ldap-rest 0.3.0 → 0.3.1

package/README.md

@@ -2,7 +2,7 @@
 
 # LDAP-Rest
 
-Lite LinID directory manager is a lightweight directory manager that provides LDAP integration through a plugin-based architecture.
+**ldap-rest** is a lightweight directory manager that provides LDAP integration through a plugin-based architecture.
 This system enables directory management operations with configurable authentication, extensible functionality through events/hooks,
 and extensible REST API.
 

package/dist/plugins/ldap/organization.js

@@ -1 +1 @@
-import t from"fs";import i from"../../abstract/plugin.js";import{tryMethodData as a,jsonBody as e,tryMethod as n,wantJson as r}from"../../lib/expressFormatedResponses.js";import{transformSchemas as s,asyncHandler as o,validateDnValue as h,escapeDnValue as c,launchHooksChained as d,escapeLdapFilter as g}from"../../lib/utils.js";import{BadRequestError as l,NotFoundError as p,ConflictError as f}from"../../lib/errors.js";class LdapOrganizations extends i{constructor(i){if(super(i),this.name="ldapOrganizations",this.roles=["api","consistency","configurable"],this.hooks={ldapaddrequest:async([t,i,a])=>(this.isOu(i)||await this.checkDeptLink(i),this.isOu(i)&&await this.checkDeptPath(i),void 0!==a?[t,i,a]:[t,i]),ldapmodifyrequest:async([t,i,a])=>{let e,n={},r={};const checkIsOu=async()=>{if(void 0!==e)return e;if(i.replace?.objectClass)e=this.isOu({objectClass:i.replace.objectClass});else if(i.add?.objectClass)e=this.isOu({objectClass:i.add.objectClass});else{const i=await this.server.ldap.search({paged:!1,scope:"base"},t);e=i.searchEntries.length>0&&this.isOu(i.searchEntries[0])}return e};if(i.delete){const t=Array.isArray(i.delete)?i.delete.includes(this.linkAttr):i.delete[this.linkAttr],a=Array.isArray(i.delete)?i.delete.includes(this.pathAttr):i.delete[this.pathAttr];if(t||a){if(!await checkIsOu()&&t)throw new l("An organization link cannot be deleted");if(a)throw new l("An organization path cannot be deleted")}}if(i.replace&&(i.replace[this.linkAttr]&&(n={...i.replace}),i.replace[this.pathAttr]&&(r={...i.replace})),i.add&&(i.add[this.linkAttr]&&(n={...n,...i.add}),i.add[this.pathAttr]&&(r={...r,...i.add})),Object.keys(n).length>0){await checkIsOu()||await this.checkDeptLink(n)}if(Object.keys(r).length>0){await checkIsOu()&&await this.checkDeptPath(r)}return[t,i,a]},ldapdeleterequest:async([t])=>(/^ou=/.test(t)&&await this.isEmptyOrganization(t),[t]),ldaprenamerequest:([t,i])=>[t,i]},!this.config.ldap_top_organization)throw new Error("Missing --ldap-top-organization");this.pathAttr=this.config.ldap_organization_path_attribute,this.linkAttr=this.config.ldap_organization_link_attribute,this.config.organization_schema&&t.readFile(this.config.organization_schema,(t,i)=>{if(t)this.logger.error(`Failed to load organization schema from ${this.config.organization_schema}: ${t}`);else try{this.schema=JSON.parse(s(i.toString(),this.config)),this.logger.debug("Organization schema loaded")}catch(t){this.logger.error(`Failed to parse organization schema: ${t}`)}})}api(t){t.get(`${this.config.api_prefix}/v1/ldap/organizations/top`,async(t,i)=>{await a(i,this.getOrganisationTop.bind(this),t)}),t.get(`${this.config.api_prefix}/v1/ldap/organizations/:dn`,async(t,i)=>{const e=decodeURIComponent(t.params.dn);await a(i,this.getOrganisationByDn.bind(this),e,t)}),t.get(`${this.config.api_prefix}/v1/ldap/organizations/:dn/subnodes`,async(t,i)=>{const e=decodeURIComponent(t.params.dn);await a(i,this.getOrganisationSubnodes.bind(this),e,t)}),t.get(`${this.config.api_prefix}/v1/ldap/organizations/:dn/subnodes/search`,o(async(t,i)=>{const e=decodeURIComponent(t.params.dn),n=t.query.q;if(!n)throw new l('query parameter "q" is required');await a(i,this.searchOrganisationSubnodes.bind(this),e,n)})),t.post(`${this.config.api_prefix}/v1/ldap/organizations`,o(async(t,i)=>this.apiAdd(t,i))),t.put(`${this.config.api_prefix}/v1/ldap/organizations/:dn`,o(async(t,i)=>this.apiModify(t,i))),t.delete(`${this.config.api_prefix}/v1/ldap/organizations/:dn`,o(async(t,i)=>this.apiDelete(t,i))),t.post(`${this.config.api_prefix}/v1/ldap/organizations/:dn/move`,o(async(t,i)=>this.apiMove(t,i)))}async apiAdd(t,i){const a=e(t,i,"ou");if(!a)return;h(a.ou,"ou");const r=a.parentDn||this.config.ldap_top_organization,s=`ou=${c(a.ou)},${r}`,o={objectClass:this.config.ldap_organization_class,ou:a.ou,...Object.fromEntries(Object.entries(a).filter(([t])=>"ou"!==t&&"parentDn"!==t))};await n(i,this.addOrganization.bind(this),s,o,t)}async apiModify(t,i){const a=e(t,i);if(!a)return;const r=decodeURIComponent(t.params.dn);if(!r)throw new l("dn is required");await n(i,this.modifyOrganization.bind(this),r,a)}async apiDelete(t,i){if(!r(t,i))return;const a=decodeURIComponent(t.params.dn);if(!a)throw new l("dn is required");await n(i,this.deleteOrganization.bind(this),a)}async apiMove(t,i){if(!r(t,i))return;const n=e(t,i,"targetOrgDn");if(!n)return;const s=decodeURIComponent(t.params.dn);if(!s)throw new l("dn is required");const{targetOrgDn:o}=n;if(!o||"string"!=typeof o)throw new l("Missing or invalid targetOrgDn in request body");await a(i,this.moveOrganization.bind(this),s,o,t)}async checkDeptLink(t){if(t[this.linkAttr]){const i=t[this.linkAttr],a=Array.isArray(i)?i[0]:i,e=await this.server.ldap.search({paged:!1,scope:"base"},a);if(0===e.searchEntries.length)throw new p(`Organization ${a} does not exist`);if(!new RegExp(`(.*,)?${this.config.ldap_top_organization}`).test(e.searchEntries[0].dn))throw new l(`Entry ${a} isn't in top organization branch`)}}async checkDeptPath(t){if(t[this.pathAttr]){const i=t[this.pathAttr],a=Array.isArray(i)?i[0]:i,e=this.config.ldap_organization_path_separator||" / ";let n=a;if(this.isOu(t)){const i=t.ou,r=Array.isArray(i)?i[0]:i;if(!a.startsWith(r+e))throw new l(`Organization path must start with its own name followed by separator "${e}"`);n=a.slice(r.length+e.length)}const[r,s]=n.split(e,2),o=await this.server.ldap.search({paged:!1,filter:`(ou=${r})`,scope:"sub"},this.config.ldap_top_organization);if(0===o.searchEntries.length)throw new l(`Invalid organization path ${a}`);if(s){let t=!1;for(const i of o.searchEntries){const a=i[this.pathAttr],e=Array.isArray(a)?a[0]:a;if(e&&e===s){t=!0;break}}if(!t)throw new l(`Invalid organization path ${a}: no matching entry for ${r} with path ${s}`)}else{let t=!1;for(const i of o.searchEntries){const a=i.dn,n=this.config.ldap_top_organization;if(a.toLowerCase()===n.toLowerCase()||a.toLowerCase().endsWith(`,${n.toLowerCase()}`)){const a=i[this.pathAttr],n=Array.isArray(a)?a[0]:a;if(!n||n===r||!n.includes(e)){t=!0;break}}}if(!t)throw new l(`Invalid organization path ${a}: no matching top-level entry for ${r}`)}}}async isEmptyOrganization(t){if((await this.server.ldap.search({paged:!1,filter:`(${this.config.ldap_organization_link_attribute}=${t})`})).searchEntries.length>0)throw new f(`Organization ${t} is not empty`)}isOu(t){if(!t.objectClass)return!1;const i=t.objectClass.map(t=>t.toLowerCase());return this.config.ldap_organization_class.filter(t=>"top"!==t.toLowerCase()).some(t=>i.includes(t.toLowerCase()))}async getOrganisationTop(t){if(!this.config.ldap_top_organization)throw new l("No top organization configured");const i=await this.server.ldap.search({paged:!1,scope:"base"},this.config.ldap_top_organization,t);if(1!==i.searchEntries.length)throw new p("Top organization not found");const[,a]=await d(this.registeredHooks.getOrganisationTop,[t,i.searchEntries[0]]);return a}async getOrganisationByDn(t,i){const a=await this.server.ldap.search({paged:!1,scope:"base",filter:"(objectClass=organizationalUnit)"},t,i);if(1!==a.searchEntries.length)throw new p(`Organization ${t} not found`);return a.searchEntries[0]}async getOrganisationSubnodes(t,i){const a=[],e=this.config.ldap_organization_max_subnodes||50,n=i?.query?.objectClass;if(!n||"organizationalUnit"===n)try{const e=await this.server.ldap.search({paged:!1,scope:"one",filter:"(objectClass=organizationalUnit)"},t,i);this.server.logger.debug(`Found ${e.searchEntries.length} sub-OUs for ${t}`),a.push(...e.searchEntries)}catch(i){this.server.logger.debug(`No sub-OUs found for ${t}: ${i}`)}const r=this.config.ldap_top_organization.replace(/^ou=[^,]+,/,"");let s=`(${this.config.ldap_organization_link_attribute}=${t})`;n&&(s=`(&${s}(objectClass=${n}))`),this.server.logger.debug(`Searching for linked entities with filter: ${s} in ${r}`);const o=await this.server.ldap.search({paged:!0,filter:s},r,i);let h=0,c=0;for await(const t of o){c+=t.searchEntries.length;const i=e-h;if(i>0){const e=t.searchEntries.slice(0,i);a.push(...e),h+=e.length}}return this.server.logger.debug(`Found ${c} linked entities for ${t}, returning ${h}`),c>e&&a.push({dn:`more-${t}`,cn:[`... ${c-e} more elements`],objectClass:["moreIndicator"],_isMoreIndicator:"true",_totalCount:c.toString(),_displayedCount:e.toString()}),a}async addOrganization(t,i,a){return this.validateNewOrganization(t,i),await this.server.ldap.add(t,i,a)}async modifyOrganization(t,i){return this.validateChanges(t,i),await this.server.ldap.modify(t,i)}validateNewOrganization(t,i){if(!this.schema)return!0;for(const[t,a]of Object.entries(i))if(!this._validateOneChange(t,a))throw new l(`Invalid value for field ${t}`);for(const[t,a]of Object.entries(this.schema.attributes))if(a.required&&null==i[t])throw new l(`Missing required field ${t}`);return!0}validateChanges(t,i){if(!this.schema)return!0;if(i.add)for(const[t,a]of Object.entries(i.add))if(!this._validateOneChange(t,a))throw new l(`Invalid value for field ${t}`);if(i.replace)for(const[t,a]of Object.entries(i.replace))if(!this._validateOneChange(t,a))throw new l(`Invalid value for field ${t}`);return!0}_validateOneChange(t,i){if(!this.schema)return!0;const a=this.schema.attributes[t];if(!a){if(this.schema.strict)throw new Error(`Field ${t} is not allowed`);return!0}if(null==i){if(a.required)throw new Error(`Field ${t} is required`);return!0}if(a.type)switch(a.type){case"string":if(Array.isArray(i))throw new Error(`Field ${t} must be a single value`);break;case"array":if(!Array.isArray(i))throw new Error(`Field ${t} must be an array`)}if(a.test){const e=Array.isArray(i)?i[0]:i;if(!("string"==typeof a.test?new RegExp(a.test):a.test).test(String(e)))throw new Error(`Field ${t} does not match required pattern`)}return!0}async moveOrganization(t,i,a){try{const t=await this.server.ldap.search({paged:!1,scope:"base"},i);if(!t.searchEntries||0===t.searchEntries.length)throw new Error(`Target organization ${i} not found`);if(!this.isOu(t.searchEntries[0]))throw new Error(`Target ${i} is not an organizational unit`)}catch(t){throw new Error(`Invalid target organization: ${t}`)}const e=`${t.split(",")[0]},${i}`;try{const i=await this.server.ldap.search({paged:!1,scope:"base"},t);if(!i.searchEntries||0===i.searchEntries.length)throw new Error(`Source organization ${t} not found`)}catch(t){throw new Error(`Source organization not found: ${t}`)}if(e===t)throw new Error("Cannot move organization to its current location");if(i===t||i.endsWith(`,${t}`))throw new Error("Cannot move organization into itself or its descendant");try{await this.server.ldap.rename(t,e,a),this.logger.info(`Moved organization from ${t} to ${e}`)}catch(t){throw new Error(`Failed to move organization: ${t}`)}return{newDn:e}}async deleteOrganization(t){return await this.server.ldap.delete(t)}async searchOrganisationSubnodes(t,i){const a=[],e=g(i);try{const n=await this.server.ldap.search({paged:!1,scope:"one",filter:`(&(objectClass=organizationalUnit)(|(ou=*${e}*)(description=*${e}*)))`},t);this.server.logger.debug(`Found ${n.searchEntries.length} sub-OUs matching "${i}" for ${t}`),a.push(...n.searchEntries)}catch(a){this.server.logger.debug(`No sub-OUs found matching "${i}" for ${t}: ${a}`)}const n=this.config.ldap_top_organization.replace(/^ou=[^,]+,/,""),r=g(t),s=`(&(${this.config.ldap_organization_link_attribute}=${r})(|(uid=*${e}*)(cn=*${e}*)(mail=*${e}*)(sn=*${e}*)(givenName=*${e}*)))`;this.server.logger.debug(`Searching for linked entities with filter: ${s} in ${n}`);const o=await this.server.ldap.search({paged:!0,filter:s},n);let h=0;for await(const t of o)h+=t.searchEntries.length,a.push(...t.searchEntries);return this.server.logger.debug(`Found ${h} linked entities matching "${i}" for ${t}`),a}getConfigApiData(){const t=this.config.api_prefix||"/api";let i;if(this.server.loadedPlugins.static&&this.config.organization_schema){const t=this.config.static_name||"static",a=this.config.organization_schema.indexOf("/schemas/");if(-1!==a){i=`/${t}${this.config.organization_schema.substring(a)}`}}return{enabled:!0,topOrganization:this.config.ldap_top_organization||"",organizationClass:this.config.ldap_organization_class||["top","organizationalUnit"],linkAttribute:this.linkAttr||"",pathAttribute:this.pathAttr||"",pathSeparator:this.config.ldap_organization_path_separator||" / ",maxSubnodes:this.config.ldap_organization_max_subnodes||50,schema:this.schema,schemaUrl:i,endpoints:{getTop:`${t}/v1/ldap/organizations`,get:`${t}/v1/ldap/organizations/:dn`,getSubnodes:`${t}/v1/ldap/organizations/:dn/subnodes`,searchSubnodes:`${t}/v1/ldap/organizations/:dn/subnodes/search`,create:`${t}/v1/ldap/organizations`,update:`${t}/v1/ldap/organizations/:dn`,move:`${t}/v1/ldap/organizations/:dn/move`,delete:`${t}/v1/ldap/organizations/:dn`}}}}export{LdapOrganizations as default};
+import a from"./organizations.js";console.warn("[ldap-rest] Plugin `core/ldap/organization` is deprecated; use `core/ldap/organizations` instead.");export{a as default};

package/dist/plugins/ldap/organizations.js

@@ -0,0 +1 @@
+import t from"fs";import i from"../../abstract/plugin.js";import{tryMethodData as a,jsonBody as e,tryMethod as n,wantJson as r}from"../../lib/expressFormatedResponses.js";import{transformSchemas as s,asyncHandler as o,validateDnValue as h,escapeDnValue as c,escapeLdapFilter as d,launchHooksChained as g,getParentDn as l,getRdn as p,isChildOf as f}from"../../lib/utils.js";import{BadRequestError as u,NotFoundError as w,ConflictError as $}from"../../lib/errors.js";class LdapOrganizations extends i{constructor(i){if(super(i),this.name="ldapOrganizations",this.roles=["api","consistency","configurable"],this.hooks={ldapaddrequest:async([t,i,a])=>(this.isOu(i)||await this.checkDeptLink(i),this.isOu(i)&&await this.checkDeptPath(i),void 0!==a?[t,i,a]:[t,i]),ldapmodifyrequest:async([t,i,a])=>{let e,n={},r={};const checkIsOu=async()=>{if(void 0!==e)return e;if(i.replace?.objectClass)e=this.isOu({objectClass:i.replace.objectClass});else if(i.add?.objectClass)e=this.isOu({objectClass:i.add.objectClass});else{const i=await this.server.ldap.search({paged:!1,scope:"base"},t);e=i.searchEntries.length>0&&this.isOu(i.searchEntries[0])}return e};if(i.delete){const t=Array.isArray(i.delete)?i.delete.includes(this.linkAttr):i.delete[this.linkAttr],a=Array.isArray(i.delete)?i.delete.includes(this.pathAttr):i.delete[this.pathAttr];if(t||a){if(!await checkIsOu()&&t)throw new u("An organization link cannot be deleted");if(a)throw new u("An organization path cannot be deleted")}}if(i.replace&&(i.replace[this.linkAttr]&&(n={...i.replace}),i.replace[this.pathAttr]&&(r={...i.replace})),i.add&&(i.add[this.linkAttr]&&(n={...n,...i.add}),i.add[this.pathAttr]&&(r={...r,...i.add})),Object.keys(n).length>0){await checkIsOu()||await this.checkDeptLink(n)}if(Object.keys(r).length>0){await checkIsOu()&&await this.checkDeptPath(r)}return[t,i,a]},ldapdeleterequest:async([t])=>(/^ou=/.test(t)&&await this.isEmptyOrganization(t),[t]),ldaprenamerequest:([t,i])=>[t,i]},!this.config.ldap_top_organization)throw new Error("Missing --ldap-top-organization");this.pathAttr=this.config.ldap_organization_path_attribute,this.linkAttr=this.config.ldap_organization_link_attribute,this.config.organization_schema&&t.readFile(this.config.organization_schema,(t,i)=>{if(t)this.logger.error(`Failed to load organization schema from ${this.config.organization_schema}: ${t}`);else try{this.schema=JSON.parse(s(i.toString(),this.config)),this.logger.debug("Organization schema loaded")}catch(t){this.logger.error(`Failed to parse organization schema: ${t}`)}})}api(t){t.get(`${this.config.api_prefix}/v1/ldap/organizations/top`,async(t,i)=>{await a(i,this.getOrganisationTop.bind(this),t)}),t.get(`${this.config.api_prefix}/v1/ldap/organizations/:dn`,async(t,i)=>{const e=decodeURIComponent(t.params.dn);await a(i,this.getOrganisationByDn.bind(this),e,t)}),t.get(`${this.config.api_prefix}/v1/ldap/organizations/:dn/subnodes`,async(t,i)=>{const e=decodeURIComponent(t.params.dn);await a(i,this.getOrganisationSubnodes.bind(this),e,t)}),t.get(`${this.config.api_prefix}/v1/ldap/organizations/:dn/subnodes/search`,o(async(t,i)=>{const e=decodeURIComponent(t.params.dn),n=t.query.q;if(!n)throw new u('query parameter "q" is required');await a(i,this.searchOrganisationSubnodes.bind(this),e,n)})),t.post(`${this.config.api_prefix}/v1/ldap/organizations`,o(async(t,i)=>this.apiAdd(t,i))),t.put(`${this.config.api_prefix}/v1/ldap/organizations/:dn`,o(async(t,i)=>this.apiModify(t,i))),t.delete(`${this.config.api_prefix}/v1/ldap/organizations/:dn`,o(async(t,i)=>this.apiDelete(t,i))),t.post(`${this.config.api_prefix}/v1/ldap/organizations/:dn/move`,o(async(t,i)=>this.apiMove(t,i)))}async apiAdd(t,i){const a=e(t,i,"ou");if(!a)return;h(a.ou,"ou");const r=a.parentDn||this.config.ldap_top_organization,s=`ou=${c(a.ou)},${r}`,o={objectClass:this.config.ldap_organization_class,ou:a.ou,...Object.fromEntries(Object.entries(a).filter(([t])=>"ou"!==t&&"parentDn"!==t))};await n(i,this.addOrganization.bind(this),s,o,t)}async apiModify(t,i){const a=e(t,i);if(!a)return;const r=decodeURIComponent(t.params.dn);if(!r)throw new u("dn is required");await n(i,this.modifyOrganization.bind(this),r,a)}async apiDelete(t,i){if(!r(t,i))return;const a=decodeURIComponent(t.params.dn);if(!a)throw new u("dn is required");await n(i,this.deleteOrganization.bind(this),a)}async apiMove(t,i){if(!r(t,i))return;const n=e(t,i,"targetOrgDn");if(!n)return;const s=decodeURIComponent(t.params.dn);if(!s)throw new u("dn is required");const{targetOrgDn:o}=n;if(!o||"string"!=typeof o)throw new u("Missing or invalid targetOrgDn in request body");await a(i,this.moveOrganization.bind(this),s,o,t)}async checkDeptLink(t){if(t[this.linkAttr]){const i=t[this.linkAttr],a=Array.isArray(i)?i[0]:i,e=await this.server.ldap.search({paged:!1,scope:"base"},a);if(0===e.searchEntries.length)throw new w(`Organization ${a} does not exist`);if(!new RegExp(`(.*,)?${this.config.ldap_top_organization}`).test(e.searchEntries[0].dn))throw new u(`Entry ${a} isn't in top organization branch`)}}async checkDeptPath(t){if(t[this.pathAttr]){const i=t[this.pathAttr],a=Array.isArray(i)?i[0]:i,e=this.config.ldap_organization_path_separator||" / ";let n=a;if(this.isOu(t)){const i=t.ou,r=Array.isArray(i)?i[0]:i;if(!a.startsWith(r+e))throw new u(`Organization path must start with its own name followed by separator "${e}"`);n=a.slice(r.length+e.length)}const[r,s]=n.split(e,2),o=await this.server.ldap.search({paged:!1,filter:`(ou=${d(r)})`,scope:"sub"},this.config.ldap_top_organization);if(0===o.searchEntries.length)throw new u(`Invalid organization path ${a}`);if(s){let t=!1;for(const i of o.searchEntries){const a=i[this.pathAttr],e=Array.isArray(a)?a[0]:a;if(e&&e===s){t=!0;break}}if(!t)throw new u(`Invalid organization path ${a}: no matching entry for ${r} with path ${s}`)}else{let t=!1;for(const i of o.searchEntries){const a=i.dn,n=this.config.ldap_top_organization;if(a.toLowerCase()===n.toLowerCase()||a.toLowerCase().endsWith(`,${n.toLowerCase()}`)){const a=i[this.pathAttr],n=Array.isArray(a)?a[0]:a;if(!n||n===r||!n.includes(e)){t=!0;break}}}if(!t)throw new u(`Invalid organization path ${a}: no matching top-level entry for ${r}`)}}}async isEmptyOrganization(t){if((await this.server.ldap.search({paged:!1,filter:`(${this.config.ldap_organization_link_attribute}=${t})`})).searchEntries.length>0)throw new $(`Organization ${t} is not empty`)}isOu(t){if(!t.objectClass)return!1;const i=t.objectClass.map(t=>t.toLowerCase());return this.config.ldap_organization_class.filter(t=>"top"!==t.toLowerCase()).some(t=>i.includes(t.toLowerCase()))}async getOrganisationTop(t){if(!this.config.ldap_top_organization)throw new u("No top organization configured");const i=await this.server.ldap.search({paged:!1,scope:"base"},this.config.ldap_top_organization,t);if(1!==i.searchEntries.length)throw new w("Top organization not found");const[,a]=await g(this.registeredHooks.getOrganisationTop,[t,i.searchEntries[0]]);return a}async getOrganisationByDn(t,i){const a=await this.server.ldap.search({paged:!1,scope:"base",filter:"(objectClass=organizationalUnit)"},t,i);if(1!==a.searchEntries.length)throw new w(`Organization ${t} not found`);return a.searchEntries[0]}async getOrganisationSubnodes(t,i){const a=[],e=this.config.ldap_organization_max_subnodes||50,n=i?.query?.objectClass;if(!n||"organizationalUnit"===n)try{const e=await this.server.ldap.search({paged:!1,scope:"one",filter:"(objectClass=organizationalUnit)"},t,i);this.server.logger.debug(`Found ${e.searchEntries.length} sub-OUs for ${t}`),a.push(...e.searchEntries)}catch(i){this.server.logger.debug(`No sub-OUs found for ${t}: ${i}`)}const r=this.config.ldap_top_organization,s=l(r);let o=`(${this.config.ldap_organization_link_attribute}=${d(t)})`;n&&(o=`(&${o}(objectClass=${d(n)}))`),this.server.logger.debug(`Searching for linked entities with filter: ${o} in ${s}`);const h=await this.server.ldap.search({paged:!0,filter:o},s,i);let c=0,g=0;for await(const t of h){g+=t.searchEntries.length;const i=e-c;if(i>0){const e=t.searchEntries.slice(0,i);a.push(...e),c+=e.length}}return this.server.logger.debug(`Found ${g} linked entities for ${t}, returning ${c}`),g>e&&a.push({dn:`more-${t}`,cn:[`... ${g-e} more elements`],objectClass:["moreIndicator"],_isMoreIndicator:"true",_totalCount:g.toString(),_displayedCount:e.toString()}),a}async addOrganization(t,i,a){return this.validateNewOrganization(t,i),await this.server.ldap.add(t,i,a)}async modifyOrganization(t,i){return this.validateChanges(t,i),await this.server.ldap.modify(t,i)}validateNewOrganization(t,i){if(!this.schema)return!0;for(const[t,a]of Object.entries(i))if(!this._validateOneChange(t,a))throw new u(`Invalid value for field ${t}`);for(const[t,a]of Object.entries(this.schema.attributes))if(a.required&&null==i[t])throw new u(`Missing required field ${t}`);return!0}validateChanges(t,i){if(!this.schema)return!0;if(i.add)for(const[t,a]of Object.entries(i.add))if(!this._validateOneChange(t,a))throw new u(`Invalid value for field ${t}`);if(i.replace)for(const[t,a]of Object.entries(i.replace))if(!this._validateOneChange(t,a))throw new u(`Invalid value for field ${t}`);return!0}_validateOneChange(t,i){if(!this.schema)return!0;const a=this.schema.attributes[t];if(!a){if(this.schema.strict)throw new Error(`Field ${t} is not allowed`);return!0}if(null==i){if(a.required)throw new Error(`Field ${t} is required`);return!0}if(a.type)switch(a.type){case"string":if(Array.isArray(i))throw new Error(`Field ${t} must be a single value`);break;case"array":if(!Array.isArray(i))throw new Error(`Field ${t} must be an array`)}if(a.test){const e=Array.isArray(i)?i[0]:i;if(!("string"==typeof a.test?new RegExp(a.test):a.test).test(String(e)))throw new Error(`Field ${t} does not match required pattern`)}return!0}async moveOrganization(t,i,a){let e;try{e=await this.server.ldap.search({paged:!1,scope:"base"},i)}catch(t){throw new w(`Target organization ${i} not found: ${t}`)}if(!e.searchEntries||0===e.searchEntries.length)throw new w(`Target organization ${i} not found`);if(!this.isOu(e.searchEntries[0]))throw new u(`Target ${i} is not an organizational unit`);const n=`${p(t)},${i}`;let r;try{r=await this.server.ldap.search({paged:!1,scope:"base"},t)}catch(t){throw new w(`Source organization not found: ${t}`)}if(!r.searchEntries||0===r.searchEntries.length)throw new w(`Source organization ${t} not found`);if(n===t)throw new u("Cannot move organization to its current location");if(i.toLowerCase()===t.toLowerCase()||f(i,t))throw new u("Cannot move organization into itself or its descendant");try{await this.server.ldap.rename(t,n,a),this.logger.info(`Moved organization from ${t} to ${n}`)}catch(t){throw new Error(`Failed to move organization: ${t}`)}return{newDn:n}}async deleteOrganization(t){return await this.server.ldap.delete(t)}async searchOrganisationSubnodes(t,i){const a=[],e=d(i);try{const n=await this.server.ldap.search({paged:!1,scope:"one",filter:`(&(objectClass=organizationalUnit)(|(ou=*${e}*)(description=*${e}*)))`},t);this.server.logger.debug(`Found ${n.searchEntries.length} sub-OUs matching "${i}" for ${t}`),a.push(...n.searchEntries)}catch(a){this.server.logger.debug(`No sub-OUs found matching "${i}" for ${t}: ${a}`)}const n=this.config.ldap_top_organization,r=l(n),s=d(t),o=`(&(${this.config.ldap_organization_link_attribute}=${s})(|(uid=*${e}*)(cn=*${e}*)(mail=*${e}*)(sn=*${e}*)(givenName=*${e}*)))`;this.server.logger.debug(`Searching for linked entities with filter: ${o} in ${r}`);const h=await this.server.ldap.search({paged:!0,filter:o},r);let c=0;for await(const t of h)c+=t.searchEntries.length,a.push(...t.searchEntries);return this.server.logger.debug(`Found ${c} linked entities matching "${i}" for ${t}`),a}getConfigApiData(){const t=this.config.api_prefix||"/api";let i;if(this.server.loadedPlugins.static&&this.config.organization_schema){const t=this.config.static_name||"static",a=this.config.organization_schema.indexOf("/schemas/");if(-1!==a){i=`/${t}${this.config.organization_schema.substring(a)}`}}return{enabled:!0,topOrganization:this.config.ldap_top_organization||"",organizationClass:this.config.ldap_organization_class||["top","organizationalUnit"],linkAttribute:this.linkAttr||"",pathAttribute:this.pathAttr||"",pathSeparator:this.config.ldap_organization_path_separator||" / ",maxSubnodes:this.config.ldap_organization_max_subnodes||50,schema:this.schema,schemaUrl:i,endpoints:{getTop:`${t}/v1/ldap/organizations/top`,get:`${t}/v1/ldap/organizations/:dn`,getSubnodes:`${t}/v1/ldap/organizations/:dn/subnodes`,searchSubnodes:`${t}/v1/ldap/organizations/:dn/subnodes/search`,create:`${t}/v1/ldap/organizations`,update:`${t}/v1/ldap/organizations/:dn`,move:`${t}/v1/ldap/organizations/:dn/move`,delete:`${t}/v1/ldap/organizations/:dn`}}}}export{LdapOrganizations as default};

package/dist/src/abstract/ldapFlat.d.ts

@@ -38,6 +38,113 @@ export interface LdapFlatConfig {
      */
     hookPrefix: string;
 }
+/**
+ * Generic OpenAPI schemas for the flat LDAP-entry CRUD surface.
+ * Every concrete plugin that extends LdapFlat (users, mailgroups, …)
+ * exposes these shapes, with `mainAttribute` and concrete attribute
+ * names varying per instance.
+ *
+ * @openapi-component
+ * FlatEntry:
+ *   type: object
+ *   description: |
+ *     A single LDAP entry from a flat branch. The `dn` field is always
+ *     present; all other fields depend on the concrete plugin's schema
+ *     (e.g. `uid`, `cn`, `mail`, `sn` for users).
+ *   required: [dn]
+ *   properties:
+ *     dn:
+ *       type: string
+ *       description: Fully-qualified distinguished name of the entry.
+ *       example: uid=alice,ou=users,dc=example,dc=com
+ *   additionalProperties:
+ *     oneOf:
+ *       - type: string
+ *       - type: array
+ *         items: { type: string }
+ *   example:
+ *     dn: uid=alice,ou=users,dc=example,dc=com
+ *     uid: alice
+ *     cn: Alice Smith
+ *     sn: Smith
+ *     mail: alice@example.com
+ * FlatList:
+ *   type: object
+ *   description: |
+ *     A map of entries returned by the LIST endpoint, keyed by the
+ *     entry's `mainAttribute` value (e.g. the `uid` for users). This
+ *     is the `LdapList` shape (`Record<string, FlatEntry>`).
+ *   additionalProperties:
+ *     $ref: '#/components/schemas/FlatEntry'
+ *   example:
+ *     alice:
+ *       dn: uid=alice,ou=users,dc=example,dc=com
+ *       uid: alice
+ *       cn: Alice Smith
+ *       mail: alice@example.com
+ *     bob:
+ *       dn: uid=bob,ou=users,dc=example,dc=com
+ *       uid: bob
+ *       cn: Bob Jones
+ *       mail: bob@example.com
+ * FlatCreate:
+ *   type: object
+ *   description: |
+ *     Body for creating a new entry. The plugin's `mainAttribute` field
+ *     (e.g. `uid`) is required and used to build the DN. All other
+ *     attributes are plugin-specific; unknown attributes are accepted
+ *     unless the plugin's schema is in strict mode.
+ *   additionalProperties: true
+ *   example:
+ *     uid: carol
+ *     cn: Carol White
+ *     sn: White
+ *     mail: carol@example.com
+ * FlatModify:
+ *   type: object
+ *   description: |
+ *     Partial-update body. Supports `add`, `replace`, and `delete`
+ *     maps matching the LDAP modify operation. The `mainAttribute`
+ *     (e.g. `uid`) cannot be changed through this endpoint — use the
+ *     rename API instead.
+ *   properties:
+ *     add:
+ *       type: object
+ *       description: Attributes whose values are appended.
+ *       additionalProperties: true
+ *     replace:
+ *       type: object
+ *       description: Attributes whose values are replaced wholesale.
+ *       additionalProperties: true
+ *     delete:
+ *       description: |
+ *         Attributes (or specific values) to remove. Either an array
+ *         of attribute names or a map of attribute → value(s).
+ *       oneOf:
+ *         - type: array
+ *           items: { type: string }
+ *         - type: object
+ *           additionalProperties: true
+ *   example:
+ *     replace:
+ *       mail: carol.white@example.com
+ *       cn: Carol White-Smith
+ * FlatMoveRequest:
+ *   type: object
+ *   description: |
+ *     Body for moving an entry to a different organisational unit.
+ *     Requires `ldap_organization_link_attribute` and
+ *     `ldap_organization_path_attribute` to be defined in the plugin's
+ *     schema.
+ *   required: [targetOrgDn]
+ *   properties:
+ *     targetOrgDn:
+ *       type: string
+ *       description: DN of the destination organisational unit.
+ *       example: ou=engineering,ou=departments,dc=example,dc=com
+ *   example:
+ *     targetOrgDn: ou=engineering,ou=departments,dc=example,dc=com
+ */
 export default abstract class LdapFlat extends DmPlugin {
     base: string;
     ldap: ldapActions;

package/dist/src/plugins/configApi.d.ts

@@ -10,6 +10,57 @@
  */
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../abstract/plugin';
+/**
+ * @openapi-component
+ * Config:
+ *   type: object
+ *   description: |
+ *     Aggregated server configuration. The top-level fields are always
+ *     present; `features` is a dynamic map whose keys are the names of
+ *     loaded plugins that declare the `configurable` role.  Each plugin
+ *     contributes an arbitrary sub-object — consult the individual plugin
+ *     documentation for its exact shape.
+ *   additionalProperties: true
+ *   properties:
+ *     apiPrefix:
+ *       type: string
+ *       description: The API base path configured on this server.
+ *       example: /api
+ *     ldapBase:
+ *       type: string
+ *       description: The root LDAP suffix used by this server.
+ *       example: dc=example,dc=com
+ *     features:
+ *       type: object
+ *       description: |
+ *         Per-plugin configuration blocks.  Keys match the plugin's
+ *         `name` field; values are plugin-specific objects.
+ *       additionalProperties: true
+ *       example:
+ *         ldapGroups:
+ *           enabled: true
+ *           base: ou=groups,dc=example,dc=com
+ *           mainAttribute: cn
+ *           objectClass: [top, groupOfNames]
+ *         static:
+ *           enabled: true
+ *           staticPath: /static
+ *         appAccountsApi:
+ *           enabled: true
+ *           base: ou=app-accounts,dc=example,dc=com
+ *           maxAccounts: 5
+ *   example:
+ *     apiPrefix: /api
+ *     ldapBase: dc=example,dc=com
+ *     features:
+ *       ldapGroups:
+ *         enabled: true
+ *         base: ou=groups,dc=example,dc=com
+ *         mainAttribute: cn
+ *       static:
+ *         enabled: true
+ *         staticPath: /static
+ */
 export default class ConfigApi extends DmPlugin {
     name: string;
     roles: Role[];

package/dist/src/plugins/demo/helloworld.d.ts

@@ -5,6 +5,27 @@
  */
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
+/**
+ * @openapi-component
+ * Hello:
+ *   type: object
+ *   description: Response returned by the hello-world demo endpoint.
+ *   properties:
+ *     message:
+ *       type: string
+ *       description: Static greeting string.
+ *       example: Hello
+ *     hookResults:
+ *       type: array
+ *       description: |
+ *         Results collected from every function registered on the `hello`
+ *         hook.  Empty when no hook listeners are installed.
+ *       items: {}
+ *       example: []
+ *   example:
+ *     message: Hello
+ *     hookResults: []
+ */
 export default class HelloWorld extends DmPlugin {
     name: string;
     roles: Role[];

package/dist/src/plugins/ldap/bulkImport.d.ts

@@ -6,6 +6,71 @@
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 import type { DM } from '../../bin';
+/**
+ * Shared OpenAPI schemas surfaced by this plugin. Picked up by
+ * scripts/generate-openapi.ts and merged into `components.schemas`.
+ *
+ * @openapi-component
+ * BulkImportResult:
+ *   type: object
+ *   description: Summary returned after a bulk import operation.
+ *   required: [success, total, created, updated, skipped, failed, errors, details]
+ *   properties:
+ *     success:
+ *       type: boolean
+ *       description: True when no fatal error aborted the import early.
+ *     total:
+ *       type: integer
+ *       description: Total number of CSV data rows (excluding header).
+ *       example: 42
+ *     created:
+ *       type: integer
+ *       description: Entries successfully created (or counted in dry-run).
+ *       example: 38
+ *     updated:
+ *       type: integer
+ *       description: Existing entries updated.
+ *       example: 2
+ *     skipped:
+ *       type: integer
+ *       description: Existing entries skipped because `updateExisting` was false.
+ *       example: 1
+ *     failed:
+ *       type: integer
+ *       description: Rows that caused an error.
+ *       example: 1
+ *     errors:
+ *       type: array
+ *       items:
+ *         type: object
+ *         required: [line, error]
+ *         properties:
+ *           line:
+ *             type: integer
+ *             description: 1-based CSV line number (2 = first data row).
+ *           identifier:
+ *             type: string
+ *             description: Value of the main attribute for the failing row (if known).
+ *           error:
+ *             type: string
+ *             description: Error message.
+ *       example:
+ *         - line: 5
+ *           identifier: bob
+ *           error: 'Missing required attribute: mail'
+ *     details:
+ *       type: object
+ *       required: [duration, linesProcessed]
+ *       properties:
+ *         duration:
+ *           type: string
+ *           description: Wall-clock time for the import (e.g. `1.2s`).
+ *           example: 1.2s
+ *         linesProcessed:
+ *           type: integer
+ *           description: Total data rows attempted.
+ *           example: 42
+ */
 export default class LdapBulkImport extends DmPlugin {
     name: string;
     roles: Role[];

package/dist/src/plugins/ldap/groups.d.ts

@@ -10,6 +10,74 @@ export interface postAdd {
     [key: string]: AttributeValue | undefined;
 }
 export type postModify = ModifyRequest;
+/**
+ * Shared OpenAPI schemas surfaced by this plugin. Picked up by
+ * scripts/generate-openapi.ts and merged into `components.schemas`.
+ *
+ * @openapi-component
+ * Group:
+ *   type: object
+ *   description: An LDAP group entry (groupOfNames / groupOfUniqueNames).
+ *   required: [dn, cn]
+ *   properties:
+ *     dn:
+ *       type: string
+ *       description: Fully-qualified distinguished name of the entry.
+ *       example: cn=admins,ou=groups,dc=example,dc=com
+ *     cn:
+ *       type: string
+ *       description: Common name (RDN attribute) of the group.
+ *       example: admins
+ *     description:
+ *       type: string
+ *       example: Server administrators
+ *     member:
+ *       type: array
+ *       items: { type: string }
+ *       description: DNs of the group's members.
+ *       example:
+ *         - uid=alice,ou=users,dc=example,dc=com
+ *         - uid=bob,ou=users,dc=example,dc=com
+ * GroupCreate:
+ *   type: object
+ *   required: [cn]
+ *   properties:
+ *     cn:
+ *       type: string
+ *       description: Common name of the new group.
+ *     description:
+ *       type: string
+ *     member:
+ *       type: array
+ *       items: { type: string }
+ *       description: Initial members (DNs).
+ *   example:
+ *     cn: admins
+ *     description: Server administrators
+ *     member:
+ *       - uid=alice,ou=users,dc=example,dc=com
+ * GroupModify:
+ *   type: object
+ *   description: |
+ *     Partial update. Each provided attribute is replaced wholesale. Use
+ *     the dedicated `/members` endpoints to add/remove members one at a
+ *     time without supplying the full list.
+ *   properties:
+ *     description: { type: string }
+ *     member:
+ *       type: array
+ *       items: { type: string }
+ *   example:
+ *     description: Updated description
+ * Error:
+ *   type: object
+ *   properties:
+ *     error: { type: string }
+ *     code: { type: integer }
+ *   example:
+ *     error: Group not found
+ *     code: 404
+ */
 export default class LdapGroups extends DmPlugin {
     name: string;
     roles: Role[];

package/dist/src/plugins/ldap/organization.d.ts

@@ -1,65 +1,8 @@
-import type { Express, Request, Response } from 'express';
-import DmPlugin, { type Role } from '../../abstract/plugin';
-import { DM } from '../../bin';
-import { Hooks } from '../../hooks';
-import { AttributesList, AttributeValue, ModifyRequest } from '../../lib/ldapActions';
-import type { Schema } from '../../config/schema';
-export default class LdapOrganizations extends DmPlugin {
-    name: string;
-    roles: Role[];
-    pathAttr: string;
-    linkAttr: string;
-    schema?: Schema;
-    constructor(dm: DM);
-    /**
-     * API routes for LDAP organizations
-     * @param app Express application
-     */
-    api(app: Express): void;
-    apiAdd(req: Request, res: Response): Promise<void>;
-    apiModify(req: Request, res: Response): Promise<void>;
-    apiDelete(req: Request, res: Response): Promise<void>;
-    apiMove(req: Request, res: Response): Promise<void>;
-    /**
-     * Consistency checks on any entry
-     */
-    hooks: Hooks;
-    /**
-     * Check if the department link is valid
-     * @param entry LDAP entry to check
-     */
-    checkDeptLink(entry: AttributesList): Promise<void>;
-    /**
-     * Check if the department path is valid
-     * @param entry LDAP entry to check
-     */
-    checkDeptPath(entry: AttributesList): Promise<void>;
-    isEmptyOrganization(dn: string): Promise<void>;
-    /**
-     * Check if entry is an organisation
-     * @param entry LDAP entry to check
-     * @returns True if entry is an organisation, false otherwise
-     */
-    isOu(entry: AttributesList): boolean;
-    getOrganisationTop(req?: Request): Promise<AttributesList | AttributesList[]>;
-    getOrganisationByDn(dn: string, req?: Request): Promise<AttributesList>;
-    getOrganisationSubnodes(dn: string, req?: Request): Promise<AttributesList[]>;
-    addOrganization(dn: string, entry: AttributesList, req?: Request): Promise<boolean>;
-    modifyOrganization(dn: string, changes: ModifyRequest): Promise<boolean>;
-    validateNewOrganization(dn: string, entry: AttributesList): boolean;
-    validateChanges(dn: string, changes: ModifyRequest): boolean;
-    _validateOneChange(field: string, value: AttributeValue | null): boolean;
-    /**
-     * Move an organization to a different parent organization
-     * Uses LDAP modifyDN to change the DN hierarchy
-     */
-    moveOrganization(dn: string, targetOrgDn: string, req?: Request): Promise<{
-        newDn: string;
-    }>;
-    deleteOrganization(dn: string): Promise<boolean>;
-    searchOrganisationSubnodes(dn: string, query: string): Promise<AttributesList[]>;
-    /**
-     * Provide configuration for config API
-     */
-    getConfigApiData(): Record<string, unknown>;
-}
+/**
+ * @deprecated Use `core/ldap/organizations` instead. This file is a
+ * backwards-compatibility shim for setups that still load the plugin under
+ * the historical (singular) filename. It will be removed in a future major
+ * release.
+ */
+import LdapOrganizations from './organizations';
+export default LdapOrganizations;

package/dist/src/plugins/ldap/organizations.d.ts

@@ -0,0 +1,155 @@
+import type { Express, Request, Response } from 'express';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+import { DM } from '../../bin';
+import { Hooks } from '../../hooks';
+import { AttributesList, AttributeValue, ModifyRequest } from '../../lib/ldapActions';
+import type { Schema } from '../../config/schema';
+/**
+ * Shared OpenAPI schemas surfaced by this plugin. Picked up by
+ * scripts/generate-openapi.ts and merged into `components.schemas`.
+ *
+ * @openapi-component
+ * Organization:
+ *   type: object
+ *   description: An LDAP organizational unit entry.
+ *   required: [dn, ou]
+ *   properties:
+ *     dn:
+ *       type: string
+ *       description: Fully-qualified distinguished name of the entry.
+ *       example: ou=Engineering,ou=organizations,dc=example,dc=com
+ *     ou:
+ *       type: string
+ *       description: Organizational unit name (RDN attribute).
+ *       example: Engineering
+ *     o:
+ *       type: string
+ *       description: Organization display name.
+ *       example: Engineering Department
+ *     l:
+ *       type: string
+ *       description: Locality / city.
+ *       example: Paris
+ *     description:
+ *       type: string
+ *       example: Software engineering division
+ *     organizationLink:
+ *       type: string
+ *       description: DN of the parent organization (link attribute).
+ *       example: ou=organizations,dc=example,dc=com
+ *     organizationPath:
+ *       type: string
+ *       description: |
+ *         Human-readable slash-separated path to this node, used by the
+ *         UI tree. Set automatically on creation and move.
+ *       example: Engineering / Backend
+ *     member:
+ *       type: array
+ *       items: { type: string }
+ *       description: DNs of entries linked to this organization.
+ *       example:
+ *         - uid=alice,ou=users,dc=example,dc=com
+ * OrgSummary:
+ *   type: object
+ *   description: Lightweight organization reference (used in node lists).
+ *   required: [dn, ou]
+ *   properties:
+ *     dn: { type: string, example: ou=HR,ou=organizations,dc=example,dc=com }
+ *     ou: { type: string, example: HR }
+ *     description: { type: string }
+ *     objectClass:
+ *       type: array
+ *       items: { type: string }
+ *       example: [top, organizationalUnit]
+ * OrganizationCreate:
+ *   type: object
+ *   required: [ou]
+ *   properties:
+ *     ou:
+ *       type: string
+ *       description: Name of the new organizational unit.
+ *       example: Marketing
+ *     parentDn:
+ *       type: string
+ *       description: |
+ *         DN of the parent organizational unit. Defaults to the configured
+ *         top organization when omitted.
+ *       example: ou=organizations,dc=example,dc=com
+ *     description: { type: string }
+ *     l: { type: string }
+ *   example:
+ *     ou: Marketing
+ *     parentDn: ou=organizations,dc=example,dc=com
+ *     description: Marketing division
+ * OrganizationModify:
+ *   type: object
+ *   description: |
+ *     Partial update. Any provided attribute is replaced wholesale.
+ *     `ou` cannot be changed via this endpoint — use the move endpoint
+ *     to relocate the node within the tree.
+ *   properties:
+ *     description: { type: string }
+ *     l: { type: string }
+ *     o: { type: string }
+ *   example:
+ *     description: Updated description for Marketing
+ */
+export default class LdapOrganizations extends DmPlugin {
+    name: string;
+    roles: Role[];
+    pathAttr: string;
+    linkAttr: string;
+    schema?: Schema;
+    constructor(dm: DM);
+    /**
+     * API routes for LDAP organizations
+     * @param app Express application
+     */
+    api(app: Express): void;
+    apiAdd(req: Request, res: Response): Promise<void>;
+    apiModify(req: Request, res: Response): Promise<void>;
+    apiDelete(req: Request, res: Response): Promise<void>;
+    apiMove(req: Request, res: Response): Promise<void>;
+    /**
+     * Consistency checks on any entry
+     */
+    hooks: Hooks;
+    /**
+     * Check if the department link is valid
+     * @param entry LDAP entry to check
+     */
+    checkDeptLink(entry: AttributesList): Promise<void>;
+    /**
+     * Check if the department path is valid
+     * @param entry LDAP entry to check
+     */
+    checkDeptPath(entry: AttributesList): Promise<void>;
+    isEmptyOrganization(dn: string): Promise<void>;
+    /**
+     * Check if entry is an organisation
+     * @param entry LDAP entry to check
+     * @returns True if entry is an organisation, false otherwise
+     */
+    isOu(entry: AttributesList): boolean;
+    getOrganisationTop(req?: Request): Promise<AttributesList | AttributesList[]>;
+    getOrganisationByDn(dn: string, req?: Request): Promise<AttributesList>;
+    getOrganisationSubnodes(dn: string, req?: Request): Promise<AttributesList[]>;
+    addOrganization(dn: string, entry: AttributesList, req?: Request): Promise<boolean>;
+    modifyOrganization(dn: string, changes: ModifyRequest): Promise<boolean>;
+    validateNewOrganization(dn: string, entry: AttributesList): boolean;
+    validateChanges(dn: string, changes: ModifyRequest): boolean;
+    _validateOneChange(field: string, value: AttributeValue | null): boolean;
+    /**
+     * Move an organization to a different parent organization
+     * Uses LDAP modifyDN to change the DN hierarchy
+     */
+    moveOrganization(dn: string, targetOrgDn: string, req?: Request): Promise<{
+        newDn: string;
+    }>;
+    deleteOrganization(dn: string): Promise<boolean>;
+    searchOrganisationSubnodes(dn: string, query: string): Promise<AttributesList[]>;
+    /**
+     * Provide configuration for config API
+     */
+    getConfigApiData(): Record<string, unknown>;
+}