ldap-rest 0.10.0 → 0.11.1

package/dist/src/lib/utils.d.ts

@@ -4,6 +4,7 @@
  */
 import type { Request, Response, NextFunction, RequestHandler } from 'express';
 import type { Config } from '../bin';
+import type { AttributeValue } from './ldapActions';
 /**
  * Get a compiled RegExp from cache, or compile and cache it
  * This avoids recompiling the same regex patterns repeatedly
@@ -268,6 +269,21 @@ export declare function normalizeDn(dn: string): string;
  * ```
  */
 export declare function isDummyMemberDn(member: unknown, dummy: string | undefined): boolean;
+/**
+ * The organization an entry is attached to, read off its link attribute
+ * (`--ldap-organization-link-attribute`), or `undefined` when it is attached
+ * to none.
+ *
+ * "None" arrives in three forms: the attribute missing, an empty array —
+ * how ldapts answers an attribute that was asked for and is absent — and an
+ * empty value. The empty array read as the branch "undefined" in one copy of
+ * this logic, and nobody could write such an entry. Every reader of the link
+ * asks here, so the copies cannot drift apart again.
+ *
+ * @param value - The link attribute as a search returned it
+ * @returns its first value, or `undefined` when there is none
+ */
+export declare function organizationLink(value: AttributeValue | undefined): string | undefined;
 /**
  * Check whether a DN is a branch base itself or sits anywhere below it.
  *

package/dist/src/plugins/auth/authzLinid1.d.ts

@@ -17,6 +17,14 @@ export default class AuthzLinid1 extends AuthzBase {
     name: string;
     permissionsCache: Map<string, CachedPermissions>;
     constructor(server: DM);
+    /**
+     * Always: the branches this plugin grants are organizations, and what an
+     * administrator manages in them is the accounts and groups whose
+     * organization link names them, wherever they are stored. Judged by their
+     * parent instead, a flat `ou=users` is nobody's branch, and every
+     * administrator is refused every account.
+     */
+    protected filtersAttachedEntries(): boolean;
     /**
      * Resolve user - for authzLinid1, convert uid to userDn via LDAP
      */

package/dist/src/plugins/auth/fake.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @module plugins/auth/fake
+ * @author Xavier Guimard <xguimard@linagora.com>
+ *
+ * Development authentication: every request is served as the identity given
+ * on the command line, without asking for anything.
+ * @group Plugins
+ */
+import type { Response } from 'express';
+import AuthBase, { type DmRequest } from '../../lib/auth/base';
+import type { Role } from '../../abstract/plugin';
+export default class AuthFake extends AuthBase {
+    name: string;
+    roles: Role[];
+    private readonly user;
+    constructor(...args: ConstructorParameters<typeof AuthBase>);
+    protected knownIdentities(): string[];
+    protected identitySource(): string;
+    afterLoad(): void;
+    authMethod(req: DmRequest, _res: Response, next: () => void): void;
+}

package/dist/src/plugins/ldap/groups.d.ts

@@ -148,23 +148,26 @@ export default class LdapGroups extends DmPlugin {
     }>;
     /**
      * List groups from LDAP
-     * @param param0 {filter, attributes}:
+     * @param param0 {filter, attributes, req}:
      * - filter: LDAP filter (default '(objectClass=*)')
      * - attributes: attributes to fetch (default ['cn','member'])
+     * - req: incoming request, forwarded to the authorization hooks
      * @returns LdapList (Record<string, AttributesList>)
      */
-    listGroups({ filter, attributes, }?: {
+    listGroups({ filter, attributes, req, }?: {
         filter?: string;
         attributes?: string[];
+        req?: Request;
     }): Promise<LdapList>;
     /**
      * Simple formatter for listGroups()
      * @param cn main attribute value (partial or full)
      * @param partial boolean, true for partial search (default false)
      * @param attributes array of attributes to return
+     * @param req incoming request, forwarded to the authorization hooks
      * @returns LdapList (means Record<string, AttributesList> where key is the --ldap-user-main-attribute value [default: cn])
      */
-    searchGroupsByName(cn: string, partial?: boolean, attributes?: string[]): Promise<LdapList>;
+    searchGroupsByName(cn: string, partial?: boolean, attributes?: string[], req?: Request): Promise<LdapList>;
     protected fixDn(dn: string): string | false;
     /**
      * Verify that each member exists in LDAP

package/dist/src/plugins/storage/ldap.d.ts

@@ -7,9 +7,6 @@ export default class LdapStore extends Store {
     private objectClass;
     constructor(server: DM, base: string, objectClass: string);
     private dn;
-    /** `<deadline> <key>\n<value>`, the deadline first as in the file store. */
-    private static encode;
-    private static decode;
     protected load(key: string): Promise<StoredRecord | null>;
     protected save(key: string, record: StoredRecord): Promise<void>;
     protected drop(key: string): Promise<void>;

package/dist/src/plugins/storage/postgres.d.ts

@@ -0,0 +1,54 @@
+/**
+ * @module plugins/storage/postgres
+ *
+ * A keyed store kept in one PostgreSQL table.
+ *
+ * `pg` is an optional dependency, loaded when this backend is chosen: a
+ * deployment that keeps its records elsewhere never needs it installed.
+ *
+ * The key is kept verbatim, split into the consumer's namespace and its own
+ * key: a `text` column has no reason to hash it the way a DN or a file name
+ * must, so a `SELECT` says what a record is about.
+ *
+ * @group Plugins
+ */
+import type winston from 'winston';
+import Store, { type StoredRecord } from '../../lib/storage/store';
+type Pg = typeof import('pg');
+export default class PostgresStore extends Store {
+    name: string;
+    private url;
+    private table;
+    /** `schema.table` or `table`, each part quoted. */
+    private quoted;
+    private connection?;
+    constructor(logger: winston.Logger, url: string, table: string);
+    /** Split out so a test can stand in for a missing package. */
+    protected driver(): Promise<Pg>;
+    open(): Promise<void>;
+    close(): Promise<void>;
+    /**
+     * The pool, once the table is known to be there. A failure is not kept:
+     * the next operation tries again, so a database down at startup does not
+     * leave the store unusable once it is back.
+     */
+    private pool;
+    private connect;
+    /**
+     * Create the table when it is not there.
+     *
+     * Looked up first: `CREATE … IF NOT EXISTS` still needs the right to create
+     * in the schema, which a role granted only this table's rows does not have.
+     */
+    private ensureTable;
+    /**
+     * The namespace and the consumer's own key. PostgreSQL refuses NUL in
+     * `text`, so a key holding one cannot be kept: `null` says so.
+     */
+    private static parts;
+    protected load(key: string): Promise<StoredRecord | null>;
+    protected save(key: string, record: StoredRecord): Promise<void>;
+    protected drop(key: string): Promise<void>;
+    sweep(): Promise<number>;
+}
+export {};

package/dist/src/plugins/storage/valkey.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @module plugins/storage/valkey
+ *
+ * A keyed store kept in Valkey, or Redis.
+ *
+ * `iovalkey` is an optional dependency, loaded when this backend is chosen: a
+ * deployment that keeps its records elsewhere never needs it installed.
+ *
+ * The only backend that expires its own records, so it has nothing to sweep.
+ * The value still carries its deadline, in the shape the LDAP store uses:
+ * reads judge expiry by it, as with every other backend, and the TTL only
+ * reclaims the memory.
+ *
+ * @group Plugins
+ */
+import type winston from 'winston';
+import Store, { type StoredRecord } from '../../lib/storage/store';
+type IoValkey = typeof import('iovalkey');
+export default class ValkeyStore extends Store {
+    name: string;
+    private url;
+    private prefix;
+    private connection?;
+    /** Set once a lost connection is reported, so a reconnect loop says it once. */
+    private down;
+    constructor(logger: winston.Logger, url: string, prefix: string);
+    /** Split out so a test can stand in for a missing package. */
+    protected driver(): Promise<IoValkey>;
+    open(): Promise<void>;
+    close(): Promise<void>;
+    /**
+     * The client, once connected. A failed first connection is not kept: the
+     * next operation tries again. Past that one, the client reconnects on its
+     * own.
+     */
+    private client;
+    private connect;
+    private key;
+    protected load(key: string): Promise<StoredRecord | null>;
+    protected save(key: string, record: StoredRecord): Promise<void>;
+    protected drop(key: string): Promise<void>;
+    /** The TTL has already reclaimed what expired. */
+    sweep(): Promise<number>;
+}
+export {};

package/docs/usage/configuration.md

@@ -25,6 +25,7 @@ All LDAP-Rest configuration options.
     - [core/auth/hmac](#coreauthhmac)
     - [core/auth/llng](#coreauthllng)
     - [core/auth/openidconnect](#coreauthopenidconnect)
+    - [core/auth/fake](#coreauthfake)
     - [core/bcl](#corebcl)
   - [Authorization Plugins](#authorization-plugins)
     - [Common to every authorization plugin](#common-to-every-authorization-plugin)
@@ -238,6 +239,14 @@ Empty means the plugin guards every path. Scoping several instances to different
 | -------------- | --------------- | ---------------- | ------- | --------------------- |
 | `--auth-token` | `--auth-tokens` | `DM_AUTH_TOKENS` | `[]`    | Authentication tokens |
 
+#### `core/auth/fake`
+
+| CLI                | Env                 | Default | Description                                    |
+| ------------------ | ------------------- | ------- | ---------------------------------------------- |
+| `--auth-fake-user` | `DM_AUTH_FAKE_USER` |         | Identity every request is served as (required) |
+
+Development only, refused with `NODE_ENV=production` — see [Fake Authentication](plugins/auth/fake.md).
+
 #### `core/auth/totp`
 
 | CLI                  | Plural         | Env                   | Default | Description                      |
@@ -324,11 +333,12 @@ whichever of the two names it selects. A value other than `req.user` or
 
 #### `core/auth/authzPerBranch`
 
-| CLI                               | Env                                | Default                                          | Description                                                                                                                                                                   |
-| --------------------------------- | ---------------------------------- | ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `--authz-per-branch-config`       | `DM_AUTHZ_PER_BRANCH_CONFIG`       | `{default:{read:true,write:false,delete:false}}` | Authorization config (JSON)                                                                                                                                                   |
-| `--authz-per-branch-cache-ttl`    | `DM_AUTHZ_PER_BRANCH_CACHE_TTL`    | `60`                                             | Cache TTL (seconds)                                                                                                                                                           |
-| `--authz-filter-attached-entries` | `DM_AUTHZ_FILTER_ATTACHED_ENTRIES` | `false`                                          | Judge an attached entry by the organization it hangs off, and filter listings accordingly. Honoured by `authzPerBranch` and `authzLinid1`; does nothing under `authzDynamic`. |
+| CLI                               | Env                                | Default                                          | Description                                                                                                                                                                                                                                                                                                                                     |
+| --------------------------------- | ---------------------------------- | ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `--authz-per-branch-config`       | `DM_AUTHZ_PER_BRANCH_CONFIG`       | `{default:{read:true,write:false,delete:false}}` | Authorization config (JSON)                                                                                                                                                                                                                                                                                                                     |
+| `--authz-per-branch-cache-ttl`    | `DM_AUTHZ_PER_BRANCH_CACHE_TTL`    | `60`                                             | Cache TTL (seconds)                                                                                                                                                                                                                                                                                                                             |
+| `--authz-filter-attached-entries` | `DM_AUTHZ_FILTER_ATTACHED_ENTRIES` | `false`                                          | Judge an attached entry by the organization it hangs off, and filter listings accordingly. Honoured by `authzPerBranch`; always on under `authzLinid1`; does nothing under `authzDynamic`.                                                                                                                                                      |
+| `--authz-transit-branch`          | `DM_AUTHZ_TRANSIT_BRANCH`          |                                                  | Organization entries are handed over through when they are judged by attachment: every administrator sees and may claim what is there, and puts an entry there with write on the organization it leaves. An entry attached to no organization is in transit too. See [authzLinid1](plugins/auth/authz-linid1.md#transit-handing-an-entry-over). |
 
 #### `core/auth/authzScope`
 
@@ -452,13 +462,17 @@ Web access logging plugin. No configuration options - just add the plugin to ena
 Keyed storage with a deadline, for the plugins that need to keep something —
 see [Storage](plugins/utilities/storage.md).
 
-| CLI                           | Env                            | Default              | Description                            |
-| ----------------------------- | ------------------------------ | -------------------- | -------------------------------------- |
-| `--storage-backend`           | `DM_STORAGE_BACKEND`           |                      | `ldap` or `file`; required             |
-| `--storage-sweep-interval`    | `DM_STORAGE_SWEEP_INTERVAL`    | `600`                | Seconds between two expiry passes      |
-| `--storage-ldap-base`         | `DM_STORAGE_LDAP_BASE`         |                      | Branch the `ldap` backend writes to    |
-| `--storage-ldap-object-class` | `DM_STORAGE_LDAP_OBJECT_CLASS` | `applicationProcess` | Object class of the entries it writes  |
-| `--storage-file-directory`    | `DM_STORAGE_FILE_DIRECTORY`    |                      | Directory the `file` backend writes to |
+| CLI                           | Env                            | Default              | Description                                      |
+| ----------------------------- | ------------------------------ | -------------------- | ------------------------------------------------ |
+| `--storage-backend`           | `DM_STORAGE_BACKEND`           |                      | `ldap`, `file`, `postgres` or `valkey`; required |
+| `--storage-sweep-interval`    | `DM_STORAGE_SWEEP_INTERVAL`    | `600`                | Seconds between two expiry passes                |
+| `--storage-ldap-base`         | `DM_STORAGE_LDAP_BASE`         |                      | Branch the `ldap` backend writes to              |
+| `--storage-ldap-object-class` | `DM_STORAGE_LDAP_OBJECT_CLASS` | `applicationProcess` | Object class of the entries it writes            |
+| `--storage-file-directory`    | `DM_STORAGE_FILE_DIRECTORY`    |                      | Directory the `file` backend writes to           |
+| `--storage-postgres-url`      | `DM_STORAGE_POSTGRES_URL`      |                      | Connection string of the `postgres` backend      |
+| `--storage-postgres-table`    | `DM_STORAGE_POSTGRES_TABLE`    | `ldap_rest_storage`  | Table it writes to                               |
+| `--storage-valkey-url`        | `DM_STORAGE_VALKEY_URL`        |                      | URL of the `valkey` backend                      |
+| `--storage-valkey-prefix`     | `DM_STORAGE_VALKEY_PREFIX`     | `ldap-rest:`         | Prefix of the keys it writes                     |
 
 #### `core/configApi`
 

package/docs/usage/plugins/README.md

@@ -62,11 +62,11 @@ Connect to external systems:
 
 ## Utility Plugins
 
-| Plugin                          | Description                   |
-| ------------------------------- | ----------------------------- |
-| [static](utilities/static.md)   | Static file server            |
-| [weblogs](utilities/weblogs.md) | HTTP logging                  |
-| [storage](utilities/storage.md) | Keyed storage with a deadline |
+| Plugin                          | Description                                                         |
+| ------------------------------- | ------------------------------------------------------------------- |
+| [static](utilities/static.md)   | Static file server                                                  |
+| [weblogs](utilities/weblogs.md) | HTTP logging                                                        |
+| [storage](utilities/storage.md) | Keyed storage with a deadline, in LDAP, files, PostgreSQL or Valkey |
 
 ## Plugin Dependencies
 

package/docs/usage/plugins/auth/README.md

@@ -11,6 +11,7 @@ LDAP-Rest provides multiple authentication plugins to secure API access. These p
 | [HMAC](hmac.md)           | `core/auth/hmac`          | HMAC-SHA256 request signing for backend services |
 | [LemonLDAP::NG](llng.md)  | `core/auth/llng`          | Integration with LemonLDAP::NG SSO               |
 | [OpenID Connect](oidc.md) | `core/auth/openidconnect` | OAuth 2.0 / OpenID Connect authentication        |
+| [Fake](fake.md)           | `core/auth/fake`          | Development only: a fixed identity, no login     |
 
 ## What a rule is keyed on
 
@@ -25,6 +26,7 @@ of what a caller is called. Every one of them publishes the caller twice:
 | `core/auth/llng`          | LLNG's `whatToTrace`                | `--llng-username-header`, or the same    |
 | `core/auth/openidconnect` | the OIDC `sub`                      | `--oidc-username-claim` (default: `sub`) |
 | `core/auth/authzDynamic`  | the token's tenant                  | the same                                 |
+| `core/auth/fake`          | `--auth-fake-user`                  | the same                                 |
 
 `req.user` is this server's identifier for the caller; `req.userName` is the
 caller under a name a person would use. `--authz-identity` says which one is

package/docs/usage/plugins/auth/authz-linid1.md

@@ -48,6 +48,54 @@ twakeDepartmentLink: ou=HR,ou=organization,dc=example,dc=com
 
 The HR admin (listed in `ou=HR`'s `twakeLocalAdminLink`) can manage John even though he's in `ou=users` because his `twakeDepartmentLink` points to the HR organization.
 
+### What an administrator reads
+
+`authzLinid1` always judges an attached entry this way, as
+`--authz-filter-attached-entries` does for `authzPerBranch`, whatever that
+option says: judged by its parent instead, an account in a flat `ou=users`
+belongs to nobody's branch, and no administrator could list or change one.
+
+- Listings of accounts and groups drop the entries attached to an
+  organization outside the caller's branches. A single read of one answers
+  `404`.
+- Entries attached to nothing — the organizations, the nomenclature values, a
+  group or an account with no `twakeDepartmentLink` — are readable by every
+  administrator: the organization tree is reference data. Writes to them are
+  judged on their parent. The tree a console draws still starts at the
+  caller's own branches: see [getOrganisationTop Hook](#getorganisationtop-hook).
+- A caller named in no `twakeLocalAdminLink` is refused every read (`403`)
+  but the top organization's own entry, which `organizations/top` answers.
+
+### Transit: handing an entry over
+
+An administrator can only move an entry between organizations they write, and
+an account created by another tool often carries no `twakeDepartmentLink` at
+all. The transit branch covers both cases: `--authz-transit-branch` names an
+organization through which entries change hands.
+
+```bash
+--authz-transit-branch "ou=Transit,ou=organization,dc=example,dc=com"
+```
+
+An entry is **in transit** when it is attached to that organization, or to
+none (with or without the option).
+
+- Every administrator sees the entries in transit.
+- **Claiming** one (`POST /api/v1/ldap/users/:id/move` towards an
+  organization) asks for write on that organization only.
+- **Putting** one in transit asks for write on the organization it leaves,
+  and nothing on the transit branch: an administrator only lets go of what
+  they manage. Handing an account over to an organization one does not manage
+  is two steps: put it in transit, then its new administrator claims it.
+- Any other change to an entry in transit (attributes, password, status,
+  deletion) is judged as before, so the entry is claimed first.
+
+`GET /api/v1/authz/scope` returns the transit branch as `transit` (`null`
+when there is none), so that a client can offer these moves. A group attached
+to the transit branch follows the same rules through
+`POST /api/v1/ldap/groups/:cn/move`; that endpoint does not move a group
+attached to no organization.
+
 ## Configuration
 
 No configuration file needed - permissions are read from LDAP. Simply load the plugin:
@@ -179,8 +227,9 @@ Intercepts all LDAP search operations:
 2. Resolves user's DN from username
 3. Allows base scope searches on top organization (for navigation)
 4. Allows searches for `twakeLocalAdminLink` (for permission refresh)
-5. Verifies user has read permission for search base
-6. Throws error if access denied
+5. Refuses a caller who administers no branch; lets the others search, and
+   drops from the answer the entries attached outside their branches
+   (`ldapsearchfilter`)
 
 **Special allowances:**
 
@@ -421,7 +470,10 @@ User exists in `ou=users,dc=example,dc=com` but local admin cannot manage them.
    twakeDepartmentLink: ou=HR,ou=organization,dc=example,dc=com
    ```
 
-2. Or move user to organization branch:
+2. Or let the local admin claim it: an account with no `twakeDepartmentLink`
+   is in transit, see [Transit](#transit-handing-an-entry-over).
+
+3. Or move user to organization branch:
    ```
    From: uid=user,ou=users,dc=example,dc=com
    To:   uid=user,ou=users,ou=HR,ou=organization,dc=example,dc=com
@@ -461,31 +513,6 @@ User jdoe not found in LDAP
 
 3. Verify authentication plugin sets `req.user` correctly
 
-### Problem: Cannot Search Top Organization
-
-**Symptoms:**
-
-```json
-{
-  "error": "User admin does not have read permission for branch ou=organization,dc=example,dc=com"
-}
-```
-
-**Solutions:**
-
-This is expected behavior - users can only see organizations they manage. To grant access to top organization:
-
-```bash
-ldapsearch -x -b "ou=organization,dc=example,dc=com" -s base "(objectClass=*)"
-# Modify to add user:
-ldapmodify <<EOF
-dn: ou=organization,dc=example,dc=com
-changetype: modify
-add: twakeLocalAdminLink
-twakeLocalAdminLink: uid=admin,ou=users,dc=example,dc=com
-EOF
-```
-
 ## Integration Examples
 
 ### With Token Authentication

package/docs/usage/plugins/auth/fake.md

@@ -0,0 +1,28 @@
+# Fake Authentication
+
+For development only: every request is served as the identity given on the
+command line, without asking for anything. Restarting with another
+`--auth-fake-user` shows an interface as another administrator sees it.
+
+```bash
+npx ldap-rest \
+  --plugin core/auth/fake --auth-fake-user alice \
+  --plugin core/auth/authzLinid1 \
+  ...
+```
+
+**Environment Variable:** `DM_AUTH_FAKE_USER=alice`
+
+The identity goes to `req.user` and `req.userName` alike, so the
+authorization plugins judge it as they would the same login coming from a
+real authenticator.
+
+## Safeguards
+
+- The server refuses to start when `NODE_ENV` is `production`, as it is in
+  the Docker image.
+- It refuses to start without `--auth-fake-user`.
+- A warning naming the identity is logged at every start.
+
+Loaded without an authorization plugin, it grants everything to anyone who
+reaches the port. Listen on a local address only.

package/docs/usage/plugins/utilities/storage.md

@@ -26,13 +26,17 @@ which is invisible in a configuration.
   --storage-ldap-base ou=Records,dc=example,dc=com
 ```
 
-| Option                        | Environment                    | Default              | Description                                               |
-| ----------------------------- | ------------------------------ | -------------------- | --------------------------------------------------------- |
-| `--storage-backend`           | `DM_STORAGE_BACKEND`           | _(none)_             | `ldap` or `file`. Empty means the plugin refuses to start |
-| `--storage-sweep-interval`    | `DM_STORAGE_SWEEP_INTERVAL`    | `600`                | Seconds between two passes dropping expired records       |
-| `--storage-ldap-base`         | `DM_STORAGE_LDAP_BASE`         | _(none)_             | Branch the `ldap` backend writes to                       |
-| `--storage-ldap-object-class` | `DM_STORAGE_LDAP_OBJECT_CLASS` | `applicationProcess` | Object class of the entries it writes                     |
-| `--storage-file-directory`    | `DM_STORAGE_FILE_DIRECTORY`    | _(none)_             | Directory the `file` backend writes to                    |
+| Option                        | Environment                    | Default              | Description                                                                     |
+| ----------------------------- | ------------------------------ | -------------------- | ------------------------------------------------------------------------------- |
+| `--storage-backend`           | `DM_STORAGE_BACKEND`           | _(none)_             | `ldap`, `file`, `postgres` or `valkey`. Empty means the plugin refuses to start |
+| `--storage-sweep-interval`    | `DM_STORAGE_SWEEP_INTERVAL`    | `600`                | Seconds between two passes dropping expired records                             |
+| `--storage-ldap-base`         | `DM_STORAGE_LDAP_BASE`         | _(none)_             | Branch the `ldap` backend writes to                                             |
+| `--storage-ldap-object-class` | `DM_STORAGE_LDAP_OBJECT_CLASS` | `applicationProcess` | Object class of the entries it writes                                           |
+| `--storage-file-directory`    | `DM_STORAGE_FILE_DIRECTORY`    | _(none)_             | Directory the `file` backend writes to                                          |
+| `--storage-postgres-url`      | `DM_STORAGE_POSTGRES_URL`      | _(none)_             | Connection string of the `postgres` backend                                     |
+| `--storage-postgres-table`    | `DM_STORAGE_POSTGRES_TABLE`    | `ldap_rest_storage`  | Table it writes to, `schema.table` accepted                                     |
+| `--storage-valkey-url`        | `DM_STORAGE_VALKEY_URL`        | _(none)_             | URL of the `valkey` backend (`redis://…` or `rediss://…`)                       |
+| `--storage-valkey-prefix`     | `DM_STORAGE_VALKEY_PREFIX`     | `ldap-rest:`         | Prefix of the keys it writes                                                    |
 
 `core/storage` is in the priority list, so it is registered before the
 plugins that consume it whatever order they are written in. A consumer that
@@ -61,18 +65,65 @@ The directory is the plugin's own: nothing else should be writing there, and
 the sweeper removes what it finds expired. It is local to one process, so it
 suits a single instance, not a cluster sharing one verdict.
 
+### `postgres`
+
+One row per record in `--storage-postgres-table`, with the consumer's
+namespace and key kept verbatim beside the value and an `expires_at` column,
+so a `SELECT` tells what a record is about. Needs the optional `pg` package.
+
+The table is created at the first connection when it is not there. A role
+that may not create tables works once it exists:
+
+```sql
+CREATE TABLE ldap_rest_storage (
+  namespace text NOT NULL,
+  key text NOT NULL,
+  value text NOT NULL,
+  expires_at timestamptz NOT NULL,
+  PRIMARY KEY (namespace, key)
+);
+CREATE INDEX ldap_rest_storage_expires_at ON ldap_rest_storage (expires_at);
+GRANT SELECT, INSERT, UPDATE, DELETE ON ldap_rest_storage TO ldap_rest;
+```
+
+Several instances can share the table and sweep it at once. PostgreSQL
+refuses a NUL in `text`, so a key holding one cannot be kept: the write
+fails.
+
+### `valkey`
+
+One key per record, `--storage-valkey-prefix` followed by the namespace and
+the key, expiring with the record: nothing is left to sweep. Works with Redis
+too. Needs the optional `iovalkey` package.
+
+**The instance must not evict.** An instance configured as a cache
+(`allkeys-lru`, `volatile-lru` and the like) drops keys under memory pressure,
+and every key this backend writes has a TTL: a Back-Channel Logout mark
+evicted early reopens the session it closed. Use an instance with
+`maxmemory-policy noeviction`, which answers a full memory with a failed
+write — reported to the identity provider — rather than a silent loss.
+
+A connection lost while running is retried in the background; meanwhile, reads
+answer "absent" with a warning and writes fail at once instead of waiting.
+
+`postgres` and `valkey` connect at startup, and report there an address that
+does not answer or a package that is not installed; the server starts anyway,
+and every operation tries to connect again.
+
 ## Expiry
 
 Two rules the backends do not get to reinterpret:
 
 - **Expiry is enforced on read.** A record past its deadline is answered as
   absent whatever the sweeper has done, so a sweeper running late is a
-  storage cost, never a wrong answer.
+  storage cost, never a wrong answer. Expiry is judged by this server's clock,
+  the sweep and the Valkey TTL included, so a database clock running ahead
+  cannot drop a record early.
 - **The deadline belongs to the consumer.** How long a record lives is the
   policy of whoever wrote it. The store is told an instant and respects it.
 
-Keys are namespaced per consumer, so two of them cannot collide in one branch
-or one directory.
+Keys are namespaced per consumer, so two of them cannot collide in one branch,
+directory, table or instance.
 
 ## For Plugin Authors
 

package/docs/usage/upgrading.md

@@ -4,6 +4,47 @@ What to check before deploying, newest first. Only releases that need a
 decision or a configuration change appear here; see the
 [CHANGELOG](../../CHANGELOG.md) for everything else.
 
+## To 0.11.0
+
+### Group reads are judged
+
+**Who is affected:** a deployment loading `core/ldap/groups` with an
+authorization plugin.
+
+Listing the groups and reading one went to the directory without the
+request, so no authorization plugin saw them: any authenticated caller read
+every group with its members. They are judged like any other read now.
+Under `core/auth/authzPerBranch` without `--authz-filter-attached-entries`,
+that means a `read` grant on the group base (`ou=groups`, or
+`--ldap-group-base`): **a caller without one is answered `403`** where the
+list used to come back.
+
+### authzLinid1 judges accounts and groups by their organization
+
+**Who is affected:** every deployment using `core/auth/authzLinid1`.
+
+It now works as with `--authz-filter-attached-entries`, whatever the option
+says. Without it, a flat `ou=users` was nobody's branch: no administrator
+could list or change an account.
+
+- An administrator lists the accounts and groups attached to their branches,
+  and those attached to none.
+- **The organization tree is readable by every administrator**, not only their
+  own branches: an organization is reference data. `organizations/top` still
+  answers their own branches, so a console starts there. Writes to the tree
+  are judged as before.
+- **A caller named in no `twakeLocalAdminLink` is refused every read** but the
+  top organization's own entry.
+- An account stored under the organization tree without a
+  `twakeDepartmentLink` becomes readable by every administrator. **Where
+  accounts sit under the tree, give them their link before upgrading.** This
+  lists the accounts that have none, under `twakeDepartmentLink: missing`:
+
+  ```bash
+  npm run audit:directory -- --schema static/schemas/twake/users.json \
+    --base ou=users,<base> --filter '(!(twakeDepartmentLink=*))'
+  ```
+
 ## To 0.10.0
 
 ### LDAP base is now required

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-rest",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Light directory manager",
   "keywords": [
     "Identity-Manager"
@@ -64,6 +64,10 @@
       "types": "./dist/src/plugins/auth/crowdsec.d.ts",
       "import": "./dist/plugins/auth/crowdsec.js"
     },
+    "./plugin-auth-fake": {
+      "types": "./dist/src/plugins/auth/fake.d.ts",
+      "import": "./dist/plugins/auth/fake.js"
+    },
     "./plugin-auth-hmac": {
       "types": "./dist/src/plugins/auth/hmac.d.ts",
       "import": "./dist/plugins/auth/hmac.js"
@@ -228,6 +232,14 @@
       "types": "./dist/src/plugins/storage/ldap.d.ts",
       "import": "./dist/plugins/storage/ldap.js"
     },
+    "./plugin-storage-postgres": {
+      "types": "./dist/src/plugins/storage/postgres.d.ts",
+      "import": "./dist/plugins/storage/postgres.js"
+    },
+    "./plugin-storage-valkey": {
+      "types": "./dist/src/plugins/storage/valkey.d.ts",
+      "import": "./dist/plugins/storage/valkey.js"
+    },
     "./plugin-twake-appaccountsapi": {
       "types": "./dist/src/plugins/twake/appAccountsApi.d.ts",
       "import": "./dist/plugins/twake/appAccountsApi.js"
@@ -723,6 +735,7 @@
     "@types/mocha": "^10.0.10",
     "@types/multer": "^2.0.0",
     "@types/node": "^24.5.1",
+    "@types/pg": "^8.23.1",
     "@types/supertest": "^6.0.3",
     "@typescript-eslint/eslint-plugin": "^8.44.0",
     "@typescript-eslint/parser": "^8.44.0",
@@ -751,7 +764,9 @@
   "optionalDependencies": {
     "@linagora/rabbitmq-client": "^0.1.2",
     "express-openid-connect": "^2.19.2",
+    "iovalkey": "^0.4.0",
     "lemonldap-ng-handler": "^0.7.3",
+    "pg": "^8.23.0",
     "re2": "^1.22.1"
   },
   "engines": {