ldap-rest 0.4.7 → 0.5.0

package/docs/usage/plugins/ldap/raw.md

@@ -0,0 +1,226 @@
+# LDAP Raw Plugin (low-level browsing)
+
+Read-only, low-level access to the directory itself: root DSE, schema, and entries addressed by their DN. Where the other LDAP plugins expose business objects (users, groups, organizations), this one exposes the tree as it is stored — the server side of a phpLDAPadmin-like interface.
+
+The companion browser library is [`ldap-browser`](../../../client-development/browser/libraries.md#ldapbrowser).
+
+## Features
+
+- **Root DSE**: naming contexts, supported controls and extensions
+- **Schema**: object classes, attribute types, syntaxes and matching rules, parsed from the subschema entry (RFC 4512) and cached
+- **Entry read**: every attribute, operational ones included, binary values base64-encoded
+- **Tree navigation**: direct children of a DN, with an optional "has children" probe
+- **Raw search**: arbitrary base, scope and LDAP filter
+- **Read-only**: this plugin registers no write route
+
+## Configuration
+
+### Environment Variables
+
+- `DM_LDAP_RAW_BASE`: comma-separated subtrees to expose (default: `--ldap-base`)
+- `DM_LDAP_RAW_HIDDEN_ATTRIBUTES`: comma-separated attributes never returned, on top of the credential ones (default: none)
+- `DM_LDAP_RAW_SHOW_SECRETS`: serve credential attributes instead of hiding them (default: `false`)
+- `DM_LDAP_RAW_MAX_RESULTS`: maximum entries returned by a search or a children listing (default: `200`)
+- `DM_LDAP_RAW_SCHEMA_CACHE_TTL`: schema cache lifetime in seconds (default: `3600`)
+
+### Command Line
+
+```bash
+ldap-rest \
+  --plugin core/ldap/raw \
+  --ldap-raw-base "ou=users,dc=example,dc=com" \
+  --ldap-raw-base "ou=groups,dc=example,dc=com" \
+  --ldap-raw-hidden-attribute employeeNumber \
+  --ldap-raw-max-results 500
+```
+
+With no `--ldap-raw-base`, the plugin exposes `--ldap-base`.
+
+## API Endpoints
+
+```
+GET /api/v1/ldap/raw/bases          # Exposed subtrees (roots of the tree)
+GET /api/v1/ldap/raw/rootdse        # Server capabilities
+GET /api/v1/ldap/raw/schema         # Parsed directory schema
+GET /api/v1/ldap/raw/entry/{dn}     # One entry, operational attributes included
+GET /api/v1/ldap/raw/children/{dn}  # Direct children of an entry
+GET /api/v1/ldap/raw/search         # Arbitrary search
+```
+
+`{dn}` is the URL-encoded fully-qualified DN.
+
+### Entry format
+
+Attribute values are always arrays. A `binary` flag tells whether the values are base64-encoded octets rather than text:
+
+```json
+{
+  "dn": "uid=alice,ou=users,dc=example,dc=com",
+  "attributes": {
+    "objectClass": { "values": ["top", "inetOrgPerson"], "binary": false },
+    "uid": { "values": ["alice"], "binary": false },
+    "cn": { "values": ["Alice Smith"], "binary": false },
+    "jpegPhoto": { "values": ["/9j/4AAQSkZJRg…"], "binary": true }
+  }
+}
+```
+
+A value is flagged binary when the directory returned octets that are not valid UTF-8, or when the attribute type is binary.
+
+Credential attributes are **not** part of the response by default — see [Hidden attributes](#hidden-attributes).
+
+### Children
+
+```bash
+curl "$URL/api/v1/ldap/raw/children/$(urlencode 'dc=example,dc=com')?children=1"
+```
+
+```json
+{
+  "children": [
+    {
+      "dn": "ou=users,dc=example,dc=com",
+      "rdn": "ou=users",
+      "objectClass": ["organizationalUnit"],
+      "hasChildren": true
+    }
+  ],
+  "truncated": false
+}
+```
+
+`hasChildren` is only computed when the `children` query parameter is set: it costs one extra search per child.
+
+At most `--ldap-raw-max-results` children are returned. `truncated` is true when the branch holds more, so a browsing UI can say so instead of silently showing a partial list — a branch of 5000 users must not look like a branch of 200.
+
+### Search
+
+| Parameter    | Default                  | Description                                    |
+| ------------ | ------------------------ | ---------------------------------------------- |
+| `base`       | first exposed base       | Search base, must be inside an exposed subtree |
+| `scope`      | `sub`                    | `base`, `one` or `sub`                         |
+| `filter`     | `(objectClass=*)`        | LDAP filter                                    |
+| `attributes` | `*`                      | Comma-separated attribute list                 |
+| `limit`      | `--ldap-raw-max-results` | Capped by `--ldap-raw-max-results`             |
+
+```bash
+curl "$URL/api/v1/ldap/raw/search?base=ou=users,dc=example,dc=com&filter=(mail=*@example.com)&attributes=uid,mail"
+```
+
+```json
+{ "entries": [...], "truncated": false }
+```
+
+`truncated` is true when the limit cut the result set short.
+
+The filter is parsed before the search runs, so a malformed one comes back as a 400 naming it rather than as a server error — a search box receives whatever the user typed, and `gov` is a typo, not a server fault:
+
+```json
+{
+  "error": "Invalid LDAP filter \"gov\": Invalid expression: gov. A filter must be parenthesised, e.g. (cn=foo) or (|(cn=*foo*)(ou=*foo*))"
+}
+```
+
+### Schema
+
+```json
+{
+  "objectClasses": [
+    {
+      "oid": "2.5.6.6",
+      "names": ["person"],
+      "desc": "RFC2256: a person",
+      "kind": "STRUCTURAL",
+      "sup": ["top"],
+      "must": ["sn", "cn"],
+      "may": ["userPassword", "telephoneNumber", "seeAlso", "description"],
+      "obsolete": false
+    }
+  ],
+  "attributeTypes": [
+    {
+      "oid": "2.5.4.3",
+      "names": ["cn", "commonName"],
+      "sup": "name",
+      "singleValue": false,
+      "noUserModification": false,
+      "usage": "userApplications",
+      "obsolete": false,
+      "collective": false
+    }
+  ],
+  "syntaxes": [...],
+  "matchingRules": [...]
+}
+```
+
+Inheritance is **not** flattened: a client resolving the attributes of an entry must walk the `sup` chains. `SchemaView` (browser) and `SchemaIndex` (`src/lib/ldapSchema.ts`, server) do it for you.
+
+## Hidden attributes
+
+Attributes holding credential material are stripped from **every** response — entry reads and searches alike — before it leaves the server. Asking for one explicitly (`?attributes=uid,userPassword`) does not get around the filter: the removal happens when the entry is serialised, not when the query is built.
+
+The built-in list covers the usual OpenLDAP, Samba, Kerberos and Active Directory spellings:
+
+```
+userPassword, authPassword, pwdHistory, sambaNTPassword, sambaLMPassword,
+sambaPasswordHistory, krbPrincipalKey, krbExtraData, krbPwdHistory,
+unicodePwd, dbcsPwd, lmPwdHistory, ntPwdHistory, supplementalCredentials,
+userPKCS12
+```
+
+A password hash served over HTTP is an offline cracking target, and browsing a directory does not require reading one — hence hidden by default, visible only on request:
+
+```bash
+--ldap-raw-show-secrets true    # logs a warning at startup
+```
+
+Site-specific attributes are added with `--ldap-raw-hidden-attribute`, which stacks on top of the built-in list rather than replacing it:
+
+```bash
+--ldap-raw-hidden-attribute twakeApiKey --ldap-raw-hidden-attribute employeeNumber
+```
+
+Note that hiding an attribute here keeps it out of the API, not out of the directory: an account able to bind to LDAP directly still reads it. This is a guard against casual exposure through the browsing UI, not an access control — use [authz-per-branch](../auth/authz-per-branch.md) or directory ACLs for that.
+
+## Security
+
+Access is restricted in three independent layers:
+
+1. **Exposed bases** — any DN outside `--ldap-raw-base` is refused with a 403, whatever the caller's rights.
+2. **Authorization hooks** — every entry read, children listing and search goes through `server.ldap`, so the authorization plugins ([authz-per-branch](../auth/authz-per-branch.md), authz-dynamic, …) apply exactly as on the high-level APIs.
+3. **Hidden attributes** — credential attributes, plus anything in `--ldap-raw-hidden-attribute`, are removed from every response, including searches. See [Hidden attributes](#hidden-attributes).
+
+Two exceptions, both deliberate: the **root DSE** and the **schema** are read with the service account, not with the caller's rights. They are directory metadata and carry no user data; reading them with a restricted account would leave the UI unable to name and type attributes. Do not expose this plugin publicly if your directory publishes sensitive information in its root DSE.
+
+Combine with an authentication plugin ([token](../auth/token.md), [oidc](../auth/oidc.md), …) — this plugin adds no authentication of its own.
+
+## How It Works
+
+- **Schema fetch**: the root DSE is read for `subschemaSubentry` (falling back to `cn=Subschema`), then the subschema entry is fetched and parsed once per `--ldap-raw-schema-cache-ttl`. Concurrent callers share a single fetch.
+- **Operational attributes**: entries are read with `*` and `+`. When the server rejects `+`, the read is retried with `*` alone.
+- **Missing entries**: the LDAP "no such object" result (code 32) is mapped to a 404.
+
+## Limitations
+
+- **Read-only.** Creating, modifying, renaming and deleting entries is not exposed yet.
+- **No LDIF** import or export.
+- **No paging**: searches and children listings are capped by `--ldap-raw-max-results` and flagged as `truncated`; there is no cursor to fetch the rest. Use a narrower search to reach entries beyond the cap.
+
+## Usage Example
+
+```bash
+ldap-rest \
+  --plugin core/auth/token --auth-token "$TOKEN" \
+  --plugin core/ldap/raw \
+  --plugin core/static
+```
+
+The demo page ([`examples/web/ldap-browser.html`](../../../../examples/web/ldap-browser.html)) is then served at
+`/static/examples/web/ldap-browser.html`.
+
+## See Also
+
+- [ldap-browser client library](../../../client-development/browser/libraries.md#ldapbrowser)
+- [organizations plugin](organizations.md) — high-level tree of organizational units
+- [authz-per-branch plugin](../auth/authz-per-branch.md) — branch-level access control

package/examples/web/README.md

@@ -82,6 +82,23 @@ Manage organizational units.
 - Move units
 - Create/delete units
 
+### 🗂️ LDAP Browser (`ldap-browser.html`)
+
+Low-level, read-only view of the directory, in the spirit of phpLDAPadmin.
+
+**Features:**
+
+- Lazy tree of the whole directory
+- Raw entry content, operational attributes included
+- Schema annotations: mandatory attributes, descriptions, unknown attributes flagged
+- LDAP filter search with scope selection
+
+Requires the `core/ldap/raw` plugin:
+
+```bash
+npm start -- --plugin core/ldap/raw
+```
+
 ## Running Examples
 
 1. **Start the server:**
@@ -109,6 +126,7 @@ Manage organizational units.
    http://localhost:8081/static/examples/web/ldap-user-editor.html
    http://localhost:8081/static/examples/web/ldap-group-editor.html
    http://localhost:8081/static/examples/web/ldap-unit-editor.html
+   http://localhost:8081/static/examples/web/ldap-browser.html
    ```
 
 ## Using Browser Libraries in Your Application

package/examples/web/ldap-browser.html

@@ -0,0 +1,94 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>LDAP Browser Demo</title>
+
+    <!-- Google Fonts -->
+    <link
+      href="https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&display=swap"
+      rel="stylesheet"
+    />
+    <link
+      href="https://fonts.googleapis.com/icon?family=Material+Icons"
+      rel="stylesheet"
+    />
+
+    <!-- Shared CSS -->
+    <link rel="stylesheet" href="/static/browser/common-demo.css" />
+    <!-- Library CSS -->
+    <link rel="stylesheet" href="/static/browser/ldap-browser.css" />
+
+    <style>
+      :root {
+        --primary-color: #3949ab;
+        --primary-color-dark: #283593;
+      }
+
+      body {
+        background: linear-gradient(135deg, #8ea7e9 0%, #3949ab 100%);
+      }
+
+      .demo-header h1 {
+        color: #3949ab;
+      }
+
+      #ldap-browser {
+        height: 70vh;
+        min-height: 520px;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="demo-container">
+      <div class="demo-header">
+        <h1>🗂️ LDAP Browser</h1>
+        <p>
+          Low-level, read-only view of the directory: tree, raw entries and
+          schema
+        </p>
+      </div>
+
+      <div id="status-container"></div>
+
+      <div id="ldap-browser"></div>
+    </div>
+
+    <!-- Shared utilities -->
+    <script src="/static/browser/shared.js"></script>
+    <!-- Library JS -->
+    <script src="/static/browser/ldap-browser.js"></script>
+
+    <script>
+      const { LdapBrowser } = window.LdapBrowser;
+      const { showStatus } = window.MiniDmShared;
+
+      async function initBrowser() {
+        try {
+          const browser = new LdapBrowser({
+            containerId: 'ldap-browser',
+            apiBaseUrl: window.location.origin,
+            onEntrySelected: dn => console.log('Entry selected:', dn),
+            onError: error => {
+              console.error('Browser error:', error);
+              showStatus(
+                'status-container',
+                `Error: ${error.message}`,
+                'error'
+              );
+            },
+          });
+
+          await browser.init();
+          showStatus('status-container', 'LDAP Browser loaded', 'success');
+        } catch (error) {
+          console.error('Failed to initialize browser:', error);
+          showStatus('status-container', `Error: ${error.message}`, 'error');
+        }
+      }
+
+      initBrowser();
+    </script>
+  </body>
+</html>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-rest",
-  "version": "0.4.7",
+  "version": "0.5.0",
   "description": "Light directory manager",
   "keywords": [
     "Identity-Manager"
@@ -132,6 +132,10 @@
       "types": "./dist/src/plugins/ldap/passwordPolicy.d.ts",
       "import": "./dist/plugins/ldap/passwordPolicy.js"
     },
+    "./plugin-ldap-raw": {
+      "types": "./dist/src/plugins/ldap/raw.d.ts",
+      "import": "./dist/plugins/ldap/raw.js"
+    },
     "./plugin-ldap-trash": {
       "types": "./dist/src/plugins/ldap/trash.d.ts",
       "import": "./dist/plugins/ldap/trash.js"
@@ -232,6 +236,34 @@
       "types": "./dist/src/abstract/twakePlugin.d.ts",
       "import": "./dist/abstract/twakePlugin.js"
     },
+    "./browser-ldap-browser-ldapbrowser": {
+      "types": "./dist/src/browser/ldap-browser/LdapBrowser.d.ts",
+      "import": "./static/browser/ldap-browser/LdapBrowser.js"
+    },
+    "./browser-ldap-browser-api-rawapiclient": {
+      "types": "./dist/src/browser/ldap-browser/api/RawApiClient.d.ts",
+      "import": "./static/browser/ldap-browser/api/RawApiClient.js"
+    },
+    "./browser-ldap-browser-components-entrytree": {
+      "types": "./dist/src/browser/ldap-browser/components/EntryTree.d.ts",
+      "import": "./static/browser/ldap-browser/components/EntryTree.js"
+    },
+    "./browser-ldap-browser-components-entryview": {
+      "types": "./dist/src/browser/ldap-browser/components/EntryView.d.ts",
+      "import": "./static/browser/ldap-browser/components/EntryView.js"
+    },
+    "./browser-ldap-browser-index": {
+      "types": "./dist/src/browser/ldap-browser/index.d.ts",
+      "import": "./static/browser/ldap-browser/index.js"
+    },
+    "./browser-ldap-browser-schema": {
+      "types": "./dist/src/browser/ldap-browser/schema.d.ts",
+      "import": "./static/browser/ldap-browser/schema.js"
+    },
+    "./browser-ldap-browser-types": {
+      "types": "./dist/src/browser/ldap-browser/types.d.ts",
+      "import": "./static/browser/ldap-browser/types.js"
+    },
     "./browser-ldap-group-editor-ldapgroupeditor": {
       "types": "./dist/src/browser/ldap-group-editor/LdapGroupEditor.d.ts",
       "import": "./static/browser/ldap-group-editor/LdapGroupEditor.js"
@@ -578,6 +610,8 @@
     "check": "npm run check:ts && npm run lint && npm run format:check",
     "check:ts": "tsc --noEmit",
     "clean": "rimraf dist/* static/browser/* coverage",
+    "coverage": "c8 --config .c8rc.json mocha",
+    "coverage:check": "npm run check:ts && c8 --config .c8rc.json --exclude 'src/browser/**' --check-coverage --statements 84 --lines 84 --branches 75 --functions 86 mocha",
     "dev": "npm run start:dev",
     "fix": "npm run lint:fix && npm run format:fix",
     "format:check": "prettier --check .",
@@ -626,6 +660,7 @@
     "@types/supertest": "^6.0.3",
     "@typescript-eslint/eslint-plugin": "^8.44.0",
     "@typescript-eslint/parser": "^8.44.0",
+    "c8": "^10.1.3",
     "chai": "^6.0.1",
     "eslint": "^9.35.0",
     "eslint-config-prettier": "^10.1.8",
@@ -633,6 +668,7 @@
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-prettier": "^5.5.4",
     "fast-glob": "^3.3.3",
+    "globals": "^14.0.0",
     "js-yaml": "^4.1.1",
     "mocha": "^11.7.2",
     "nock": "^14.0.10",

package/static/browser/ldap-browser/LdapBrowser.js

@@ -0,0 +1,199 @@
+import { escapeHtml } from '../shared/utils/dom.js';
+import { RawApiClient } from './api/RawApiClient.js';
+import { EntryTree } from './components/EntryTree.js';
+import { EntryView } from './components/EntryView.js';
+import { SchemaView } from './schema.js';
+
+/**
+ * Low-level LDAP browser: a tree of the directory on the left, the raw
+ * content of the selected entry on the right, and a filter search on top.
+ *
+ * Read-only: it renders what the `core/ldap/raw` plugin serves.
+ *
+ * @module browser/ldap-browser/LdapBrowser
+ */
+class LdapBrowser {
+    constructor(options) {
+        this.container = null;
+        this.tree = null;
+        this.entryView = null;
+        this.schema = null;
+        this.bases = [];
+        this.currentDn = null;
+        this.options = options;
+        this.api = new RawApiClient(options.apiBaseUrl || '', options.authToken);
+    }
+    /**
+     * Build the interface, load the schema and open the first base.
+     *
+     * @throws Error when the container does not exist or the API is unreachable
+     */
+    async init() {
+        const container = document.getElementById(this.options.containerId);
+        if (!container)
+            throw new Error(`Container element with id '${this.options.containerId}' not found`);
+        this.container = container;
+        this.bases = await this.api.getBases();
+        this.render();
+        // The schema only decorates the display: a directory that refuses it
+        // must not prevent browsing
+        try {
+            this.schema = new SchemaView(await this.api.getSchema());
+        }
+        catch (err) {
+            this.reportError(err);
+        }
+        const treeContainer = container.querySelector('.ldap-browser__tree');
+        const entryContainer = container.querySelector('.ldap-browser__entry');
+        if (!treeContainer || !entryContainer)
+            return;
+        this.entryView = new EntryView(entryContainer, this.schema);
+        this.entryView.renderEmpty();
+        this.tree = new EntryTree(treeContainer, this.api, dn => this.showEntry(dn), error => this.reportError(error));
+        await this.tree.init(this.bases);
+        this.bindToolbar();
+        const initial = this.options.initialDn || this.bases[0];
+        if (initial)
+            await this.tree.revealAndSelect(initial);
+    }
+    /** Release the listeners held by the tree */
+    destroy() {
+        this.tree?.destroy();
+        this.tree = null;
+    }
+    /**
+     * DN currently displayed.
+     *
+     * @returns selected DN, or null when none
+     */
+    getCurrentDn() {
+        return this.currentDn;
+    }
+    /** Draw the static layout */
+    render() {
+        if (!this.container)
+            return;
+        this.container.classList.add('ldap-browser-container');
+        this.container.innerHTML = `
+      <div class="ldap-browser">
+        <div class="ldap-browser__toolbar">
+          <input class="ldap-browser__filter" type="text"
+                 placeholder="LDAP filter, e.g. (uid=alice)" />
+          <select class="ldap-browser__scope">
+            <option value="sub">sub</option>
+            <option value="one">one</option>
+            <option value="base">base</option>
+          </select>
+          <select class="ldap-browser__base">
+            ${this.bases
+            .map(base => `<option value="${escapeHtml(base)}">${escapeHtml(base)}</option>`)
+            .join('')}
+          </select>
+          <button class="ldap-browser__search" type="button">
+            <span class="material-icons">search</span> Search
+          </button>
+          <button class="ldap-browser__refresh" type="button" title="Reload">
+            <span class="material-icons">refresh</span>
+          </button>
+        </div>
+        <div class="ldap-browser__body">
+          <div class="ldap-browser__tree"></div>
+          <div class="ldap-browser__entry"></div>
+        </div>
+        <div class="ldap-browser__results" hidden></div>
+      </div>`;
+    }
+    /** Wire the search and refresh controls */
+    bindToolbar() {
+        const filter = this.container?.querySelector('.ldap-browser__filter');
+        const searchButton = this.container?.querySelector('.ldap-browser__search');
+        const refreshButton = this.container?.querySelector('.ldap-browser__refresh');
+        const results = this.container?.querySelector('.ldap-browser__results');
+        searchButton?.addEventListener('click', () => void this.runSearch());
+        filter?.addEventListener('keydown', event => {
+            if (event.key === 'Enter')
+                void this.runSearch();
+        });
+        refreshButton?.addEventListener('click', () => {
+            this.tree?.invalidate();
+            if (this.currentDn)
+                void this.showEntry(this.currentDn);
+        });
+        results?.addEventListener('click', event => {
+            const target = event.target.closest('[data-dn]');
+            if (target?.dataset.dn)
+                void this.tree?.revealAndSelect(target.dataset.dn);
+        });
+    }
+    /**
+     * Load an entry and display it.
+     *
+     * @param dn DN of the entry
+     */
+    async showEntry(dn) {
+        if (!this.entryView)
+            return;
+        this.currentDn = dn;
+        this.entryView.renderLoading();
+        try {
+            const entry = await this.api.getEntry(dn);
+            this.entryView.render(entry);
+            this.options.onEntrySelected?.(dn);
+        }
+        catch (err) {
+            this.entryView.renderError(err.message);
+            this.reportError(err);
+        }
+    }
+    /** Run the search typed in the toolbar and list the matching DNs */
+    async runSearch() {
+        const filter = this.container?.querySelector('.ldap-browser__filter')
+            ?.value || '';
+        const scope = this.container?.querySelector('.ldap-browser__scope')
+            ?.value || 'sub';
+        const base = this.container?.querySelector('.ldap-browser__base')
+            ?.value || this.bases[0];
+        const results = this.container?.querySelector('.ldap-browser__results');
+        if (!results)
+            return;
+        if (!filter.trim()) {
+            results.hidden = true;
+            results.innerHTML = '';
+            return;
+        }
+        results.hidden = false;
+        results.innerHTML = '<p>Searching…</p>';
+        try {
+            const found = await this.api.search({
+                base,
+                scope: scope,
+                filter,
+                attributes: ['dn'],
+            });
+            results.innerHTML = found.entries.length
+                ? `<p>${found.entries.length} result(s)${found.truncated ? ' (truncated)' : ''}</p>
+           <ul>${found.entries
+                    .map(entry => `<li><a href="#" data-dn="${escapeHtml(entry.dn)}">${escapeHtml(entry.dn)}</a></li>`)
+                    .join('')}</ul>`
+                : '<p>No result</p>';
+        }
+        catch (err) {
+            results.innerHTML = `<p class="ldap-browser__error">${escapeHtml(err.message)}</p>`;
+            this.reportError(err);
+        }
+    }
+    /**
+     * Forward an error to the host page, or log it when no handler was given.
+     *
+     * @param error error to report
+     */
+    reportError(error) {
+        if (this.options.onError)
+            this.options.onError(error);
+        else
+            console.error('[ldap-browser]', error);
+    }
+}
+
+export { LdapBrowser };
+//# sourceMappingURL=LdapBrowser.js.map

package/static/browser/ldap-browser/LdapBrowser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LdapBrowser.js","sources":["../../../../src/browser/ldap-browser/LdapBrowser.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;AAAA;;;;;;;AAOG;MAUU,WAAW,CAAA;AAUtB,IAAA,WAAA,CAAY,OAAuB,EAAA;QAP3B,IAAA,CAAA,SAAS,GAAuB,IAAI;QACpC,IAAA,CAAA,IAAI,GAAqB,IAAI;QAC7B,IAAA,CAAA,SAAS,GAAqB,IAAI;QAClC,IAAA,CAAA,MAAM,GAAsB,IAAI;QAChC,IAAA,CAAA,KAAK,GAAa,EAAE;QACpB,IAAA,CAAA,SAAS,GAAkB,IAAI;AAGrC,QAAA,IAAI,CAAC,OAAO,GAAG,OAAO;AACtB,QAAA,IAAI,CAAC,GAAG,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC;IAC1E;AAEA;;;;AAIG;AACH,IAAA,MAAM,IAAI,GAAA;AACR,QAAA,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;AACnE,QAAA,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CACb,CAAA,2BAAA,EAA8B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAA,WAAA,CAAa,CACpE;AACH,QAAA,IAAI,CAAC,SAAS,GAAG,SAAS;QAE1B,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;QACtC,IAAI,CAAC,MAAM,EAAE;;;AAIb,QAAA,IAAI;AACF,YAAA,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QAC1D;QAAE,OAAO,GAAG,EAAE;AACZ,YAAA,IAAI,CAAC,WAAW,CAAC,GAAY,CAAC;QAChC;QAEA,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,CAC3C,qBAAqB,CACtB;QACD,MAAM,cAAc,GAAG,SAAS,CAAC,aAAa,CAC5C,sBAAsB,CACvB;AACD,QAAA,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc;YAAE;AAEvC,QAAA,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC;AAC3D,QAAA,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;AAE5B,QAAA,IAAI,CAAC,IAAI,GAAG,IAAI,SAAS,CACvB,aAAa,EACb,IAAI,CAAC,GAAG,EACR,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EACxB,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CACjC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAEhC,IAAI,CAAC,WAAW,EAAE;AAElB,QAAA,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,QAAA,IAAI,OAAO;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;IACvD;;IAGA,OAAO,GAAA;AACL,QAAA,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE;AACpB,QAAA,IAAI,CAAC,IAAI,GAAG,IAAI;IAClB;AAEA;;;;AAIG;IACH,YAAY,GAAA;QACV,OAAO,IAAI,CAAC,SAAS;IACvB;;IAGQ,MAAM,GAAA;QACZ,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE;QACrB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,wBAAwB,CAAC;AACtD,QAAA,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG;;;;;;;;;;;AAWjB,YAAA,EAAA,IAAI,CAAC;AACJ,aAAA,GAAG,CACF,IAAI,IACF,kBAAkB,UAAU,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,WAAW;aAErE,IAAI,CAAC,EAAE,CAAC;;;;;;;;;;;;;;aAcV;IACX;;IAGQ,WAAW,GAAA;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAC1C,uBAAuB,CACxB;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAChD,uBAAuB,CACxB;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CACjD,wBAAwB,CACzB;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAC3C,wBAAwB,CACzB;AAED,QAAA,YAAY,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;AACpE,QAAA,MAAM,EAAE,gBAAgB,CAAC,SAAS,EAAE,KAAK,IAAG;AAC1C,YAAA,IAAK,KAAuB,CAAC,GAAG,KAAK,OAAO;AAAE,gBAAA,KAAK,IAAI,CAAC,SAAS,EAAE;AACrE,QAAA,CAAC,CAAC;AACF,QAAA,aAAa,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAK;AAC5C,YAAA,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE;YACvB,IAAI,IAAI,CAAC,SAAS;gBAAE,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;AACzD,QAAA,CAAC,CAAC;AACF,QAAA,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,IAAG;YACzC,MAAM,MAAM,GAAI,KAAK,CAAC,MAAsB,CAAC,OAAO,CAClD,WAAW,CACU;AACvB,YAAA,IAAI,MAAM,EAAE,OAAO,CAAC,EAAE;AACpB,gBAAA,KAAK,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AACtD,QAAA,CAAC,CAAC;IACJ;AAEA;;;;AAIG;IACK,MAAM,SAAS,CAAC,EAAU,EAAA;QAChC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE;AACrB,QAAA,IAAI,CAAC,SAAS,GAAG,EAAE;AACnB,QAAA,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE;AAC9B,QAAA,IAAI;YACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzC,YAAA,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,eAAe,GAAG,EAAE,CAAC;QACpC;QAAE,OAAO,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS,CAAC,WAAW,CAAE,GAAa,CAAC,OAAO,CAAC;AAClD,YAAA,IAAI,CAAC,WAAW,CAAC,GAAY,CAAC;QAChC;IACF;;AAGQ,IAAA,MAAM,SAAS,GAAA;QACrB,MAAM,MAAM,GACV,IAAI,CAAC,SAAS,EAAE,aAAa,CAAmB,uBAAuB;cACnE,KAAK,IAAI,EAAE;QACjB,MAAM,KAAK,GACT,IAAI,CAAC,SAAS,EAAE,aAAa,CAAoB,sBAAsB;cACnE,KAAK,IAAI,KAAK;QACpB,MAAM,IAAI,GACR,IAAI,CAAC,SAAS,EAAE,aAAa,CAAoB,qBAAqB;cAClE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAC3C,wBAAwB,CACzB;AACD,QAAA,IAAI,CAAC,OAAO;YAAE;AAEd,QAAA,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;AAClB,YAAA,OAAO,CAAC,MAAM,GAAG,IAAI;AACrB,YAAA,OAAO,CAAC,SAAS,GAAG,EAAE;YACtB;QACF;AAEA,QAAA,OAAO,CAAC,MAAM,GAAG,KAAK;AACtB,QAAA,OAAO,CAAC,SAAS,GAAG,mBAAmB;AACvC,QAAA,IAAI;YACF,MAAM,KAAK,GAAoB,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBACnD,IAAI;AACJ,gBAAA,KAAK,EAAE,KAA+B;gBACtC,MAAM;gBACN,UAAU,EAAE,CAAC,IAAI,CAAC;AACnB,aAAA,CAAC;AACF,YAAA,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC;AAChC,kBAAE,CAAA,GAAA,EAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAA,UAAA,EACxB,KAAK,CAAC,SAAS,GAAG,cAAc,GAAG,EACrC,CAAA;AACO,eAAA,EAAA,KAAK,CAAC;qBACT,GAAG,CACF,KAAK,IACH,CAAA,yBAAA,EAA4B,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA,EAAA,EAAK,UAAU,CAC7D,KAAK,CAAC,EAAE,CACT,WAAW;qBAEf,IAAI,CAAC,EAAE,CAAC,CAAA,KAAA;kBACZ,kBAAkB;QACxB;QAAE,OAAO,GAAG,EAAE;YACZ,OAAO,CAAC,SAAS,GAAG,CAAA,+BAAA,EAAkC,UAAU,CAC7D,GAAa,CAAC,OAAO,CACvB,CAAA,IAAA,CAAM;AACP,YAAA,IAAI,CAAC,WAAW,CAAC,GAAY,CAAC;QAChC;IACF;AAEA;;;;AAIG;AACK,IAAA,WAAW,CAAC,KAAY,EAAA;AAC9B,QAAA,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO;AAAE,YAAA,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;;AAChD,YAAA,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC;IAC7C;AACD;;;;"}