ldap-rest 0.1.2 → 0.1.4

package/dist/src/lib/errors.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Custom HTTP Error classes with status codes
+ * @author Xavier Guimard <xguimard@linagora.com>
+ */
+/**
+ * Base HTTP Error class with status code
+ */
+export declare class HttpError extends Error {
+    statusCode: number;
+    constructor(message: string, statusCode?: number);
+}
+/**
+ * Client errors (4xx)
+ */
+export declare class BadRequestError extends HttpError {
+    constructor(message?: string);
+}
+export declare class UnauthorizedError extends HttpError {
+    constructor(message?: string);
+}
+export declare class ForbiddenError extends HttpError {
+    constructor(message?: string);
+}
+export declare class NotFoundError extends HttpError {
+    constructor(message?: string);
+}
+export declare class ConflictError extends HttpError {
+    constructor(message?: string);
+}
+export declare class UriTooLongError extends HttpError {
+    constructor(message?: string);
+}
+export declare class TooManyRequestsError extends HttpError {
+    constructor(message?: string);
+}
+/**
+ * Server errors (5xx)
+ */
+export declare class BadGatewayError extends HttpError {
+    constructor(message?: string);
+}
+export declare class ServiceUnavailableError extends HttpError {
+    constructor(message?: string);
+}
+export declare class GatewayTimeoutError extends HttpError {
+    constructor(message?: string);
+}

package/dist/src/lib/ldapActions.d.ts

@@ -32,6 +32,9 @@ declare class ldapActions {
     private connectionTtl;
     private ldapUrls;
     private currentUrlIndex;
+    private attrSignatureCache;
+    private waitingResolvers;
+    private availableConnections;
     constructor(server: DM);
     /**
      * Create a new LDAP connection with failover support
@@ -43,12 +46,18 @@ declare class ldapActions {
     private cleanupExpiredConnections;
     /**
      * Acquire a connection from the pool or create a new one
+     * Optimized for O(1) lookup using separate available connections queue
      */
     private acquireConnection;
     /**
      * Release a connection back to the pool
+     * If there are waiting requests, hand off the connection directly
      */
     private releaseConnection;
+    /**
+     * Get a sorted signature for attribute list, using cache for performance
+     */
+    private getAttributeSignature;
     /**
      * Generate cache key for LDAP search
      */

package/dist/src/lib/utils.d.ts

@@ -7,6 +7,23 @@ import type { Config } from '../bin';
 export declare const launchHooks: (hooks: Function[] | undefined, ...args: unknown[]) => Promise<void>;
 export declare const launchHooksChained: <T>(hooks: Function[] | undefined, args: T) => Promise<T>;
 export declare const transformSchemas: (schemas: string | Buffer, config: Config) => string;
+/**
+ * Escape special characters in LDAP filter values according to RFC 4515
+ * Prevents LDAP injection attacks by escaping characters that have special meaning in LDAP filters
+ *
+ * @param value - The value to escape
+ * @returns The escaped value safe for use in LDAP filters
+ *
+ * @example
+ * ```typescript
+ * escapeLdapFilter('user*')
+ * // => 'user\\2a'
+ *
+ * escapeLdapFilter('Smith, John (admin)')
+ * // => 'Smith, John \\28admin\\29'
+ * ```
+ */
+export declare function escapeLdapFilter(value: string): string;
 /**
  * Parse a Distinguished Name (DN) into its component parts (RDNs)
  * Handles escaped commas and other special characters

package/dist/src/plugins/auth/trustedProxy.d.ts

@@ -0,0 +1,67 @@
+/**
+ * @module core/auth/trustedProxy
+ * Trusted proxy plugin to validate X-Forwarded-For headers
+ *
+ * This plugin validates that X-Forwarded-For headers only come from trusted
+ * upstream reverse proxies. If the request comes from an untrusted IP,
+ * the X-Forwarded-For header is removed to prevent IP spoofing attacks.
+ *
+ * This plugin MUST be loaded BEFORE any plugin that uses X-Forwarded-For
+ * (like crowdsec and rateLimit) to ensure they receive sanitized headers.
+ *
+ * Configuration:
+ * - trusted_proxy: Array of trusted proxy IPs or CIDR ranges (required)
+ *   Example: ["127.0.0.1", "10.0.0.0/8", "192.168.1.0/24", "::1"]
+ * - trusted_proxy_auth_header: Header name containing the authenticated user
+ *   from trusted proxy (optional, default: "Auth-User")
+ *
+ * When a request comes from a trusted proxy:
+ * - X-Forwarded-For header is preserved
+ * - The request is marked as trusted (req.trustedProxy = true)
+ * - If trusted_proxy_auth_header is set and the header is present,
+ *   req.proxyAuthUser is set to its value for use by other plugins (e.g., weblogs)
+ *
+ * @author Xavier Guimard <xguimard@linagora.com>
+ */
+import type { Express } from 'express';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+declare global {
+    namespace Express {
+        interface Request {
+            trustedProxy?: boolean;
+            proxyAuthUser?: string;
+        }
+    }
+}
+export default class TrustedProxy extends DmPlugin {
+    name: string;
+    roles: Role[];
+    private trustedNetworks;
+    private authHeader;
+    constructor(...args: ConstructorParameters<typeof DmPlugin>);
+    api(app: Express): void;
+    /**
+     * Check if an IP address belongs to a trusted proxy network
+     */
+    private isTrustedProxy;
+    /**
+     * Normalize IP address (handle IPv4-mapped IPv6 addresses)
+     */
+    private normalizeIP;
+    /**
+     * Parse an IP address into a bigint for comparison
+     */
+    private parseIP;
+    /**
+     * Parse a CIDR notation string into network address and mask
+     */
+    private parseCIDR;
+    /**
+     * Parse an IPv4 address into a bigint
+     */
+    private parseIPv4;
+    /**
+     * Parse an IPv6 address into a bigint
+     */
+    private parseIPv6;
+}

package/dist/src/plugins/ldap/groups.d.ts

@@ -17,6 +17,15 @@ export default class LdapGroups extends DmPlugin {
     ldap: ldapActions;
     cn: string;
     schema?: Schema;
+    private regexCache;
+    /**
+     * Get a compiled RegExp from cache, or compile and cache it
+     */
+    private getCompiledRegex;
+    /**
+     * Escape special regex characters in a string
+     */
+    private escapeRegex;
     constructor(server: DM);
     /**
      * Catch all deletion to remove deleted users from groups

package/dist/src/plugins/twake/james.d.ts

@@ -1,3 +1,4 @@
+import type { Express } from 'express';
 import TwakePlugin from '../../abstract/twakePlugin';
 import { type Role } from '../../abstract/plugin';
 import type { DM } from '../../bin';
@@ -16,6 +17,14 @@ export default class James extends TwakePlugin {
     private mailboxTypeAttr;
     private initDelay;
     constructor(server: DM);
+    /**
+     * Register API routes
+     */
+    api(app: Express): void;
+    /**
+     * Get quota information for a user
+     */
+    private getUserQuota;
     hooks: Hooks;
     /**
      * Handle mailbox type transitions when twakeMailboxType changes

package/dist/src/plugins/weblogs.d.ts

@@ -5,4 +5,5 @@ export default class WebLogs extends DmPlugin {
     roles: Role[];
     api(app: Express): void;
     log(req: Request, res: Response, start: number, log: Record<string, string | number>): void;
+    private getClientIp;
 }

package/docs/authentication.md

@@ -11,6 +11,139 @@ LDAP-Rest provides multiple authentication plugins to secure API access. These p
 5. **OpenID Connect** (`core/auth/openidconnect`) - OAuth 2.0 / OpenID Connect authentication
 6. **Authorization Per Branch** (`core/auth/authzPerBranch`) - Branch-level access control (see [authzPerBranch.md](authzPerBranch.md))
 
+## Security Plugins
+
+1. **Trusted Proxy** (`core/auth/trustedProxy`) - Validate X-Forwarded-For headers from reverse proxies
+2. **Rate Limiting** (`core/auth/rateLimit`) - Prevent brute force attacks
+3. **CrowdSec** (`core/auth/crowdsec`) - IP reputation and blocking
+
+## Trusted Proxy
+
+When running behind a reverse proxy (nginx, Apache, HAProxy, etc.), client IP addresses are typically passed via `X-Forwarded-For` headers. The `trustedProxy` plugin validates these headers to prevent IP spoofing attacks.
+
+### Configuration
+
+```bash
+--plugin core/auth/trustedProxy \
+--trusted-proxy "127.0.0.1" \
+--trusted-proxy "10.0.0.0/8" \
+--trusted-proxy "192.168.0.0/16"
+```
+
+**Environment Variables:**
+
+```bash
+# Comma-separated list of trusted proxy IPs or CIDR ranges
+DM_TRUSTED_PROXIES="127.0.0.1,10.0.0.0/8,192.168.0.0/16,::1"
+
+# Optional: Header name for authenticated user from proxy (default: Auth-User)
+DM_TRUSTED_PROXY_AUTH_HEADER="Auth-User"
+```
+
+### How It Works
+
+1. **Request arrives** from reverse proxy
+2. **Plugin checks** if `req.socket.remoteAddress` matches a trusted proxy
+3. **If trusted:**
+   - `X-Forwarded-For` header is preserved
+   - `Auth-User` header (or custom header) is extracted for logging
+   - Request is marked as `req.trustedProxy = true`
+4. **If untrusted:**
+   - `X-Forwarded-For` header is **removed** to prevent IP spoofing
+   - Request is marked as `req.trustedProxy = false`
+5. **Other plugins** (rate limiting, CrowdSec, weblogs) see sanitized headers
+
+### Supported Formats
+
+- **IPv4 addresses:** `192.168.1.1`
+- **IPv6 addresses:** `::1`, `fe80::1`
+- **CIDR ranges:** `10.0.0.0/8`, `192.168.0.0/16`, `2001:db8::/32`
+- **IPv4-mapped IPv6:** Automatically handled (e.g., `::ffff:127.0.0.1` matches `127.0.0.1`)
+
+### Auth-User Header
+
+When requests come from a trusted proxy, the plugin can extract an authenticated username from a header set by the proxy. This is useful for:
+
+- Logging who made the request (even if LDAP-Rest doesn't handle authentication)
+- Passing identity from an upstream authentication system
+
+```bash
+# Custom header name (default: Auth-User)
+DM_TRUSTED_PROXY_AUTH_HEADER="X-Remote-User"
+```
+
+The extracted username is:
+- Available as `req.proxyAuthUser` for other plugins
+- Used by the `weblogs` plugin to log the user field
+
+### Example: nginx Configuration
+
+```nginx
+upstream ldap_rest {
+    server 127.0.0.1:8081;
+}
+
+server {
+    listen 443 ssl;
+    server_name api.example.com;
+
+    location / {
+        proxy_pass http://ldap_rest;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Optional: Pass authenticated user from nginx auth
+        proxy_set_header Auth-User $remote_user;
+    }
+}
+```
+
+LDAP-Rest configuration:
+
+```bash
+DM_TRUSTED_PROXIES="127.0.0.1"
+```
+
+### Example: HAProxy Configuration
+
+```haproxy
+frontend https
+    bind *:443 ssl crt /etc/ssl/cert.pem
+    default_backend ldap_rest
+
+backend ldap_rest
+    option forwardfor
+    http-request set-header X-Forwarded-Proto https
+    server ldap_rest 127.0.0.1:8081
+```
+
+### Use Cases
+
+- **Reverse Proxy Deployments:** Ensure correct client IP for rate limiting and logging
+- **Load Balancers:** Trust headers from known load balancer IPs
+- **CDN Integration:** Trust headers from CDN edge servers
+- **Kubernetes:** Trust headers from ingress controllers
+- **Security:** Prevent attackers from spoofing `X-Forwarded-For` to bypass rate limits
+
+### Security Considerations
+
+- **Only trust known proxies:** Never use `0.0.0.0/0` or trust all IPs
+- **Use specific IPs/ranges:** Limit to your actual proxy infrastructure
+- **HTTPS between proxy and LDAP-Rest:** Prevent header injection attacks
+- **Monitor logs:** Watch for warnings about removed X-Forwarded-For headers
+
+### Plugin Load Order
+
+The `trustedProxy` plugin is automatically loaded **first** (via `priority.json`) to ensure all other plugins see sanitized headers:
+
+1. `core/auth/trustedProxy` - Sanitizes X-Forwarded-For headers
+2. `core/weblogs` - Logs requests with correct client IP
+3. `core/auth/crowdsec` - Checks IP reputation
+4. `core/auth/rateLimit` - Rate limits by IP
+5. Authentication plugins...
+
 ## Token Authentication
 
 Simple stateless authentication using bearer tokens.

package/docs/twakeJames.md

@@ -243,6 +243,66 @@ proxyAddresses: SMTP:john.doe@company.com
 
 The `smtp:` prefix is automatically stripped. The capitalization (SMTP vs smtp) is ignored - only the email address after the colon is used.
 
+## REST API
+
+The James plugin exposes a REST API to retrieve quota usage and limits for users.
+
+### GET /api/v1/users/:user/quota-usage
+
+Retrieve quota usage and limits for a user from James. This endpoint returns both the quota limits configured for the user and their current mailbox usage.
+
+**Request:**
+
+```bash
+GET /api/v1/users/jdoe/quota-usage
+```
+
+**Response (200 OK):**
+
+```json
+{
+  "global": { "count": 1000, "size": 1000000000 },
+  "domain": { "count": 800, "size": 800000000 },
+  "user": { "count": 500, "size": 75000000 },
+  "computed": { "count": 500, "size": 75000000 },
+  "occupation": {
+    "size": 50000000,
+    "count": 250,
+    "ratio": {
+      "size": 0.67,
+      "count": 0.5,
+      "max": 0.67
+    }
+  }
+}
+```
+
+**Response Fields:**
+
+- `global`: Global quota limit (server-wide)
+- `domain`: Domain-specific quota limit
+- `user`: User-specific quota limit from LDAP
+- `computed`: Effective quota limit applied (resolved from upper values)
+- `occupation`: **Current mailbox usage statistics**
+  - `size`: Storage currently used (bytes)
+  - `count`: Number of messages in mailbox
+  - `ratio`: Usage ratios (used / limit)
+
+**Error Responses:**
+
+- `404`: User not found in LDAP or quota not found in James
+- `400`: User has no mail attribute
+- `502`: Failed to retrieve quota from James
+- `500`: Internal server error
+
+**Example:**
+
+```bash
+# Get quota usage for user 'jdoe'
+curl http://localhost:8081/api/v1/users/jdoe/quota-usage \
+  -H "Authorization: Bearer admin-token"
+```
+
 ## James WebAdmin API
 
 ### Endpoints Used
@@ -251,6 +311,7 @@ The `smtp:` prefix is automatically stripped. The capitalization (SMTP vs smtp)
 | ------------------- | ------------------------------------------ | ------ |
 | Rename account      | `/users/{old}/rename/{new}?action=rename`  | POST   |
 | Update quota        | `/quota/users/{mail}/size`                 | PUT    |
+| Get quota           | `/quota/users/{mail}`                      | GET    |
 | Add delegation      | `/users/{mail}/authorizedUsers/{delegate}` | PUT    |
 | Remove delegation   | `/users/{mail}/authorizedUsers/{delegate}` | DELETE |
 | Add alias           | `/address/aliases/{mail}/sources/{alias}`  | PUT    |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-rest",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Light directory manager",
   "keywords": [
     "Identity-Manager"
@@ -64,6 +64,10 @@
       "import": "./dist/plugins/auth/totp.js",
       "types": "./dist/src/plugins/auth/totp.d.ts"
     },
+    "./plugin-auth-trustedproxy": {
+      "import": "./dist/plugins/auth/trustedProxy.js",
+      "types": "./dist/src/plugins/auth/trustedProxy.d.ts"
+    },
     "./plugin-configapi": {
       "import": "./dist/plugins/configApi.js",
       "types": "./dist/src/plugins/configApi.d.ts"
@@ -292,6 +296,10 @@
       "import": "./static/browser/ldap-user-editor/types.js",
       "types": "./dist/src/browser/ldap-user-editor/types.d.ts"
     },
+    "./browser-shared-components-disposablecomponent": {
+      "import": "./static/browser/shared/components/DisposableComponent.js",
+      "types": "./dist/src/browser/shared/components/DisposableComponent.d.ts"
+    },
     "./browser-shared-components-modal": {
       "import": "./static/browser/shared/components/Modal.js",
       "types": "./dist/src/browser/shared/components/Modal.d.ts"
@@ -450,6 +458,9 @@
     "test:dev": "./.dev.mk test",
     "test:one": "mocha --config .mocharc-one.json"
   },
+  "overrides": {
+    "glob": ">=11.0.4"
+  },
   "dependencies": {
     "body-parser": "^2.2.0",
     "csv-parse": "^6.1.0",

package/static/browser/ldap-user-editor/components/UserTree.js

@@ -1,11 +1,13 @@
 import { CacheManager } from '../cache/CacheManager.js';
+import { DisposableComponent } from '../../shared/components/DisposableComponent.js';
 
 /**
  * LDAP User Editor - Organization Tree Component
  * Shows only LDAP organization tree (filters out users/groups)
  */
-class UserTree {
+class UserTree extends DisposableComponent {
     constructor(container, baseUrl, onSelectOrg) {
+        super();
         this.expandedNodes = new Set();
         this.selectedDn = null;
         this.rootDn = null;
@@ -13,8 +15,8 @@ class UserTree {
         this.baseUrl = baseUrl;
         this.onSelectOrg = onSelectOrg;
         this.cache = new CacheManager();
-        // Clean expired entries every 5 minutes
-        window.setInterval(() => this.cache.cleanExpired(), 5 * 60 * 1000);
+        // Clean expired entries every 5 minutes - now properly cleaned up
+        this.addManagedInterval(() => this.cache.cleanExpired(), 5 * 60 * 1000);
     }
     /**
      * Fetch with cache support
@@ -157,6 +159,7 @@ class UserTree {
     }
     destroy() {
         this.container.innerHTML = '';
+        super.destroy();
     }
 }
 

package/static/browser/ldap-user-editor/components/UserTree.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserTree.js","sources":["../../../../../src/browser/ldap-user-editor/components/UserTree.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;MAKU,QAAQ,CAAA;AASnB,IAAA,WAAA,CACE,SAAsB,EACtB,OAAe,EACf,WAAiC,EAAA;AAR3B,QAAA,IAAA,CAAA,aAAa,GAAgB,IAAI,GAAG,EAAE;QACtC,IAAA,CAAA,UAAU,GAAkB,IAAI;QAChC,IAAA,CAAA,MAAM,GAAkB,IAAI;AAQlC,QAAA,IAAI,CAAC,SAAS,GAAG,SAAS;AAC1B,QAAA,IAAI,CAAC,OAAO,GAAG,OAAO;AACtB,QAAA,IAAI,CAAC,WAAW,GAAG,WAAW;AAC9B,QAAA,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,EAAE;;AAG/B,QAAA,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACpE;AAEA;;AAEG;IACK,MAAM,WAAW,CAAI,GAAW,EAAA;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAI,GAAG,CAAC;AACrC,QAAA,IAAI,MAAM,KAAK,IAAI,EAAE;AACnB,YAAA,OAAO,MAAM;QACf;AAEA,QAAA,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC;AAC5B,QAAA,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;AACX,YAAA,MAAM,IAAI,KAAK,CAAC,CAAA,KAAA,EAAQ,GAAG,CAAC,MAAM,CAAA,EAAA,EAAK,GAAG,CAAC,UAAU,CAAA,CAAE,CAAC;QAC1D;QAEA,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AACzB,QAAA,OAAO,IAAI;IACb;AAEA,IAAA,MAAM,IAAI,GAAA;AACR,QAAA,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG;;;;;;;;;;;;KAY1B;AAED,QAAA,IAAI;;AAEF,YAAA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CACnC,CAAA,EAAG,IAAI,CAAC,OAAO,CAAA,8BAAA,CAAgC,CAChD;AACD,YAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE;AACvB,YAAA,MAAM,IAAI,CAAC,UAAU,EAAE;QACzB;QAAE,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,kBAAkB,CAAC;YAC/D,IAAI,MAAM,EAAE;AACV,gBAAA,MAAM,CAAC,SAAS;AACd,oBAAA,iHAAiH;YACrH;QACF;IACF;AAEQ,IAAA,MAAM,UAAU,GAAA;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,kBAAkB,CAAC;AAC/D,QAAA,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE;AAE7B,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAClD,YAAA,MAAM,CAAC,SAAS,GAAG,IAAI;YACvB,IAAI,CAAC,oBAAoB,EAAE;QAC7B;QAAE,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC;AAC9C,YAAA,MAAM,CAAC,SAAS;AACd,gBAAA,qGAAqG;QACzG;IACF;AAEQ,IAAA,MAAM,UAAU,CAAC,EAAU,EAAE,KAAa,EAAA;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7C,QAAA,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,KAAK,EAAE;AACzC,QAAA,MAAM,MAAM,GAAG,KAAK,GAAG,EAAE;;AAGzB,QAAA,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CACjC,CAAA,EAAG,IAAI,CAAC,OAAO,8BAA8B,kBAAkB,CAAC,EAAE,CAAC,CAAA,CAAE,CACtE;;QAGD,IAAI,WAAW,GAAG,EAAE;AACpB,QAAA,IAAI,IAAI,CAAC,EAAE,EAAE;YACX,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE;QAC7D;AAAO,aAAA,IAAI,IAAI,CAAC,EAAE,EAAE;YAClB,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE;QAC7D;AAEA,QAAA,IAAI,IAAI,GAAG;8BACe,UAAU,GAAG,QAAQ,GAAG,EAAE,CAAA,uBAAA,EAA0B,MAAM,CAAA;iEACvB,EAAE,CAAA;AACvD,UAAA,EAAA,UAAU,GAAG,aAAa,GAAG,eAAe;;;AAGP,+CAAA,EAAA,EAAE,KAAK,WAAW,CAAA;;KAE9D;QAED,IAAI,UAAU,EAAE;AACd,YAAA,IAAI;;AAEF,gBAAA,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CACrC,CAAA,EAAG,IAAI,CAAC,OAAO,8BAA8B,kBAAkB,CAAC,EAAE,CAAC,CAAA,SAAA,CAAW,CAC/E;gBACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAW,KAAI;oBAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;0BACvC,CAAC,CAAC;0BACF,CAAC,CAAC;AACF,8BAAE,CAAC,CAAC,CAAC,WAAW;8BACd,EAAE;AACR,oBAAA,QACE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;AACtC,wBAAA,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;AAEpC,gBAAA,CAAC,CAAC;AAEF,gBAAA,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE;AAC1B,oBAAA,IAAI,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC;gBACtD;YACF;YAAE,OAAO,KAAK,EAAE;gBACd,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,EAAE,KAAK,CAAC;YACzD;QACF;AAEA,QAAA,OAAO,IAAI;IACb;IAEQ,oBAAoB,GAAA;;AAE1B,QAAA,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE,IAAG;YAChE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAM,CAAC,KAAG;gBACrC,CAAC,CAAC,eAAe,EAAE;gBACnB,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;AACrC,gBAAA,IAAI,CAAC,EAAE;oBAAE;gBAET,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;AAC9B,oBAAA,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B;qBAAO;AACL,oBAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B;AACA,gBAAA,MAAM,IAAI,CAAC,UAAU,EAAE;AACzB,YAAA,CAAC,CAAC;AACJ,QAAA,CAAC,CAAC;;AAGF,QAAA,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE,IAAG;AAC/D,YAAA,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAG;gBAC/B,CAAC,CAAC,eAAe,EAAE;gBACnB,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;AACrC,gBAAA,IAAI,CAAC,EAAE;oBAAE;AAET,gBAAA,IAAI,CAAC,UAAU,GAAG,EAAE;gBACpB,IAAI,CAAC,UAAU,EAAE;AACjB,gBAAA,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;AACtB,YAAA,CAAC,CAAC;AACJ,QAAA,CAAC,CAAC;IACJ;AAEA,IAAA,MAAM,OAAO,GAAA;AACX,QAAA,MAAM,IAAI,CAAC,UAAU,EAAE;IACzB;IAEA,OAAO,GAAA;AACL,QAAA,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,EAAE;IAC/B;AACD;;;;"}
+{"version":3,"file":"UserTree.js","sources":["../../../../../src/browser/ldap-user-editor/components/UserTree.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAAA;;;AAGG;AAMG,MAAO,QAAS,SAAQ,mBAAmB,CAAA;AAS/C,IAAA,WAAA,CACE,SAAsB,EACtB,OAAe,EACf,WAAiC,EAAA;AAEjC,QAAA,KAAK,EAAE;AAVD,QAAA,IAAA,CAAA,aAAa,GAAgB,IAAI,GAAG,EAAE;QACtC,IAAA,CAAA,UAAU,GAAkB,IAAI;QAChC,IAAA,CAAA,MAAM,GAAkB,IAAI;AASlC,QAAA,IAAI,CAAC,SAAS,GAAG,SAAS;AAC1B,QAAA,IAAI,CAAC,OAAO,GAAG,OAAO;AACtB,QAAA,IAAI,CAAC,WAAW,GAAG,WAAW;AAC9B,QAAA,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,EAAE;;AAG/B,QAAA,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACzE;AAEA;;AAEG;IACK,MAAM,WAAW,CAAI,GAAW,EAAA;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAI,GAAG,CAAC;AACrC,QAAA,IAAI,MAAM,KAAK,IAAI,EAAE;AACnB,YAAA,OAAO,MAAM;QACf;AAEA,QAAA,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC;AAC5B,QAAA,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;AACX,YAAA,MAAM,IAAI,KAAK,CAAC,CAAA,KAAA,EAAQ,GAAG,CAAC,MAAM,CAAA,EAAA,EAAK,GAAG,CAAC,UAAU,CAAA,CAAE,CAAC;QAC1D;QAEA,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AACzB,QAAA,OAAO,IAAI;IACb;AAEA,IAAA,MAAM,IAAI,GAAA;AACR,QAAA,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG;;;;;;;;;;;;KAY1B;AAED,QAAA,IAAI;;AAEF,YAAA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CACnC,CAAA,EAAG,IAAI,CAAC,OAAO,CAAA,8BAAA,CAAgC,CAChD;AACD,YAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE;AACvB,YAAA,MAAM,IAAI,CAAC,UAAU,EAAE;QACzB;QAAE,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,kBAAkB,CAAC;YAC/D,IAAI,MAAM,EAAE;AACV,gBAAA,MAAM,CAAC,SAAS;AACd,oBAAA,iHAAiH;YACrH;QACF;IACF;AAEQ,IAAA,MAAM,UAAU,GAAA;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,kBAAkB,CAAC;AAC/D,QAAA,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE;AAE7B,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAClD,YAAA,MAAM,CAAC,SAAS,GAAG,IAAI;YACvB,IAAI,CAAC,oBAAoB,EAAE;QAC7B;QAAE,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC;AAC9C,YAAA,MAAM,CAAC,SAAS;AACd,gBAAA,qGAAqG;QACzG;IACF;AAEQ,IAAA,MAAM,UAAU,CAAC,EAAU,EAAE,KAAa,EAAA;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7C,QAAA,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,KAAK,EAAE;AACzC,QAAA,MAAM,MAAM,GAAG,KAAK,GAAG,EAAE;;AAGzB,QAAA,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CACjC,CAAA,EAAG,IAAI,CAAC,OAAO,8BAA8B,kBAAkB,CAAC,EAAE,CAAC,CAAA,CAAE,CACtE;;QAGD,IAAI,WAAW,GAAG,EAAE;AACpB,QAAA,IAAI,IAAI,CAAC,EAAE,EAAE;YACX,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE;QAC7D;AAAO,aAAA,IAAI,IAAI,CAAC,EAAE,EAAE;YAClB,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE;QAC7D;AAEA,QAAA,IAAI,IAAI,GAAG;8BACe,UAAU,GAAG,QAAQ,GAAG,EAAE,CAAA,uBAAA,EAA0B,MAAM,CAAA;iEACvB,EAAE,CAAA;AACvD,UAAA,EAAA,UAAU,GAAG,aAAa,GAAG,eAAe;;;AAGP,+CAAA,EAAA,EAAE,KAAK,WAAW,CAAA;;KAE9D;QAED,IAAI,UAAU,EAAE;AACd,YAAA,IAAI;;AAEF,gBAAA,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CACrC,CAAA,EAAG,IAAI,CAAC,OAAO,8BAA8B,kBAAkB,CAAC,EAAE,CAAC,CAAA,SAAA,CAAW,CAC/E;gBACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAW,KAAI;oBAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;0BACvC,CAAC,CAAC;0BACF,CAAC,CAAC;AACF,8BAAE,CAAC,CAAC,CAAC,WAAW;8BACd,EAAE;AACR,oBAAA,QACE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;AACtC,wBAAA,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;AAEpC,gBAAA,CAAC,CAAC;AAEF,gBAAA,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE;AAC1B,oBAAA,IAAI,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC;gBACtD;YACF;YAAE,OAAO,KAAK,EAAE;gBACd,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,EAAE,KAAK,CAAC;YACzD;QACF;AAEA,QAAA,OAAO,IAAI;IACb;IAEQ,oBAAoB,GAAA;;AAE1B,QAAA,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE,IAAG;YAChE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAM,CAAC,KAAG;gBACrC,CAAC,CAAC,eAAe,EAAE;gBACnB,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;AACrC,gBAAA,IAAI,CAAC,EAAE;oBAAE;gBAET,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;AAC9B,oBAAA,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B;qBAAO;AACL,oBAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B;AACA,gBAAA,MAAM,IAAI,CAAC,UAAU,EAAE;AACzB,YAAA,CAAC,CAAC;AACJ,QAAA,CAAC,CAAC;;AAGF,QAAA,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE,IAAG;AAC/D,YAAA,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAG;gBAC/B,CAAC,CAAC,eAAe,EAAE;gBACnB,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;AACrC,gBAAA,IAAI,CAAC,EAAE;oBAAE;AAET,gBAAA,IAAI,CAAC,UAAU,GAAG,EAAE;gBACpB,IAAI,CAAC,UAAU,EAAE;AACjB,gBAAA,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;AACtB,YAAA,CAAC,CAAC;AACJ,QAAA,CAAC,CAAC;IACJ;AAEA,IAAA,MAAM,OAAO,GAAA;AACX,QAAA,MAAM,IAAI,CAAC,UAAU,EAAE;IACzB;IAES,OAAO,GAAA;AACd,QAAA,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,EAAE;QAC7B,KAAK,CAAC,OAAO,EAAE;IACjB;AACD;;;;"}

package/static/browser/ldap-user-editor.esm.js

@@ -324,12 +324,70 @@ class UserApiClient {
     }
 }
 
+/**
+ * Base class for browser components with proper lifecycle management
+ * Ensures all event listeners and intervals are cleaned up on destroy
+ * @module browser/shared/components/DisposableComponent
+ */
+class DisposableComponent {
+    constructor() {
+        this._eventListeners = [];
+        this._intervals = [];
+        this._isDestroyed = false;
+    }
+    /**
+     * Register an event listener for automatic cleanup
+     * Use this instead of element.addEventListener directly
+     */
+    addManagedEventListener(target, type, listener, options) {
+        if (this._isDestroyed)
+            return;
+        target.addEventListener(type, listener, options);
+        this._eventListeners.push({ target, type, listener, options });
+    }
+    /**
+     * Register an interval for automatic cleanup
+     * Use this instead of setInterval directly
+     */
+    addManagedInterval(callback, ms) {
+        const id = setInterval(callback, ms);
+        this._intervals.push(id);
+        return id;
+    }
+    /**
+     * Check if the component has been destroyed
+     */
+    get isDestroyed() {
+        return this._isDestroyed;
+    }
+    /**
+     * Clean up all managed resources
+     * Override in subclasses but ALWAYS call super.destroy()
+     */
+    destroy() {
+        if (this._isDestroyed)
+            return;
+        this._isDestroyed = true;
+        // Remove all event listeners
+        for (const { target, type, listener, options } of this._eventListeners) {
+            target.removeEventListener(type, listener, options);
+        }
+        this._eventListeners = [];
+        // Clear all intervals
+        for (const id of this._intervals) {
+            clearInterval(id);
+        }
+        this._intervals = [];
+    }
+}
+
 /**
  * LDAP User Editor - Organization Tree Component
  * Shows only LDAP organization tree (filters out users/groups)
  */
-class UserTree {
+class UserTree extends DisposableComponent {
     constructor(container, baseUrl, onSelectOrg) {
+        super();
         this.expandedNodes = new Set();
         this.selectedDn = null;
         this.rootDn = null;
@@ -337,8 +395,8 @@ class UserTree {
         this.baseUrl = baseUrl;
         this.onSelectOrg = onSelectOrg;
         this.cache = new CacheManager();
-        // Clean expired entries every 5 minutes
-        window.setInterval(() => this.cache.cleanExpired(), 5 * 60 * 1000);
+        // Clean expired entries every 5 minutes - now properly cleaned up
+        this.addManagedInterval(() => this.cache.cleanExpired(), 5 * 60 * 1000);
     }
     /**
      * Fetch with cache support
@@ -481,6 +539,7 @@ class UserTree {
     }
     destroy() {
         this.container.innerHTML = '';
+        super.destroy();
     }
 }