ldap-rest 0.1.6 → 0.1.8

package/dist/src/plugins/ldap/groups.d.ts

@@ -17,15 +17,6 @@ export default class LdapGroups extends DmPlugin {
     ldap: ldapActions;
     cn: string;
     schema?: Schema;
-    private regexCache;
-    /**
-     * Get a compiled RegExp from cache, or compile and cache it
-     */
-    private getCompiledRegex;
-    /**
-     * Escape special regex characters in a string
-     */
-    private escapeRegex;
     constructor(server: DM);
     /**
      * Catch all deletion to remove deleted users from groups

package/dist/src/plugins/ldap/passwordPolicy.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Password Policy plugin - Administration API for OpenLDAP ppolicy
+ *
+ * Provides REST endpoints to:
+ * - Query password status (expiration, lockout, etc.)
+ * - Unlock locked accounts
+ * - List expiring passwords and locked accounts
+ * - Validate password complexity (optional)
+ *
+ * @author Xavier Guimard <xguimard@linagora.com>
+ */
+import type { Express } from 'express';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+export default class PasswordPolicy extends DmPlugin {
+    name: string;
+    roles: Role[];
+    private policyCache;
+    private policyCacheTime;
+    private readonly POLICY_CACHE_TTL;
+    api(app: Express): void;
+    /**
+     * Get password status for a user
+     */
+    private getPasswordStatus;
+    /**
+     * Calculate password status from LDAP entry and policy
+     */
+    private calculateStatus;
+    /**
+     * Unlock a user account by removing pwdAccountLockedTime and pwdFailureTime
+     */
+    private unlockAccount;
+    /**
+     * Find users with passwords expiring soon
+     */
+    private findExpiringPasswords;
+    /**
+     * Find locked accounts
+     */
+    private findLockedAccounts;
+    /**
+     * Read ppolicy configuration from LDAP
+     */
+    private readPolicyConfig;
+    /**
+     * Parse ppolicy entry to config object
+     */
+    private parsePolicyEntry;
+    /**
+     * Parse number from LDAP attribute value
+     */
+    private parseNumber;
+    /**
+     * Parse GeneralizedTime (YYYYMMDDHHmmssZ) to Date
+     */
+    private parseGeneralizedTime;
+    /**
+     * Validate password complexity (optional local validation)
+     */
+    private validateComplexity;
+    /**
+     * Resolve user DN from userId (uid or full DN)
+     * Escapes special characters in userId to prevent LDAP injection
+     */
+    private resolveUserDn;
+    /**
+     * Provide configuration data for config API
+     */
+    getConfigApiData(): Record<string, unknown> | undefined;
+}

package/dist/src/plugins/twake/calendarResources.d.ts

@@ -28,4 +28,13 @@ export default class CalendarResources extends TwakePlugin {
      * Extract resource ID from DN
      */
     private getResourceId;
+    /**
+     * Delete user data from Twake Calendar WebAdmin API
+     * Calls POST /users/{mail}?action=deleteData
+     * @param mail - The user's email address
+     * @returns Task information or null on error
+     */
+    deleteUserData(mail: string): Promise<{
+        taskId: string;
+    } | null>;
 }

package/dist/src/plugins/twake/james.d.ts

@@ -39,6 +39,14 @@ export default class James extends TwakePlugin {
     getDisplayNameFromDN(dn: string): Promise<string | null>;
     generateSignature(dn: string): Promise<string | null>;
     updateJamesIdentity(dn: string, mail: string, displayName: string): Promise<void>;
+    /**
+     * Delete user data via James WebAdmin API
+     * Calls POST /users/{mail}?action=deleteData
+     * Returns task information from the response
+     */
+    deleteUserData(mail: string, fromStep?: string): Promise<{
+        taskId: string;
+    } | null>;
     /**
      * Type guard to check if delete operation is an AttributesList
      */

package/docs/presentations/en.md

@@ -7,7 +7,7 @@ sub_title: Lightweight Directory Manager
 
 ## Lightweight Directory Manager with Plugin Architecture
 
-![LDAP-Rest Logo](./linagora.png)
+![LDAP-Rest Logo](../linagora.png)
 
 <!-- end_slide -->
 
@@ -710,7 +710,7 @@ Open http://localhost:8081
 
 ## LDAP-Rest - Lightweight Directory Manager
 
-[![Powered by LINAGORA](./linagora.png)](https://linagora.com)
+[![Powered by LINAGORA](../linagora.png)](https://linagora.com)
 
 **GitHub**: https://github.com/linagora/ldap-rest
 

package/docs/presentations/fr.md

@@ -7,7 +7,7 @@ sub_title: Gestionnaire d'annuaire léger avec architecture à plugins
 
 ## Gestionnaire d'annuaire léger avec architecture à plugins
 
-![LDAP-Rest Logo](./linagora.png)
+![LDAP-Rest Logo](../linagora.png)
 
 <!-- end_slide -->
 
@@ -710,7 +710,7 @@ Ouvrez http://localhost:8081
 
 ## LDAP-Rest - Gestionnaire d'annuaire léger
 
-[![Powered by LINAGORA](./linagora.png)](https://linagora.com)
+[![Powered by LINAGORA](../linagora.png)](https://linagora.com)
 
 **GitHub**: https://github.com/linagora/ldap-rest
 

package/docs/usage/plugins/integrations/calendar-resources.md

@@ -146,3 +146,46 @@ Ensure `DM_CALENDAR_WEBADMIN_TOKEN` is set and valid. The token is sent as a Bea
 ### Wrong resources being synced
 
 Use `DM_CALENDAR_RESOURCE_BASE` and `DM_CALENDAR_RESOURCE_OBJECTCLASS` to filter which LDAP entries are considered resources.
+
+## Public Methods
+
+Public methods available on the CalendarResources plugin instance.
+
+### Usage
+
+```typescript
+import type { DM } from 'ldap-rest';
+import type CalendarResources from 'ldap-rest/plugin-twake-calendarresources';
+
+// Get the plugin instance from another plugin
+const calendar = this.server.getPlugin(
+  'calendarResources'
+) as CalendarResources;
+```
+
+### deleteUserData(mail)
+
+Delete all user data from Twake Calendar via WebAdmin API. Useful for GDPR "right to be forgotten" compliance.
+
+**Signature:**
+
+```typescript
+async deleteUserData(mail: string): Promise<{ taskId: string } | null>
+```
+
+**Parameters:**
+
+- `mail` (string): User's email address
+
+**Returns:** Task information with `taskId`, or `null` on error.
+
+**Example:**
+
+```typescript
+const result = await calendar.deleteUserData('user@example.com');
+if (result) {
+  console.log(`Deletion task started: ${result.taskId}`);
+}
+```
+
+**Reference:** [Twake Calendar deleteData API](https://github.com/linagora/twake-calendar-side-service/blob/main/docs/apis/webadmin.md#deleting-user-data)

package/docs/usage/plugins/integrations/james-mail.md

@@ -303,6 +303,244 @@ curl http://localhost:8081/api/v1/users/jdoe/quota-usage \
   -H "Authorization: Bearer admin-token"
 ```
 
+## Public Methods
+
+Public methods available on the James plugin instance. Useful for building GDPR workflows, custom integrations, or calling from other plugins.
+
+### Usage
+
+```typescript
+import type { DM } from 'ldap-rest';
+import type James from 'ldap-rest/plugin-twake-james';
+
+// Get the James plugin instance
+const james = server.getPlugin('james') as James;
+```
+
+### deleteUserData(mail, fromStep?)
+
+Delete all user data via James WebAdmin API. Useful for GDPR "right to be forgotten" compliance.
+
+**Signature:**
+
+```typescript
+async deleteUserData(mail: string, fromStep?: string): Promise<{ taskId: string } | null>
+```
+
+**Parameters:**
+
+- `mail` (string): User's email address
+- `fromStep` (string, optional): Resume deletion from a specific step if a previous attempt failed
+
+**Returns:** Task information with `taskId`, or `null` on error.
+
+**Example:**
+
+```typescript
+const result = await james.deleteUserData('user@example.com');
+if (result) {
+  console.log(`Deletion task started: ${result.taskId}`);
+}
+
+// Resume from a failed step
+const resumed = await james.deleteUserData(
+  'user@example.com',
+  'DeleteMailboxesStep'
+);
+```
+
+**Reference:** [James deleteData API](https://james.apache.org/server/manage-webadmin.html#delete-data-of-a-user)
+
+---
+
+### getMailFromDN(dn)
+
+Retrieve the email address for a user given their LDAP DN.
+
+**Signature:**
+
+```typescript
+async getMailFromDN(dn: string): Promise<string | null>
+```
+
+**Parameters:**
+
+- `dn` (string): LDAP Distinguished Name of the user
+
+**Returns:** Email address string, or `null` if not found.
+
+**Example:**
+
+```typescript
+const mail = await james.getMailFromDN('uid=jdoe,ou=users,dc=example,dc=com');
+// Returns: "jdoe@example.com"
+```
+
+---
+
+### getDisplayNameFromDN(dn)
+
+Retrieve the display name for a user given their LDAP DN. Uses fallback logic: `displayName` → `cn` → `givenName sn` → `mail`.
+
+**Signature:**
+
+```typescript
+async getDisplayNameFromDN(dn: string): Promise<string | null>
+```
+
+**Parameters:**
+
+- `dn` (string): LDAP Distinguished Name of the user
+
+**Returns:** Display name string, or `null` if not found.
+
+**Example:**
+
+```typescript
+const name = await james.getDisplayNameFromDN(
+  'uid=jdoe,ou=users,dc=example,dc=com'
+);
+// Returns: "John Doe"
+```
+
+---
+
+### generateSignature(dn)
+
+Generate an HTML email signature for a user using the configured template (`--james-signature-template`).
+
+**Signature:**
+
+```typescript
+async generateSignature(dn: string): Promise<string | null>
+```
+
+**Parameters:**
+
+- `dn` (string): LDAP Distinguished Name of the user
+
+**Returns:** HTML signature string with placeholders replaced, or `null` if no template configured.
+
+**Example:**
+
+```typescript
+// With template: "<p>{displayName}</p><p>{title} - {department}</p>"
+const signature = await james.generateSignature(
+  'uid=jdoe,ou=users,dc=example,dc=com'
+);
+// Returns: "<p>John Doe</p><p>Engineer - IT</p>"
+```
+
+---
+
+### updateJamesIdentity(dn, mail, displayName)
+
+Update a user's JMAP identity in James (name and optional signature).
+
+**Signature:**
+
+```typescript
+async updateJamesIdentity(dn: string, mail: string, displayName: string): Promise<void>
+```
+
+**Parameters:**
+
+- `dn` (string): LDAP Distinguished Name (used for signature generation)
+- `mail` (string): User's email address
+- `displayName` (string): New display name for the identity
+
+**Example:**
+
+```typescript
+await james.updateJamesIdentity(
+  'uid=jdoe,ou=users,dc=example,dc=com',
+  'jdoe@example.com',
+  'John Doe'
+);
+```
+
+---
+
+### getMemberEmails(memberDns)
+
+Retrieve email addresses for multiple LDAP members. Useful for bulk operations on groups.
+
+**Signature:**
+
+```typescript
+async getMemberEmails(memberDns: string[]): Promise<string[]>
+```
+
+**Parameters:**
+
+- `memberDns` (string[]): Array of LDAP Distinguished Names
+
+**Returns:** Array of email addresses (excludes members without mail attribute).
+
+**Example:**
+
+```typescript
+const emails = await james.getMemberEmails([
+  'uid=alice,ou=users,dc=example,dc=com',
+  'uid=bob,ou=users,dc=example,dc=com',
+]);
+// Returns: ["alice@example.com", "bob@example.com"]
+```
+
+---
+
+### getGroupMail(groupDn)
+
+Retrieve the email address for a group given its LDAP DN.
+
+**Signature:**
+
+```typescript
+async getGroupMail(groupDn: string): Promise<string | null>
+```
+
+**Parameters:**
+
+- `groupDn` (string): LDAP Distinguished Name of the group
+
+**Returns:** Group email address, or `null` if not found.
+
+**Example:**
+
+```typescript
+const mail = await james.getGroupMail(
+  'cn=engineering,ou=groups,dc=example,dc=com'
+);
+// Returns: "engineering@example.com"
+```
+
+---
+
+### getGroupMailboxType(groupDn)
+
+Retrieve the mailbox type for a group (mailing list, team mailbox, or simple group).
+
+**Signature:**
+
+```typescript
+async getGroupMailboxType(groupDn: string): Promise<'group' | 'mailingList' | 'teamMailbox' | null>
+```
+
+**Parameters:**
+
+- `groupDn` (string): LDAP Distinguished Name of the group
+
+**Returns:** Mailbox type string, or `null` if not determinable.
+
+**Example:**
+
+```typescript
+const type = await james.getGroupMailboxType(
+  'cn=engineering,ou=groups,dc=example,dc=com'
+);
+// Returns: "mailingList" or "teamMailbox" or "group"
+```
+
 ## James WebAdmin API
 
 ### Endpoints Used

package/docs/usage/plugins/ldap/README.md

@@ -4,15 +4,16 @@ Plugins for LDAP entity management.
 
 ## Overview
 
-| Plugin                              | Entity                   | Features                            |
-| ----------------------------------- | ------------------------ | ----------------------------------- |
-| [flat-generic](flat-generic.md)     | Users, Positions, Custom | Schema-driven, Validation, Pointers |
-| [groups](groups.md)                 | Groups                   | Member validation, Nested groups    |
-| [organizations](organizations.md)   | Organizational Units     | Tree navigation, Search             |
-| [bulk-import](bulk-import.md)       | All (bulk operations)    | CSV import, Template generation     |
-| [trash](trash.md)                   | All (soft delete)        | Trash system, Recovery              |
-| [external-users](external-users.md) | Contacts                 | Automatic creation                  |
-| [on-change](on-change.md)           | All                      | Change detection                    |
+| Plugin                                | Entity                   | Features                            |
+| ------------------------------------- | ------------------------ | ----------------------------------- |
+| [flat-generic](flat-generic.md)       | Users, Positions, Custom | Schema-driven, Validation, Pointers |
+| [groups](groups.md)                   | Groups                   | Member validation, Nested groups    |
+| [organizations](organizations.md)     | Organizational Units     | Tree navigation, Search             |
+| [bulk-import](bulk-import.md)         | All (bulk operations)    | CSV import, Template generation     |
+| [trash](trash.md)                     | All (soft delete)        | Trash system, Recovery              |
+| [external-users](external-users.md)   | Contacts                 | Automatic creation                  |
+| [on-change](on-change.md)             | All                      | Change detection                    |
+| [password-policy](password-policy.md) | Password management      | Expiration, Lockout, Unlock         |
 
 ## API Endpoints
 
@@ -50,6 +51,17 @@ POST   /api/v1/ldap/organizations/{dn}/move             # Move
 DELETE /api/v1/ldap/organizations/{dn}                  # Delete
 ```
 
+### Password Policy (passwordPolicy)
+
+```
+GET    /api/v1/password-policy                  # Get ppolicy configuration
+GET    /api/v1/users/{id}/password-status       # Get user password status
+POST   /api/v1/users/{id}/unlock                # Unlock locked account
+GET    /api/v1/password-policy/expiring-soon    # List expiring passwords
+GET    /api/v1/password-policy/locked-accounts  # List locked accounts
+POST   /api/v1/password/validate                # Validate complexity (optional)
+```
+
 ### Bulk Import (ldapBulkImport)
 
 ```