ldap-rest 0.26.0 → 1.0.1

package/dist/src/lib/authz/base.d.ts

@@ -12,6 +12,21 @@ import type { DM } from '../../bin';
 import type { BranchPermissions } from '../../config/args';
 import { type DmRequest } from '../auth/base';
 import type { AttributesList, ModifyRequest, SearchResult } from '../ldapActions';
+/**
+ * The rule of the most specific configured branch holding `target`.
+ *
+ * Branches are compared as DNs, whatever the case and spacing a rule or the
+ * directory spells them in. Among one subject's rules, the narrowest branch
+ * holding the target applies: a rule on `ou=payroll,ou=acme` takes over from
+ * one on `ou=acme` for everything below it, whichever was written first.
+ * Rules of different subjects (a user and their groups) are combined by the
+ * caller.
+ *
+ * @param rules the subject's rules, by branch
+ * @param target the branch judged
+ * @returns the rule that applies, or null when no branch holds the target
+ */
+export declare function mostSpecificBranchRule<T>(rules: Iterable<[string, T]>, target: string): T | null;
 /**
  * Abstract base class for authorization plugins
  * Provides common utility methods and interface for LDAP-based authorization
@@ -22,10 +37,21 @@ export default abstract class AuthzBase extends DmPlugin {
      *
      * The filter cannot ask `opts` whether the caller wanted the attribute: by
      * then `opts` is the widened one and would answer yes about an attribute
-     * we added ourselves. Holding the objects we touched keeps the question
-     * answerable, and a WeakSet lets them be collected with the request.
+     * we added ourselves. A mark on the options keeps the question answerable.
+     *
+     * A symbol key rather than a set of the objects touched: authorization
+     * judges a search before any other plugin, and one rewriting it after —
+     * `twake/tombstone` narrows the filter of a SCIM search — hands on a copy.
+     * An object spread copies the key; a set would no longer know the copy.
+     */
+    private static readonly widenedForLink;
+    /**
+     * The search of the top organization by itself, which every caller may
+     * make (`getOrganisationTop`): granted by `ldapsearchrequest` whatever the
+     * rules say, it is not filtered by them either. A symbol key, for the
+     * reason given at {@link widenedForLink}.
      */
-    private static widenedForLink;
+    private static readonly topOrganizationRead;
     roles: Role[];
     cacheTTL: number;
     /** What `--authz-unresolved-user` accepts. */
@@ -58,6 +84,11 @@ export default abstract class AuthzBase extends DmPlugin {
      * `--authz-filter-attached-entries`, off by default.
      */
     protected filtersAttachedEntries(): boolean;
+    /**
+     * Whether this plugin judges entries by their organization link: a plugin
+     * writing entries in an organization's branch gives them one then.
+     */
+    judgesByAttachment(): boolean;
     /**
      * Branches the broad read of `filtersAttachedEntries` leaves out: there,
      * only a caller holding the branch reads. None unless a plugin names some.
@@ -87,6 +118,20 @@ export default abstract class AuthzBase extends DmPlugin {
      * write.
      */
     protected sourcePermission(_branch: string): keyof BranchPermissions;
+    /**
+     * `dn` as the directory names it, read as the server. OpenLDAP reads a DN
+     * through its schema and matching rules — `2.5.4.11=payroll`,
+     * `ou=payroll\20` and `ou=payroll` are one entry — further than a text
+     * comparison can follow, so a write is judged on the entry it acts on,
+     * by the name the rules know it by. An entry that is not there keeps the
+     * spelling given: the write fails on it anyway.
+     */
+    protected storedDn(dn: string): Promise<string>;
+    /**
+     * A DN about to be written, under its parent as the directory names it:
+     * see {@link storedDn}.
+     */
+    protected storedParent(dn: string): Promise<string>;
     /**
      * The branch a write is judged against.
      *
@@ -178,6 +223,29 @@ export default abstract class AuthzBase extends DmPlugin {
      * Must be implemented by subclasses
      */
     abstract getAuthorizedBranches(user: string): Promise<string[]>;
+    /**
+     * Every branch one of the caller's rules names, whatever it grants: the
+     * branches where what applies differs from the branch above.
+     */
+    abstract ruleBranches(user: string): Promise<string[]>;
+    /**
+     * Whether a write changes nothing but the organization link and the path
+     * that goes with it: what moving an entry between organizations writes.
+     */
+    private onlyRelinks;
+    /**
+     * An entry a rule names is under that rule as well as under what judged
+     * the write, and moving it takes along the rules naming what lies below
+     * it, which name nothing afterwards (`departmentSync` relinks the
+     * accounts attached there to the new DN): the first of these branches
+     * where `user` lacks one of `permissions`.
+     *
+     * Only those: an entry no rule names is under the rule the caller judges.
+     *
+     * @param subtree whether the rules below `dn` count too: a move, or a
+     *   delete, which `trash` turns into one
+     */
+    private refusingRule;
     /**
      * Whether this request is none of this plugin's business.
      *
@@ -256,6 +324,16 @@ export default abstract class AuthzBase extends DmPlugin {
      * @returns the attribute name, or undefined when no domain is linked
      */
     protected domainLinkAttribute(): string | undefined;
+    /**
+     * The organization a write attaches an entry to, among the link values it
+     * gives: one at most. The judgement reads one, so a second would attach
+     * the entry to an organization nobody judged; and an empty value, which
+     * the directory stores, would make the entry read as attached to none.
+     *
+     * @throws BadRequestError when a value is empty or the values name
+     * several organizations
+     */
+    private static organizationLinks;
     /**
      * The values a write gives an attribute, whatever case its name is
      * spelled in.
@@ -333,7 +411,12 @@ export default abstract class AuthzBase extends DmPlugin {
         ldapaddrequest: ([dn, entry, req]: [string, AttributesList, DmRequest?]) => Promise<[string, AttributesList, DmRequest?]>;
         ldapsearchrequest: ([base, opts, req]: [string, SearchOptions, DmRequest?]) => Promise<[string, SearchOptions, DmRequest?]>;
         /**
-         * Drop the accounts attached outside the branches this caller manages.
+         * Drop what this caller may not read from a search it was granted.
+         *
+         * Judged by branch, the search was granted on its base: each entry is
+         * kept only where the caller may read it, a rule narrower than the base
+         * refusing part of what it holds. Judged by attachment, the accounts
+         * attached outside the branches this caller manages are dropped.
          *
          * Runs after the cache and carries the request, so what one caller may
          * not see never reaches another. An entry with no organization link —

package/dist/src/lib/authz/composition.d.ts

@@ -142,4 +142,25 @@ export declare function describePopulation(population: Population, authenticator
  * @throws Error naming the plugins when the composition is ambiguous
  */
 export declare function assertAuthzComposition(server: DM, candidate?: DmPlugin): Promise<void>;
+/**
+ * What the loaded plugins can enforce, decided once the configuration is
+ * loaded (#385).
+ *
+ * - No authentication nor authorization plugin: every request is served
+ *   with every right. An open mode on purpose — local development, a
+ *   trusted network — said once.
+ * - Authorization without authentication: no request carries an identity,
+ *   so every authorization plugin steps aside and everything passes while
+ *   the operator believes authorization is on. The server does not start.
+ * - Authentication without authorization: every authenticated caller has
+ *   every right, which a single administration token legitimately wants.
+ *   Said once.
+ *
+ * A plugin carrying both roles (`authzDynamic`) authenticates the requests
+ * it judges.
+ *
+ * @param server the server, its configuration loaded
+ * @throws Error naming the authorization plugins nothing authenticates for
+ */
+export declare function assertEnforceable(server: DM): void;
 export {};

package/dist/src/lib/ldapActions.d.ts

@@ -4,6 +4,7 @@ import type winston from 'winston';
 import pLimit from 'p-limit';
 import { type Config } from '../config/args';
 import { type DM } from '../bin';
+import type { Hooks } from '../hooks';
 import { type ChangeContext } from './changeContext';
 import { SchemaIndex } from './ldapSchema';
 export type AttributeValue = Buffer | Buffer[] | string[] | string;
@@ -14,15 +15,13 @@ export type { SearchOptions, SearchResult };
  * The directory as seen by one HTTP request.
  *
  * `ldapActions`'s own methods take the request as a trailing optional
- * argument, and the authorization plugins hook `ldap*request` and skip every
- * check when it is missing — so omitting it is an authorization bypass that
- * fails silently rather than loudly. Three shipped in the SCIM plugin alone.
+ * argument, which the authorization plugins judge by. One naming none is
+ * made for the request being served, if any (#385); this says which
+ * request is meant rather than leaving it to the context.
  *
  * These methods take no request parameter: it is captured once by
- * `ldapActions.forRequest()`, and forgetting it stops being expressible.
- * Request handlers should bind once and use this; the unbound methods remain
- * for work that genuinely belongs to no request, such as startup and cron
- * tasks, where passing nothing is the deliberate answer.
+ * `ldapActions.forRequest()`. Request handlers should bind once and use
+ * this; the server's own work goes through {@link ldapActions.system}.
  */
 export interface RequestBoundLdap {
     search(options: SearchOptions, base?: string): Promise<SearchResult | AsyncGenerator<SearchResult>>;
@@ -65,6 +64,8 @@ export interface ModifyOptions {
      */
     declaredClasses?: string[];
 }
+/** The request hooks an operation is judged in, see `ldapActions.authorize` */
+type AuthorizedHook = 'ldapaddrequest' | 'ldapmodifyrequest' | 'ldapdeleterequest' | 'ldaprenamerequest';
 declare class ldapActions {
     config: Config;
     options: ClientOptions;
@@ -106,6 +107,13 @@ declare class ldapActions {
     private schemaLoading?;
     /** Whether the last schema read failed, so a failure is logged once. */
     private schemaUnavailable;
+    /**
+     * How this server spells attribute names, by name in lower case: the
+     * configuration's, then the loaded schemas'. See {@link canonicalName}.
+     */
+    private spellings;
+    /** The first name given for each attribute type, to warn of another. */
+    private spelledTypes;
     /** Class problems already reported, per entry. See {@link warnOnce}. */
     private classWarnings;
     constructor(server: DM);
@@ -156,31 +164,91 @@ declare class ldapActions {
      * below it and the extra test costs nothing.
      */
     invalidateCache(dn: string): void;
+    /**
+     * Drop every cached read holding a value that names `dn`, or an entry
+     * below it.
+     *
+     * The directory mirrors some writes onto other entries than the one
+     * written: the `memberof` overlay keeps each member's `memberOf` in step
+     * with the group's `member` / `uniqueMember`, and `refint` rewrites or
+     * removes the references to an entry renamed or deleted. Those entries'
+     * cached reads are what {@link invalidateCache} cannot find, and they name
+     * the entry written: the members of a group name it in their `memberOf`.
+     * A member a write adds names it only once the write has landed; the
+     * caller drops those by their own DN.
+     *
+     * Every attribute is looked at, not `memberOf` alone: which attributes an
+     * overlay maintains is the deployment's configuration. A read naming `dn`
+     * for another reason is dropped too, which costs a miss.
+     */
+    private invalidateReferences;
     /**
      * The directory as the server itself, with no request behind it.
      *
-     * Every authorization plugin skips its check when a call carries no
-     * request, so an unbound call is a bypass — a deliberate one where the
-     * work belongs to nobody in particular: a startup task, a cron job, a
-     * uniqueness check, a referential-integrity check. Those must see the
+     * Every authorization plugin judges an operation by its request, and
+     * judges nothing without one. Some work belongs to nobody in particular:
+     * a startup task, a cron job, a uniqueness check, a referential-integrity
+     * check. Those must see the
      * whole directory to be correct: a caller who cannot *read* `uid=jdoe`
      * must still not be handed it as a free identifier, and a reference to an
      * organization they cannot read is still a valid reference.
      *
-     * The methods are the same objects as this instance's own — writes
-     * included, since a scheduled task writes: the examples above are reads
-     * because that is where the ambiguity lives, not because a write cannot
-     * belong to nobody. What this adds is a name: `ldap.system.search(…)` says
-     * the omission was meant, where `ldap.search(…)` says nothing and looks
-     * exactly like the mistake it takes one review to miss. A plugin serving a
-     * request should reach for {@link forRequest} instead.
+     * Writes included, since a scheduled task writes: the examples above are
+     * reads because that is where the ambiguity lives, not because a write
+     * cannot belong to nobody.
+     *
+     * While a request is being served, an operation that names none is made
+     * for it ({@link currentRequest}), so `ldap.search(…)` is judged as the
+     * caller. These operations step out of the request instead: they are the
+     * server's, whatever plugin serves the request — `authzDynamic` included.
+     * Each use says why the work is the server's.
+     *
+     * Only those six step out: `system.readableBy` and `system.forRequest`
+     * still judge the request they are given or find.
      */
     get system(): this;
+    /** {@link system}, built once. */
+    private systemView?;
     /**
      * Bind every directory operation to one request, so the authorization
      * hooks always see it. See {@link RequestBoundLdap}.
      */
     forRequest(req: Request): RequestBoundLdap;
+    /**
+     * Whether the caller of a request can read an entry.
+     *
+     * For a route that finds an entry as the server — by an attribute, across
+     * branches — and then answers about it: an entry the caller cannot read
+     * must get the answer an entry that is not there gets, or the route tells
+     * them what the directory holds where they cannot read. Refused or
+     * filtered out by an authorization plugin, the entry reads as absent.
+     * Without a request, as for any operation, nobody judges.
+     *
+     * @param dn the entry
+     * @param req the request whose caller asks
+     * @returns whether a read of the entry, as that caller, finds it
+     */
+    readableBy(dn: string, req?: Request): Promise<boolean>;
+    /**
+     * Have the authorization plugins judge an operation, without making it.
+     *
+     * A route that looks in the directory before it writes — whether an entry
+     * is there, which organization holds it, whether a pointer leads
+     * somewhere — answers what it found, as the server, to whoever asked. A
+     * caller who may not make the write then learns, one request at a time,
+     * what the directory holds where they cannot read. Judged first, they get
+     * the 403 the write itself would get, whether the entry is there or not.
+     *
+     * Only the hooks of the plugins with the `authz` role run, and what they
+     * return is dropped: the operation, when it is made, runs every hook
+     * again. Without a request in the arguments, the one being served is
+     * judged, as for the operation itself; outside any, nobody judges.
+     *
+     * @param hook the request hook the operation launches
+     * @param args what the operation hands that hook
+     * @throws the refusal of the first authorization plugin refusing
+     */
+    authorize<H extends AuthorizedHook>(hook: H, args: Parameters<NonNullable<Hooks[H]>>[0]): Promise<void>;
     /**
      * Declare the object classes an entity gives the entries of its branch.
      *
@@ -243,6 +311,55 @@ declare class ldapActions {
      * @returns indexed schema
      */
     schemaIndex(): Promise<SchemaIndex>;
+    /**
+     * Say how this server spells attribute names: a schema loaded by a plugin
+     * names its attributes as the plugins compare them. The first spelling of
+     * a name wins.
+     *
+     * @param names attribute names
+     */
+    knowAttributeNames(names: Iterable<string>): void;
+    /**
+     * Name each attribute of a write as this server does, in place.
+     *
+     * The directory takes `MAIL`, `rfc822Mailbox` and `0.9.2342.19200300.100.1.3`
+     * for `mail`, while the authorization plugins and the hooks look for
+     * `mail`: a write naming the organization link by its OID was judged as
+     * if it left the link alone. Each name is resolved through the directory
+     * schema — case, aliases, OIDs — and written as the configuration or a
+     * loaded schema spells it, or as the directory declares it first.
+     *
+     * An option names a value of its own (`member;lang-en` is not `member` to
+     * the hooks guarding `member`), and is refused, `;binary` aside. Two names
+     * for one attribute in one part of a write are refused too: on a modify
+     * the directory applies both, and only one would have been judged.
+     *
+     * Without the schema, the case is still set, and a name given as an OID,
+     * which nothing here could resolve, is refused.
+     *
+     * @param entry attributes of an add, or one part of a modify
+     * @throws BadRequestError on an option, or on one attribute named twice
+     */
+    canonicalAttributes(entry: AttributesList | undefined): Promise<void>;
+    /**
+     * {@link canonicalAttributes} for every part of a modify, in place.
+     *
+     * @param changes the modify
+     * @throws BadRequestError as {@link canonicalAttributes}
+     */
+    canonicalChanges(changes: ModifyRequest | undefined): Promise<void>;
+    /**
+     * The names of one part of a write, as {@link canonicalAttributes} writes
+     * them.
+     */
+    private canonicalNames;
+    /**
+     * One attribute description, named as this server does.
+     *
+     * @param key the name as written, options included
+     * @param index the directory schema, when it could be read
+     */
+    private canonicalName;
     /**
      * Hand a search result to `ldapsearchfilter`, which may drop entries the
      * caller is not allowed to see.
@@ -267,6 +384,10 @@ declare class ldapActions {
      * Move an entry to a new location (different parent)
      * Uses LDAP modifyDN with full DN to change both RDN and parent
      *
+     * Not judged, request or not: a move is the server's, made for a write
+     * already judged — the trash turning a delete into one. A route moving an
+     * entry for its caller uses {@link rename}, which is judged.
+     *
      * Note: ldapts provides a high-level API that accepts a full DN as the second parameter,
      * unlike the standard LDAP modifyDN which expects (newRDN, deleteOldRDN, newSuperior).
      * ldapts automatically parses the full DN and extracts the newRDN and newSuperior components

package/dist/src/lib/mailDomains.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @module lib/mailDomains
+ * @author Xavier Guimard <xguimard@linagora.com>
+ *
+ * The mail domains a directory declares: entries in the domain branches,
+ * each naming its domain in an attribute.
+ * @group Libraries
+ */
+import type { DM } from '../bin';
+/** Where mail domain entries live, and the attribute naming their domain */
+export interface DomainBranch {
+    base: string;
+    attribute: string;
+}
+/** The mail domains among values, lower-cased as James stores them */
+export declare const mailDomains: (values: string[] | undefined) => string[];
+/**
+ * Where the mail domain entries live, and the attribute naming their
+ * domain: each loaded flat schema declaring the `domainName` role, the
+ * lookup `core/ldap/enterpriseRules` makes. Without one, the branch of the
+ * shipped `twake/nomenclature/twakeDomain.json` and the attribute
+ * `--enterprise-domain-name-attribute` names.
+ *
+ * Rebuilt on each call, as the enterprise rules do theirs: a list taken in
+ * a constructor could predate the schemas.
+ *
+ * @param server the server, whose flat entities are read
+ * @returns the domain branches
+ */
+export declare function domainBranches(server: DM): DomainBranch[];
+/**
+ * Every mail domain the domain branches declare, lower-cased.
+ *
+ * Read as the server: which domains the directory serves is not a matter of
+ * who asks. A branch that does not exist declares none; any other failure
+ * is thrown, since an answer missing domains reads as "not ours".
+ *
+ * @param server the server
+ * @returns the declared domains, each once
+ */
+export declare function declaredMailDomains(server: DM): Promise<string[]>;

package/dist/src/lib/requestContext.d.ts

@@ -0,0 +1,23 @@
+import type { Request } from 'express';
+/**
+ * Serve a request: what runs inside, synchronously or not, is made for it.
+ *
+ * @param req the authenticated request
+ * @param fn what serves it
+ * @returns what `fn` returns
+ */
+export declare function runForRequest<T>(req: Request, fn: () => T): T;
+/**
+ * Run something as the server, outside the request being served: its
+ * operations are judged by nobody. What `ldap.system` does.
+ *
+ * @param fn what to run
+ * @returns what it returns
+ */
+export declare function outsideRequest<T>(fn: () => T): T;
+/**
+ * The request being served.
+ *
+ * @returns the request, or undefined outside any, or as the server
+ */
+export declare function currentRequest(): Request | undefined;

package/dist/src/lib/utils.d.ts

@@ -147,7 +147,9 @@ export declare function unescapeDnValue(value: string): string;
 export declare function validateDnValue(value: string, fieldName: string): void;
 /**
  * Parse a Distinguished Name (DN) into its component parts (RDNs)
- * Handles escaped commas and other special characters
+ * Handles escaped commas and other special characters, and what OpenLDAP
+ * still reads from LDAPv2 (RFC 1779): `;` separating RDNs as `,` does, and
+ * a value in double quotes holding either
  *
  * @param dn - The DN to parse
  * @returns Array of RDN components
@@ -164,6 +166,15 @@ export declare function validateDnValue(value: string, fieldName: string): void;
  * @throws BadRequestError if `dn` is not a string
  */
 export declare function parseDn(dn: string): string[];
+/**
+ * Whether a string has the shape of a DN: RDNs of `type=value` assertions,
+ * a type being a name or an OID. What the directory would refuse as
+ * `invalidDNSyntax` is answered without asking it.
+ *
+ * @param dn - The string
+ * @returns whether it reads as a DN
+ */
+export declare function isDnSyntax(dn: string): boolean;
 /**
  * Extract the parent DN from a DN
  * Removes the first RDN component to get the parent branch
@@ -228,6 +239,32 @@ export declare function rdnValue(dn: string): string;
  * ```
  */
 export declare function isChildOf(dn: string, parentDn: string): boolean;
+/**
+ * Teach {@link normalizeDn} the names and OIDs of attribute types: each is
+ * read as the type's first name.
+ *
+ * @param types attribute types, as `ldapSchema` parses them
+ */
+export declare function registerAttributeTypes(types: Iterable<{
+    oid: string;
+    names: string[];
+}>): void;
+/**
+ * The name an attribute type is known by, spelled as declared, from the
+ * names and OIDs {@link registerAttributeTypes} was given: `COMMONNAME`,
+ * `2.5.4.3` and `OID.2.5.4.3` are `cn`.
+ *
+ * @param type attribute name or OID
+ * @returns the name, or undefined for a type it was not given
+ */
+export declare function knownAttributeName(type: string): string | undefined;
+/**
+ * The attribute types the first RDN of a DN names, as {@link normalizeDn}
+ * reads them: `CN=a+2.5.4.11=b,…` names `cn` and `ou`.
+ *
+ * @param dn the DN
+ */
+export declare function rdnTypes(dn: string): string[];
 /**
  * Normalize a DN into a canonical, comparable form.
  *
@@ -238,7 +275,9 @@ export declare function isChildOf(dn: string, parentDn: string): boolean;
  * `,`. Empty components (e.g. from a trailing separator) are dropped.
  *
  * This makes equality / suffix comparisons robust to case, surrounding
- * whitespace and multi-valued RDN ordering — unlike a raw string match.
+ * whitespace, multi-valued RDN ordering, the escapes a directory answers
+ * with ({@link canonicalValue}) and the names and OIDs of an attribute type
+ * ({@link registerAttributeTypes}) — unlike a raw string match.
  *
  * @param dn - The DN to normalize
  * @returns The canonical form

package/dist/src/plugins/auth/authzDynamic.d.ts

@@ -24,7 +24,6 @@
  * Sub-branch matching is used (a permission on `ou=acme` covers
  * `ou=users,ou=acme`).
  */
-import { AsyncLocalStorage } from 'async_hooks';
 import type { Express, Response } from 'express';
 import { type Role } from '../../abstract/plugin';
 import type { DM } from '../../bin';
@@ -51,16 +50,6 @@ export interface TokenEntry {
 export interface AuthzDynamicRequest extends DmRequest {
     authzToken?: TokenEntry;
 }
-/**
- * Per-request async context holding the authenticated token.
- *
- * Core plugins (ldapGroups, ldapFlat, etc.) do not always forward the Express
- * `req` object down to `ldapActions.search()` / `.modify()`. Relying solely
- * on `req` would therefore let un-tracked operations bypass authorization.
- * Using AsyncLocalStorage gives us a request-scoped, ambient handle that the
- * authz hooks can read regardless of whether the caller threaded `req`.
- */
-export declare const authzContext: AsyncLocalStorage<TokenEntry>;
 export default class AuthzDynamic extends AuthBase {
     name: string;
     roles: Role[];
@@ -175,7 +164,11 @@ export default class AuthzDynamic extends AuthBase {
      * request.
      */
     hooks: Hooks;
-    /** Read the active token from the async context, or (as a fallback) from `req`. */
+    /**
+     * The token of the request an operation is made for: the one it names,
+     * or the one being served (`ldapActions` fills it in). An operation the
+     * server makes as itself (`ldap.system`) has none, and is not judged.
+     */
     private activeToken;
     /**
      * Throw a ForbiddenError (403) if the token cannot perform `permission` on

package/dist/src/plugins/auth/authzLinid1.d.ts

@@ -82,8 +82,10 @@ export default class AuthzLinid1 extends AuthzBase {
      * Get list of branches user has access to
      */
     getAuthorizedBranches(userDn: string): Promise<string[]>;
+    /** The organizations naming the user an administrator */
+    ruleBranches(userDn: string): Promise<string[]>;
     /**
-     * Find permissions for a branch (supports sub-branch matching)
+     * The caller's rights on a branch: see {@link mostSpecificBranchRule}.
      */
     private findBranchPermissions;
 }

package/dist/src/plugins/auth/authzPerBranch.d.ts

@@ -65,22 +65,18 @@ export default class AuthzPerBranch extends AuthzBase {
      * Get list of branches user has read access to (base class implementation)
      */
     getAuthorizedBranches(uid: string): Promise<string[]>;
+    /**
+     * The branches named by the user's rules and their groups'
+     */
+    ruleBranches(uid: string): Promise<string[]>;
     /**
      * Get list of branches user has access to for a given permission type
      */
     getAuthorizedBranchesForPermission(uid: string, permissionType: 'read' | 'write' | 'delete'): Promise<string[]>;
     /**
-     * Find permissions for a branch (supports sub-branch matching)
+     * The subject's rule on a branch: see {@link mostSpecificBranchRule}.
      */
     private findBranchPermissions;
-    /**
-     * Merge permissions (OR logic - grant if any source grants)
-     */
-    private mergePermissions;
-    /**
-     * Build LDAP filter for authorized branches
-     */
-    private buildBranchFilter;
     /**
      * The rules configured for a group, compared as DNs.
      *

package/dist/src/plugins/auth/openidconnect.d.ts

@@ -11,6 +11,10 @@ export default class OpenIDConnect extends AuthBase {
     private router?;
     /** Set once the missing `end_session_endpoint` has been reported. */
     private warnedNoEndSession;
+    /** Set once a `/logout` with nothing to record it has been reported. */
+    private warnedNoRecord;
+    /** Set once a `/logout` of a session nothing names has been reported. */
+    private warnedUnnamed;
     constructor(server: DM);
     /**
      * What is handed to `express-openid-connect`.
@@ -99,6 +103,49 @@ export default class OpenIDConnect extends AuthBase {
      * one ends the session. Undefined when there is nothing to wait for.
      */
     private renewExpired;
+    /**
+     * Whether the session in front of a request was ended — by a logout token,
+     * or by `/logout`.
+     *
+     * @param req the request, after the library has read its session
+     * @returns true when a subscriber of `oidcsessionvalid` refuses it
+     */
+    private loggedOut;
+    /**
+     * The id a session gets at login.
+     *
+     * The same person logging in again over a live session keeps its id: the
+     * library merges the new tokens into that session, and a copy of its
+     * cookie taken before would otherwise carry an id the next `/logout` no
+     * longer names. Anyone else, or a session already ended — the callback
+     * runs before the library asks — gets a new one.
+     *
+     * @param req the callback request, its session as the cookie brought it
+     * @param sub the `sub` of the id token just received
+     * @returns the id to keep in the session
+     */
+    private sessionId;
+    /**
+     * Record that the session in front of `/logout` is dead, as a logout token
+     * naming it would.
+     *
+     * Dropping the cookie ends the browser's copy only: the cookie holds the
+     * whole session, and a copy kept elsewhere — a shared computer, a backup
+     * of the browser profile, a stolen cookie — stayed valid until its tokens
+     * expired. The provider ends the sessions of the other applications
+     * through Back-Channel Logout, but does not tell the one that asked it to.
+     *
+     * The session is named by the id given at login, or by the provider's
+     * `sid` for a session from before that id existed — never by the `sub`,
+     * which would end every session of that person.
+     *
+     * A failure to record is logged and the logout goes on: the caller asked
+     * to leave, and refusing would keep the browser's copy alive as well.
+     *
+     * @param req the request, after the library's router
+     * @returns once the subscribers have run; never rejects
+     */
+    private endHere;
     /**
      * Whether `/logout` failed because the provider offers no RP-Initiated
      * Logout, rather than for a reason worth a 500.