ldap-rest 0.17.1 → 0.18.0

package/dist/src/browser/ldap-unit-editor/types.d.ts

@@ -1,6 +1,7 @@
 /**
  * TypeScript types for LDAP Unit Editor
  */
+import type { LocalizedText } from '../shared/types';
 export interface UnitEditorOptions {
     containerId: string;
     apiBaseUrl?: string;
@@ -45,7 +46,7 @@ export interface SchemaAttribute {
         type: string;
         branch?: string[];
     };
-    group?: string;
+    group?: LocalizedText;
 }
 export interface LdapUnit {
     dn: string;

package/dist/src/browser/ldap-user-editor/types.d.ts

@@ -1,6 +1,7 @@
 /**
  * LDAP User Editor - Type definitions
  */
+import type { LocalizedText } from '../shared/types';
 export interface EditorOptions {
     containerId: string;
     apiBaseUrl?: string;
@@ -15,13 +16,13 @@ export interface SchemaAttribute {
     type: string;
     required?: boolean;
     fixed?: boolean;
-    role?: string;
+    role?: string | string[];
     test?: string;
     branch?: string[];
     items?: SchemaAttribute;
     default?: unknown;
     ui?: 'select' | 'search';
-    group?: string;
+    group?: LocalizedText;
 }
 export interface Schema {
     entity: {

package/dist/src/browser/shared/types/index.d.ts

@@ -2,6 +2,11 @@
  * Shared TypeScript types for browser components
  * @module browser/shared/types
  */
+/**
+ * Text of a schema in one language (a plain string) or several (a map keyed
+ * by language tag), see `localizedText`
+ */
+export type LocalizedText = string | Record<string, string>;
 export interface EditorConfig {
     ldapBase?: string;
     features?: {
@@ -27,13 +32,14 @@ export interface SchemaAttribute {
     type: 'string' | 'number' | 'integer' | 'array' | 'pointer';
     required?: boolean;
     fixed?: boolean;
+    role?: string | string[];
     default?: unknown;
     branch?: string[];
     items?: {
         type: string;
         branch?: string[];
     };
-    group?: string;
+    group?: LocalizedText;
 }
 export interface PointerOption {
     dn: string;

package/dist/src/browser/shared/utils/schema.d.ts

@@ -2,7 +2,7 @@
  * Schema utility functions
  * @module browser/shared/utils/schema
  */
-import type { PointerOption } from '../types';
+import type { LocalizedText, PointerOption, SchemaAttribute } from '../types';
 /**
  * Load pointer options from API
  */
@@ -27,3 +27,22 @@ export declare function getOrganizationPath(orgDn: string, apiBaseUrl: string):
  * Load schema from URL or object
  */
 export declare function loadSchema<T = unknown>(schemaSource: string | T): Promise<T>;
+/**
+ * Tell whether an attribute carries a role: a schema names one, or several.
+ *
+ * @param attr attribute definition
+ * @param role role to look for
+ * @returns true when the attribute declares that role
+ */
+export declare function hasRole(attr: Pick<SchemaAttribute, 'role'> | undefined, role: string): boolean;
+/**
+ * Pick the text of a {@link LocalizedText} for a language: the exact tag,
+ * then its primary language, then English, then whatever the map holds.
+ *
+ * The editors are written in English, so English is the default.
+ *
+ * @param text plain string or map keyed by language tag
+ * @param language tag to look for
+ * @returns the text, or undefined when there is none
+ */
+export declare function localizedText(text: LocalizedText | undefined, language?: string): string | undefined;

package/dist/src/config/schema.d.ts

@@ -49,6 +49,29 @@ export type SchemaRole = string;
  * rather than in a catalogue shipped with the code.
  */
 export type LocalizedText = string | Record<string, string>;
+/**
+ * Pick the text of a {@link LocalizedText} for a language: the exact tag,
+ * then its primary language, then English, then whatever the map holds.
+ *
+ * @param text plain string or map keyed by language tag
+ * @param language tag to look for, English when omitted
+ * @returns the text, or undefined when there is none
+ */
+export declare function localizedText(text: LocalizedText | undefined, language?: string): string | undefined;
+/**
+ * Refusal of a value that failed its schema `test`, for a `BadRequestError`.
+ *
+ * When the schema carries a `hint`, the message says what a valid value
+ * looks like instead of only that this one was not. The hint lives next to
+ * the pattern so the two cannot drift apart, and so a client can show it
+ * under the field *before* the user gets it wrong. Its English text is
+ * quoted, the language of every other API message.
+ *
+ * @param name attribute name
+ * @param attr its schema definition
+ * @returns the message
+ */
+export declare function invalidValueMessage(name: string, attr: SchemaAttribute | undefined): string;
 /** Roles the core itself looks for. See {@link SchemaRole}. */
 export declare const CORE_ROLES: readonly ["identifier", "displayName", "primaryEmail", "emailAliases", "emailQuota", "organizationLink", "organizationPath", "members", "owners", "accountStatus", "password", "passwordReset", "accountExpiry", "domainLink", "domainName"];
 /**
@@ -114,7 +137,7 @@ export interface SchemaAttribute {
     items?: {
         type: string;
         test?: string | RegExp;
-        hint?: string;
+        hint?: LocalizedText;
         branch?: string[];
     };
     default?: AttributeValue;
@@ -126,7 +149,7 @@ export interface SchemaAttribute {
      * schema so the pattern and its explanation cannot drift apart, and so a
      * client never has to hardcode either.
      */
-    hint?: string;
+    hint?: LocalizedText;
     branch?: string[];
     fixed?: boolean;
     /** Semantic role(s) — see {@link SchemaRole} */
@@ -209,8 +232,8 @@ export interface SchemaAttribute {
      * under `example.org`. Off by default: the domain must match exactly.
      */
     allowSubdomains?: boolean;
-    /** Grouping hint for a form, e.g. `Mailbox Settings` */
-    group?: string;
+    /** Section of a form the attribute belongs to, e.g. `Mailbox settings` */
+    group?: LocalizedText;
     /** Name a client shows for this attribute, in one or several languages */
     label?: LocalizedText;
 }

package/dist/src/plugins/ldap/organizations.d.ts

@@ -231,14 +231,6 @@ export default class LdapOrganizations extends DmPlugin {
     addOrganization(dn: string, entry: AttributesList, req?: Request): Promise<boolean>;
     modifyOrganization(dn: string, changes: ModifyRequest, req?: Request): Promise<boolean>;
     validateNewOrganization(dn: string, entry: AttributesList): Promise<boolean>;
-    /**
-     * Build the rejection message for a value that failed its schema `test`,
-     * quoting the `hint` when the schema carries one so the answer says what a
-     * valid value looks like.
-     *
-     * @param field attribute name
-     * @returns message for a `BadRequestError`
-     */
     invalidValueMessage(field: string): string;
     validateChanges(dn: string, changes: ModifyRequest): Promise<boolean>;
     _validateOneChange(field: string, value: AttributeValue | null): Promise<boolean>;

package/dist/src/plugins/twake/james.d.ts

@@ -5,53 +5,6 @@ import type { DM } from '../../bin';
 import type { AttributeValue } from '../../lib/ldapActions';
 import { Hooks } from '../../hooks';
 import type { ChangesToNotify } from '../ldap/onChange';
-/**
- * OpenAPI schemas specific to the James integration.
- *
- * @openapi-component
- * JamesQuotaUsage:
- *   type: object
- *   description: |
- *     Quota information for a mailbox user as returned by the James
- *     WebAdmin API (`GET /quota/users/{mail}`). Contains separate
- *     counters for message count and storage size.
- *   properties:
- *     count:
- *       type: object
- *       description: Message-count quota.
- *       properties:
- *         used:
- *           type: integer
- *           description: Number of messages currently stored.
- *           example: 142
- *         max:
- *           type: integer
- *           nullable: true
- *           description: |
- *             Maximum number of messages allowed. `null` means unlimited.
- *           example: 10000
- *     size:
- *       type: object
- *       description: Storage-size quota (bytes).
- *       properties:
- *         used:
- *           type: integer
- *           description: Bytes currently used.
- *           example: 524288000
- *         max:
- *           type: integer
- *           nullable: true
- *           description: |
- *             Maximum bytes allowed. `null` means unlimited.
- *           example: 2147483648
- *   example:
- *     count:
- *       used: 142
- *       max: 10000
- *     size:
- *       used: 524288000
- *       max: 2147483648
- */
 export default class James extends TwakePlugin {
     name: string;
     roles: Role[];
@@ -74,14 +27,23 @@ export default class James extends TwakePlugin {
     private getUserQuota;
     hooks: Hooks;
     /**
-     * Handle mailbox type transitions when twakeMailboxType changes
+     * The address of the team mailbox an entry stands for, and whether it is
+     * refused for lying in a mailing list branch.
      */
-    private handleMailboxTypeTransition;
+    private teamMailboxOf;
+    /**
+     * Bring James from the team mailbox an entry was to the one it is. A
+     * mailbox the entry no longer stands for is kept, emptied of its members.
+     */
+    private followTeamMailbox;
+    private teamMailboxQueue;
+    private teamMailboxMembers;
     /**
      * Extract display name from LDAP attributes
      * Fallback logic: displayName → cn → givenName+sn → mail
      */
     private getDisplayNameFromAttributes;
+    private isGroupDn;
     getMailFromDN(dn: string): Promise<string | null>;
     getDisplayNameFromDN(dn: string): Promise<string | null>;
     generateSignature(dn: string): Promise<string | null>;
@@ -113,40 +75,15 @@ export default class James extends TwakePlugin {
     deleteUserData(mail: string, fromStep?: string): Promise<{
         taskId: string;
     } | null>;
-    /**
-     * Type guard to check if delete operation is an AttributesList
-     */
-    private isAttributesList;
     /**
      * Extract mailbox type from group attributes
      * Returns: 'group', 'mailingList', 'teamMailbox', or null if not set
      */
     private getMailboxType;
-    /**
-     * Validate that a DN is within one of the allowed branches
-     */
-    private isInAllowedBranches;
-    /**
-     * Create a mailing list in James
-     */
-    private createMailingList;
     /**
      * Create a team mailbox in James
      */
     private createTeamMailbox;
-    /**
-     * Delete a team mailbox from James
-     */
-    private deleteTeamMailbox;
-    /**
-     * Remove all members from a team mailbox (without deleting it)
-     * This preserves the mailbox for potential future use
-     */
-    private removeAllTeamMailboxMembers;
-    /**
-     * Delete a mailing list from James
-     */
-    private deleteMailingList;
     /**
      * Get email addresses for a list of member DNs
      * Uses p-limit to parallelize LDAP queries while limiting concurrency

package/docs/client-development/api/reference.md

@@ -875,7 +875,7 @@ Ensure all required fields are included:
 
 ```json
 {
-  "error": "Invalid value for attribute \"mail\": must match ^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$"
+  "error": "Invalid value for attribute \"mail\": Expected an email address, e.g. jane.doe@example.org"
 }
 ```
 

package/docs/client-development/api/rest-api.md

@@ -1075,6 +1075,16 @@ curl -X POST \
 }
 ```
 
+A member that does not exist answers 400 naming it, and none of the members
+is added (unless `--group-allow-unexistent-members` is set). Group creation
+checks its `member` list the same way:
+
+```json
+{
+  "error": "Member uid=nobody,ou=users,dc=example,dc=com not found"
+}
+```
+
 ### Remove Group Member
 
 Remove a user from a group.
@@ -1146,7 +1156,7 @@ All errors return a JSON object with an error message:
 
 ```json
 {
-  "error": "Invalid value for attribute \"uid\": must match ^[a-zA-Z0-9._-]{1,255}$"
+  "error": "Invalid value for attribute \"uid\""
 }
 ```
 

package/docs/client-development/schemas/README.md

@@ -335,18 +335,23 @@ Complete reference for all attribute properties.
 
 ### Attribute Properties Table
 
-| Property   | Type         | Applies To          | Description                                                                      | Example                             |
-| ---------- | ------------ | ------------------- | -------------------------------------------------------------------------------- | ----------------------------------- |
-| `type`     | string       | All                 | Attribute data type: `"string"`, `"array"`, `"pointer"`, `"number"`, `"integer"` | `"string"`                          |
-| `required` | boolean      | All                 | Whether the attribute must be present                                            | `true`                              |
-| `fixed`    | boolean      | All                 | Whether the attribute value cannot be changed after creation                     | `true`                              |
-| `role`     | string       | String              | Semantic role for special handling (see [Semantic Roles](#semantic-roles))       | `"identifier"`                      |
-| `test`     | string/regex | String, Array items | Regular expression for validation                                                | `"^[a-zA-Z0-9._-]{1,255}$"`         |
-| `branch`   | string[]     | Pointer             | LDAP branches where referenced entries exist                                     | `["ou=users,dc=example,dc=com"]`    |
-| `ui`       | object       | Pointer             | UI configuration for pointer selection (future feature)                          | `{}`                                |
-| `group`    | string       | All                 | UI grouping for form organization (future feature)                               | `"contact"`                         |
-| `default`  | any          | All                 | Default value for new entries                                                    | `["top", "person"]`                 |
-| `items`    | object       | Array               | Schema for array element validation                                              | `{"type": "string", "test": "..."}` |
+| Property   | Type            | Applies To          | Description                                                                           | Example                             |
+| ---------- | --------------- | ------------------- | ------------------------------------------------------------------------------------- | ----------------------------------- |
+| `type`     | string          | All                 | Attribute data type: `"string"`, `"array"`, `"pointer"`, `"number"`, `"integer"`      | `"string"`                          |
+| `required` | boolean         | All                 | Whether the attribute must be present                                                 | `true`                              |
+| `fixed`    | boolean         | All                 | Whether the attribute value cannot be changed after creation                          | `true`                              |
+| `role`     | string/string[] | String              | Semantic role, or roles, for special handling (see [Semantic Roles](#semantic-roles)) | `"identifier"`                      |
+| `test`     | string/regex    | String, Array items | Regular expression for validation                                                     | `"^[a-zA-Z0-9._-]{1,255}$"`         |
+| `branch`   | string[]        | Pointer             | LDAP branches where referenced entries exist                                          | `["ou=users,dc=example,dc=com"]`    |
+| `ui`       | object          | Pointer             | UI configuration for pointer selection (future feature)                               | `{}`                                |
+| `hint`     | text            | String, Array items | What a valid value looks like, shown under the field and quoted in refusals           | `"Expected pattern 999 9999"`       |
+| `group`    | text            | All                 | Form section the attribute is shown in                                                | `"Mailbox Settings"`                |
+| `default`  | any             | All                 | Default value for new entries                                                         | `["top", "person"]`                 |
+| `items`    | object          | Array               | Schema for array element validation                                                   | `{"type": "string", "test": "..."}` |
+
+A _text_ is a plain string or a map keyed by language tag,
+`{ "en": "Mailbox Settings", "fr": "Paramètres de messagerie" }`, picked as
+[labels are](../../usage/plugins/ldap/flat-generic.md#naming-things-in-the-readers-language).
 
 ### Property Details
 
@@ -394,7 +399,7 @@ Marks the attribute as immutable after creation. Useful for objectClass or ident
 
 #### `role` (Optional)
 
-Assigns semantic meaning to attributes for special handling by the application. See [Semantic Roles](#semantic-roles).
+Assigns semantic meaning to attributes for special handling by the application. See [Semantic Roles](#semantic-roles). An attribute holding several roles lists them: `"role": ["domainName", "displayName"]`.
 
 ```json
 {

package/docs/plugin-development/dependencies.md

@@ -200,9 +200,7 @@ overrides builds a second instance, and it needs a name of its own.
   - `onLdapForwardChange` - Syncs forwarding
   - `onLdapChange` - General LDAP change handling
   - `onLdapDisplayNameChange` - Syncs display name
-  - `ldapgroupadddone` - After group added
-  - `ldapgroupmodifydone` - After group modified
-  - `ldapgroupdeletedone` - After group deleted
+  - `onLdapEntryChange` - Follows team mailboxes
 - **Consumes Hooks**: (Hooks provided by `onLdapChange`)
 - **Notes**: Synchronizes LDAP users/groups with Apache James mail server
 

package/docs/presentations/en.md

@@ -115,7 +115,6 @@ export default class MyPlugin extends DmPlugin {
 - 📧 **Automatic LDAP → James Sync**
 - 🔄 **Mail Address Changes** - Account renaming + data
 - 💾 **Quota Management** - Automatic updates
-- 👥 **Mailing Lists** - LDAP Groups → Address Groups
 - 📨 **Mail Aliases** - mailAlternateAddress → James aliases
 - 🎯 **WebAdmin API** - REST Communication
 
@@ -159,33 +158,6 @@ James WebAdmin: PUT /quota/users/alice@.../size
 
 <!-- end_slide -->
 
-# James Plugin - List Consistency
-
-## LDAP Groups → James Address Groups
-
-```bash
-# Create a group with mail attribute
-POST /api/v1/ldap/groups
-{
-  "cn": "engineering",
-  "mail": "engineering@company.com",
-  "member": ["uid=alice,...", "uid=bob,..."]
-}
-```
-
-### Automatic List Consistency
-
-1. ✅ **Creation** → Group created in James + members added
-2. ✅ **Add Member** → Member added to James list
-3. ✅ **Remove Member** → Member removed from James list
-4. ✅ **Delete Group** → List deleted in James
-
-### Guarantee
-
-**LDAP is the source of truth, James stays synchronized**
-
-<!-- end_slide -->
-
 # LDAP Consistency
 
 ## Automatic Consistency Plugins

package/docs/presentations/fr.md

@@ -115,7 +115,6 @@ export default class MyPlugin extends DmPlugin {
 - 📧 **Synchronisation automatique LDAP → James**
 - 🔄 **Changement d'adresse mail** - Renommage compte + données
 - 💾 **Gestion des quotas** - Mise à jour automatique
-- 👥 **Listes de diffusion** - Groupes LDAP → Address Groups
 - 📨 **Alias mail** - mailAlternateAddress → James aliases
 - 🎯 **WebAdmin API** - Communication via REST
 
@@ -159,33 +158,6 @@ James WebAdmin: PUT /quota/users/alice@.../size
 
 <!-- end_slide -->
 
-# Plugin James - Cohérence des listes
-
-## Groupes LDAP → James Address Groups
-
-```bash
-# Création d'un groupe avec attribut mail
-POST /api/v1/ldap/groups
-{
-  "cn": "engineering",
-  "mail": "engineering@company.com",
-  "member": ["uid=alice,...", "uid=bob,..."]
-}
-```
-
-### Cohérence automatique des listes
-
-1. ✅ **Création** → Groupe créé dans James + membres ajoutés
-2. ✅ **Ajout membre** → Membre ajouté à la liste James
-3. ✅ **Retrait membre** → Membre retiré de la liste James
-4. ✅ **Suppression groupe** → Liste supprimée dans James
-
-### Garantie
-
-**LDAP est la source de vérité, James reste synchronisé**
-
-<!-- end_slide -->
-
 # Cohérence LDAP
 
 ## Plugins de cohérence automatique

package/docs/usage/configuration.md

@@ -452,18 +452,18 @@ whichever of the two names it selects. A value other than `req.user` or
 
 #### `core/twake/james`
 
-| CLI                              | Plural                          | Env                               | Default                 | Description                 |
-| -------------------------------- | ------------------------------- | --------------------------------- | ----------------------- | --------------------------- |
-| `--james-webadmin-url`           |                                 | `DM_JAMES_WEBADMIN_URL`           | `http://localhost:8000` | James WebAdmin API URL      |
-| `--james-webadmin-token`         |                                 | `DM_JAMES_WEBADMIN_TOKEN`         |                         | James authentication token  |
-| `--james-signature-template`     |                                 | `DM_JAMES_SIGNATURE_TEMPLATE`     |                         | Email signature template    |
-| `--james-concurrency`            |                                 | `DM_JAMES_CONCURRENCY`            | `10`                    | James API concurrency       |
-| `--james-init-delay`             |                                 | `DM_JAMES_INIT_DELAY`             | `1000`                  | Init delay (ms)             |
-| `--james-retry-attempts`         |                                 | `DM_JAMES_RETRY_ATTEMPTS`         | `5`                     | Attempts per user call      |
-| `--james-retry-delay`            |                                 | `DM_JAMES_RETRY_DELAY`            | `1000`                  | Base retry delay (ms)       |
-| `--james-mailing-list-branch`    | `--james-mailing-list-branches` | `DM_JAMES_MAILING_LIST_BRANCHES`  | `[]`                    | Mailing list branches       |
-| `--james-mailbox-type-attribute` |                                 | `DM_JAMES_MAILBOX_TYPE_ATTRIBUTE` | `twakeMailboxType`      | Mailbox type attribute      |
-| `--ldap-concurrency`             |                                 | `DM_LDAP_CONCURRENCY`             | `10`                    | LDAP operations concurrency |
+| CLI                              | Plural                          | Env                               | Default                 | Description                        |
+| -------------------------------- | ------------------------------- | --------------------------------- | ----------------------- | ---------------------------------- |
+| `--james-webadmin-url`           |                                 | `DM_JAMES_WEBADMIN_URL`           | `http://localhost:8000` | James WebAdmin API URL             |
+| `--james-webadmin-token`         |                                 | `DM_JAMES_WEBADMIN_TOKEN`         |                         | James authentication token         |
+| `--james-signature-template`     |                                 | `DM_JAMES_SIGNATURE_TEMPLATE`     |                         | Email signature template           |
+| `--james-concurrency`            |                                 | `DM_JAMES_CONCURRENCY`            | `10`                    | James API concurrency              |
+| `--james-init-delay`             |                                 | `DM_JAMES_INIT_DELAY`             | `1000`                  | Init delay (ms)                    |
+| `--james-retry-attempts`         |                                 | `DM_JAMES_RETRY_ATTEMPTS`         | `5`                     | Attempts per user call             |
+| `--james-retry-delay`            |                                 | `DM_JAMES_RETRY_DELAY`            | `1000`                  | Base retry delay (ms)              |
+| `--james-mailing-list-branch`    | `--james-mailing-list-branches` | `DM_JAMES_MAILING_LIST_BRANCHES`  | `[]`                    | Branches refused to team mailboxes |
+| `--james-mailbox-type-attribute` |                                 | `DM_JAMES_MAILBOX_TYPE_ATTRIBUTE` | `twakeMailboxType`      | Mailbox type attribute             |
+| `--ldap-concurrency`             |                                 | `DM_LDAP_CONCURRENCY`             | `10`                    | LDAP operations concurrency        |
 
 The wait before each retry grows with the attempt, so the total wait is `--james-retry-delay` × n(n−1)/2 for n attempts: 10 s with the defaults, 190 s with 20 attempts.