ldap-rest 0.6.2 → 0.8.0

package/dist/src/abstract/ldapFlat.d.ts

@@ -144,6 +144,50 @@ export interface LdapFlatConfig {
  *       example: ou=engineering,ou=departments,dc=example,dc=com
  *   example:
  *     targetOrgDn: ou=engineering,ou=departments,dc=example,dc=com
+ * FlatRenameRequest:
+ *   type: object
+ *   description: |
+ *     Body for changing the identifier of an entry. The field is named
+ *     `newId` for every resource, whatever that resource calls its
+ *     `mainAttribute`.
+ *   required: [newId]
+ *   properties:
+ *     newId:
+ *       type: string
+ *       description: |
+ *         New value of the resource's `mainAttribute`. A value, not a DN.
+ *       example: bob
+ *   example:
+ *     newId: bob
+ * FlatRenameResult:
+ *   type: object
+ *   description: |
+ *     Outcome of a rename: the entry's new DN, and how many references to
+ *     the old one were rewritten.
+ *   properties:
+ *     success:
+ *       type: boolean
+ *       description: False when a reference could not be rewritten.
+ *     dn:
+ *       type: string
+ *       description: DN the entry now has.
+ *     referencesUpdated:
+ *       type: integer
+ *       description: References rewritten to the new DN.
+ *     referencesFailed:
+ *       type: array
+ *       description: |
+ *         References left naming the old DN, counted per attribute. The
+ *         referring entries are named in the server log, not here.
+ *       items:
+ *         type: object
+ *         properties:
+ *           attribute: { type: string }
+ *           count: { type: integer }
+ *   example:
+ *     success: true
+ *     dn: uid=bob,ou=users,dc=example,dc=com
+ *     referencesUpdated: 3
  */
 export default abstract class LdapFlat extends DmPlugin {
     base: string;
@@ -156,6 +200,85 @@ export default abstract class LdapFlat extends DmPlugin {
     pluralName: string;
     hookPrefix: string;
     constructor(server: DM, config: LdapFlatConfig);
+    /**
+     * Attributes a client is not allowed to supply: those the server computes
+     * (`generated`) and those it only ever derives from elsewhere (`readOnly`,
+     * such as `memberOf`, which is driven from the group side).
+     *
+     * The core and its plugins still write them — the restriction is on the
+     * request body, not on the entry.
+     *
+     * @returns lowercased attribute names
+     */
+    protected clientForbiddenAttributes(): Set<string>;
+    /**
+     * Attributes never sent back over the API. A manager may reset a password
+     * without being able to read it back: the asymmetry is a projection, not an
+     * authorization rule, so it lives with the schema.
+     *
+     * @returns lowercased attribute names
+     */
+    protected hiddenAttributes(): Set<string>;
+    /**
+     * Remove the `neverReturn` attributes from an entry about to be serialised.
+     * LDAP attribute names are case-insensitive and may carry options
+     * (`userPassword;binary`), so both are normalised before comparison.
+     *
+     * @param entry entry as read from the directory
+     * @returns a copy without the hidden attributes
+     */
+    protected project<T extends Record<string, unknown>>(entry: T): T;
+    /**
+     * Same as {@link project}, for a map of entries keyed by identifier.
+     *
+     * @param list entries as read from the directory
+     * @returns a copy without the hidden attributes
+     */
+    protected projectList(list: LdapList): LdapList;
+    /**
+     * Refuse a request body that carries an attribute the client may not set.
+     *
+     * Failing loudly matters more than ignoring the value: a client that sends
+     * `twakeDepartmentPath` believes it is setting the path, and silently
+     * overwriting it with the computed one would leave it thinking otherwise.
+     *
+     * @param names attribute names present in the request
+     * @throws BadRequestError naming the first offending attribute
+     */
+    protected rejectForbiddenInput(names: string[]): void;
+    /**
+     * Derive the RDN value of a new entry when the schema says the server
+     * generates it — an account identifier taken from the local part of its mail
+     * address, typically.
+     *
+     * The derivation itself (source attribute, extraction pattern, collision
+     * strategy) is schema configuration; this method only applies it.
+     *
+     * @param body creation payload
+     * @returns the generated value, or undefined when nothing is generated
+     * @throws BadRequestError when the source attribute is missing, or when the
+     *         value collides and the schema asks for an error
+     */
+    protected generateMainAttribute(body: Record<string, AttributeValue>): Promise<string | undefined>;
+    /**
+     * Tell whether an entry already uses this RDN value in the branch.
+     *
+     * @param value candidate RDN value
+     * @returns true when the DN is taken
+     */
+    protected rdnExists(value: string): Promise<boolean>;
+    /**
+     * Build the rejection message for a value that failed its schema `test`.
+     *
+     * When the schema carries a `hint`, the message says what a valid value
+     * looks like instead of only that this one was not. The hint lives next to
+     * the pattern so the two cannot drift apart, and so a client can show it
+     * under the field *before* the user gets it wrong.
+     *
+     * @param field attribute name
+     * @returns message for a `BadRequestError`
+     */
+    protected invalidValueMessage(field: string): string;
     /**
      * API routes
      */
@@ -165,6 +288,26 @@ export default abstract class LdapFlat extends DmPlugin {
     apiDelete(req: Request, res: Response): Promise<void>;
     apiModify(req: Request, res: Response): Promise<void>;
     apiMove(req: Request, res: Response): Promise<void>;
+    /**
+     * Change an entry's identifier, and make the directory consistent again
+     * before answering.
+     *
+     * Shaped like `apiMove`, and deliberately not on `tryMethod`: that helper
+     * flattens every outcome to `{success: true}`, which cannot say how many
+     * references were rewritten nor that one was not.
+     *
+     * @param req request, carrying `newId`
+     * @param res response
+     */
+    apiRename(req: Request, res: Response): Promise<void>;
+    /**
+     * Whether an entry exists, asked without narrowing by the caller's own
+     * permissions — as `apiGet` asks it.
+     *
+     * @param dn entry to look for
+     * @returns true when the directory holds it
+     */
+    private entryExists;
     /**
      * Resolve an id (either an RDN value or a full DN) into a DN inside this
      * instance's base branch.
@@ -187,7 +330,22 @@ export default abstract class LdapFlat extends DmPlugin {
     protected resolveDn(id: string): string;
     addEntry(id: string, additional?: AttributesList, req?: Request): Promise<boolean>;
     modifyEntry(id: string, changes: ModifyRequest): Promise<boolean>;
-    renameEntry(id: string, newId: string): Promise<boolean>;
+    /**
+     * Change the RDN of an entry.
+     *
+     * The request is not optional in practice: `ldapActions` hands it to the
+     * `ldaprenamerequest` hook, and every authorization plugin skips its check
+     * when there is none (`AuthzBase.shouldSkipAuthorization`). Renaming
+     * without one therefore renames without authorization — silently. It stays
+     * optional in the signature for the callers that genuinely belong to no
+     * request, as the rest of this class does.
+     *
+     * @param id current identifier, or the entry's DN
+     * @param newId new identifier, or the entry's new DN
+     * @param req request this comes from, so the branch check runs
+     * @returns true when the directory accepted the rename
+     */
+    renameEntry(id: string, newId: string, req?: Request): Promise<boolean>;
     deleteEntry(id: string): Promise<boolean>;
     /**
      * Move entry to a different organization

package/dist/src/abstract/plugin.d.ts

@@ -42,6 +42,19 @@ export default abstract class DmPlugin {
      * @returns uniq operation number
      */
     opNumber(): number;
+    /**
+     * Leave out of data about to be sent every attribute a loaded schema marks
+     * `neverReturn`.
+     *
+     * A flat entity hides its own attributes, but an organization's subnodes are
+     * users, groups, positions…, each described by another plugin's schema: an
+     * answer mixing entities has to honour all of them, or `/users/<uid>` hides
+     * a password hash that `/organizations/<org>/subnodes` hands out.
+     *
+     * @param data an entry, a list of entries, or entries keyed by identifier
+     * @returns the same shape, without the hidden attributes
+     */
+    protected hideNeverReturn<T>(data: T): T;
     /** Names already warned about by requirePlugin, so each warns at most once. */
     private missingPluginsWarned?;
     /**

package/dist/src/config/args.d.ts

@@ -58,6 +58,8 @@ export interface Config {
     ldap_organization_max_subnodes?: number;
     organization_schema?: string;
     ldap_flat_schema?: string[];
+    enterprise_domain_name_attribute?: string;
+    enterprise_domain_link_attribute?: string;
     ldap_raw_base?: string[];
     ldap_raw_hidden_attribute?: string[];
     ldap_raw_show_secrets?: boolean;
@@ -186,8 +188,11 @@ export interface Config {
     scim_base_map?: string;
     scim_user_object_class?: string[];
     scim_user_rdn_attribute?: string;
+    scim_user_lock_attribute?: string;
+    scim_user_lock_value?: string;
     scim_group_object_class?: string[];
     scim_group_rdn_attribute?: string;
+    scim_group_external_id_attribute?: string;
     scim_id_attribute?: string;
     scim_user_mapping?: string;
     scim_group_mapping?: string;

package/dist/src/config/schema.d.ts

@@ -1,18 +1,388 @@
 import type { AttributeValue } from '../lib/ldapActions';
+/**
+ * Scalar and container types an entity schema may declare.
+ *
+ * `pointer` is a DN reference validated against `branch`; `date` is an LDAP
+ * generalized time (`yyyyMMddHHmmss[.SSS]Z`).
+ */
+export type SchemaAttributeType = 'string' | 'number' | 'integer' | 'boolean' | 'date' | 'array' | 'pointer';
+/**
+ * Semantic role of an attribute: what it *means*, independent of the concrete
+ * LDAP attribute holding it. Core code is written against roles so that a
+ * deployment with a different directory layout reuses it unchanged — the name
+ * of the attribute and the values it takes are configuration.
+ *
+ * The type is a plain string: the list below is what the core itself looks
+ * for, and a deployment is free to add its own for its plugins.
+ *
+ * | Role               | Meaning                                              |
+ * | ------------------ | ---------------------------------------------------- |
+ * | `identifier`       | RDN value of the entry                               |
+ * | `displayName`      | Human-readable name                                  |
+ * | `primaryEmail`     | Main mail address                                    |
+ * | `emailAliases`     | Further addresses of the same mailbox                |
+ * | `emailQuota`       | Mailbox size limit, in bytes                         |
+ * | `organizationLink` | DN of the organization the entry belongs to          |
+ * | `organizationPath` | Human-readable path of that organization             |
+ * | `members`          | DNs of the members of a group                        |
+ * | `owners`           | DNs allowed to write to a restricted group           |
+ * | `accountStatus`    | Lifecycle state of an account (enabled / disabled…)  |
+ * | `password`         | Credential                                           |
+ * | `passwordReset`    | Flag forcing a password change at next login         |
+ * | `accountExpiry`    | Date after which the account is to be removed        |
+ * | `domainLink`       | DNs of the mail domains an organization may use      |
+ * | `domainName`       | Domain name carried by a domain entry                |
+ */
+export type SchemaRole = string;
+/**
+ * A piece of text a client shows, in one or several languages.
+ *
+ * A plain string is the text itself. A map is keyed by language tag, and a
+ * client picks the closest one it can:
+ *
+ * ```json
+ * "label": { "en": "Department", "fr": "Département" }
+ * ```
+ *
+ * These words belong to the deployment, not to the product — they name *its*
+ * entities and attributes — so their translations belong in its schemas
+ * rather than in a catalogue shipped with the code.
+ */
+export type LocalizedText = string | Record<string, string>;
+/** Roles the core itself looks for. See {@link SchemaRole}. */
+export declare const CORE_ROLES: readonly ["identifier", "displayName", "primaryEmail", "emailAliases", "emailQuota", "organizationLink", "organizationPath", "members", "owners", "accountStatus", "password", "passwordReset", "accountExpiry", "domainLink", "domainName"];
+/**
+ * How a uniqueness constraint is evaluated.
+ *
+ * By default the value must be unique among the entries of the entity's own
+ * branch. `branches` widens the search to a shared namespace — a mail address
+ * belongs to accounts *and* to distribution lists — and `attributes` names the
+ * other attributes that hold values of that same namespace.
+ */
+export interface UniqueConstraint {
+    /**
+     * Extra branches searched besides the entity's own base. Each entry may use
+     * the `__ldap_base__` placeholder, like `branch`.
+     */
+    branches?: string[];
+    /**
+     * Other attributes sharing the value namespace, searched alongside the
+     * attribute itself (e.g. `mailAlternateAddress` for `mail`).
+     */
+    attributes?: string[];
+    /**
+     * Value exempted from the check. A directory may use a placeholder for
+     * non-individual entries (a shared payroll number, say); that value is
+     * allowed to repeat.
+     */
+    sentinel?: string;
+    /** Extra LDAP filter narrowing the search, e.g. `(objectClass=twakeAccount)` */
+    filter?: string;
+}
+/**
+ * Derivation of a generated attribute from another attribute of the same
+ * entry. Used for identifiers built from the mail address, where the client
+ * never supplies the value.
+ */
+export interface GeneratedFrom {
+    /** Source attribute, e.g. `mail` */
+    attribute: string;
+    /**
+     * Regex whose first capturing group is the generated value. Applied to the
+     * source value; when it does not match, the whole source value is used.
+     */
+    extract?: string;
+    /** Lowercase the result */
+    lowercase?: boolean;
+    /**
+     * Characters to drop from the extracted value, as an extended regular
+     * expression. A mail local part may legally hold `+`, `'` or `!`, which an
+     * identifier charset usually refuses; without this the entry becomes
+     * uncreatable, since the client may not send the generated attribute
+     * either. `[^a-zA-Z0-9._-]` keeps what a `uid` accepts.
+     */
+    strip?: string;
+    /**
+     * What to do when the generated value is already taken. `error` (the
+     * default) refuses the creation; `suffix` appends `-2`, `-3`, … until a free
+     * value is found.
+     */
+    onCollision?: 'error' | 'suffix';
+}
+export interface SchemaAttribute {
+    type: SchemaAttributeType;
+    items?: {
+        type: string;
+        test?: string | RegExp;
+        hint?: string;
+        branch?: string[];
+    };
+    default?: AttributeValue;
+    required?: boolean;
+    test?: string | RegExp;
+    /**
+     * Plain-language description of `test`, shown to the user *before* they get
+     * a value wrong — "Expected pattern 999 9999". It travels with the
+     * schema so the pattern and its explanation cannot drift apart, and so a
+     * client never has to hardcode either.
+     */
+    hint?: string;
+    branch?: string[];
+    fixed?: boolean;
+    /** Semantic role(s) — see {@link SchemaRole} */
+    role?: SchemaRole | SchemaRole[];
+    /**
+     * Computed server-side. Refused when a client supplies it; still writable by
+     * the core and by plugins.
+     *
+     * The refusal is about *attribute names in a payload*, not about the entry
+     * being immutable: an endpoint parameter that happens to end up in a
+     * generated attribute is not one of them. `POST /ldap/{resource}/{id}/rename`
+     * takes a `newId` and `POST /ldap/{resource}/{id}/move` a `targetOrgDn`, and
+     * both then write a `generated` attribute themselves — while
+     * `PUT /ldap/{resource}/{id}` naming that attribute is still refused.
+     */
+    generated?: boolean;
+    /** How a `generated` value is derived from another attribute */
+    generatedFrom?: GeneratedFrom;
+    /**
+     * Operational or derived attribute: refused in input and never written.
+     * `memberOf` is the archetype — membership is driven from the group side.
+     */
+    readOnly?: boolean;
+    /**
+     * Never returned to a client, though it may still be written. Covers the
+     * write-only attributes of a password reset.
+     */
+    neverReturn?: boolean;
+    /** Value must be unique; `true` means "unique within this entity" */
+    unique?: boolean | UniqueConstraint;
+    /**
+     * Canonicalisation applied to an incoming value before it is stored.
+     *
+     * `byteSize` reads a human-readable size (`5GB`, `500MB`, `2048`) and stores
+     * the number of bytes, so the same value means the same thing whether it
+     * arrived on a creation or an update.
+     */
+    normalize?: 'byteSize';
+    /**
+     * Whether a client's "search everywhere" should include this attribute.
+     *
+     * Which attributes can be searched at all is a property of the deployment,
+     * not of the code: a substring filter on an attribute the directory has not
+     * indexed scans the branch. A schema that marks none leaves the client to
+     * guess — every returnable, single-valued, non-pointer attribute — which is
+     * right for a small branch and wrong for a large one. Marking even one
+     * attribute replaces the guess entirely, so the list is exactly what the
+     * deployment indexed.
+     */
+    searchable?: boolean;
+    /**
+     * Named states of a lifecycle attribute, mapping a semantic name the API
+     * speaks (`enabled`, `disabled`) to the concrete value this directory
+     * stores. What "disabled" *is* — a DN in a nomenclature, a string, a
+     * boolean — is a property of the deployment, never of the code.
+     */
+    states?: Record<string, AttributeValue>;
+    /**
+     * For a `pointer`: refuse to delete the entry it points at while any entry
+     * still references it. `ignore` (the default) leaves the reference dangling.
+     */
+    referentialIntegrity?: 'restrict' | 'ignore';
+    /**
+     * For a `members`-role attribute: refuse to delete the entry while it still
+     * has members. The placeholder member some directories need to keep a
+     * `groupOfNames` valid (`--group-dummy-user`) does not count.
+     */
+    deleteGuard?: 'nonEmpty';
+    /**
+     * For a mail attribute: which set of domains the address must belong to.
+     *
+     * `organization` walks up from the entry's organization, collecting the
+     * domains declared on it and on each of its ancestors; `directory` accepts
+     * any domain declared anywhere in the directory. When no domain is declared
+     * at all, any address passes.
+     */
+    mailDomainScope?: 'organization' | 'directory';
+    /**
+     * Accept a subdomain of an authorised domain — `list@lists.example.org`
+     * under `example.org`. Off by default: the domain must match exactly.
+     */
+    allowSubdomains?: boolean;
+    /** Grouping hint for a form, e.g. `Mailbox Settings` */
+    group?: string;
+    /** Name a client shows for this attribute, in one or several languages */
+    label?: LocalizedText;
+}
 export interface Schema {
     strict: boolean;
     attributes: {
-        [key: string]: {
-            type: 'string' | 'array' | 'pointer';
-            items?: {
-                type: string;
-                test?: string | RegExp;
-            };
-            default?: AttributeValue;
-            required?: boolean;
-            test?: string | RegExp;
-            branch?: string[];
-            fixed?: boolean;
-        };
+        [key: string]: SchemaAttribute;
+    };
+    /**
+     * Metadata about the entity itself, present in a schema file loaded by
+     * `ldapFlatGeneric` (the whole file is parsed as a `Schema`, so this is what
+     * that parse actually carries — narrowing to the declared type must not
+     * silently drop it). A schema attached to a plugin without its own file
+     * carries none of this.
+     */
+    entity?: {
+        /** Name a client shows for the collection, in one or several languages */
+        label?: LocalizedText;
+        /** Same, for a single entry */
+        singularLabel?: LocalizedText;
+        /**
+         * What a client shows for an entry, keyed by its main attribute value:
+         * the readable name of a nomenclature value a pointer lands on
+         */
+        valueLabels?: Record<string, LocalizedText>;
     };
 }
+/**
+ * Tell whether an attribute carries a given semantic role.
+ *
+ * @param attr attribute definition
+ * @param role role to look for
+ * @returns true when the attribute declares that role
+ */
+export declare function hasRole(attr: SchemaAttribute | undefined, role: SchemaRole): boolean;
+/**
+ * Find the attribute of a schema carrying a given semantic role.
+ *
+ * This is the lookup that keeps core code free of concrete attribute names:
+ * `roleAttribute(schema, 'accountStatus')` returns `twakeAccountStatus` for a
+ * Twake directory and whatever another deployment chose for its own.
+ *
+ * @param schema entity schema
+ * @param role role to look for
+ * @returns attribute name, or undefined when no attribute declares that role
+ */
+export declare function roleAttribute(schema: Schema | undefined, role: SchemaRole): string | undefined;
+/**
+ * Find every attribute of a schema carrying a given semantic role.
+ *
+ * @param schema entity schema
+ * @param role role to look for
+ * @returns attribute names, in declaration order
+ */
+export declare function roleAttributes(schema: Schema | undefined, role: SchemaRole): string[];
+/**
+ * Find an attribute definition by the name a request or the directory uses.
+ *
+ * LDAP attribute names are case-insensitive and may carry options
+ * (`cn;lang-fr`), while schema keys are written in one spelling. Looking a
+ * name up verbatim lets `TWAKEDEPARTMENTPATH` slip past a rule written for
+ * `twakeDepartmentPath`, though the directory treats both as the same.
+ *
+ * @param schema entity schema
+ * @param name attribute name, in any case, with or without options
+ * @returns the schema's own spelling and the definition, or undefined
+ */
+export declare function schemaAttribute(schema: Schema | undefined, name: string): [string, SchemaAttribute] | undefined;
+/**
+ * Every attribute name a modify request touches: added, replaced or deleted.
+ *
+ * A delete counts as much as a replace: removing a computed attribute is
+ * setting it, to nothing, and nothing the client does afterwards can put it
+ * back. `delete` comes as a list of names or as an object of values to remove.
+ *
+ * @param body modify request
+ * @returns attribute names, as the client spelt them
+ */
+export declare function modifiedAttributeNames(body: {
+    add?: object;
+    replace?: object;
+    delete?: string[] | object;
+}): string[];
+/**
+ * Lowercased names of the attributes marked `neverReturn` in any of the given
+ * schemas.
+ *
+ * @param schemas schemas to read, undefined entries skipped
+ * @returns lowercased attribute names
+ */
+export declare function neverReturnAttributes(schemas: Iterable<Schema | undefined>): Set<string>;
+/**
+ * Copy an entry without the attributes of a hidden set.
+ *
+ * @param entry entry about to be serialised
+ * @param hidden lowercased attribute names to leave out
+ * @returns the entry itself when nothing is hidden, a filtered copy otherwise
+ */
+export declare function withoutAttributes<T extends object>(entry: T, hidden: Set<string>): T;
+/**
+ * Check the DNs an attribute carries: a `pointer`, or an array whose `items`
+ * are pointers or declare a `branch`.
+ *
+ * Each DN has to sit inside one of the declared branches, compared RDN by RDN
+ * (a suffix match reads `uid=x,xou=users,…` as inside `ou=users,…`), and a
+ * pointer has to name an entry that exists. The flat entities checked the
+ * branch of a single pointer; organizations and groups read neither `items`
+ * rule, so an organization accepted a domain link to a DN outside the domains
+ * branch, or to none at all — and lost its mail-domain restriction with it.
+ *
+ * @param field attribute name, for the messages
+ * @param attr its schema definition
+ * @param value value submitted
+ * @param entryExists tells whether a DN names an existing entry
+ * @throws BadRequestError naming the first DN that breaks a rule
+ */
+export declare function checkDnValues(field: string, attr: SchemaAttribute, value: AttributeValue, entryExists: (dn: string) => Promise<boolean>): Promise<void>;
+/**
+ * Tell whether every value of an attribute matches its pattern: `test`, or
+ * `items.test` for the elements of an array.
+ *
+ * @param attr schema definition
+ * @param value value submitted
+ * @returns false when one value does not match
+ */
+export declare function matchesPattern(attr: SchemaAttribute, value: AttributeValue): boolean;
+/**
+ * Refuse a payload naming an attribute the server owns.
+ *
+ * `generated` and `readOnly` say a value is not the client's to set. The flat
+ * entities enforce it on their own paths; organizations and groups have their
+ * own routes and need the same guard, or an endpoint promising that a computed
+ * path "cannot be changed here" quietly accepts one.
+ *
+ * @param schema entity schema, when one is loaded
+ * @param names attribute names carried by the request
+ * @param mainAttribute RDN attribute, exempt when nothing derives it
+ * @throws BadRequestError naming the first attribute the client may not set
+ */
+export declare function assertClientMaySet(schema: Schema | undefined, names: string[], mainAttribute?: string): void;
+/**
+ * A plugin able to say whether it fills a given generated attribute.
+ *
+ * Declaring the method is the whole contract: an entity asks before it
+ * exempts a required attribute from its check, so the answer has to be about
+ * that attribute, not about a role the plugin happens to carry.
+ */
+export interface GeneratedAttributeFiller {
+    fillsGeneratedAttribute?: (name: string, attr: SchemaAttribute, schema: Schema) => boolean;
+}
+/**
+ * Name the first required attribute a new entry fails to provide.
+ *
+ * A `generated` attribute is exempt: it is filled by a hook *after*
+ * validation, on purpose — checks must see the payload as the client sent it,
+ * never a value the server has already rewritten.
+ *
+ * Exempt only when something will actually fill it. `generatedFrom` is
+ * derived by the entity itself; for the rest, ask the loaded plugins about
+ * *this* attribute rather than trusting a role a dozen of them carry. With no
+ * filler — a server upgraded without adding `core/ldap/enterpriseRules` —
+ * exempting would write an entry missing an attribute its own schema calls
+ * required, silently, and the client could not supply it either since
+ * `generated` is refused as input. The entry would be unwritable by any
+ * route, so demand it and say so instead.
+ *
+ * Every entity runs this check: the flat branches, the organizations and the
+ * groups, each wording the refusal in its own terms.
+ *
+ * @param schema entity schema, when one is loaded
+ * @param entry entry as the client sent it
+ * @param plugins loaded plugins, asked about each generated attribute
+ * @returns the attribute name to complain about, or undefined
+ */
+export declare function missingRequiredAttribute(schema: Schema | undefined, entry: Record<string, unknown>, plugins: Record<string, unknown>): string | undefined;

package/dist/src/lib/expressFormatedResponses.d.ts

@@ -11,6 +11,20 @@ export declare const tryMethodData: (res: Response, method: Function, ...args: u
 export declare const ok: (res: Response, data?: object) => void;
 export declare const created: (res: Response, data?: object) => void;
 export declare const noContent: (res: Response) => void;
+/**
+ * A request whose parts did not all succeed, and whose failure cannot be
+ * undone (RFC 4918 section 13).
+ *
+ * An entry rename rewrites the references other entries hold to it. The
+ * rename itself is the only rollback point: once the directory has accepted
+ * it, a reference that could not be rewritten leaves the directory partly
+ * inconsistent, and answering 200 would hide it while answering 500 would
+ * claim nothing happened. The body says what was done and what was not.
+ *
+ * @param res express response
+ * @param data report of what succeeded and what did not
+ */
+export declare const multiStatus: (res: Response, data: object) => void;
 export declare const badRequest: (res: Response, message?: string) => void;
 export declare const unauthorized: (res: Response, message?: string) => void;
 export declare const forbidden: (res: Response, message?: string) => void;