ldap-rest 0.4.5 → 0.4.7

package/README.md

@@ -53,6 +53,28 @@ LDAP-Rest uses syslog-style log levels:
 
 Use `--log-level notice` for production to see web access logs without general info messages.
 
+## Deployment
+
+### Docker
+
+Multi-arch (amd64/arm64) images are published on each release:
+
+```shell
+docker run -p 8081:8081 ghcr.io/linagora/ldap-rest:latest
+# also available on Docker Hub as yadd/ldap-rest
+```
+
+### Helm
+
+A Helm chart is published as an OCI artifact on each release:
+
+```shell
+helm install ldap-rest oci://ghcr.io/linagora/charts/ldap-rest
+```
+
+See the **[Helm chart README](./helm/ldap-rest/README.md)** for configuration
+(image, `env`/`secrets`, ingress, probes, …).
+
 ## Configuration
 
 See **[Configuration Guide](./docs/usage/configuration.md)** for all CLI options and environment variables.
@@ -67,6 +89,7 @@ Installation, configuration and plugin usage.
 
 - **[Getting Started](./docs/usage/README.md)** - Quick start guide
 - **[Configuration](./docs/usage/configuration.md)** - CLI options and environment variables
+- **[Helm chart](./helm/ldap-rest/README.md)** - Kubernetes deployment
 - **[Plugins](./docs/usage/plugins/README.md)** - Plugin documentation
 - **[Authentication](./docs/usage/plugins/auth/README.md)** - Token, TOTP, HMAC, LemonLDAP::NG, OpenID Connect
 

package/dist/plugins/weblogs.js

@@ -1 +1 @@
-import e from"../abstract/plugin.js";class WebLogs extends e{constructor(){super(...arguments),this.name="weblogs",this.roles=["logging"]}api(e){e.use((e,r,o)=>{let s=!0;this.logger.debug(`Incoming request: ${e.method} ${e.originalUrl}`);const t=Date.now();r.on("finish",()=>{const o={};e.proxyAuthUser?o.user=e.proxyAuthUser:e.user&&(o.user=e.user),s&&this.log(e,r,t,o),s=!1}),r.on("error",o=>{s&&this.log(e,r,t,{error:o.message}),s=!1}),r.on("close",()=>{r.writableEnded||(s&&this.log(e,r,t,{error:`Connection closed before response was sent for ${e.method} ${e.originalUrl}`}),s=!1)}),o()})}log(e,r,o,s){const t=Date.now()-o,n={method:e.method,url:e.originalUrl,status:r.statusCode,duration:t,ip:this.getClientIp(e),...s};this.logger.notice(n)}getClientIp(e){const r=e.headers["x-forwarded-for"];if(r){return(Array.isArray(r)?r[0]:r).split(",")[0].trim()}return e.socket.remoteAddress||"unknown"}}export{WebLogs as default};
+import e from"../abstract/plugin.js";class WebLogs extends e{constructor(){super(...arguments),this.name="weblogs",this.roles=["logging"]}api(e){e.use((e,r,o)=>{let s=!0;this.logger.debug(`Incoming request: ${e.method} ${e.originalUrl}`);const t=Date.now();r.on("finish",()=>{const o={};e.proxyAuthUser?o.user=e.proxyAuthUser:e.user&&(o.user=e.user),s&&this.log(e,r,t,o),s=!1}),r.on("error",o=>{s&&this.log(e,r,t,{error:o.message}),s=!1}),r.on("close",()=>{r.writableEnded||(s&&this.log(e,r,t,{error:`Connection closed before response was sent for ${e.method} ${e.originalUrl}`}),s=!1)}),o()})}log(e,r,o,s){const t=Date.now()-o,n={...e.logDetails||{},method:e.method,url:e.originalUrl,status:r.statusCode,duration:t,ip:this.getClientIp(e),...s};this.logger.notice(n)}getClientIp(e){const r=e.headers["x-forwarded-for"];if(r){return(Array.isArray(r)?r[0]:r).split(",")[0].trim()}return e.socket.remoteAddress||"unknown"}}export{WebLogs as default};

package/dist/src/plugins/weblogs.d.ts

@@ -1,5 +1,12 @@
 import type { Express, Request, Response } from 'express';
 import DmPlugin, { type Role } from '../abstract/plugin';
+declare global {
+    namespace Express {
+        interface Request {
+            logDetails?: Record<string, unknown>;
+        }
+    }
+}
 export default class WebLogs extends DmPlugin {
     name: string;
     roles: Role[];

package/docs/usage/plugins/utilities/weblogs.md

@@ -52,6 +52,53 @@ Each response is logged when completed at **notice** level (between info and war
 | `responseTime` | Request duration                | `45ms`, `123ms`                   |
 | `error`        | Error message (if applicable)   | `Connection timeout`              |
 
+## Enriching the Log Line From Another Plugin
+
+The standard fields say _that_ a request happened, not _what_ was requested. For
+`POST`/`DELETE` routes carrying their parameters in the body, the URL alone is
+not enough for auditing.
+
+Any plugin can attach extra context to the access log entry by setting
+`req.logDetails` in its handler. Those fields are merged into the single
+`notice` entry emitted when the response completes — no second log line, no
+correlation by timestamp:
+
+```typescript
+app.post('/api/_getldapentries', (req, res) => {
+  req.logDetails = { uids: req.body };
+  // ...
+});
+```
+
+Output:
+
+```json
+{
+  "level": "notice",
+  "message": {
+    "uids": ["jdoe", "asmith"],
+    "method": "POST",
+    "url": "/api/_getldapentries",
+    "status": 200,
+    "duration": 9,
+    "ip": "10.0.9.12",
+    "user": "admin"
+  }
+}
+```
+
+Notes:
+
+- Core fields (`method`, `url`, `status`, `duration`, `ip`, `user`, `error`)
+  always take precedence: a plugin cannot overwrite them.
+- The value must be set **before** the response completes (i.e. before
+  `res.json()` / `res.end()`), since the entry is written on the `finish` event.
+- Only log what identifies the request (uids, mail addresses, target user,
+  action). Do **not** put credentials or free-text personal data there — this
+  line is written at `notice` level, i.e. in production.
+- Keep lists bounded: a request with thousands of uids produces an unreadable
+  log line. Truncate and log the real count alongside.
+
 ## Use Cases
 
 ### 1. Request Monitoring

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-rest",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "description": "Light directory manager",
   "keywords": [
     "Identity-Manager"
@@ -549,7 +549,7 @@
       "require": "./static/schemas/twake/users.json"
     }
   },
-  "main": "dist/bin/index.mjs",
+  "main": "dist/bin/index.js",
   "types": "./dist/src/bin/index.d.ts",
   "bin": {
     "cleanup-external-users": "bin/cleanup-external-users.mjs",