ldap-rest 0.18.0 → 0.19.1

package/dist/src/plugins/twake/james.d.ts

@@ -5,6 +5,16 @@ import type { DM } from '../../bin';
 import type { AttributeValue } from '../../lib/ldapActions';
 import { Hooks } from '../../hooks';
 import type { ChangesToNotify } from '../ldap/onChange';
+type Identity = {
+    id: string;
+    email: string;
+    mayDelete?: boolean;
+    sortOrder?: number;
+    htmlSignature?: string;
+    textSignature?: string;
+};
+/** Signatures an identity carries over, see {@link Identity} */
+export type Signatures = Pick<Identity, 'htmlSignature' | 'textSignature'>;
 export default class James extends TwakePlugin {
     name: string;
     roles: Role[];
@@ -15,6 +25,7 @@ export default class James extends TwakePlugin {
     private quotaAttr;
     private aliasAttr;
     private mailboxTypeAttr;
+    private forwardAttr;
     private initDelay;
     constructor(server: DM);
     /**
@@ -27,16 +38,30 @@ export default class James extends TwakePlugin {
     private getUserQuota;
     hooks: Hooks;
     /**
-     * The address of the team mailbox an entry stands for, and whether it is
-     * refused for lying in a mailing list branch.
+     * The address of the team mailbox an entry stands for, and why it is
+     * refused, if it is: it lies in a mailing list branch, or TMail cannot
+     * name a team mailbox after its address.
      */
     private teamMailboxOf;
+    /**
+     * Give James what an account holds: quota, aliases and identity, after
+     * dropping the forwards left on its addresses. Runs when an entry is
+     * added with a mail, or gains one.
+     */
+    private provisionAccount;
     /**
      * Bring James from the team mailbox an entry was to the one it is. A
      * mailbox the entry no longer stands for is kept, emptied of its members.
      */
     private followTeamMailbox;
     private teamMailboxQueue;
+    /**
+     * The WebAdmin path of the team mailbox at an address
+     * {@link teamMailboxOf} accepted: TMail names it by the local part, under
+     * its domain. Lower-cased, so that a change of case only, which keeps the
+     * mailbox, keeps its path.
+     */
+    private teamMailboxUrl;
     private teamMailboxMembers;
     /**
      * Extract display name from LDAP attributes
@@ -62,10 +87,35 @@ export default class James extends TwakePlugin {
      * Calls for one address run one after the other: an add triggers this twice
      * (ldapadddone, then the display name "change" onChange publishes), and two
      * concurrent first calls would both find no default and both create one.
+     *
+     * `signatures` are written when `--james-signature-template` is not set:
+     * those of the identity the user had before a rename.
      */
-    updateJamesIdentity(dn: string, mail: string, displayName: string): Promise<void>;
+    updateJamesIdentity(dn: string, mail: string, displayName: string, signatures?: Signatures): Promise<void>;
     private identityQueue;
     private doUpdateJamesIdentity;
+    /**
+     * The signatures of an address's default identity, none when it has none
+     * or James cannot be read.
+     */
+    private defaultSignatures;
+    /**
+     * The forwards the directory gives an entry, those James is to keep on its
+     * address: none unless the directory owns forwards
+     * (`--james-sync-forwards`).
+     */
+    private ownForwards;
+    /**
+     * Remove the forwards James holds from an address an entry takes, but
+     * those in `keep`: the entry's own. A rename leaves one from the old
+     * address to the new, and its next owner would not get its mail.
+     *
+     * Runs whether forwards are synced or not: Twake Mail keeps a user's
+     * forwards under their own address, and none can have been set yet on an
+     * address the account is only now taking. The rename calls this before
+     * James moves the user's forwards to the new address.
+     */
+    private dropStaleForwards;
     private warnAndWait;
     /**
      * Delete user data via James WebAdmin API
@@ -101,3 +151,4 @@ export default class James extends TwakePlugin {
     _getDelegateEmail(dn: string): Promise<string | null>;
     _normalizeToArray(value: AttributeValue | null): string[];
 }
+export {};

package/docs/client-development/api/rest-api.md

@@ -245,6 +245,8 @@ curl -H "Accept: application/json" \
 - `features.ldapFlatGeneric.flatResources`: Array of flat LDAP resources (users, positions, etc.)
 - `features.ldapGroups`: Group management configuration (if enabled)
 - `features.ldapOrganizations`: Organization tree configuration (if enabled)
+- `features.externalUsersInGroups`: where to send an external group member
+  (if enabled), [details](../../usage/plugins/ldap/external-users.md#config-api)
 - `features.openidconnect.endpoints.logout`: the logout route, when OpenID Connect
   guards the server ([details](../../usage/plugins/auth/oidc.md#logout))
 

package/docs/usage/configuration.md

@@ -452,18 +452,19 @@ whichever of the two names it selects. A value other than `req.user` or
 
 #### `core/twake/james`
 
-| CLI                              | Plural                          | Env                               | Default                 | Description                        |
-| -------------------------------- | ------------------------------- | --------------------------------- | ----------------------- | ---------------------------------- |
-| `--james-webadmin-url`           |                                 | `DM_JAMES_WEBADMIN_URL`           | `http://localhost:8000` | James WebAdmin API URL             |
-| `--james-webadmin-token`         |                                 | `DM_JAMES_WEBADMIN_TOKEN`         |                         | James authentication token         |
-| `--james-signature-template`     |                                 | `DM_JAMES_SIGNATURE_TEMPLATE`     |                         | Email signature template           |
-| `--james-concurrency`            |                                 | `DM_JAMES_CONCURRENCY`            | `10`                    | James API concurrency              |
-| `--james-init-delay`             |                                 | `DM_JAMES_INIT_DELAY`             | `1000`                  | Init delay (ms)                    |
-| `--james-retry-attempts`         |                                 | `DM_JAMES_RETRY_ATTEMPTS`         | `5`                     | Attempts per user call             |
-| `--james-retry-delay`            |                                 | `DM_JAMES_RETRY_DELAY`            | `1000`                  | Base retry delay (ms)              |
-| `--james-mailing-list-branch`    | `--james-mailing-list-branches` | `DM_JAMES_MAILING_LIST_BRANCHES`  | `[]`                    | Branches refused to team mailboxes |
-| `--james-mailbox-type-attribute` |                                 | `DM_JAMES_MAILBOX_TYPE_ATTRIBUTE` | `twakeMailboxType`      | Mailbox type attribute             |
-| `--ldap-concurrency`             |                                 | `DM_LDAP_CONCURRENCY`             | `10`                    | LDAP operations concurrency        |
+| CLI                              | Plural                          | Env                               | Default                 | Description                                                                               |
+| -------------------------------- | ------------------------------- | --------------------------------- | ----------------------- | ----------------------------------------------------------------------------------------- |
+| `--james-webadmin-url`           |                                 | `DM_JAMES_WEBADMIN_URL`           | `http://localhost:8000` | James WebAdmin API URL                                                                    |
+| `--james-webadmin-token`         |                                 | `DM_JAMES_WEBADMIN_TOKEN`         |                         | James authentication token                                                                |
+| `--james-signature-template`     |                                 | `DM_JAMES_SIGNATURE_TEMPLATE`     |                         | Email signature template                                                                  |
+| `--james-concurrency`            |                                 | `DM_JAMES_CONCURRENCY`            | `10`                    | James API concurrency                                                                     |
+| `--james-init-delay`             |                                 | `DM_JAMES_INIT_DELAY`             | `1000`                  | Init delay (ms)                                                                           |
+| `--james-retry-attempts`         |                                 | `DM_JAMES_RETRY_ATTEMPTS`         | `5`                     | Attempts per user call                                                                    |
+| `--james-retry-delay`            |                                 | `DM_JAMES_RETRY_DELAY`            | `1000`                  | Base retry delay (ms)                                                                     |
+| `--james-mailing-list-branch`    | `--james-mailing-list-branches` | `DM_JAMES_MAILING_LIST_BRANCHES`  | `[]`                    | Branches refused to team mailboxes                                                        |
+| `--james-mailbox-type-attribute` |                                 | `DM_JAMES_MAILBOX_TYPE_ATTRIBUTE` | `twakeMailboxType`      | Mailbox type attribute                                                                    |
+| `--james-sync-forwards`          |                                 | `DM_JAMES_SYNC_FORWARDS`          | `false`                 | Copy LDAP forwards to Twake Mail — [details](plugins/integrations/james-mail.md#forwards) |
+| `--ldap-concurrency`             |                                 | `DM_LDAP_CONCURRENCY`             | `10`                    | LDAP operations concurrency                                                               |
 
 The wait before each retry grows with the attempt, so the total wait is `--james-retry-delay` × n(n−1)/2 for n attempts: 10 s with the defaults, 190 s with 20 attempts.
 

package/docs/usage/plugins/auth/authz-linid1.md

@@ -96,6 +96,27 @@ to the transit branch follows the same rules through
 `POST /api/v1/ldap/groups/:cn/move`; that endpoint does not move a group
 attached to no organization.
 
+### Mail domains
+
+The mail domains an organization's entries may use are those it links in
+`twakeDomainLink` and those every organization above it links
+(`ldap/enterpriseRules`). Creating or changing an organization only asks for
+write on its parent, so the link itself is held to more:
+
+- a domain newly linked to an organization must already be linked by an
+  organization above it, up to the top organization;
+- a caller holding write on the top organization links any domain: they are
+  the one giving each organization its own;
+- a domain the organization already links can be kept, and removing one is
+  judged as any other change.
+
+So the administrator of `ou=Sales` can create `ou=Sales-EU` restricted to
+Sales' domain, but cannot give it another customer's. The attribute is the
+organization schema's `domainLink` role, or
+`--enterprise-domain-link-attribute`; with neither, nothing is checked. The
+rule belongs to the base of the authorization plugins, so `authzPerBranch`
+applies it too.
+
 ## Configuration
 
 No configuration file needed - permissions are read from LDAP. Simply load the plugin:

package/docs/usage/plugins/integrations/james-mail.md

@@ -39,6 +39,8 @@ DM_JAMES_WEBADMIN_TOKEN="your-admin-token"
 - `--mail-attribute`: LDAP attribute for email (default: `mail`)
 - `--quota-attribute`: LDAP attribute for quota (default: `mailQuotaSize`)
 - `--alias-attribute`: LDAP attribute for email aliases (default: `mailAlternateAddress`)
+- `--forward-attribute`: LDAP attribute for forwards (default: `mailForwardingAddress`)
+- `--james-sync-forwards`: copy that attribute to Twake Mail's forwards (default: `false`), see [Forwards](#forwards)
 - `--james-mailbox-type-attribute`: LDAP attribute for mailbox type (default: `twakeMailboxType`)
 - `--james-retry-attempts`: attempts in all of a call about a user James may not see yet (default: `5`), see [Replication lag](#replication-lag)
 - `--james-retry-delay`: base delay between those attempts, in ms (default: `1000`); the total wait is delay × n(n−1)/2 for n attempts
@@ -87,7 +89,29 @@ When a user's mail attribute changes:
    POST /users/old@company.com/rename/john.doe@company.com?action=rename
    ```
 
-4. **James** renames the mail account and all associated data
+4. **James** renames the mail account and its mailboxes, and adds a forward
+   from the old address to the new one, so that mail sent to the old address
+   still arrives. It leaves the identities under the old address.
+
+5. **James plugin** moves the aliases (see
+   [Aliases and Mail Changes](#aliases-and-mail-changes)) and gives the new
+   address its [default identity](#display-name-and-identity) back, with the
+   signatures of the old one when `--james-signature-template` is not set.
+
+#### Forwards Left on an Address
+
+The forward a rename leaves outlives the account. When an address becomes the
+`mail` or an alias of an account, at its creation, a rename, a mail added to
+an existing entry or an alias add, the plugin removes the forwards James holds
+from it, except the entry's own when the directory owns forwards
+(`--forward-attribute`, with `--james-sync-forwards`):
+
+```http
+GET /address/forwards/old@company.com
+DELETE /address/forwards/old@company.com/targets/john.doe@company.com
+```
+
+Otherwise the new owner of the address would not get its mail.
 
 ### Quota Changes
 
@@ -115,11 +139,33 @@ When a user's quota changes:
    5000000000
    ```
 
+### Forwards
+
+Forwards are a setting of the user in Twake Mail, beside "keep a copy in my
+mailbox", and Twake Mail Admin can change them too. By default the plugin
+does not copy `--forward-attribute` to them. It still removes the
+[forwards left](#forwards-left-on-an-address) on an address an account takes:
+Twake Mail keeps a user's forwards under their own address, and none can have
+been set on an address the account is only now taking.
+
+With `--james-sync-forwards`, the directory owns them: each change of
+`--forward-attribute` is applied to Twake Mail, and overwrites what the user
+set there.
+
+```http
+PUT /address/forwards/jdoe@company.com/targets/john@partner.com
+DELETE /address/forwards/jdoe@company.com/targets/old@partner.com
+```
+
+Only the change is applied: a forward the user added in Twake Mail stays
+until the directory names it and removes it, and the directory is never told
+about the forwards set in Twake Mail.
+
 ### Display Name and Identity
 
-When a user is added, or their display name changes, the plugin names their
-default identity in Twake Mail after the directory. The name is the first one
-found in `--display-name-attribute` (`displayName` by default), `cn`, then
+When a user is added, renamed, or their display name changes, the plugin names
+their default identity in Twake Mail after the directory. The name is the first
+one found in `--display-name-attribute` (`displayName` by default), `cn`, then
 `givenName` and `sn`. The optional signature is `--james-signature-template`.
 
 1. **James plugin** reads the default identity, the deletable one with the
@@ -226,7 +272,8 @@ When the primary email address changes, all aliases are automatically updated:
    PUT /address/aliases/john.smith@company.com/sources/jdoe@company.com
    ```
 
-   **Note:** James automatically creates an alias from the old address when renaming a user. The plugin attempts to create this alias explicitly, but handles the 409 Conflict response gracefully if it already exists.
+   James forwards the old address to the new one, see
+   [Forwards Left on an Address](#forwards-left-on-an-address).
 
 #### Active Directory Format Support
 
@@ -430,14 +477,19 @@ const signature = await james.generateSignature(
 
 ---
 
-### updateJamesIdentity(dn, mail, displayName)
+### updateJamesIdentity(dn, mail, displayName, signatures?)
 
 Update a user's JMAP identity in James (name and optional signature).
 
 **Signature:**
 
 ```typescript
-async updateJamesIdentity(dn: string, mail: string, displayName: string): Promise<void>
+async updateJamesIdentity(
+  dn: string,
+  mail: string,
+  displayName: string,
+  signatures?: { htmlSignature?: string; textSignature?: string }
+): Promise<void>
 ```
 
 **Parameters:**
@@ -445,6 +497,8 @@ async updateJamesIdentity(dn: string, mail: string, displayName: string): Promis
 - `dn` (string): LDAP Distinguished Name (used for signature generation)
 - `mail` (string): User's email address
 - `displayName` (string): New display name for the identity
+- `signatures` (object, optional): written when `--james-signature-template`
+  is not set
 
 **Example:**
 
@@ -551,6 +605,8 @@ const type = await james.getGroupMailboxType(
 | Remove delegation | `/users/{mail}/authorizedUsers/{delegate}` | DELETE |
 | Add alias         | `/address/aliases/{mail}/sources/{alias}`  | PUT    |
 | Remove alias      | `/address/aliases/{mail}/sources/{alias}`  | DELETE |
+| List forwards     | `/address/forwards/{mail}`                 | GET    |
+| Remove forward    | `/address/forwards/{mail}/targets/{to}`    | DELETE |
 
 ### Authentication
 
@@ -783,9 +839,10 @@ Quota values are in **bytes**:
 
 ### Scenario 1: User Creation
 
-1. Create user in LDAP with mail attribute
-2. James plugin does nothing (user doesn't exist in James yet)
-3. Create mail account in James manually or via provisioning script
+1. Create user in LDAP with mail attribute: James reads its users from LDAP
+2. James plugin sets the quota, the aliases and the default identity, after
+   dropping the [forwards left](#forwards-left-on-an-address) on its addresses
+3. A mail added later to an existing entry is handled the same way
 4. Future mail/quota changes are synced automatically
 
 ### Scenario 2: Mail Address Change

package/docs/usage/plugins/integrations/james-mailboxes.md

@@ -97,8 +97,8 @@ await dm.ldap.add('cn=sales-team,ou=groups,dc=example,dc=com', {
 
 This will:
 
-1. Create the team mailbox via `PUT /domains/example.com/team-mailboxes/sales@example.com`
-2. Add each member via `PUT /domains/example.com/team-mailboxes/sales@example.com/members/{member-email}`
+1. Create the team mailbox via `PUT /domains/example.com/team-mailboxes/sales`
+2. Add each member via `PUT /domains/example.com/team-mailboxes/sales/members/{member-email}`
 
 ### Creating a Mailing List
 
@@ -159,9 +159,16 @@ address cannot be read.
 
 ### Team Mailboxes
 
-- **Create**: `PUT /domains/{domain}/team-mailboxes/{teamMailbox}`
-- **Add member**: `PUT /domains/{domain}/team-mailboxes/{teamMailbox}/members/{memberEmail}`
-- **Delete member**: `DELETE /domains/{domain}/team-mailboxes/{teamMailbox}/members/{memberEmail}`
+- **Create**: `PUT /domains/{domain}/team-mailboxes/{name}`
+- **Add member**: `PUT /domains/{domain}/team-mailboxes/{name}/members/{memberEmail}`
+- **Delete member**: `DELETE /domains/{domain}/team-mailboxes/{name}/members/{memberEmail}`
+
+TMail names a team mailbox by the local part of its address, `{name}@{domain}`,
+and accepts only letters, digits, `#`, `-` and `_` in it, up to 255 characters.
+A group whose address has any other character, such as a dot, gets no team
+mailbox: the plugin logs an error once, when the group comes to have such an
+address, and does not call TMail. The name is lower-cased, so a change of case
+of the address keeps the same team mailbox.
 
 ## Validation Rules
 
@@ -220,7 +227,7 @@ await dm.ldap.modify('cn=sales,ou=groups,dc=example,dc=com', {
 
 **What happens:**
 
-1. Creates the team mailbox (`PUT /domains/{domain}/team-mailboxes/{mail}`)
+1. Creates the team mailbox (`PUT /domains/{domain}/team-mailboxes/{name}`)
 2. Adds all current members to the team mailbox
 
 #### teamMailbox → mailingList
@@ -236,7 +243,7 @@ await dm.ldap.modify('cn=sales,ou=groups,dc=example,dc=com', {
 
 **What happens:**
 
-1. Removes all members from the team mailbox (`DELETE /domains/{domain}/team-mailboxes/{mail}/members/{member}`)
+1. Removes all members from the team mailbox (`DELETE /domains/{domain}/team-mailboxes/{name}/members/{member}`)
 2. **Preserves the team mailbox** (does NOT delete it - can be recovered later)
 
 #### group → mailingList or teamMailbox

package/docs/usage/plugins/ldap/external-users.md

@@ -33,10 +33,31 @@ This plugin intercepts group member validation and automatically creates missing
 ### Important Notes
 
 - **Dependencies**: This plugin requires the `core/ldap/groups` plugin
-- **DN Format**: External members are in the format `mail={email},{external_members_branch}`
-- **Domain Protection**: External users cannot be created if their mail are in managed domains (configured via `--mail-domain`)
+- **DN Format**: External members are in the format `mail={email},{external_members_branch}`,
+  the address escaped as any DN value (RFC 4514): `mail=a\+b@partner.com,…`
+  creates an entry whose `mail` is `a+b@partner.com`. Only the direct children of the
+  branch are external members.
+- **Domain Protection**: External users cannot be created if their mail are in managed domains (configured via `--mail-domain`, compared case-insensitively)
 - **Automatic Creation**: Users are created automatically when added to a group if they don't exist
 
+### Config API
+
+`GET /api/v1/config` tells a client whether external members are accepted, and
+where to send them:
+
+```json
+"externalUsersInGroups": {
+  "enabled": true,
+  "branch": "ou=contacts,dc=example,dc=com",
+  "rdnAttribute": "mail",
+  "managedDomains": ["example.com"]
+}
+```
+
+A client turns an address into a member with
+`rdnAttribute=<escaped address>,<branch>`, and can refuse a `managedDomains`
+address before sending it.
+
 ## How It Works
 
 ### Member Validation Hook

package/docs/usage/upgrading.md

@@ -4,6 +4,24 @@ What to check before deploying, newest first. Only releases that need a
 decision or a configuration change appear here; see the
 [CHANGELOG](../../CHANGELOG.md) for everything else.
 
+## To 0.19.0
+
+### Forwards are no longer copied to Twake Mail
+
+**Who is affected:** a deployment that loads `twake/james` and stores
+forwards in `--forward-attribute` (`mailForwardingAddress` by default).
+
+`twake/james` no longer applies the changes of that attribute to Twake Mail's
+forwards: users set them in Twake Mail. The forwards already in Twake Mail
+stay as they are, except those left on an address an account takes, removed
+as before,
+[details](plugins/integrations/james-mail.md#forwards-left-on-an-address).
+
+To keep the directory as the owner of the forwards, set
+`--james-sync-forwards` (`DM_JAMES_SYNC_FORWARDS=true`); it then overwrites
+what users set in Twake Mail,
+[details](plugins/integrations/james-mail.md#forwards).
+
 ## To 0.18.0
 
 ### Mailing lists are no longer copied to James

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-rest",
-  "version": "0.18.0",
+  "version": "0.19.1",
   "description": "Light directory manager",
   "keywords": [
     "Identity-Manager"

package/static/schemas/twake/groups.json

@@ -8,11 +8,13 @@
     "base": "ou=groups,__ldap_base__",
     "label": {
       "en": "Groups",
-      "fr": "Groupes"
+      "fr": "Groupes",
+      "mn": "Бүлгүүд"
     },
     "singularLabel": {
       "en": "group",
-      "fr": "groupe"
+      "fr": "groupe",
+      "mn": "бүлэг"
     }
   },
   "strict": true,
@@ -33,13 +35,15 @@
       "test": "^(?!.*\\.\\.)[a-zA-Z0-9!#$%&'*+/=?^_`{|}.-]{1,64}$",
       "hint": {
         "en": "Must match an email local part: letters, digits and ! # $ % & ' * + / = ? ^ _ ` { | } . -, no consecutive dots",
-        "fr": "Partie locale d'une adresse électronique : lettres, chiffres et ! # $ % & ' * + / = ? ^ _ ` { | } . -, sans points consécutifs"
+        "fr": "Partie locale d'une adresse électronique : lettres, chiffres et ! # $ % & ' * + / = ? ^ _ ` { | } . -, sans points consécutifs",
+        "mn": "Имэйл хаягийн @-ээс өмнөх хэсэг: үсэг, тоо болон ! # $ % & ' * + / = ? ^ _ ` { | } . -, дараалсан цэггүй"
       },
       "required": true,
       "role": "identifier",
       "label": {
         "en": "Name",
-        "fr": "Nom"
+        "fr": "Nom",
+        "mn": "Нэр"
       }
     },
     "description": {
@@ -48,7 +52,8 @@
       "required": false,
       "label": {
         "en": "Description",
-        "fr": "Description"
+        "fr": "Description",
+        "mn": "Тайлбар"
       }
     },
     "mail": {
@@ -57,7 +62,8 @@
       "test": "^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$",
       "hint": {
         "en": "Expected an email address, e.g. all-staff@lists.example.org",
-        "fr": "Une adresse électronique est attendue, par ex. all-staff@lists.example.org"
+        "fr": "Une adresse électronique est attendue, par ex. all-staff@lists.example.org",
+        "mn": "Имэйл хаяг оруулна уу, жишээ нь all-staff@lists.example.org"
       },
       "required": false,
       "unique": {
@@ -69,7 +75,8 @@
       "role": "primaryEmail",
       "label": {
         "en": "Email",
-        "fr": "Adresse électronique"
+        "fr": "Adresse électronique",
+        "mn": "Имэйл хаяг"
       }
     },
     "businessCategory": {
@@ -79,11 +86,13 @@
       "role": "writePolicy",
       "label": {
         "en": "List type",
-        "fr": "Type de liste"
+        "fr": "Type de liste",
+        "mn": "Жагсаалтын төрөл"
       },
       "group": {
         "en": "Mailbox Settings",
-        "fr": "Paramètres de messagerie"
+        "fr": "Paramètres de messagerie",
+        "mn": "Шуудангийн хайрцгийн тохиргоо"
       }
     },
     "twakeMailboxType": {
@@ -91,13 +100,15 @@
       "branch": ["ou=twakeMailboxType,ou=nomenclature,__LDAP_BASE__"],
       "group": {
         "en": "Mailbox Settings",
-        "fr": "Paramètres de messagerie"
+        "fr": "Paramètres de messagerie",
+        "mn": "Шуудангийн хайрцгийн тохиргоо"
       },
       "required": false,
       "role": "mailboxType",
       "label": {
         "en": "Group type",
-        "fr": "Type de groupe"
+        "fr": "Type de groupe",
+        "mn": "Бүлгийн төрөл"
       }
     },
     "member": {
@@ -107,14 +118,16 @@
         "test": "^[a-zA-Z]+=.*,__LDAP_BASE__$",
         "hint": {
           "en": "Expected the DN of an entry of this directory",
-          "fr": "Le DN d'une entrée de cet annuaire est attendu"
+          "fr": "Le DN d'une entrée de cet annuaire est attendu",
+          "mn": "Энэ лавлахын бичлэгийн DN оруулна уу"
         }
       },
       "required": false,
       "role": "members",
       "label": {
         "en": "Members",
-        "fr": "Membres"
+        "fr": "Membres",
+        "mn": "Гишүүд"
       }
     },
     "owner": {
@@ -124,14 +137,16 @@
         "test": "^[a-zA-Z]+=.*,__LDAP_BASE__$",
         "hint": {
           "en": "Expected the DN of an entry of this directory",
-          "fr": "Le DN d'une entrée de cet annuaire est attendu"
+          "fr": "Le DN d'une entrée de cet annuaire est attendu",
+          "mn": "Энэ лавлахын бичлэгийн DN оруулна уу"
         }
       },
       "required": false,
       "role": "owners",
       "label": {
         "en": "Owners",
-        "fr": "Propriétaires"
+        "fr": "Propriétaires",
+        "mn": "Эзэмшигчид"
       }
     },
     "twakeDepartmentLink": {
@@ -141,7 +156,8 @@
       "role": "organizationLink",
       "label": {
         "en": "Department",
-        "fr": "Organisation"
+        "fr": "Organisation",
+        "mn": "Байгууллага"
       }
     },
     "twakeDepartmentPath": {
@@ -152,7 +168,8 @@
       "role": "organizationPath",
       "label": {
         "en": "Department path",
-        "fr": "Chemin"
+        "fr": "Chemin",
+        "mn": "Зам"
       }
     }
   }

package/static/schemas/twake/nomenclature/twakeAccountStatus.json

@@ -7,28 +7,34 @@
     "pluralName": "accountStatuses",
     "label": {
       "en": "Account states",
-      "fr": "États de compte"
+      "fr": "États de compte",
+      "mn": "Бүртгэлийн төлөвүүд"
     },
     "singularLabel": {
       "en": "account state",
-      "fr": "état de compte"
+      "fr": "état de compte",
+      "mn": "бүртгэлийн төлөв"
     },
     "valueLabels": {
       "active": {
         "en": "Active",
-        "fr": "Actif"
+        "fr": "Actif",
+        "mn": "Идэвхтэй"
       },
       "disabled": {
         "en": "Disabled",
-        "fr": "Désactivé"
+        "fr": "Désactivé",
+        "mn": "Идэвхгүй"
       },
       "noaccess": {
         "en": "No access",
-        "fr": "Sans accès"
+        "fr": "Sans accès",
+        "mn": "Хандах эрхгүй"
       },
       "todelete": {
         "en": "To delete",
-        "fr": "À supprimer"
+        "fr": "À supprimer",
+        "mn": "Устгах"
       }
     },
     "base": "ou=twakeAccountStatus,ou=nomenclature,{ldap_base}"
@@ -50,7 +56,8 @@
       "required": true,
       "label": {
         "en": "Name",
-        "fr": "Nom"
+        "fr": "Nom",
+        "mn": "Нэр"
       }
     },
     "description": {
@@ -58,7 +65,8 @@
       "required": false,
       "label": {
         "en": "Description",
-        "fr": "Description"
+        "fr": "Description",
+        "mn": "Тайлбар"
       }
     }
   }