ldap-rest 0.3.0 → 0.3.2

package/dist/src/plugins/ldap/organizations.d.ts

@@ -0,0 +1,155 @@
+import type { Express, Request, Response } from 'express';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+import { DM } from '../../bin';
+import { Hooks } from '../../hooks';
+import { AttributesList, AttributeValue, ModifyRequest } from '../../lib/ldapActions';
+import type { Schema } from '../../config/schema';
+/**
+ * Shared OpenAPI schemas surfaced by this plugin. Picked up by
+ * scripts/generate-openapi.ts and merged into `components.schemas`.
+ *
+ * @openapi-component
+ * Organization:
+ *   type: object
+ *   description: An LDAP organizational unit entry.
+ *   required: [dn, ou]
+ *   properties:
+ *     dn:
+ *       type: string
+ *       description: Fully-qualified distinguished name of the entry.
+ *       example: ou=Engineering,ou=organizations,dc=example,dc=com
+ *     ou:
+ *       type: string
+ *       description: Organizational unit name (RDN attribute).
+ *       example: Engineering
+ *     o:
+ *       type: string
+ *       description: Organization display name.
+ *       example: Engineering Department
+ *     l:
+ *       type: string
+ *       description: Locality / city.
+ *       example: Paris
+ *     description:
+ *       type: string
+ *       example: Software engineering division
+ *     organizationLink:
+ *       type: string
+ *       description: DN of the parent organization (link attribute).
+ *       example: ou=organizations,dc=example,dc=com
+ *     organizationPath:
+ *       type: string
+ *       description: |
+ *         Human-readable slash-separated path to this node, used by the
+ *         UI tree. Set automatically on creation and move.
+ *       example: Engineering / Backend
+ *     member:
+ *       type: array
+ *       items: { type: string }
+ *       description: DNs of entries linked to this organization.
+ *       example:
+ *         - uid=alice,ou=users,dc=example,dc=com
+ * OrgSummary:
+ *   type: object
+ *   description: Lightweight organization reference (used in node lists).
+ *   required: [dn, ou]
+ *   properties:
+ *     dn: { type: string, example: ou=HR,ou=organizations,dc=example,dc=com }
+ *     ou: { type: string, example: HR }
+ *     description: { type: string }
+ *     objectClass:
+ *       type: array
+ *       items: { type: string }
+ *       example: [top, organizationalUnit]
+ * OrganizationCreate:
+ *   type: object
+ *   required: [ou]
+ *   properties:
+ *     ou:
+ *       type: string
+ *       description: Name of the new organizational unit.
+ *       example: Marketing
+ *     parentDn:
+ *       type: string
+ *       description: |
+ *         DN of the parent organizational unit. Defaults to the configured
+ *         top organization when omitted.
+ *       example: ou=organizations,dc=example,dc=com
+ *     description: { type: string }
+ *     l: { type: string }
+ *   example:
+ *     ou: Marketing
+ *     parentDn: ou=organizations,dc=example,dc=com
+ *     description: Marketing division
+ * OrganizationModify:
+ *   type: object
+ *   description: |
+ *     Partial update. Any provided attribute is replaced wholesale.
+ *     `ou` cannot be changed via this endpoint — use the move endpoint
+ *     to relocate the node within the tree.
+ *   properties:
+ *     description: { type: string }
+ *     l: { type: string }
+ *     o: { type: string }
+ *   example:
+ *     description: Updated description for Marketing
+ */
+export default class LdapOrganizations extends DmPlugin {
+    name: string;
+    roles: Role[];
+    pathAttr: string;
+    linkAttr: string;
+    schema?: Schema;
+    constructor(dm: DM);
+    /**
+     * API routes for LDAP organizations
+     * @param app Express application
+     */
+    api(app: Express): void;
+    apiAdd(req: Request, res: Response): Promise<void>;
+    apiModify(req: Request, res: Response): Promise<void>;
+    apiDelete(req: Request, res: Response): Promise<void>;
+    apiMove(req: Request, res: Response): Promise<void>;
+    /**
+     * Consistency checks on any entry
+     */
+    hooks: Hooks;
+    /**
+     * Check if the department link is valid
+     * @param entry LDAP entry to check
+     */
+    checkDeptLink(entry: AttributesList): Promise<void>;
+    /**
+     * Check if the department path is valid
+     * @param entry LDAP entry to check
+     */
+    checkDeptPath(entry: AttributesList): Promise<void>;
+    isEmptyOrganization(dn: string): Promise<void>;
+    /**
+     * Check if entry is an organisation
+     * @param entry LDAP entry to check
+     * @returns True if entry is an organisation, false otherwise
+     */
+    isOu(entry: AttributesList): boolean;
+    getOrganisationTop(req?: Request): Promise<AttributesList | AttributesList[]>;
+    getOrganisationByDn(dn: string, req?: Request): Promise<AttributesList>;
+    getOrganisationSubnodes(dn: string, req?: Request): Promise<AttributesList[]>;
+    addOrganization(dn: string, entry: AttributesList, req?: Request): Promise<boolean>;
+    modifyOrganization(dn: string, changes: ModifyRequest): Promise<boolean>;
+    validateNewOrganization(dn: string, entry: AttributesList): boolean;
+    validateChanges(dn: string, changes: ModifyRequest): boolean;
+    _validateOneChange(field: string, value: AttributeValue | null): boolean;
+    /**
+     * Move an organization to a different parent organization
+     * Uses LDAP modifyDN to change the DN hierarchy
+     */
+    moveOrganization(dn: string, targetOrgDn: string, req?: Request): Promise<{
+        newDn: string;
+    }>;
+    deleteOrganization(dn: string): Promise<boolean>;
+    searchOrganisationSubnodes(dn: string, query: string): Promise<AttributesList[]>;
+    /**
+     * Provide configuration for config API
+     */
+    getConfigApiData(): Record<string, unknown>;
+}

package/dist/src/plugins/ldap/passwordPolicy.d.ts

@@ -11,6 +11,184 @@
  */
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
+/**
+ * Shared OpenAPI schemas surfaced by this plugin. Picked up by
+ * scripts/generate-openapi.ts and merged into `components.schemas`.
+ *
+ * @openapi-component
+ * PasswordPolicy:
+ *   type: object
+ *   description: |
+ *     Active OpenLDAP ppolicy configuration. All duration fields are in
+ *     **seconds**. Absent fields mean the policy attribute is not set.
+ *   properties:
+ *     dn:
+ *       type: string
+ *       description: DN of the ppolicy entry.
+ *       example: cn=default,ou=policies,dc=example,dc=com
+ *     pwdMaxAge:
+ *       type: integer
+ *       description: Maximum password age in seconds (0 = never expires).
+ *       example: 7776000
+ *     pwdMinAge:
+ *       type: integer
+ *       description: Minimum password age in seconds before it may be changed.
+ *       example: 0
+ *     pwdInHistory:
+ *       type: integer
+ *       description: Number of previous passwords stored.
+ *       example: 5
+ *     pwdCheckQuality:
+ *       type: integer
+ *       description: Password quality enforcement level (0-2).
+ *       example: 1
+ *     pwdMinLength:
+ *       type: integer
+ *       description: Minimum password length.
+ *       example: 12
+ *     pwdMaxFailure:
+ *       type: integer
+ *       description: Maximum bind failures before lockout.
+ *       example: 5
+ *     pwdLockout:
+ *       type: boolean
+ *       description: Whether account lockout is enabled.
+ *       example: true
+ *     pwdLockoutDuration:
+ *       type: integer
+ *       description: Lockout duration in seconds (0 = permanent until admin reset).
+ *       example: 300
+ *     pwdGraceAuthNLimit:
+ *       type: integer
+ *       description: Number of grace logins allowed after password expires.
+ *       example: 0
+ *     pwdExpireWarning:
+ *       type: integer
+ *       description: Seconds before expiry at which a warning is issued.
+ *       example: 1209600
+ *     pwdMustChange:
+ *       type: boolean
+ *       description: If true, users must change their password after an admin reset.
+ *       example: true
+ *     pwdAllowUserChange:
+ *       type: boolean
+ *       description: Whether users are allowed to change their own password.
+ *       example: true
+ * PasswordStatus:
+ *   type: object
+ *   description: Current password status for a specific user account.
+ *   required: [dn, passwordSet, isExpired, isExpiringSoon, mustChange, isLocked, failureCount, graceLoginsUsed]
+ *   properties:
+ *     dn:
+ *       type: string
+ *       description: Fully-qualified DN of the user.
+ *       example: uid=alice,ou=users,dc=example,dc=com
+ *     passwordSet:
+ *       type: boolean
+ *       description: Whether a userPassword attribute is present.
+ *       example: true
+ *     lastChanged:
+ *       type: string
+ *       format: date-time
+ *       nullable: true
+ *       description: ISO-8601 timestamp of last password change, or null if never set.
+ *       example: '2026-01-15T10:00:00.000Z'
+ *     expiresAt:
+ *       type: string
+ *       format: date-time
+ *       nullable: true
+ *       description: ISO-8601 expiry timestamp, or null if no max age is configured.
+ *       example: '2026-04-15T10:00:00.000Z'
+ *     daysUntilExpiration:
+ *       type: integer
+ *       nullable: true
+ *       description: Remaining days until expiry (negative means already expired).
+ *       example: 80
+ *     isExpired:
+ *       type: boolean
+ *       example: false
+ *     isExpiringSoon:
+ *       type: boolean
+ *       description: True when expiry is within the configured warning window.
+ *       example: false
+ *     mustChange:
+ *       type: boolean
+ *       description: True when `pwdReset` is set (admin forced change).
+ *       example: false
+ *     isLocked:
+ *       type: boolean
+ *       description: True when the account is currently locked.
+ *       example: false
+ *     lockedAt:
+ *       type: string
+ *       format: date-time
+ *       nullable: true
+ *       description: ISO-8601 timestamp of lockout, or null.
+ *       example: null
+ *     failureCount:
+ *       type: integer
+ *       description: Number of recorded bind failures still within the window.
+ *       example: 0
+ *     graceLoginsUsed:
+ *       type: integer
+ *       description: Number of grace logins already consumed.
+ *       example: 0
+ * ExpiringAccount:
+ *   type: object
+ *   description: User whose password is expiring within the warning window.
+ *   required: [dn, expiresAt, daysUntilExpiration]
+ *   properties:
+ *     dn: { type: string, example: uid=bob,ou=users,dc=example,dc=com }
+ *     uid: { type: string, example: bob }
+ *     displayName: { type: string, example: Bob Builder }
+ *     mail: { type: string, example: bob@example.com }
+ *     expiresAt:
+ *       type: string
+ *       format: date-time
+ *       example: '2026-05-01T08:00:00.000Z'
+ *     daysUntilExpiration: { type: integer, example: 6 }
+ * LockedAccount:
+ *   type: object
+ *   description: User account that is currently locked.
+ *   required: [dn, failureCount]
+ *   properties:
+ *     dn: { type: string, example: uid=charlie,ou=users,dc=example,dc=com }
+ *     uid: { type: string, example: charlie }
+ *     displayName: { type: string, example: Charlie Chaplin }
+ *     mail: { type: string, example: charlie@example.com }
+ *     lockedAt:
+ *       type: string
+ *       format: date-time
+ *       nullable: true
+ *       example: '2026-04-24T14:30:00.000Z'
+ *     failureCount: { type: integer, example: 5 }
+ * PasswordValidationRequest:
+ *   type: object
+ *   required: [password]
+ *   properties:
+ *     password:
+ *       type: string
+ *       format: password
+ *       description: The candidate password to validate.
+ *       example: 'S3cur3P@ss!'
+ *     dn:
+ *       type: string
+ *       description: Optional user DN for context (not used in local validation).
+ *       example: uid=alice,ou=users,dc=example,dc=com
+ * PasswordValidationResponse:
+ *   type: object
+ *   required: [valid, errors]
+ *   properties:
+ *     valid:
+ *       type: boolean
+ *       description: True when the password meets all complexity rules.
+ *       example: true
+ *     errors:
+ *       type: array
+ *       items: { type: string }
+ *       description: List of failed rule descriptions (empty when valid).
+ *       example: []
+ */
 export default class PasswordPolicy extends DmPlugin {
     name: string;
     roles: Role[];