(60));
+  } catch (err) {
+    dm.logger.error('Error during synchronization:', err);
+    process.exit(1);
+  } finally {
+    await dm.ldap.unbind();
+  }
+}
+
+// Run the sync
+syncJamesQuotas().catch(err => {
+  console.error('Fatal error:', err);
+  process.exit(1);
+});

package/dist/abstract/ldapFlat.js

@@ -0,0 +1 @@
+import t from"fs";import{wantJson as e,serverError as i,notFound as r,jsonBody as s,created as a,tryMethod as n}from"../lib/expressFormatedResponses.js";import{transformSchemas as o,launchHooksChained as h,launchHooks as c}from"../lib/utils.js";import d from"./plugin.js";class LdapFlat extends d{constructor(e,i){if(super(e),this.ldap=e.ldap,this.base=i.base,this.mainAttribute=i.mainAttribute,this.objectClass=i.objectClass,this.defaultAttributes=i.defaultAttributes||{},this.singularName=i.singularName,this.pluralName=i.pluralName,this.hookPrefix=i.hookPrefix,!this.base)throw new Error(`LDAP base is not defined for ${this.singularName}`);if(i.schemaPath)try{const e=t.readFileSync(i.schemaPath,"utf8");this.schema=JSON.parse(o(e,this.config)),this.logger.info(`${this.singularName} schema loaded from ${i.schemaPath}`)}catch(t){this.logger.error(`Failed to load ${this.singularName} schema from ${i.schemaPath}: ${t}`)}}api(t){t.get(`${this.config.api_prefix}/v1/ldap/${this.pluralName}`,async(t,r)=>{if(e(t,r))try{const e={};t.query.match&&"string"==typeof t.query.match&&t.query.attribute&&"string"==typeof t.query.attribute&&(e.filter=`(${t.query.attribute}=*${t.query.match}*)`),t.query.attributes&&"string"==typeof t.query.attributes&&(e.attributes=t.query.attributes.split(","));const i=await this.listEntries(e);r.json(i)}catch(t){return i(r,t)}}),t.get(`${this.config.api_prefix}/v1/ldap/${this.pluralName}/:id`,async(t,e)=>this.apiGet(t,e)),t.post(`${this.config.api_prefix}/v1/ldap/${this.pluralName}`,async(t,e)=>this.apiAdd(t,e)),t.delete(`${this.config.api_prefix}/v1/ldap/${this.pluralName}/:id`,async(t,e)=>this.apiDelete(t,e)),t.put(`${this.config.api_prefix}/v1/ldap/${this.pluralName}/:id`,async(t,e)=>this.apiModify(t,e)),t.post(`${this.config.api_prefix}/v1/ldap/${this.pluralName}/:id/move`,async(t,e)=>this.apiMove(t,e))}async apiGet(t,s){if(!e(t,s))return;const a=decodeURIComponent(t.params.id);try{const t=/,/.test(a)?a:`${this.mainAttribute}=${a},${this.base}`,e=await this.ldap.search({paged:!1,scope:"base"},t);if(0===e.searchEntries.length)return r(s,`${this.singularName} not found`);s.json(e.searchEntries[0])}catch(t){return t.code&&32===t.code?r(s,`${this.singularName} not found`):i(s,t)}}async apiAdd(t,e){const r=s(t,e,this.mainAttribute);if(!r)return;const n=r[this.mainAttribute],o={...r};delete o[this.mainAttribute],delete o.dn;try{await this.addEntry(n,o,t);const i=await this.searchEntriesByName(n,!1);return a(e,i[n])}catch(t){return i(e,t)}}async apiDelete(t,i){if(!e(t,i))return;const r=decodeURIComponent(t.params.id);await n(i,this.deleteEntry.bind(this),r)}async apiModify(t,e){const i=s(t,e);if(!i)return;const r=decodeURIComponent(t.params.id);await n(e,this.modifyEntry.bind(this),r,i)}async apiMove(t,r){if(!e(t,r))return;const a=s(t,r,"targetOrgDn");if(!a)return;const n=decodeURIComponent(t.params.id),{targetOrgDn:o}=a;if(o&&"string"==typeof o)try{const e=await this.moveEntry(n,o,t);r.json({success:!0,...e})}catch(t){return i(r,t)}else r.status(400).json({error:"Missing or invalid targetOrgDn in request body"})}async addEntry(t,e={},i){let r;if(new RegExp(`^${this.mainAttribute}=`).test(t)){r=t;const e=`,${this.base}`;if(!r.endsWith(e))throw new Error(`DN must be in the flat branch "${this.base}". Provided DN "${r}" does not end with "${e}"`);t=t.replace(new RegExp(`^${this.mainAttribute}=([^,]+).*`),"$1")}else r=`${this.mainAttribute}=${t},${this.base}`;await this.validateNewEntry(r,{objectClass:this.objectClass,[this.mainAttribute]:t,...e});let s,a={objectClass:this.objectClass,...this.defaultAttributes,[this.mainAttribute]:t,...e};this.schema?this.logger.debug("Schema loaded, attributes:",Object.keys(this.schema.attributes)):this.logger.warn("No schema available"),[r,a]=await h(this.registeredHooks[`${this.hookPrefix}add`],[r,a]),this.logger.debug("Adding LDAP entry:",{dn:r,entry:JSON.stringify(a,null,2)}),this.logger.debug("Entry attributes breakdown:");for(const[t,e]of Object.entries(a))this.logger.debug(`  ${t}: ${typeof e} = ${JSON.stringify(e)}`);try{s=await this.ldap.add(r,a,i)}catch(t){throw this.logger.error("LDAP add failed:",{dn:r,entry:JSON.stringify(a,null,2),error:t}),new Error(`Failed to add ${this.singularName} ${r}: ${t}`)}return c(this.registeredHooks[`${this.hookPrefix}adddone`],[r,a]),s}async modifyEntry(t,e){let i=/,/.test(t)?t:`${this.mainAttribute}=${t},${this.base}`;const r=this.opNumber();if([i,e]=await h(this.registeredHooks[`${this.hookPrefix}modify`],[i,e,r]),e.add&&e.add[this.mainAttribute])throw new Error(`${this.mainAttribute} attribute is unique, cannot add`);if(e.delete){if(e.delete instanceof Object&&e.delete[this.mainAttribute])throw new Error(`Cannot delete ${this.mainAttribute} attribute`);if(Array.isArray(e.delete)&&e.delete.includes(this.mainAttribute))throw new Error(`Cannot delete ${this.mainAttribute} attribute`)}if(e.replace&&e.replace[this.mainAttribute])throw new Error(`Use dedicated API to change ${this.mainAttribute} attribute`);await this.validateChanges(i,e);const s=await this.ldap.modify(i,e);return c(this.registeredHooks[`${this.hookPrefix}modifydone`],[i,e,r]),s}async renameEntry(t,e){let i=/,/.test(t)?t:`${this.mainAttribute}=${t},${this.base}`,r=/,/.test(e)?e:`${this.mainAttribute}=${e},${this.base}`;[i,r]=await h(this.registeredHooks[`${this.hookPrefix}rename`],[i,r]);const s=await this.ldap.rename(i,r);return c(this.registeredHooks[`${this.hookPrefix}renamedone`],[i,r]),s}async deleteEntry(t){let e=/,/.test(t)?t:`${this.mainAttribute}=${t},${this.base}`;e=await h(this.registeredHooks[`${this.hookPrefix}delete`],e);const i=await this.ldap.delete(e);return c(this.registeredHooks[`${this.hookPrefix}deletedone`],e),i}async moveEntry(t,e,i){const r=/,/.test(t)?t:`${this.mainAttribute}=${t},${this.base}`,s=this.config.ldap_organization_link_attribute||"twakeDepartmentLink",a=this.config.ldap_organization_path_attribute||"twakeDepartmentPath";if(!this.schema?.attributes[s]||!this.schema?.attributes[a])throw new Error(`Schema for ${this.singularName} does not support move operation (missing ${s} or ${a})`);const n=await this.ldap.search({paged:!1,scope:"base",attributes:[s]},r,i);if(!n.searchEntries||0===n.searchEntries.length)throw new Error(`Entry ${r} not found`);const o=await this.getDepartmentPath(e,i);[,e]=await h(this.registeredHooks[`${this.hookPrefix}move`],[r,e,i]);const c={replace:{[s]:e,[a]:o}};return await this.modifyEntry(t,c),{departmentPath:o,departmentLink:e}}async getDepartmentPath(t,e){const i=this.config.ldap_organization_path_attribute||"twakeDepartmentPath";try{const r=await this.ldap.search({paged:!1,scope:"base",attributes:[i,"ou","o"]},t,e);if(!r.searchEntries||0===r.searchEntries.length)throw new Error(`Organization ${t} not found`);const s=r.searchEntries[0];if(s[i]){const t=s[i];return Array.isArray(t)?String(t[0]):String(t)}const a=s.ou||s.o;if(a){return`/${Array.isArray(a)?String(a[0]):String(a)}`}return this.logger.warn(`Organization ${t} has no ${i} attribute, using DN`),t}catch(e){throw new Error(`Failed to fetch organization ${t}: ${e}`)}}async listEntries({filter:t,attributes:e}){const i={paged:!0,filter:t=t||"(objectClass=*)"};e&&e.length>0&&(i.attributes=e);const r=await this.ldap.search(i,this.base),s={};for await(const t of r)t.searchEntries.forEach(t=>{if(t[this.mainAttribute]){const e=t[this.mainAttribute];let i;i=Array.isArray(e)?"string"==typeof e[0]?e[0]:String(e[0]):"string"==typeof e?e:String(e),s[i]=t}});return s}async searchEntriesByName(t,e=!1,i=[this.mainAttribute]){const r=e?`(${this.mainAttribute}=*${t}*)`:`(${this.mainAttribute}=${t})`;return await this.listEntries({filter:r,attributes:i})}async validateNewEntry(t,e){if(!this.schema)return!0;for(const[t,i]of Object.entries(this.schema.attributes))i.fixed&&void 0!==i.default&&(e[t]=i.default);for(const[t,i]of Object.entries(e)){if(!this.schema.attributes[t]){if(this.schema.strict)throw new Error(`Unknown attribute "${t}" for ${this.singularName}`);continue}const e=this.schema.attributes[t];if(e.fixed&&void 0!==e.default){const r=JSON.stringify(e.default);if(r!==JSON.stringify(i))throw new Error(`Attribute "${t}" is fixed and cannot be modified. Expected: ${r}`)}if(!await this._validateOneChange(t,i))throw new Error(`Invalid value for attribute "${t}"`);if(e.required&&!i)throw new Error(`Attribute "${t}" is required`)}for(const[t,i]of Object.entries(this.schema.attributes))if(i.required&&!e[t])throw new Error(`Attribute "${t}" is required`);return!0}async validateChanges(t,e){if(!this.schema)return!0;const checkFixed=(t,e)=>{const i=this.schema?.attributes[t];if(i?.fixed)throw new Error(`Attribute "${t}" is fixed and cannot be modified`)};if(e.add)for(const[t,i]of Object.entries(e.add))if(checkFixed(t),!await this._validateOneChange(t,i))throw new Error(`Invalid value for attribute "${t}"`);if(e.replace)for(const[t,i]of Object.entries(e.replace))if(checkFixed(t),!await this._validateOneChange(t,i))throw new Error(`Invalid value for attribute "${t}"`);if(e.delete){const t=Array.isArray(e.delete)?e.delete:Object.keys(e.delete);for(const e of t){const t=this.schema.attributes[e];if(t?.fixed)throw new Error(`Attribute "${e}" is fixed and cannot be deleted`)}}return!0}async _validateOneChange(t,e){if(!this.schema)return!0;const i=this.schema.attributes[t];if(!i)return!this.schema.strict;if(!e)return!0;if("pointer"===i.type){if("string"!=typeof e)throw new Error(`Field ${t} must be a string (DN pointer)`);const r=e;if(i.branch&&i.branch.length>0){if(!i.branch.some(t=>new RegExp(`,?${t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}$`,"i").test(r)))throw new Error(`Field ${t} must point to a DN within allowed branches: ${i.branch.join(", ")}`)}try{const e=await this.ldap.search({paged:!1,scope:"base"},r);if(!e||!e.searchEntries||0===e.searchEntries.length)throw new Error(`Field ${t} points to non-existent DN: ${r}`)}catch(e){throw new Error(`Field ${t} points to invalid or non-existent DN: ${r}`)}}if(i.test){const t=new RegExp(i.test);return Array.isArray(e)?e.every(e=>t.test(e)):t.test(e)}return!0}escapeDnValue(t){if(!t)return t;return t.split(",").map(t=>{const e=t.trim(),i=e.indexOf("=");if(-1===i)return e;const r=e.substring(0,i);let s=e.substring(i+1);return s=s.replace(/\\/g,"\\\\").replace(/ /g,"\\ ").replace(/#/g,"\\#").replace(/\+/g,"\\+").replace(/,/g,"\\,").replace(/;/g,"\\;").replace(/</g,"\\<").replace(/>/g,"\\>"),`${r}=${s}`}).join(",")}}export{LdapFlat as default};

package/dist/abstract/plugin.js

@@ -0,0 +1 @@
+class DmPlugin{constructor(e){this.registeredHooks={},this.server=e,this.config=e.config,this.logger=e.logger,this.registeredHooks=e.hooks}opNumber(){return this.server.operationSequence++}}export{DmPlugin as default};

package/dist/abstract/twakePlugin.js

@@ -0,0 +1 @@
+import t from"node-fetch";import r from"p-limit";import e from"./plugin.js";class TwakePlugin extends e{constructor(t,e,s,i){if(super(t),this.webadminUrl=this.config[e]||"",this.webadminToken=this.config[s]||"",!this.webadminUrl)throw new Error(`Twake plugin: ${e} is required`);const n="number"==typeof this.config[i]?this.config[i]:10;this.requestLimit=r(n),this.logger.info(`Twake plugin HTTP request concurrency limit set to ${n}`),this.mailAttr=this.config.mail_attribute||"mail",this.displayNameAttr=this.config.display_name_attribute||"displayName"}createHeaders(t){const r={};return this.webadminToken&&(r.Authorization=`Bearer ${this.webadminToken}`),t&&(r["Content-Type"]=t),r}async callWebAdminApi(r,e,s,i,n,a){return this.requestLimit(async()=>{const o={plugin:this.name,event:r,result:"error",dn:i,...a};try{const i={method:s,headers:this.createHeaders(n?"application/json":void 0)};n&&(i.body=n);const a=await t(e,i);a.ok?this.logger.info({...o,result:"success",http_status:a.status,url:e}):this.shouldIgnoreError(a.status,r)?this.logger.debug({...o,result:"ignored",http_status:a.status,http_status_text:a.statusText,url:e}):this.logger.error({...o,http_status:a.status,http_status_text:a.statusText,url:e})}catch(t){this.logger.error({...o,error:t,url:e})}})}shouldIgnoreError(t,r){return 409===t&&r.includes("Alias")}attributeToString(t){return t?Array.isArray(t)?t.length>0?String(t[0]):null:String(t):null}async ldapGetAttributes(t,r){try{const e=r&&r.length>0?r:void 0,s=await this.server.ldap.search({paged:!1,scope:"base",attributes:e},t);return s.searchEntries&&s.searchEntries.length>0?s.searchEntries[0]:null}catch(r){return this.logger.debug(`Could not fetch attributes from DN ${t}: ${r}`),null}}getAliases(t){if(!t)return[];return(Array.isArray(t)?t:[t]).map(t=>Buffer.isBuffer(t)?t.toString("utf-8"):String(t)).map(t=>this.normalizeAlias(t))}normalizeAlias(t){return t.toLowerCase().startsWith("smtp:")?t.substring(5):t}extractMailDomain(t){const r=t.split("@");return 2===r.length?r[1]:null}extractDomainFromDn(t){const r=t.match(/dc=([^,]+)/gi);return r?r.map(t=>t.substring(3)).join("."):"example.com"}}export{TwakePlugin,TwakePlugin as default};

package/dist/bin/index.js

@@ -0,0 +1 @@
+import{fileURLToPath as i}from"url";import{join as e,dirname as s}from"path";import o from"express";import r from"body-parser";import{parseConfig as t}from"../lib/parseConfig.js";import n from"../config/args.js";import g from"../lib/ldapActions.js";import{buildLogger as l}from"../logger/winston.js";import{setLogger as a}from"../lib/expressFormatedResponses.js";import h from"../plugins/priority.json.js";class DM{constructor(){this.hooks={},this.loadedPlugins={},this.config=t(n),this.app=o(),this.app.use(r.json()),this.app.use(r.urlencoded({extended:!0})),this.logger=l(this.config),this.ldap=new g(this),a(this.logger),this.operationSequence=0;const i=[];if(this.config.plugin){const e=this.config.plugin.find(i=>i.includes("configApi"));let s=this.config.plugin.filter(i=>!i.includes("configApi"));for(const e of h)s.includes(e)&&(s=s.filter(i=>i!==e),i.push(this.loadPlugin(e)));for(const e of s)i.push(this.loadPlugin(e));e&&i.push(Promise.all(i).then(()=>this.loadPlugin(e)))}this.ready=new Promise((e,s)=>{i.length>0?Promise.all(i).then(()=>e()).catch(i=>s(new Error("Error loading plugins: "+i))):e()})}run(){return new Promise((i,e)=>{this.server=this.app.listen(this.config.port,s=>{s?(this.logger.error(`Error starting server: ${s}`),e(s)):(this.logger.debug(`Server started on port ${this.config.port}`),i())})})}stop(){this.app.removeAllListeners(),this.server?.close(),this.logger.debug("Server stopped")}loadPlugin(o){let r,t;if(/:/.test(o)){let i=o.substring(o.indexOf(":")+1);if(o=o.substring(0,o.indexOf(":")),/:/.test(i)){r=i.substring(0,i.indexOf(":")),r||(r=void 0),i=i.substring(i.indexOf(":")+1);try{t=JSON.parse(i),"object"!=typeof t?(this.logger.error(`Overrides for plugin ${o} are not valid: ${i}`),t=void 0):this.logger.debug(`Overrides for plugin ${r||o}: ${i}`)}catch(e){this.logger.error(`Failed to parse overrides for plugin ${o}: ${e}, using ${i}`),t=void 0}}else r=i,r||(r=void 0)}else r=void 0;return this.logger.debug(`Loading plugin ${o}`),o.startsWith("core/")&&(o=o.replace("core/",e(s(i(import.meta.url)),"..","plugins")+"/").replace(/$/,".js")),new Promise((i,e)=>{import(o).then(async s=>{let n;if(s&&s.default&&(s=s.default),t){const i={...this.config,...t};n=new s({...this,config:i})}else n=new s(this);if(!n)return e(new Error(`Unable to load ${o}`));i(await this.registerPlugin(o,n,r)),this.logger.debug(`Plugin ${n.name} loaded`)}).catch(i=>e(new Error(`Failed to load plugin ${o}: ${i}`)))})}async registerPlugin(i,e,s){if(e.name||(e.name=i),s&&(e.name=s),this.loadedPlugins[e.name])return this.logger.info(`Plugin ${i} already loaded as ${e.name}`),!1;if(this.logger.debug(`Registering plugin ${i} as ${e.name}`),e.dependencies)for(const i in e.dependencies)this.loadedPlugins[i]||(this.logger.debug(`Plugin ${e.name} depends on ${i}, loading it first`),await this.loadPlugin(e.dependencies[i]));if(e.api&&(this.logger.debug(`Plugin ${e.name} has API, registering it`),await e.api(this.app)),e.hooks)for(const i in e.hooks){this.logger.debug(`Plugin ${e.name} has hook ${i}, registering it`);const s=e.hooks[i];if(this.hooks[i]||(this.hooks[i]=[]),!s||"function"!=typeof s)throw new Error(`Plugin ${e.name}: hook ${i} is invalid`);this.hooks[i].push(s)}return this.loadedPlugins[e.name]=e,!0}}export{DM};

package/dist/config/args.js

@@ -0,0 +1 @@
+import{fileURLToPath as a}from"url";import{join as _,dirname as e}from"path";const t=[["--port","DM_PORT",8081,"number"],["--plugin","DM_PLUGINS",[],"array","--plugins"],["--log-level","DM_LOG_LEVEL","info"],["--logger","DM_LOGGER","console"],["--api-prefix","DM_API_PREFIX","/api"],["--mail-domain","DM_MAIL_DOMAIN",[],"array","--mail-domains"],["--ldap-base","DM_LDAP_BASE",""],["--ldap-dn","DM_LDAP_DN","cn=admin,dc=example,dc=com"],["--ldap-pwd","DM_LDAP_PWD","admin"],["--ldap-url","DM_LDAP_URL","ldap://localhost"],["--ldap-user-main-attribute","DM_LDAP_USER_ATTRIBUTE","uid"],["--ldap-cache-max","DM_LDAP_CACHE_MAX",1e3,"number"],["--ldap-cache-ttl","DM_LDAP_CACHE_TTL",300,"number"],["--ldap-pool-size","DM_LDAP_POOL_SIZE",5,"number"],["--ldap-connection-ttl","DM_LDAP_CONNECTION_TTL",60,"number"],["--schemas-path","DM_SCHEMAS_PATH",_(e(a(import.meta.url)),"..","..","static","schemas")],["--mail-attribute","DM_MAIL_ATTRIBUTE","mail"],["--quota-attribute","DM_QUOTA_ATTRIBUTE","mailQuota"],["--delegation-attribute","DM_DELEGATION_ATTRIBUTE","twakeDelegatedUsers"],["--alias-attribute","DM_ALIAS_ATTRIBUTE","mailAlternateAddress"],["--forward-attribute","DM_FORWARD_ATTRIBUTE","mailForwardingAddress"],["--display-name-attribute","DM_DISPLAY_NAME_ATTRIBUTE","displayName"],["--user-class","DM_USER_CLASSES",["top","twakeAccount","twakeWhitePages"],"array","--user-classes"],["--ldap-top-organization","DM_LDAP_TOP_ORGANIZATION",""],["--ldap-organization-class","DM_LDAP_ORGANIZATION_CLASSES",["top","organizationalUnit","twakeDepartment"],"array","--ldap-organization-classes"],["--ldap-organization-link-attribute","DM_LDAP_ORGANIZATION_LINK_ATTRIBUTE","twakeDepartmentLink"],["--ldap-organization-path-attribute","DM_LDAP_ORGANIZATION_PATH_ATTRIBUTE","twakeDepartmentPath"],["--ldap-organization-path-separator","DM_LDAP_ORGANIZATION_PATH_SEPARATOR"," / "],["--ldap-organization-max-subnodes","DM_LDAP_ORGANIZATION_MAX_SUBNODES",50,"number"],["--ldap-group-base","DM_LDAP_GROUP_BASE",""],["--ldap-groups-main-attribute","DM_LDAP_GROUPS_MAIN_ATTRIBUTE","cn"],["--group-class","DM_GROUP_CLASSES",["top","groupOfNames"],"array","--group-classes"],["--group-allow-unexistent-members","DM_ALLOW_UNEXISTENT_MEMBERS",!1,"boolean"],["--group-default-attributes","DM_GROUP_DEFAULT_ATTRIBUTES",{},"json"],["--group-dummy-user","DM_GROUP_DUMMY_USER","cn=fakeuser"],["--group-schema","DM_GROUP_SCHEMA",_(e(a(import.meta.url)),"..","..","static","schemas","twake","groups.json")],["--external-members-branch","DM_EXTERNAL_MEMBERS_BRANCH","ou=contacts,dc=example,dc=com"],["--external-branch-class","DM_EXTERNAL_BRANCH_CLASSES",["top","inetOrgPerson"],"array","--external-branch-classes"],["--static-path","DM_STATIC_PATH",_(e(a(import.meta.url)),"..","..","static")],["--static-name","DM_STATIC_NAME","static"],["--ldap-flat-schema","DM_LDAP_FLAT_SCHEMA",[],"array","--ldap-flat-schemas"],["--bulk-import-schemas","DM_BULK_IMPORT_SCHEMAS",""],["--bulk-import-max-file-size","DM_BULK_IMPORT_MAX_FILE_SIZE","10485760"],["--bulk-import-batch-size","DM_BULK_IMPORT_BATCH_SIZE","100"],["--james-webadmin-url","DM_JAMES_WEBADMIN_URL","http://localhost:8000"],["--james-webadmin-token","DM_JAMES_WEBADMIN_TOKEN",""],["--james-signature-template","DM_JAMES_SIGNATURE_TEMPLATE",""],["--ldap-concurrency","DM_LDAP_CONCURRENCY",10,"number"],["--james-concurrency","DM_JAMES_CONCURRENCY",10,"number"],["--james-init-delay","DM_JAMES_INIT_DELAY",1e3,"number"],["--james-mailing-list-branch","DM_JAMES_MAILING_LIST_BRANCHES",[],"array","--james-mailing-list-branches"],["--james-mailbox-type-attribute","DM_JAMES_MAILBOX_TYPE_ATTRIBUTE","twakeMailboxType"],["--calendar-webadmin-url","DM_CALENDAR_WEBADMIN_URL","http://localhost:8080"],["--calendar-webadmin-token","DM_CALENDAR_WEBADMIN_TOKEN",""],["--calendar-concurrency","DM_CALENDAR_CONCURRENCY",10,"number"],["--calendar-resource-base","DM_CALENDAR_RESOURCE_BASE",""],["--calendar-resource-objectclass","DM_CALENDAR_RESOURCE_OBJECTCLASS",""],["--calendar-resource-creator","DM_CALENDAR_RESOURCE_CREATOR",""],["--calendar-resource-domain","DM_CALENDAR_RESOURCE_DOMAIN",""],["--trash-base","DM_TRASH_BASE",""],["--trash-watched-bases","DM_TRASH_WATCHED_BASES",""],["--trash-add-metadata","DM_TRASH_ADD_METADATA","true"],["--trash-auto-create","DM_TRASH_AUTO_CREATE","true"],["--llng-ini","DM_LLNG_INI","/etc/lemonldap-ng/lemonldap-ng.ini"],["--auth-token","DM_AUTH_TOKENS",[],"array","--auth-tokens"],["--authz-per-branch-config","DM_AUTHZ_PER_BRANCH_CONFIG",{default:{read:!0,write:!1,delete:!1}},"json"],["--authz-per-branch-cache-ttl","DM_AUTHZ_PER_BRANCH_CACHE_TTL",60,"number"],["--authz-local-admin-attribute","DM_AUTHZ_LOCAL_ADMIN_ATTRIBUTE","twakeLocalAdminLink"],["--oidc-server","DM_OIDC_SERVER",""],["--oidc-client-id","DM_OIDC_CLIENT_ID",""],["--oidc-client-secret","DM_OIDC_CLIENT_SECRET",""],["--base-url","DM_BASE_URL",""],["--rate-limit-window-ms","DM_RATE_LIMIT_WINDOW_MS",9e5,"number"],["--rate-limit-max","DM_RATE_LIMIT_MAX",100,"number"],["--crowdsec-url","DM_CROWDSEC_URL","http://localhost:8080/v1/decisions"],["--crowdsec-api-key","DM_CROWDSEC_API_KEY",""],["--crowdsec-cache-ttl","DM_CROWDSEC_CACHE_TTL",60,"number"]];export{t as default};

package/dist/lib/auth/base.js

@@ -0,0 +1 @@
+import t from"../../abstract/plugin.js";import{serverError as s}from"../expressFormatedResponses.js";import{launchHooksChained as e}from"../utils.js";class AuthBase extends t{api(t){t.use(async(t,r,a)=>{try{[t,r]=await e(this.server.hooks.beforeAuth,[t,r])}catch(t){return s(r,t)}this.authMethod(t,r,async()=>{try{this.hooks?.onAuth&&([t,r]=await e(this.server.hooks.afterAuth,[t,r])),a()}catch(t){s(r,t)}})})}}export{AuthBase as default};

package/dist/lib/authz/base.js

@@ -0,0 +1 @@
+import r from"../../abstract/plugin.js";import{getParentDn as e}from"../utils.js";class AuthzBase extends r{constructor(){super(...arguments),this.roles=["authz"],this.hooks={ldapmodifyrequest:async([r,e,s,t])=>{if(this.shouldSkipAuthorization(t))return[r,e,s,t];const i=await this.resolveUser(t.user);if(!i)return this.logger.warn(`User ${t.user} could not be resolved`),[r,e,s,t];const o=this.config.ldap_organization_link_attribute;if(o&&e.replace?.[o]){try{const e=await this.server.ldap.search({paged:!1,scope:"base",attributes:[o]},r);if(e.searchEntries.length>0){const r=e.searchEntries[0][o],s=Array.isArray(r)?String(r[0]):String(r);if(!(await this.getUserPermissions(i,s)).read)throw new Error(`User ${t.user} does not have read permission for source branch ${s}`)}}catch(e){const s=this.extractBranchDn(r);if(!(await this.getUserPermissions(i,s)).read)throw new Error(`User ${t.user} does not have read permission for source branch ${s}`)}const s=e.replace[o],n=Array.isArray(s)?String(s[0]):String(s);if(!(await this.getUserPermissions(i,n)).write)throw new Error(`User ${t.user} does not have write permission for destination branch ${n}`)}else{const e=this.extractBranchDn(r);if(!(await this.getUserPermissions(i,e)).write)throw new Error(`User ${t.user} does not have write permission for branch ${e}`)}return[r,e,s,t]},ldapaddrequest:async([r,e,s])=>{if(this.shouldSkipAuthorization(s))return[r,e,s];const t=await this.resolveUser(s.user);if(!t)return this.logger.warn(`User ${s.user} could not be resolved`),[r,e,s];let i;const o=this.config.ldap_organization_link_attribute;if(o&&e[o]){const r=e[o];i=Array.isArray(r)?String(r[0]):String(r)}else i=this.extractBranchDn(r);if(!(await this.getUserPermissions(t,i)).write)throw new Error(`User ${s.user} does not have write permission for branch ${i}`);return[r,e,s]},ldapsearchrequest:async([r,e,s])=>{if(this.shouldSkipAuthorization(s))return[r,e,s];const t=await this.resolveUser(s.user);if(!t)return this.logger.warn(`User ${s.user} could not be resolved`),[r,e,s];if(r===this.config.ldap_top_organization&&"base"===e.scope)return[r,e,s];if(!(await this.getUserPermissions(t,r)).read)throw new Error(`User ${s.user} does not have read permission for branch ${r}`);return[r,e,s]},getOrganisationTop:async([r,e])=>{if(this.shouldSkipAuthorization(r))return[r,e];const s=await this.resolveUser(r.user);if(!s)return[r,e];const t=await this.getAuthorizedBranches(s);if(t.length>0){const e=[];for(const s of t)try{const t=await this.server.ldap.search({paged:!1,scope:"base"},s,r);1===t.searchEntries.length&&e.push(t.searchEntries[0])}catch(r){this.logger.warn(`Failed to fetch authorized branch ${s}: ${r}`)}if(1===e.length)return[r,e[0]];if(e.length>1)return[r,e[0]]}return[r,e]},ldaprenamerequest:async([r,e,s])=>{if(this.shouldSkipAuthorization(s))return[r,e,s];const t=await this.resolveUser(s.user);if(!t)return this.logger.warn(`User ${s.user} could not be resolved`),[r,e,s];const i=this.extractBranchDn(r),o=this.extractBranchDn(e);if(!(await this.getUserPermissions(t,i)).read)throw new Error(`User ${s.user} does not have read permission for source branch ${i}`);if(!(await this.getUserPermissions(t,o)).write)throw new Error(`User ${s.user} does not have write permission for destination branch ${o}`);return[r,e,s]}}}extractBranchDn(r){return e(r)}shouldSkipAuthorization(r){return!r?.user}}export{AuthzBase as default};

package/dist/lib/expressFormatedResponses.js

@@ -0,0 +1 @@
+let r;const setLogger=t=>{r=t},getLogger=()=>r,tryMethod=async(r,t,...e)=>{try{return await t(...e),ok(r)}catch(t){return serverError(r,t)}},tryMethodData=async(r,t,...e)=>{try{const n=await t(...e);return ok(r,n)}catch(t){return serverError(r,t)}},_rejectResponse=(r,t,e)=>{t.status(r).json({error:e})},ok=(r,t={success:!0})=>{r.status(200).json(t)},created=(r,t)=>{r.status(201).json(t)},badRequest=(r,t="Bad request")=>_rejectResponse(400,r,t),unauthorized=(r,t="Unauthorized")=>_rejectResponse(401,r,t),notFound=(r,t="Not found")=>_rejectResponse(404,r,t),serverError=(t,e)=>{e instanceof Error?r.error(e.message,e):"string"==typeof e?r.error(e):r.error("Server error",e),t.status(500).json({error:"check logs"})},wantJson=(r,t)=>!1!==r.accepts("json")||(badRequest(t),!1),jsonBody=(r,t,...e)=>{try{if(!wantJson(r,t))return!1;const n=r.body;if(e.length>0)for(let r=0;r<e.length;r++)if(null==n[e[r]])return badRequest(t,"Bad content"),!1;return n}catch(r){return badRequest(t,"Bad content"),!1}};export{badRequest,created,getLogger,jsonBody,notFound,ok,serverError,setLogger,tryMethod,tryMethodData,unauthorized,wantJson};

package/dist/lib/ldapActions.js

@@ -0,0 +1 @@
+import{Client as e,Attribute as t,Change as n}from"ldapts";import{LRUCache as i}from"lru-cache";import o from"p-limit";import{launchHooksChained as s,launchHooks as r}from"./utils.js";const a={scope:"sub",filter:"(objectClass=*)",attributes:["*"],sizeLimit:0,timeLimit:10,paged:{pageSize:100}};class ldapActions{constructor(e){this.connectionPool=[],this.parent=e,this.logger=e.logger,this.config=e.config,this.poolSize=this.config.ldap_pool_size||5,this.connectionTtl=1e3*(this.config.ldap_connection_ttl||60),this.logger.info(`LDAP connection pool initialized: size=${this.poolSize}, ttl=${this.connectionTtl/1e3}s`);const t=this.config.ldap_concurrency||10;this.queryLimit=o(t),this.logger.info(`Global LDAP query concurrency limit set to ${t}`);const n="string"==typeof this.config.ldap_cache_max?parseInt(this.config.ldap_cache_max,10)||1e3:this.config.ldap_cache_max??1e3,s=1e3*(this.config.ldap_cache_ttl||300);if(this.searchCache=new i({max:n,ttl:s,updateAgeOnGet:!1,updateAgeOnHas:!1}),this.logger.info(`LDAP search cache initialized: max=${n}, ttl=${s/1e3}s`),!e.config.ldap_url)throw new Error("LDAP URL is not defined");if(!e.config.ldap_dn)throw new Error("LDAP DN is not defined");if(!e.config.ldap_pwd)throw new Error("LDAP password is not defined");e.config.ldap_base?this.base=e.config.ldap_base:(this.base=e.config.ldap_dn.split(",",2)[1],this.logger.warn(`LDAP base is not defined, using "${this.base}"`)),this.options={url:e.config.ldap_url,timeout:0,connectTimeout:0,strictDN:!1},e.config.ldap_url.startsWith("ldaps://")&&(this.options.tlsOptions={minVersion:"TLSv1.2"}),this.dn=e.config.ldap_dn,this.pwd=e.config.ldap_pwd}async createConnection(){const t=new e(this.options);try{await t.bind(this.dn,this.pwd)}catch(e){throw this.logger.error("LDAP bind error:",e),new Error("LDAP bind error")}if(!t)throw new Error("LDAP connection error");return t}cleanupExpiredConnections(){const e=Date.now(),t=[];for(let n=this.connectionPool.length-1;n>=0;n--){const i=this.connectionPool[n];!i.inUse&&e-i.createdAt>this.connectionTtl&&(t.push(i),this.connectionPool.splice(n,1))}for(const e of t)e.client.unbind().catch(e=>{this.logger.debug(`Error unbinding expired connection: ${String(e)}`)});t.length>0&&this.logger.debug(`Cleaned up ${t.length} expired LDAP connections`)}async acquireConnection(){this.cleanupExpiredConnections();const e=this.connectionPool.find(e=>!e.inUse);if(e)return e.inUse=!0,this.logger.debug("Reusing pooled LDAP connection"),e;if(this.connectionPool.length<this.poolSize){const e={client:await this.createConnection(),createdAt:Date.now(),inUse:!0};return this.connectionPool.push(e),this.logger.debug(`Created new LDAP connection (pool: ${this.connectionPool.length}/${this.poolSize})`),e}return this.logger.debug("LDAP connection pool full, waiting for available connection"),new Promise(e=>{const t=setInterval(()=>{this.cleanupExpiredConnections();const n=this.connectionPool.find(e=>!e.inUse);n&&(clearInterval(t),n.inUse=!0,e(n))},50)})}releaseConnection(e){e.inUse=!1,this.logger.debug("Released LDAP connection back to pool")}async connect(){return await this.createConnection()}getCacheKey(e,t){const n=t.attributes?[...t.attributes].sort().join(","):"*",i="string"==typeof t.filter?t.filter:t.filter?t.filter.toString():"(objectClass=*)";return`${e}:${t.scope||"sub"}:${i}:${n}`}invalidateCache(e){for(const t of this.searchCache.keys())t.startsWith(e)&&this.searchCache.delete(t)}async search(e,t=this.base,n){let i={...a,...e};if(i=await s(this.parent.hooks.ldapsearchopts,i),[t,i]=await s(this.parent.hooks.ldapsearchrequest,[t,i,n]),!i.paged&&"base"===i.scope){const e=this.getCacheKey(t,i),n=this.searchCache.get(e);if(n)return this.logger.debug(`LDAP search cache hit: ${e}`),n}const o=await this.acquireConnection();try{let e=i.paged?o.client.searchPaginated(t,i):o.client.search(t,i);if(e=await s(this.parent.hooks.ldapsearchresult,e),!i.paged&&"base"===i.scope&&e instanceof Promise){const n=await e,o=this.getCacheKey(t,i);return this.searchCache.set(o,n),this.logger.debug(`LDAP search cached: ${o}`),n}return i.paged?this.wrapPaginatedSearch(e,o):e}finally{i.paged||this.releaseConnection(o)}}async*wrapPaginatedSearch(e,t){try{for await(const t of e)yield t}finally{this.releaseConnection(t)}}async add(e,n,i){e=this.setDn(e),n.objectClass&&0!==n.objectClass.length||!this.config.user_class||(n.objectClass=this.config.user_class);const o={};for(const[e,t]of Object.entries(n))Buffer.isBuffer(t)?o[e]=t.toString():Array.isArray(t)&&t.length>0&&Buffer.isBuffer(t[0])?o[e]=t.map(e=>e.toString()):o[e]=t;[e,n]=await s(this.parent.hooks.ldapaddrequest,[e,o,i]);const a=[];for(const[e,n]of Object.entries(o)){const i=Array.isArray(n)?n:[n];a.push(new t({type:e,values:i}))}const c=await this.acquireConnection();try{return await c.client.add(e,a),this.invalidateCache(e),r(this.parent.hooks.ldapadddone,[e,n]),!0}catch(e){throw new Error(`LDAP add error: ${e}`)}finally{this.releaseConnection(c)}}async modify(e,i,o){e=this.setDn(e);const a=[],c=this.opNumber();if([e,i]=await s(this.parent.hooks.ldapmodifyrequest,[e,i,c,o]),i.add)for(const[e,o]of Object.entries(i.add))a.push(new n({operation:"add",modification:new t({type:e,values:Array.isArray(o)?o:[o]})}));if(i.replace)for(const[e,o]of Object.entries(i.replace))a.push(new n({operation:"replace",modification:new t({type:e,values:Array.isArray(o)?o:[o]})}));if(i.delete)if(Array.isArray(i.delete))for(const e of i.delete)e&&a.push(new n({operation:"delete",modification:new t({type:e,values:[]})}));else for(const[e,o]of Object.entries(i.delete)){const i=new n({operation:"delete",modification:new t(o?{type:e,values:Array.isArray(o)?o:[o]}:{type:e})});a.push(i)}if(0===a.length)return this.logger.error("No changes to apply"),r(this.parent.hooks.ldapmodifydone,[e,{},c]),!1;{const t=await this.acquireConnection();try{return await t.client.modify(e,a),this.invalidateCache(e),r(this.parent.hooks.ldapmodifydone,[e,i,c]),!0}catch(t){throw this.logger.warn(`Changes that failed: ${e}, ${JSON.stringify(a)}`),new Error(`LDAP modify error: ${t}`)}finally{this.releaseConnection(t)}}}async rename(e,t,n){e=this.setDn(e),t=this.setDn(t),[e,t]=await s(this.parent.hooks.ldaprenamerequest,[e,t,n]);const i=await this.acquireConnection();try{return await i.client.modifyDN(e,t),r(this.parent.hooks.ldaprenamedone,[e,t]),!0}catch(e){throw new Error(`LDAP rename error: ${e}`)}finally{this.releaseConnection(i)}}async move(e,t){e=this.setDn(e),t=this.setDn(t);const n=await this.acquireConnection();try{return await n.client.modifyDN(e,t),this.logger.debug(`LDAP move: ${e} -> ${t}`),!0}catch(e){throw new Error(`LDAP move error: ${e}`)}finally{this.releaseConnection(n)}}async delete(e){e=Array.isArray(e)?e.map(e=>this.setDn(e)):this.setDn(e),Array.isArray(e)||(e=[e]),e=await s(this.parent?.hooks.ldapdeleterequest,e);const t=await this.acquireConnection();try{for(const n of e){try{await t.client.del(n),this.invalidateCache(n)}catch(e){throw new Error(`LDAP delete error: ${e}`)}r(this.parent.hooks.ldapdeletedone,n)}return!0}finally{this.releaseConnection(t)}}setDn(e){return/=/.test(e)?/,/.test(e)||(e+=`,${this.base}`):e=`${this.config.ldap_user_main_attribute}=${e},${this.base}`,e}opNumber(){return this.parent.operationSequence++}}export{ldapActions as default};

package/dist/lib/parseConfig.js

@@ -0,0 +1 @@
+class ConfigParser{constructor(r){this.config=r}parse(r=process.argv){const e={},s=this.parseCliArgs(r);for(const r of this.config){const t=this.getKeyFromCliArg(r[0]);let n=r[2];if(void 0!==r[1]){const e=process.env[r[1]];if(void 0!==e)if("boolean"===r[3])n="true"===e.toLowerCase();else if("number"===r[3])n=parseInt(e);else if("array"===r[3]){const r=e.indexOf(";")>0?";":",";n=e.split(new RegExp(`[${r}\\s]+`)).map(r=>r.trim()).filter(r=>r.length>0)}else if("json"===r[3])try{n=JSON.parse(e)}catch(e){throw new Error(`Error parsing JSON from environment variable ${r[1]}: ${e}`)}else n=e}if(s.has(r[0])){const e=s.get(r[0]);if("boolean"===r[3])n=!0;else if("number"===r[3])n=parseInt(e);else if("array"===r[3])n=Array.isArray(n)?n.concat(e):e;else if("json"===r[3])try{n=JSON.parse(e)}catch(e){throw new Error(`Error parsing JSON from command line argument ${r[0]}: ${e}`)}else n=e;s.delete(r[0])}if("array"===r[3]&&r[4]&&s.has(r[4])){const e=s.get(r[4])||"";n=Array.isArray(n)?n.concat(e.split(/[,\s]+/).filter(r=>r.length>0)):e.split(/[,\s]+/).filter(r=>r.length>0),s.delete(r[4])}e[t]=n}return s.forEach((r,s)=>{if(e[s])throw new Error(`Error in command line: ${s} redefined`);e[s.replace(/^-+/,"").replace(/-/g,"_")]=r}),e}parseCliArgs(r){const e=new Map;for(let s=2;s<r.length;s++){const t=r[s];if(t.startsWith("--")||t.startsWith("-")){const n=this.config.find(r=>r[0]===t);if(n&&"boolean"===n[3])e.set(t,!0);else if(n&&"number"===n[3])e.set(t,parseInt(r[s+1]));else if(n&&"array"===n[3]){const n=e.get(t)||[],i=r[s+1];n.push(i),e.set(t,n)}else{const n=r[s+1];e.set(t,n),s++}}}return e}getKeyFromCliArg(r){return r.startsWith("--")?r.substring(2).replace(/-/g,"_"):r.startsWith("-")?r.substring(1).replace(/-/g,"_"):r}}function parseConfig(r,e=process.argv){return new ConfigParser(r).parse(e)}export{ConfigParser,parseConfig};

package/dist/lib/utils.js

@@ -0,0 +1 @@
+import{getLogger as t}from"./expressFormatedResponses.js";const r=t(),launchHooks=async(t,...e)=>{if(t)for(const n of t)if(n)try{await n(...e)}catch(t){r.error("Hook error",t)}},launchHooksChained=async(t,r)=>{if(t)for(const e of t)e&&(r=await e(r));return r},transformSchemas=(t,r)=>t.toString().replace(/__(\S+)__/g,(t,e)=>{if(!e||"string"!=typeof e)return t;const n=e.trim().toLowerCase();return r[n]?"object"!=typeof r[n]?r[n]:JSON.stringify(r[n]):t});function parseDn(t){const r=[];let e="",n=!1;for(let o=0;o<t.length;o++){const s=t[o];n?(e+=s,n=!1):"\\"===s?(e+=s,n=!0):","===s?(r.push(e.trim()),e=""):e+=s}return e&&r.push(e.trim()),r}function getParentDn(t){const r=parseDn(t);return r.length<=1?t:r.slice(1).join(",")}export{getParentDn,launchHooks,launchHooksChained,parseDn,transformSchemas};

package/dist/logger/winston.js

@@ -0,0 +1 @@
+import e from"winston";const buildLogger=r=>e.createLogger({level:r.log_level,format:e.format.combine(e.format.timestamp(),e.format.printf(({timestamp:e,level:r,message:o})=>`${e} [${r}]: ${o}`)),transports:["console"===r.logger?new e.transports.Console({stderrLevels:["error","warn"],format:e.format.json()}):new e.transports.File({filename:"error.log"})]});export{buildLogger};

package/dist/plugins/auth/authzLinid1.js

@@ -0,0 +1 @@
+import s from"../../lib/authz/base.js";class AuthzLinid1 extends s{constructor(s){super(s),this.name="authzLinid1",this.permissionsCache=new Map,this.cacheTTL=3e5;const e=this.config.authz_local_admin_attribute||"twakeLocalAdminLink";this.logger.info(`AuthzLinid1: Authorization based on ${e} attribute enabled`)}async resolveUser(s){return this.getUserDn(s)}async getUserDn(s){try{const e=`(${this.config.ldap_user_main_attribute||"uid"}=${s})`,t=await this.server.ldap.search({paged:!1,filter:e,attributes:["dn"],scope:"sub"},this.config.ldap_base||"");if(t.searchEntries&&t.searchEntries.length>0){const s=t.searchEntries[0].dn;return"string"==typeof s?s:String(s)}}catch(e){this.logger.error(`Failed to get DN for user ${s}: ${e}`)}return null}async getUserPermissions(s,e){const t=Date.now(),i=this.permissionsCache.get(s);if(i&&t-i.timestamp<this.cacheTTL){const s=this.findBranchPermissions(i.branches,e);if(s)return s}await this.refreshUserPermissions(s);const r=this.permissionsCache.get(s);if(r){const s=this.findBranchPermissions(r.branches,e);if(s)return s}return{read:!1,write:!1,delete:!1}}async refreshUserPermissions(s){const e=new Map;try{const t=`(${this.config.authz_local_admin_attribute||"twakeLocalAdminLink"}=${s})`,i=this.config.ldap_top_organization||this.config.ldap_base||"",r=await this.server.ldap.search({paged:!1,filter:t,attributes:["dn"],scope:"sub"},i);if(r.searchEntries)for(const s of r.searchEntries){const t="string"==typeof s.dn?s.dn:String(s.dn);e.set(t,{read:!0,write:!0,delete:!0})}}catch(e){this.logger.error(`Failed to refresh permissions for user ${s}: ${e}`)}this.permissionsCache.set(s,{branches:e,timestamp:Date.now()})}async getAuthorizedBranches(s){const e=Date.now(),t=this.permissionsCache.get(s);(!t||e-t.timestamp>=this.cacheTTL)&&await this.refreshUserPermissions(s);const i=this.permissionsCache.get(s);return i?Array.from(i.branches.keys()):[]}findBranchPermissions(s,e){if(s.has(e))return s.get(e)||null;for(const[t,i]of s.entries())if(e.toLowerCase().endsWith(`,${t.toLowerCase()}`))return i;return null}}export{AuthzLinid1 as default};

package/dist/plugins/auth/authzPerBranch.js

@@ -0,0 +1 @@
+import e from"../../lib/authz/base.js";class AuthzPerBranch extends e{constructor(e){super(e),this.name="authzPerBranch",this.groupCache=new Map,this.cacheTTL=1e3*(this.config.authz_per_branch_cache_ttl||60),this.authConfig=this.config.authz_per_branch_config,this.authConfig&&this.logger.info("Authorization config loaded")}resolveUser(e){return Promise.resolve(e)}shouldSkipAuthorization(e){return!e?.user||!this.authConfig}async getUserPermissions(e,t){if(!this.authConfig)return{read:!0,write:!0,delete:!0};let r={read:this.authConfig.default?.read??!1,write:this.authConfig.default?.write??!1,delete:this.authConfig.default?.delete??!1};if(this.authConfig.users?.[e]){const s=this.findBranchPermissions(this.authConfig.users[e],t);s&&(r=this.mergePermissions(r,s))}const s=await this.getUserGroups(e);for(const e of s)if(this.authConfig.groups?.[e]){const s=this.findBranchPermissions(this.authConfig.groups[e],t);s&&(r=this.mergePermissions(r,s))}return r}async getAuthorizedBranches(e){return this.getAuthorizedBranchesForPermission(e,"read")}async getAuthorizedBranchesForPermission(e,t){if(!this.authConfig)return[];const r=[];if(this.authConfig.users?.[e])for(const[s,i]of Object.entries(this.authConfig.users[e]))i[t]&&r.push(s);const s=await this.getUserGroups(e);for(const e of s)if(this.authConfig.groups?.[e])for(const[s,i]of Object.entries(this.authConfig.groups[e]))i[t]&&!r.includes(s)&&r.push(s);return r}findBranchPermissions(e,t){if(e[t])return e[t];for(const[r,s]of Object.entries(e))if(t.toLowerCase().endsWith(`,${r.toLowerCase()}`))return s;return null}mergePermissions(e,t){return{read:e.read||t.read||!1,write:e.write||t.write||!1,delete:e.delete||t.delete||!1}}buildBranchFilter(e,t){if(t.some(t=>e.toLowerCase()===t.toLowerCase()||e.toLowerCase().endsWith(`,${t.toLowerCase()}`)))return null;if(1===t.length)return`(entryDN=*,${t[0]})`;if(t.length>1){return`(|${t.map(e=>`(entryDN=*,${e})`).join("")})`}return null}async getUserGroups(e){const t=Date.now(),r=this.groupCache.get(e);if(r&&t-r.timestamp<this.cacheTTL)return r.groups;const s=[];try{const t=`(${this.config.ldap_group_member_attribute||"member"}=${this.config.ldap_user_main_attribute}=${e},*)`,r=await this.server.ldap.search({paged:!1,filter:t,attributes:["dn"]},this.server.ldap.base);if(r.searchEntries)for(const e of r.searchEntries)e.dn&&s.push("string"==typeof e.dn?e.dn:String(e.dn))}catch(t){this.logger.error(`Failed to resolve groups for user ${e}: ${t}`)}return this.groupCache.set(e,{groups:s,timestamp:t}),s}}export{AuthzPerBranch as default};

package/dist/plugins/auth/crowdsec.js

@@ -0,0 +1 @@
+import e from"node-fetch";import r from"../../abstract/plugin.js";class CrowdSec extends r{constructor(...e){if(super(...e),this.name="crowdsec",this.roles=["protect"],this.cache=new Map,this.apiUrl=this.config.crowdsec_url||"http://localhost:8080/v1/decisions",this.apiKey=this.config.crowdsec_api_key,this.cacheTtl=this.config.crowdsec_cache_ttl||60,!this.apiKey)throw new Error("CrowdSec plugin requires crowdsec_api_key configuration");this.logger.info(`CrowdSec integration enabled with API at ${this.apiUrl} (cache TTL: ${this.cacheTtl}s)`)}api(e){e.use(async(e,r,t)=>{const s=this.getClientIp(e);try{if(await this.checkIpBanned(s))return this.logger.warn(`Blocked request from CrowdSec-banned IP: ${s}`),r.status(403).json({error:"Access denied",reason:"IP address is banned by security policies"});t()}catch(e){this.logger.error(`CrowdSec API error for IP ${s}: ${e instanceof Error?e.message:String(e)}`),t()}})}async checkIpBanned(r){const t=this.cache.get(r),s=Date.now();if(t&&s<t.expiresAt)return this.logger.debug(`CrowdSec cache hit for IP ${r}: ${t.isBanned}`),t.isBanned;const o=`${this.apiUrl}?ip=${encodeURIComponent(r)}`;this.logger.debug(`Querying CrowdSec API: ${o}`);const i=await e(o,{headers:{"X-Api-Key":this.apiKey}});if(!i.ok)throw new Error(`CrowdSec API returned status ${i.status}: ${i.statusText}`);let c;try{const e=await i.text();c="null"===e||""===e?null:JSON.parse(e)}catch(e){throw this.logger.error(`Failed to parse CrowdSec API response: ${e instanceof Error?e.message:String(e)}`),new Error("Invalid JSON response from CrowdSec API")}let n=!1;return null!==c&&Array.isArray(c)&&(n=c.some(e=>"ban"===e.type)),this.cache.set(r,{isBanned:n,expiresAt:s+1e3*this.cacheTtl}),this.logger.debug(`CrowdSec decision for IP ${r}: ${n?"BANNED":"ALLOWED"}`),n}getClientIp(e){const r=e.headers["x-forwarded-for"];if(r){return(Array.isArray(r)?r[0]:r).split(",")[0].trim()}return e.socket.remoteAddress||"unknown"}}export{CrowdSec as default};

package/dist/plugins/auth/llng.js

@@ -0,0 +1 @@
+import*as e from"lemonldap-ng-handler";import t from"../../lib/auth/base.js";class AuthLLNG extends t{constructor(){super(...arguments),this.name="authLemonldapNg",this.roles=["auth"]}authMethod(t,s,a){e.run(t,s,()=>{t.user=t.headers["Lm-Remote-User"],a()})}}export{AuthLLNG as default};