ldap-rest 0.0.1

package/dist/src/plugins/auth/rateLimit.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @module core/auth/rateLimit
+ * Rate limiting plugin to prevent brute-force attacks
+ *
+ * This plugin adds rate limiting middleware specifically for authentication
+ * to protect against brute-force attacks. It should be loaded BEFORE auth plugins.
+ *
+ * Uses an Express middleware to check rate limits before processing, and
+ * an afterAuth hook to track failed authentication attempts.
+ *
+ * @author Xavier Guimard <xguimard@linagora.com>
+ */
+import type { Express } from 'express';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+export default class RateLimit extends DmPlugin {
+    name: string;
+    roles: Role[];
+    private store;
+    private windowMs;
+    private maxRequests;
+    constructor(...args: ConstructorParameters<typeof DmPlugin>);
+    api(app: Express): void;
+    private getClientIp;
+}

package/dist/src/plugins/auth/token.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @module plugins/auth/token
+ * @author Xavier Guimard <xguimard@linagora.com>
+ *
+ * Token-based authentication plugin
+ * @group Plugins
+ */
+import type { Response } from 'express';
+import AuthBase, { type DmRequest } from '../../lib/auth/base';
+import type { Role } from '../../abstract/plugin';
+export default class AuthToken extends AuthBase {
+    name: string;
+    roles: Role[];
+    private tokenMap;
+    constructor(...args: ConstructorParameters<typeof AuthBase>);
+    authMethod(req: DmRequest, res: Response, next: () => void): void;
+}

package/dist/src/plugins/configApi.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @module plugins/configApi
+ * @author Xavier Guimard <xguimard@linagora.com>
+ *
+ * Plugin that exposes API configuration for LDAP editor applications
+ * Provides information about available resources, schemas, and endpoints
+ *
+ * Uses autodiscovery pattern: plugins with 'configurable' role automatically
+ * expose their configuration via getConfigApiData() method
+ */
+import type { Express } from 'express';
+import DmPlugin, { type Role } from '../abstract/plugin';
+export default class ConfigApi extends DmPlugin {
+    name: string;
+    roles: Role[];
+    /**
+     * API routes
+     */
+    api(app: Express): void;
+    /**
+     * Collect configuration from all plugins with 'configurable' role
+     */
+    private collectPluginConfigs;
+}

package/dist/src/plugins/demo/helloworld.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @module core/helloworld
+ * Demo plugin, add /hello API + consumes 'hello' hook
+ * @author Xavier Guimard <xguimard@linagora.com>
+ */
+import type { Express } from 'express';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+export default class HelloWorld extends DmPlugin {
+    name: string;
+    roles: Role[];
+    api(app: Express): void;
+}

package/dist/src/plugins/ldap/bulkImport.d.ts

@@ -0,0 +1,48 @@
+/**
+ * LDAP Bulk Import Plugin
+ * Provides CSV-based bulk import for LDAP resources based on JSON schemas
+ * @author LDAP-Rest Team
+ */
+import type { Express } from 'express';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+import type { DM } from '../../bin';
+export default class LdapBulkImport extends DmPlugin {
+    name: string;
+    roles: Role[];
+    private resources;
+    private upload;
+    constructor(parent: DM);
+    api(app: Express): void;
+    /**
+     * Generate CSV template from schema
+     */
+    private getTemplate;
+    /**
+     * Bulk import from CSV file
+     */
+    private bulkImport;
+    /**
+     * Process a single CSV record
+     */
+    private processRecord;
+    /**
+     * Get editable attributes from schema (exclude fixed and calculated)
+     */
+    private getEditableAttributes;
+    /**
+     * Find attribute by role in schema
+     */
+    private findAttributeByRole;
+    /**
+     * Fetch organization to get its path
+     */
+    private fetchOrganization;
+    /**
+     * Check if entry exists
+     */
+    private entryExists;
+    /**
+     * Provide configuration for config API
+     */
+    getConfigApiData(): Record<string, unknown>;
+}

package/dist/src/plugins/ldap/departmentSync.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @module plugins/ldap/departmentSync
+ * @author Xavier Guimard <xguimard@linagora.com>
+ *
+ * Plugin to maintain consistency of department links when organizations are renamed/moved
+ * Automatically updates twakeDepartmentLink and twakeDepartmentPath attributes on all
+ * resources (users, groups, etc.) when their linked organization DN changes.
+ */
+import DmPlugin, { type Role } from '../../abstract/plugin';
+import type { DM } from '../../bin';
+import type { Hooks } from '../../hooks';
+export default class LdapDepartmentSync extends DmPlugin {
+    name: string;
+    roles: Role[];
+    private linkAttr;
+    private pathAttr;
+    constructor(server: DM);
+    hooks: Hooks;
+    /**
+     * Update resources that are directly linked to the renamed organization
+     */
+    private updateLinkedResources;
+    /**
+     * Update resources linked to sub-organizations that were moved
+     * When ou=IT moves from ou=IT,ou=Departments to ou=IT,ou=Tech,
+     * its child ou=Dev,ou=IT,ou=Departments becomes ou=Dev,ou=IT,ou=Tech
+     * We need to update resources pointing to the old child DN
+     */
+    private updateDescendantReferences;
+    /**
+     * Get department path from an organization DN
+     * Fetches the path attribute directly from the organization entry
+     */
+    private getDepartmentPath;
+}

package/dist/src/plugins/ldap/externalUsersInGroups.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @module plugins/ldap/externalUsersInGroups
+ * @author Xavier Guimard <xguimard@linagora.com>
+ *
+ * Creates on-the-fly missing group users into a branch
+ * This permits to add external users into mailing lists
+ */
+import DmPlugin, { type Role } from '../../abstract/plugin';
+import type { DM } from '../../bin';
+import { Hooks } from '../../hooks';
+import ldapActions from '../../lib/ldapActions';
+export default class ExternalUsersInGroups extends DmPlugin {
+    name: string;
+    roles: Role[];
+    dependencies: {
+        ldapGroups: string;
+    };
+    ldap: ldapActions;
+    constructor(server: DM);
+    hooks: Hooks;
+}

package/dist/src/plugins/ldap/flatGeneric.d.ts

@@ -0,0 +1,31 @@
+import type { Express } from 'express';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+import LdapFlat from '../../abstract/ldapFlat';
+import type { DM } from '../../bin';
+/**
+ * Concrete implementation of LdapFlat for generic instances
+ */
+declare class LdapFlatInstance extends LdapFlat {
+    name: string;
+    roles: Role[];
+    dependencies: {
+        departmentSync: string;
+    };
+    constructor(server: DM, config: ConstructorParameters<typeof LdapFlat>[1]);
+}
+export default class LdapFlatGeneric extends DmPlugin {
+    name: string;
+    roles: Role[];
+    instances: LdapFlatInstance[];
+    private schemaPaths;
+    constructor(server: DM);
+    /**
+     * Register all instance APIs
+     */
+    api(app: Express): void;
+    /**
+     * Provide configuration for config API
+     */
+    getConfigApiData(): Record<string, unknown>;
+}
+export {};

package/dist/src/plugins/ldap/groups.d.ts

@@ -0,0 +1,95 @@
+import type { Express, Request, Response } from 'express';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+import type { DM } from '../../bin';
+import type { Hooks } from '../../hooks';
+import type ldapActions from '../../lib/ldapActions';
+import type { AttributesList, AttributeValue, LdapList, ModifyRequest } from '../../lib/ldapActions';
+import type { Schema } from '../../config/schema';
+export interface postAdd {
+    cn?: string;
+    [key: string]: AttributeValue | undefined;
+}
+export type postModify = ModifyRequest;
+export default class LdapGroups extends DmPlugin {
+    name: string;
+    roles: Role[];
+    base?: string;
+    ldap: ldapActions;
+    cn: string;
+    schema?: Schema;
+    constructor(server: DM);
+    /**
+     * Catch all deletion to remove deleted users from groups
+     */
+    hooks: Hooks;
+    /**
+     * API routes
+     */
+    api(app: Express): void;
+    apiGet(req: Request, res: Response): Promise<void>;
+    apiAdd(req: Request, res: Response, ...requiredFields: string[]): Promise<void>;
+    apiDelete(req: Request, res: Response): Promise<void>;
+    apiModify(req: Request, res: Response): Promise<void>;
+    /**
+     * LDAP group methods
+     */
+    addGroup(cn: string, members?: string[], additional?: AttributesList): Promise<boolean>;
+    modifyGroup(cn: string, changes: {
+        add?: AttributesList;
+        replace?: AttributesList;
+        delete?: string[] | AttributesList;
+    }): Promise<boolean>;
+    renameGroup(cn: string, newCn: string): Promise<boolean>;
+    deleteGroup(cn: string): Promise<boolean>;
+    addMember(cn: string, member: string | string[]): Promise<boolean>;
+    deleteMember(cn: string, member: string): Promise<boolean>;
+    deleteMemberFromAll(memberDn: string): Promise<void>;
+    /**
+     * Move a group to a different organization by updating organization link and path attributes
+     * This method should only be called when organization attributes are configured
+     * @param cn Group cn or DN
+     * @param targetOrgDn DN of the target organization
+     * @returns Success status
+     */
+    moveGroup(cn: string, targetOrgDn: string, req?: Request): Promise<{
+        success: boolean;
+    }>;
+    /**
+     * List groups from LDAP
+     * @param param0 {filter, attributes}:
+     * - filter: LDAP filter (default '(objectClass=*)')
+     * - attributes: attributes to fetch (default ['cn','member'])
+     * @returns LdapList (Record<string, AttributesList>)
+     */
+    listGroups({ filter, attributes, }?: {
+        filter?: string;
+        attributes?: string[];
+    }): Promise<LdapList>;
+    /**
+     * Simple formatter for listGroups()
+     * @param cn main attribute value (partial or full)
+     * @param partial boolean, true for partial search (default false)
+     * @param attributes array of attributes to return
+     * @returns LdapList (means Record<string, AttributesList> where key is the --ldap-user-main-attribute value [default: cn])
+     */
+    searchGroupsByName(cn: string, partial?: boolean, attributes?: string[]): Promise<LdapList>;
+    protected fixDn(dn: string): string | false;
+    /**
+     * Verify that each member exists in LDAP
+     *
+     * It calls ldapgroupvalidatemembers hook before validation
+     * so that plugins can modify the members list and/or the group DN
+     * and/or create missing members on the fly
+     * @param dn Group DN (given to hooks)
+     * @param members Array of member DNs to check
+     * @returns nothing, throw if error
+     */
+    validateMembers(dn: string, members: string[]): Promise<void>;
+    validateNewGroup(dn: string, entry: AttributesList): Promise<boolean>;
+    validateChanges(dn: string, changes: ModifyRequest): Promise<boolean>;
+    _validateOneChange(field: string, value: AttributeValue | null): Promise<boolean>;
+    /**
+     * Provide configuration for config API
+     */
+    getConfigApiData(): Record<string, unknown>;
+}

package/dist/src/plugins/ldap/onChange.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @module core/onLdapChange
+ * Check for ldap modify events and generate hooks:
+ *  - onLdapChange
+ *  - onLdapMailChange
+ * @author Xavier Guimard <xguimard@linagora.com>
+ */
+import { Entry } from 'ldapts';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+import type { Hooks } from '../../hooks';
+import type { AttributeValue } from '../../lib/ldapActions';
+export type ChangesToNotify = Record<string, [
+    AttributeValue | null,
+    AttributeValue | null
+]>;
+declare class OnLdapChange extends DmPlugin {
+    name: string;
+    roles: Role[];
+    stack: Record<number, Entry>;
+    hooks: Hooks;
+    notify(dn: string, changes: ChangesToNotify): void;
+    notifyAttributeChange(attribute: string, hookName: keyof Hooks, dn: string, changes: ChangesToNotify, stringOnly?: boolean): void;
+    notifyAttributeChangeWithMail(attribute: string, hookName: keyof Hooks, dn: string, changes: ChangesToNotify): Promise<void>;
+    /**
+     * Reconstruct display name from cn, givenName, and sn attributes
+     * @param changes - The changes object
+     * @param index - 0 for old value, 1 for new value
+     * @returns The reconstructed display name or null
+     */
+    reconstructDisplayName(changes: ChangesToNotify, index: 0 | 1): string | null;
+}
+export default OnLdapChange;

package/dist/src/plugins/ldap/organization.d.ts

@@ -0,0 +1,65 @@
+import type { Express, Request, Response } from 'express';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+import { DM } from '../../bin';
+import { Hooks } from '../../hooks';
+import { AttributesList, AttributeValue, ModifyRequest } from '../../lib/ldapActions';
+import type { Schema } from '../../config/schema';
+export default class LdapOrganizations extends DmPlugin {
+    name: string;
+    roles: Role[];
+    pathAttr: string;
+    linkAttr: string;
+    schema?: Schema;
+    constructor(dm: DM);
+    /**
+     * API routes for LDAP organizations
+     * @param app Express application
+     */
+    api(app: Express): void;
+    apiAdd(req: Request, res: Response): Promise<void>;
+    apiModify(req: Request, res: Response): Promise<void>;
+    apiDelete(req: Request, res: Response): Promise<void>;
+    apiMove(req: Request, res: Response): Promise<void>;
+    /**
+     * Consistency checks on any entry
+     */
+    hooks: Hooks;
+    /**
+     * Check if the department link is valid
+     * @param entry LDAP entry to check
+     */
+    checkDeptLink(entry: AttributesList): Promise<void>;
+    /**
+     * Check if the department path is valid
+     * @param entry LDAP entry to check
+     */
+    checkDeptPath(entry: AttributesList): Promise<void>;
+    isEmptyOrganization(dn: string): Promise<void>;
+    /**
+     * Check if entry is an organisation
+     * @param entry LDAP entry to check
+     * @returns True if entry is an organisation, false otherwise
+     */
+    isOu(entry: AttributesList): boolean;
+    getOrganisationTop(req?: Request): Promise<AttributesList | AttributesList[]>;
+    getOrganisationByDn(dn: string, req?: Request): Promise<AttributesList>;
+    getOrganisationSubnodes(dn: string, req?: Request): Promise<AttributesList[]>;
+    addOrganization(dn: string, entry: AttributesList, req?: Request): Promise<boolean>;
+    modifyOrganization(dn: string, changes: ModifyRequest): Promise<boolean>;
+    validateNewOrganization(dn: string, entry: AttributesList): boolean;
+    validateChanges(dn: string, changes: ModifyRequest): boolean;
+    _validateOneChange(field: string, value: AttributeValue | null): boolean;
+    /**
+     * Move an organization to a different parent organization
+     * Uses LDAP modifyDN to change the DN hierarchy
+     */
+    moveOrganization(dn: string, targetOrgDn: string, req?: Request): Promise<{
+        newDn: string;
+    }>;
+    deleteOrganization(dn: string): Promise<boolean>;
+    searchOrganisationSubnodes(dn: string, query: string): Promise<AttributesList[]>;
+    /**
+     * Provide configuration for config API
+     */
+    getConfigApiData(): Record<string, unknown>;
+}

package/dist/src/plugins/ldap/trash.d.ts

@@ -0,0 +1,52 @@
+/**
+ * @module core/trash
+ * LDAP Trash System - Intercepts delete operations and moves entries to a trash branch
+ *
+ * When a delete operation occurs on a watched LDAP branch:
+ * 1. Check if DN is in a watched branch (configured via DM_TRASH_WATCHED_BASES)
+ * 2. Remove any existing entry with same RDN in trash (overwrite old trash)
+ * 3. Use LDAP modifyDN to atomically move entry to trash branch
+ * 4. Add metadata (deletedAt, originalDN) as description attribute
+ * 5. Cancel the native delete operation
+ *
+ * @author Xavier Guimard <xguimard@linagora.com>
+ */
+import DmPlugin, { type Role } from '../../abstract/plugin';
+import type { Hooks } from '../../hooks';
+declare class TrashPlugin extends DmPlugin {
+    name: string;
+    roles: Role[];
+    private watchedBases;
+    private trashBase;
+    private addMetadata;
+    private autoCreateTrash;
+    private trashInitialized;
+    constructor(dm: typeof DmPlugin.prototype.server);
+    /**
+     * Check if a DN is in a watched branch
+     */
+    private isWatched;
+    /**
+     * Extract RDN from DN (e.g., "uid=john" from "uid=john,ou=users,dc=example,dc=com")
+     */
+    private extractRDN;
+    /**
+     * Build trash DN from original DN
+     * uid=john,ou=users,dc=example,dc=com -> uid=john,ou=trash,dc=example,dc=com
+     */
+    private buildTrashDN;
+    /**
+     * Ensure trash branch exists in LDAP
+     */
+    private ensureTrashExists;
+    /**
+     * Remove old entry from trash if it exists (to allow overwrite)
+     */
+    private removeOldTrashEntry;
+    /**
+     * Add metadata to trash entry (deletedAt, originalDN)
+     */
+    private addMetadataToTrash;
+    hooks: Hooks;
+}
+export default TrashPlugin;

package/dist/src/plugins/static.d.ts

@@ -0,0 +1,7 @@
+import type { Express } from 'express';
+import DmPlugin, { type Role } from '../abstract/plugin';
+export default class Static extends DmPlugin {
+    name: string;
+    roles: Role[];
+    api(app: Express): void;
+}

package/dist/src/plugins/twake/calendarResources.d.ts

@@ -0,0 +1,31 @@
+import TwakePlugin from '../../abstract/twakePlugin';
+import { type Role } from '../../abstract/plugin';
+import { Hooks } from '../../hooks';
+/**
+ * Plugin to sync LDAP resources with Twake Calendar
+ *
+ * Monitors a LDAP branch for resources (meeting rooms, equipment, etc.)
+ * and automatically creates/updates/deletes them in Twake Calendar via WebAdmin API
+ */
+export default class CalendarResources extends TwakePlugin {
+    name: string;
+    roles: Role[];
+    private resourceBase;
+    private resourceObjectClass;
+    private resourceCreator;
+    private resourceDomain;
+    constructor(server: import('../../bin').DM);
+    hooks: Hooks;
+    /**
+     * Check if a LDAP entry is a calendar resource
+     */
+    private isResource;
+    /**
+     * Build resource data for Calendar API from LDAP attributes
+     */
+    private buildResourceData;
+    /**
+     * Extract resource ID from DN
+     */
+    private getResourceId;
+}

package/dist/src/plugins/twake/james.d.ts

@@ -0,0 +1,83 @@
+import TwakePlugin from '../../abstract/twakePlugin';
+import { type Role } from '../../abstract/plugin';
+import type { DM } from '../../bin';
+import type { AttributeValue } from '../../lib/ldapActions';
+import { Hooks } from '../../hooks';
+import type { ChangesToNotify } from '../ldap/onChange';
+export default class James extends TwakePlugin {
+    name: string;
+    roles: Role[];
+    dependencies: {
+        onLdapChange: string;
+        ldapGroups: string;
+    };
+    private quotaAttr;
+    private aliasAttr;
+    private mailboxTypeAttr;
+    private initDelay;
+    constructor(server: DM);
+    hooks: Hooks;
+    /**
+     * Handle mailbox type transitions when twakeMailboxType changes
+     */
+    private handleMailboxTypeTransition;
+    /**
+     * Extract display name from LDAP attributes
+     * Fallback logic: displayName → cn → givenName+sn → mail
+     */
+    private getDisplayNameFromAttributes;
+    getMailFromDN(dn: string): Promise<string | null>;
+    getDisplayNameFromDN(dn: string): Promise<string | null>;
+    generateSignature(dn: string): Promise<string | null>;
+    updateJamesIdentity(dn: string, mail: string, displayName: string): Promise<void>;
+    /**
+     * Type guard to check if delete operation is an AttributesList
+     */
+    private isAttributesList;
+    /**
+     * Extract mailbox type from group attributes
+     * Returns: 'group', 'mailingList', 'teamMailbox', or null if not set
+     */
+    private getMailboxType;
+    /**
+     * Validate that a DN is within one of the allowed branches
+     */
+    private isInAllowedBranches;
+    /**
+     * Create a mailing list in James
+     */
+    private createMailingList;
+    /**
+     * Create a team mailbox in James
+     */
+    private createTeamMailbox;
+    /**
+     * Delete a team mailbox from James
+     */
+    private deleteTeamMailbox;
+    /**
+     * Remove all members from a team mailbox (without deleting it)
+     * This preserves the mailbox for potential future use
+     */
+    private removeAllTeamMailboxMembers;
+    /**
+     * Delete a mailing list from James
+     */
+    private deleteMailingList;
+    /**
+     * Get email addresses for a list of member DNs
+     * Uses p-limit to parallelize LDAP queries while limiting concurrency
+     */
+    getMemberEmails(memberDns: string[]): Promise<string[]>;
+    /**
+     * Get the mail address for a group DN
+     */
+    getGroupMail(groupDn: string): Promise<string | null>;
+    /**
+     * Get the mailbox type for a group DN
+     */
+    getGroupMailboxType(groupDn: string): Promise<'group' | 'mailingList' | 'teamMailbox' | null>;
+    _handleDelegationChange(dn: string, changes: ChangesToNotify): Promise<void>;
+    _getDelegateEmail(dn: string): Promise<string | null>;
+    _normalizeToArray(value: AttributeValue | null): string[];
+}

package/dist/src/plugins/weblogs.d.ts

@@ -0,0 +1,8 @@
+import type { Express, Request, Response } from 'express';
+import DmPlugin, { type Role } from '../abstract/plugin';
+export default class WebLogs extends DmPlugin {
+    name: string;
+    roles: Role[];
+    api(app: Express): void;
+    log(req: Request, res: Response, start: number, log: Record<string, string | number>): void;
+}