ldap-rest 0.0.1

package/dist/src/config/args.d.ts

@@ -0,0 +1,128 @@
+import type { AttributesList } from '../lib/ldapActions';
+import type { ConfigTemplate } from '../lib/parseConfig';
+export interface BranchPermissions {
+    read?: boolean;
+    write?: boolean;
+    delete?: boolean;
+}
+export interface AuthConfig {
+    default?: BranchPermissions;
+    users?: {
+        [uid: string]: {
+            [branch: string]: BranchPermissions;
+        };
+    };
+    groups?: {
+        [groupDn: string]: {
+            [branch: string]: BranchPermissions;
+        };
+    };
+}
+/**
+ * Typescript declaration of config
+ *
+ * See below for config arguments, corresponding environment variables,
+ * default value, type and optional plural name
+ */
+export interface Config {
+    port: number;
+    plugin?: string[];
+    schemas_path: string;
+    log_level: 'error' | 'warn' | 'notice' | 'info' | 'debug';
+    logger: 'console';
+    api_prefix: string;
+    mail_domain?: string[];
+    ldap_base?: string;
+    ldap_dn?: string;
+    ldap_pwd?: string;
+    ldap_url?: string;
+    ldap_user_main_attribute?: string;
+    ldap_cache_max?: number;
+    ldap_cache_ttl?: number;
+    ldap_pool_size?: number;
+    ldap_connection_ttl?: number;
+    user_class?: string[];
+    ldap_group_base?: string;
+    ldap_groups_main_attribute?: string;
+    group_class?: string[];
+    group_classes?: string[];
+    group_default_attributes?: AttributesList;
+    groups_allow_unexistent_members?: boolean;
+    group_dummy_user?: string;
+    group_schema?: string;
+    ldap_top_organization?: string;
+    ldap_organization_class?: string[];
+    ldap_organization_link_attribute?: string;
+    ldap_organization_path_attribute?: string;
+    ldap_organization_path_separator?: string;
+    ldap_organization_max_subnodes?: number;
+    organization_schema?: string;
+    ldap_flat_schema?: string[];
+    bulk_import_schemas?: string;
+    bulk_import_max_file_size?: string;
+    bulk_import_batch_size?: string;
+    external_members_branch?: string;
+    external_branch_class?: string[];
+    static_path?: string;
+    static_name?: string;
+    llng_ini?: string;
+    auth_token?: string[];
+    oidc_server?: string;
+    oidc_client_id?: string;
+    oidc_client_secret?: string;
+    base_url?: string;
+    authz_per_branch_config?: AuthConfig;
+    authz_per_branch_cache_ttl?: number;
+    authz_local_admin_attribute?: string;
+    rate_limit_window_ms?: number;
+    rate_limit_max?: number;
+    crowdsec_url?: string;
+    crowdsec_api_key?: string;
+    crowdsec_cache_ttl?: number;
+    mail_attribute?: string;
+    quota_attribute?: string;
+    delegation_attribute?: string;
+    alias_attribute?: string;
+    forward_attribute?: string;
+    display_name_attribute?: string;
+    james_webadmin_url?: string;
+    james_webadmin_token?: string;
+    james_signature_template?: string;
+    ldap_concurrency?: number;
+    james_concurrency?: number;
+    james_init_delay?: number;
+    james_mailing_list_branch?: string[];
+    james_mailbox_type_attribute?: string;
+    calendar_webadmin_url?: string;
+    calendar_webadmin_token?: string;
+    calendar_concurrency?: number;
+    calendar_resource_base?: string;
+    calendar_resource_objectclass?: string;
+    calendar_resource_creator?: string;
+    calendar_resource_domain?: string;
+    trash_base?: string;
+    trash_watched_bases?: string;
+    trash_add_metadata?: string;
+    trash_auto_create?: string;
+    [key: string]: string | string[] | boolean | number | AttributesList | AuthConfig | undefined;
+}
+/**
+ * Config arguments
+ *
+ * Format:
+ * [ command-line-option, env-variable, default-value, type?, plural? ]
+ *
+ * type can be one of:
+ * - string (default value)
+ * - boolean:
+ *    * --option is enough
+ *    * env variable must be set to "true" to be considered as truthy
+ * - number
+ * - json: parameter s a string that will be converted into an object during configuration parsing
+ *
+ * Additional command-line:
+ * to permit to non-core plugin to use command-line, all command-line pairs `--key-name value`
+ * are stored into config (string only) as `config.key_name = value`
+ */
+declare const configArgs: ConfigTemplate;
+export default configArgs;

package/dist/src/config/schema.d.ts

@@ -0,0 +1,18 @@
+import type { AttributeValue } from '../lib/ldapActions';
+export interface Schema {
+    strict: boolean;
+    attributes: {
+        [key: string]: {
+            type: 'string' | 'array' | 'pointer';
+            items?: {
+                type: string;
+                test?: string | RegExp;
+            };
+            default?: AttributeValue;
+            required?: boolean;
+            test?: string | RegExp;
+            branch?: string[];
+            fixed?: boolean;
+        };
+    };
+}

package/dist/src/hooks.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Types for hooks
+ * @author Xavier Guimard <xguimard@linagora.com>
+ */
+import type { SearchOptions, SearchResult } from 'ldapts';
+import type { Request, Response } from 'express';
+import type { ModifyRequest, AttributesList } from './lib/ldapActions';
+import type { ChangesToNotify } from './plugins/ldap/onChange';
+import * as utils from './lib/utils';
+export type MaybePromise<T> = Promise<T> | T;
+export type ChainedHook<T> = (arg: T) => MaybePromise<T>;
+export type VoidHook<T extends unknown[]> = (...args: T) => MaybePromise<void>;
+export type OtherHook = Function;
+export { utils };
+/**
+ * All available hooks
+ */
+export interface Hooks {
+    /**
+     * Libraries
+     */
+    ldapsearchopts?: ChainedHook<SearchOptions>;
+    ldapsearchrequest?: ChainedHook<[string, SearchOptions, Request?]>;
+    ldapsearchresult?: ChainedHook<SearchResult>;
+    ldapaddrequest?: ChainedHook<[string, AttributesList, Request?]>;
+    ldapadddone?: (args: [string, AttributesList]) => MaybePromise<void>;
+    ldapmodifyrequest?: ChainedHook<[string, ModifyRequest, number, Request?]>;
+    ldapmodifydone?: (args: [string, ModifyRequest, number]) => MaybePromise<void>;
+    ldapdeleterequest?: ChainedHook<string | string[]>;
+    ldapdeletedone?: (dn: string | string[]) => MaybePromise<void>;
+    ldaprenamerequest?: ChainedHook<[string, string, Request?]>;
+    ldaprenamedone?: (args: [string, string]) => MaybePromise<void>;
+    /**
+     * Plugins
+     */
+    /** Demo plugin */
+    hello?: () => string;
+    /** LdapGroups plugin */
+    ldapgroupvalidatemembers?: ChainedHook<[string, string[]]>;
+    ldapgroupadd?: ChainedHook<[string, AttributesList]>;
+    ldapgroupadddone?: (args: [string, AttributesList]) => MaybePromise<void>;
+    ldapgroupmodify?: ChainedHook<[string, ModifyRequest, number]>;
+    ldapgroupmodifydone?: (args: [string, ModifyRequest, number]) => MaybePromise<void>;
+    ldapgroupdelete?: ChainedHook<string>;
+    ldapgroupdeletedone?: (dn: string) => MaybePromise<void>;
+    ldapgroupaddmember?: ChainedHook<[string, string[]]>;
+    ldapgroupdeletemember?: ChainedHook<[string, string[]]>;
+    _ldapgrouplist?: ChainedHook<AsyncGenerator<SearchResult>>;
+    /** "onLdapChange" */
+    onLdapChange?: (dn: string, changes: ChangesToNotify) => MaybePromise<void>;
+    onLdapMailChange?: (dn: string, oldMail: string, newMail: string) => MaybePromise<void>;
+    onLdapAliasChange?: (dn: string, mail: string, oldAliases: string[], newAliases: string[]) => MaybePromise<void>;
+    onLdapQuotaChange?: (dn: string, mail: string, oldQuota: number, newQuota: number) => MaybePromise<void>;
+    onLdapForwardChange?: (dn: string, mail: string, oldForwards: string[], newForwards: string[]) => MaybePromise<void>;
+    onLdapDisplayNameChange?: (dn: string, oldDisplayName: string | null, newDisplayName: string | null) => MaybePromise<void>;
+    /** externalUsersInGroup */
+    externaluserentry?: ChainedHook<[string, AttributesList]>;
+    externaluseradded?: (dn: string, mail: string) => MaybePromise<void>;
+    /**
+     * Generic flat resource move hooks
+     * Pattern: {hookPrefix}move
+     * Examples: ldapusermove, ldappositionmove, etc.
+     *
+     * move: before moving - can modify target or cancel
+     * Note: After move, onLdapChange is triggered automatically by modifyEntry()
+     */
+    [K: string]: ChainedHook<unknown> | VoidHook<unknown[]> | OtherHook | undefined;
+    /** Common authentication hooks */
+    beforeAuth?: ChainedHook<[Request, Response]>;
+    afterAuth?: ChainedHook<[Request, Response]>;
+    /** Organization hooks */
+    getOrganisationTop?: ChainedHook<[
+        Request | undefined,
+        AttributesList | null
+    ]>;
+}

package/dist/src/lib/auth/base.d.ts

@@ -0,0 +1,9 @@
+import type { Express, Request, Response } from 'express';
+export type DmRequest = Request & {
+    user?: string;
+};
+import DmPlugin from '../../abstract/plugin';
+export default abstract class AuthBase extends DmPlugin {
+    abstract authMethod(req: DmRequest, res: Response, next: () => void): void;
+    api(app: Express): void;
+}

package/dist/src/lib/authz/base.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @module lib/authz/base
+ * @author Xavier Guimard <xguimard@linagora.com>
+ *
+ * Base class for authorization plugins
+ * Provides common functionality for permission-based access control
+ * @group Libraries
+ */
+import type { SearchOptions } from 'ldapts';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+import type { BranchPermissions } from '../../config/args';
+import type { DmRequest } from '../auth/base';
+import type { AttributesList, ModifyRequest } from '../ldapActions';
+/**
+ * Abstract base class for authorization plugins
+ * Provides common utility methods and interface for LDAP-based authorization
+ */
+export default abstract class AuthzBase extends DmPlugin {
+    roles: Role[];
+    cacheTTL: number;
+    /**
+     * Extract the branch DN to check permissions against
+     * For a DN like "uid=user,ou=users,ou=org,dc=example,dc=com"
+     * we need to check permissions on the parent branch
+     *
+     * Handles escaped commas in DN values (e.g., "cn=Smith\, John")
+     */
+    extractBranchDn(dn: string): string;
+    /**
+     * Resolve user identifier to the format expected by getUserPermissions
+     * This allows different implementations:
+     * - authzLinid1: converts uid to userDn via LDAP
+     * - authzPerBranch: uses uid directly
+     *
+     * Returns null if user cannot be resolved (will skip authorization)
+     */
+    abstract resolveUser(uid: string): Promise<string | null>;
+    /**
+     * Get user's permissions for a specific branch
+     * Must be implemented by subclasses
+     */
+    abstract getUserPermissions(user: string, branch: string): Promise<BranchPermissions>;
+    /**
+     * Get list of branches user has access to (for read permission by default)
+     * Must be implemented by subclasses
+     */
+    abstract getAuthorizedBranches(user: string): Promise<string[]>;
+    /**
+     * Check if authorization should be skipped for this request
+     * Can be overridden by subclasses for custom logic
+     */
+    protected shouldSkipAuthorization(req?: DmRequest): boolean;
+    /**
+     * Common hooks for all authorization plugins
+     */
+    hooks: {
+        ldapmodifyrequest: ([dn, changes, opNumber, req]: [string, ModifyRequest, number, DmRequest?]) => Promise<[string, ModifyRequest, number, DmRequest?]>;
+        ldapaddrequest: ([dn, entry, req]: [string, AttributesList, DmRequest?]) => Promise<[string, AttributesList, DmRequest?]>;
+        ldapsearchrequest: ([base, opts, req]: [string, SearchOptions, DmRequest?]) => Promise<[string, SearchOptions, DmRequest?]>;
+        getOrganisationTop: ([req, defaultTop]: [DmRequest | undefined, AttributesList | null]) => Promise<[DmRequest | undefined, AttributesList | null]>;
+        ldaprenamerequest: ([oldDn, newDn, req]: [string, string, DmRequest?]) => Promise<[string, string, DmRequest?]>;
+    };
+}

package/dist/src/lib/expressFormatedResponses.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Standard express responses and express utilities
+ * @author Xavier Guimard <xguimard@linagora.com>
+ */
+import type { Request, Response } from 'express';
+import type winston from 'winston';
+export declare const setLogger: (logger: winston.Logger) => void;
+export declare const getLogger: () => winston.Logger;
+export declare const tryMethod: (res: Response, method: Function, ...args: unknown[]) => Promise<void>;
+export declare const tryMethodData: (res: Response, method: Function, ...args: unknown[]) => Promise<void>;
+export declare const ok: (res: Response, data?: object) => void;
+export declare const created: (res: Response, data?: object) => void;
+export declare const noContent: (res: Response) => void;
+export declare const badRequest: (res: Response, message?: string) => void;
+export declare const unauthorized: (res: Response, message?: string) => void;
+export declare const forbidden: (res: Response, message?: string) => void;
+export declare const notFound: (res: Response, message?: string) => void;
+export declare const conflict: (res: Response, message?: string) => void;
+export declare const uriTooLong: (res: Response, message?: string) => void;
+export declare const tooManyRequests: (res: Response, message?: string) => void;
+export declare const serverError: (res: Response, err: unknown) => void;
+export declare const badGateway: (res: Response, message?: string) => void;
+export declare const serviceUnavailable: (res: Response, message?: string) => void;
+export declare const gatewayTimeout: (res: Response, message?: string) => void;
+export declare const wantJson: (req: Request, res: Response) => boolean;
+export declare const jsonBody: (req: Request, res: Response, ...requiredFields: string[]) => object | false;

package/dist/src/lib/ldapActions.d.ts

@@ -0,0 +1,91 @@
+/**
+ * LDAP low-level library
+ * @author Xavier Guimard <xguimard@linagora.com>
+ */
+import type { Request } from 'express';
+import { Client } from 'ldapts';
+import type { ClientOptions, SearchResult, SearchOptions } from 'ldapts';
+import type winston from 'winston';
+import pLimit from 'p-limit';
+import { type Config } from '../config/args';
+import { type DM } from '../bin';
+export type AttributeValue = Buffer | Buffer[] | string[] | string;
+export type AttributesList = Record<string, AttributeValue>;
+export type LdapList = Record<string, AttributesList>;
+export type { SearchOptions, SearchResult };
+export interface ModifyRequest {
+    add?: AttributesList;
+    replace?: AttributesList;
+    delete?: string[] | AttributesList;
+}
+declare class ldapActions {
+    config: Config;
+    options: ClientOptions;
+    dn: string;
+    pwd: string;
+    base: string;
+    parent: DM;
+    logger: winston.Logger;
+    private searchCache;
+    queryLimit: ReturnType<typeof pLimit>;
+    private connectionPool;
+    private poolSize;
+    private connectionTtl;
+    constructor(server: DM);
+    /**
+     * Create a new LDAP connection
+     */
+    private createConnection;
+    /**
+     * Clean up expired connections from the pool
+     */
+    private cleanupExpiredConnections;
+    /**
+     * Acquire a connection from the pool or create a new one
+     */
+    private acquireConnection;
+    /**
+     * Release a connection back to the pool
+     */
+    private releaseConnection;
+    /**
+     * Legacy connect method for backward compatibility
+     * @deprecated Use acquireConnection/releaseConnection instead
+     */
+    connect(): Promise<Client>;
+    /**
+     * Generate cache key for LDAP search
+     */
+    private getCacheKey;
+    /**
+     * Invalidate cache entries for a specific DN
+     * Called after modifications to ensure cache consistency
+     */
+    invalidateCache(dn: string): void;
+    search(options: SearchOptions, base?: string, req?: Request): Promise<SearchResult | AsyncGenerator<SearchResult>>;
+    /**
+     * Wrap paginated search to ensure connection is released when done
+     */
+    private wrapPaginatedSearch;
+    add(dn: string, entry: AttributesList, req?: Request): Promise<boolean>;
+    modify(dn: string, changes: ModifyRequest, req?: Request): Promise<boolean>;
+    rename(dn: string, newRdn: string, req?: Request): Promise<boolean>;
+    /**
+     * Move an entry to a new location (different parent)
+     * Uses LDAP modifyDN with full DN to change both RDN and parent
+     *
+     * Note: ldapts provides a high-level API that accepts a full DN as the second parameter,
+     * unlike the standard LDAP modifyDN which expects (newRDN, deleteOldRDN, newSuperior).
+     * ldapts automatically parses the full DN and extracts the newRDN and newSuperior components
+     * before sending the proper LDAP modifyDN request to the server.
+     *
+     * @param dn - Current DN (e.g., "uid=user1,ou=users,dc=example,dc=com")
+     * @param newDn - Full new DN (e.g., "uid=user1,ou=trash,dc=example,dc=com")
+     *                ldapts will extract newRDN="uid=user1" and newSuperior="ou=trash,dc=example,dc=com"
+     */
+    move(dn: string, newDn: string): Promise<boolean>;
+    delete(dn: string | string[]): Promise<boolean>;
+    private setDn;
+    opNumber(): number;
+}
+export default ldapActions;

package/dist/src/lib/parseConfig.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Configuration parser
+ * Order: default < env < cli
+ * @author Xavier Guimard <xguimard@linagora.com>
+ */
+import type { Config } from '../config/args';
+export type ConfigTemplate = ConfigEntry[];
+export type ConfigEntry = [
+    string,
+    string,
+    // env value
+    string | string[] | boolean | number | Record<string, any>,
+    ('string' | 'number' | 'boolean' | 'array' | 'json' | null | undefined)?,
+    (string | null | undefined)?
+];
+export declare class ConfigParser {
+    private config;
+    constructor(config: ConfigTemplate);
+    parse(argv?: string[]): Config;
+    private parseCliArgs;
+    private getKeyFromCliArg;
+}
+export declare function parseConfig(config: ConfigEntry[], argv?: string[]): Config;

package/dist/src/lib/utils.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Utility functions
+ * @author Xavier Guimard <xguimard@linagora.com>
+ */
+import type { Config } from '../bin';
+export declare const launchHooks: (hooks: Function[] | undefined, ...args: unknown[]) => Promise<void>;
+export declare const launchHooksChained: <T>(hooks: Function[] | undefined, args: T) => Promise<T>;
+export declare const transformSchemas: (schemas: string | Buffer, config: Config) => string;
+/**
+ * Parse a Distinguished Name (DN) into its component parts (RDNs)
+ * Handles escaped commas and other special characters
+ *
+ * @param dn - The DN to parse
+ * @returns Array of RDN components
+ *
+ * @example
+ * ```typescript
+ * parseDn('uid=user,ou=users,dc=example,dc=com')
+ * // => ['uid=user', 'ou=users', 'dc=example', 'dc=com']
+ *
+ * parseDn('cn=Smith\\, John,ou=users,dc=example,dc=com')
+ * // => ['cn=Smith\\, John', 'ou=users', 'dc=example', 'dc=com']
+ * ```
+ */
+export declare function parseDn(dn: string): string[];
+/**
+ * Extract the parent DN from a DN
+ * Removes the first RDN component to get the parent branch
+ *
+ * @param dn - The DN to extract parent from
+ * @returns The parent DN, or the original DN if it has no parent
+ *
+ * @example
+ * ```typescript
+ * getParentDn('uid=user,ou=users,dc=example,dc=com')
+ * // => 'ou=users,dc=example,dc=com'
+ *
+ * getParentDn('dc=com')
+ * // => 'dc=com'
+ * ```
+ */
+export declare function getParentDn(dn: string): string;
+/**
+ * Extract the RDN (Relative Distinguished Name) from a DN
+ * Returns the first component of the DN
+ *
+ * @param dn - The DN to extract RDN from
+ * @returns The RDN component
+ *
+ * @example
+ * ```typescript
+ * getRdn('uid=user,ou=users,dc=example,dc=com')
+ * // => 'uid=user'
+ * ```
+ */
+export declare function getRdn(dn: string): string;
+/**
+ * Check if a DN is a child of another DN
+ *
+ * @param dn - The DN to check
+ * @param parentDn - The potential parent DN
+ * @returns True if dn is a child of parentDn
+ *
+ * @example
+ * ```typescript
+ * isChildOf('uid=user,ou=users,dc=example,dc=com', 'ou=users,dc=example,dc=com')
+ * // => true
+ *
+ * isChildOf('uid=user,ou=users,dc=example,dc=com', 'ou=groups,dc=example,dc=com')
+ * // => false
+ * ```
+ */
+export declare function isChildOf(dn: string, parentDn: string): boolean;

package/dist/src/logger/winston.d.ts

@@ -0,0 +1,3 @@
+import winston from 'winston';
+import { Config } from '../bin';
+export declare const buildLogger: (config: Config) => winston.Logger;

package/dist/src/plugins/auth/authzLinid1.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @module plugins/auth/authzLinid1
+ * @author Xavier Guimard <xguimard@linagora.com>
+ *
+ * Authorization plugin based on twakeLocalAdminLink LDAP attribute
+ * Grants permissions to users referenced in organization's twakeLocalAdminLink
+ * @group Plugins
+ */
+import type { DM } from '../../bin';
+import type { BranchPermissions } from '../../config/args';
+import AuthzBase from '../../lib/authz/base';
+interface CachedPermissions {
+    branches: Map<string, BranchPermissions>;
+    timestamp: number;
+}
+export default class AuthzLinid1 extends AuthzBase {
+    name: string;
+    permissionsCache: Map<string, CachedPermissions>;
+    constructor(server: DM);
+    /**
+     * Resolve user - for authzLinid1, convert uid to userDn via LDAP
+     */
+    resolveUser(uid: string): Promise<string | null>;
+    /**
+     * Get user DN from uid
+     */
+    getUserDn(uid: string): Promise<string | null>;
+    /**
+     * Get user's permissions for a specific branch
+     * Searches LDAP for organizations with twakeLocalAdminLink containing the user's DN
+     */
+    getUserPermissions(userDn: string, branch: string): Promise<BranchPermissions>;
+    /**
+     * Refresh user permissions from LDAP
+     */
+    refreshUserPermissions(userDn: string): Promise<void>;
+    /**
+     * Get list of branches user has access to
+     */
+    getAuthorizedBranches(userDn: string): Promise<string[]>;
+    /**
+     * Find permissions for a branch (supports sub-branch matching)
+     */
+    private findBranchPermissions;
+}
+export {};

package/dist/src/plugins/auth/authzPerBranch.d.ts

@@ -0,0 +1,59 @@
+/**
+ * @module plugins/auth/authzPerBranch
+ * @author Xavier Guimard <xguimard@linagora.com>
+ *
+ * Authorization plugin that restricts LDAP access by branch
+ * Supports user and group-based permissions with configurable defaults
+ * @group Plugins
+ */
+import type { DM } from '../../bin';
+import type { AuthConfig, BranchPermissions } from '../../config/args';
+import type { DmRequest } from '../../lib/auth/base';
+import AuthzBase from '../../lib/authz/base';
+interface CachedGroups {
+    groups: string[];
+    timestamp: number;
+}
+export default class AuthzPerBranch extends AuthzBase {
+    name: string;
+    authConfig?: AuthConfig;
+    groupCache: Map<string, CachedGroups>;
+    constructor(server: DM);
+    /**
+     * Resolve user - for authzPerBranch, we use uid directly
+     */
+    resolveUser(uid: string): Promise<string | null>;
+    /**
+     * Override to add authConfig check
+     */
+    protected shouldSkipAuthorization(req?: DmRequest): boolean;
+    /**
+     * Get user's permissions for a specific branch
+     */
+    getUserPermissions(uid: string, branch: string): Promise<BranchPermissions>;
+    /**
+     * Get list of branches user has read access to (base class implementation)
+     */
+    getAuthorizedBranches(uid: string): Promise<string[]>;
+    /**
+     * Get list of branches user has access to for a given permission type
+     */
+    getAuthorizedBranchesForPermission(uid: string, permissionType: 'read' | 'write' | 'delete'): Promise<string[]>;
+    /**
+     * Find permissions for a branch (supports sub-branch matching)
+     */
+    private findBranchPermissions;
+    /**
+     * Merge permissions (OR logic - grant if any source grants)
+     */
+    private mergePermissions;
+    /**
+     * Build LDAP filter for authorized branches
+     */
+    private buildBranchFilter;
+    /**
+     * Get user's group memberships with caching
+     */
+    getUserGroups(uid: string): Promise<string[]>;
+}
+export {};

package/dist/src/plugins/auth/crowdsec.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @module core/auth/crowdsec
+ * CrowdSec integration plugin to block banned IPs
+ *
+ * This plugin integrates with CrowdSec Local API to check if incoming
+ * requests are from IPs with active ban decisions. It should be loaded
+ * BEFORE authentication plugins to block malicious IPs early.
+ *
+ * Configuration:
+ * - crowdsec_url: CrowdSec Local API URL (default: http://localhost:8080)
+ * - crowdsec_api_key: API key for bouncer authentication (required)
+ * - crowdsec_cache_ttl: Cache TTL in seconds for decisions (default: 60)
+ *
+ * @author Xavier Guimard <xguimard@linagora.com>
+ */
+import type { Express } from 'express';
+import DmPlugin, { Role } from '../../abstract/plugin';
+export default class CrowdSec extends DmPlugin {
+    name: string;
+    roles: Role[];
+    private apiUrl;
+    private apiKey;
+    private cacheTtl;
+    private cache;
+    constructor(...args: ConstructorParameters<typeof DmPlugin>);
+    api(app: Express): void;
+    private checkIpBanned;
+    private getClientIp;
+}

package/dist/src/plugins/auth/llng.d.ts

@@ -0,0 +1,8 @@
+import type { Response } from 'express';
+import AuthBase, { DmRequest } from '../../lib/auth/base';
+import type { Role } from '../../abstract/plugin';
+export default class AuthLLNG extends AuthBase {
+    name: string;
+    roles: Role[];
+    authMethod(req: DmRequest, res: Response, next: () => void): void;
+}

package/dist/src/plugins/auth/openidconnect.d.ts

@@ -0,0 +1,11 @@
+import type { Express, Response } from 'express';
+import { DmRequest } from '../../lib/auth/base';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+import { DM } from '../../bin';
+export default class OpenIDConnect extends DmPlugin {
+    name: string;
+    roles: Role[];
+    constructor(server: DM);
+    api(app: Express): void;
+    authMethod(req: DmRequest, res: Response, next: () => void): void;
+}