ldap-rest 0.7.0 → 0.8.1

package/dist/src/plugins/ldap/accountLifecycle.d.ts

@@ -0,0 +1,56 @@
+import type { Express } from 'express';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+/**
+ * Draw a password from {@link PASSWORD_ALPHABET} with a uniform distribution.
+ *
+ * Bytes whose value would wrap the alphabet are discarded rather than folded
+ * with a modulo, which would make the first characters of the alphabet more
+ * likely than the last.
+ *
+ * @param length number of characters
+ * @returns the generated password
+ */
+export declare function generatePassword(length?: number): string;
+export default class LdapAccountLifecycle extends DmPlugin {
+    name: string;
+    roles: Role[];
+    dependencies: {
+        ldapFlatGeneric: string;
+    };
+    /**
+     * Register the lifecycle endpoints of every flat entity whose schema asks
+     * for them.
+     *
+     * @param app Express application
+     */
+    api(app: Express): void;
+    /**
+     * Apply a named state to an account.
+     *
+     * @param entity flat entity holding the account
+     * @param attribute attribute carrying the state
+     * @param states state names declared by the schema
+     * @param req Express request
+     * @param res Express response
+     */
+    private setStatus;
+    /**
+     * Replace an account's credential, and flag it for a change at next login
+     * when the schema knows how to.
+     *
+     * @param entity flat entity holding the account
+     * @param attribute attribute carrying the credential
+     * @param req Express request
+     * @param res Express response
+     */
+    private resetPassword;
+    /**
+     * Apply a change through the entity's own modify path, turning a missing
+     * entry into a 404 rather than a directory error.
+     *
+     * @param entity flat entity holding the account
+     * @param id identifier or DN of the entry
+     * @param changes modification to apply
+     */
+    private modify;
+}

package/dist/src/plugins/ldap/departmentSync.d.ts

@@ -15,7 +15,50 @@ export default class LdapDepartmentSync extends DmPlugin {
     private linkAttr;
     private pathAttr;
     constructor(server: DM);
+    /**
+     * The attribute holding an organization's path: the `organizationPath` role
+     * of the organization schema, then the configured name.
+     *
+     * Role first, as the enterprise rules read it: a deployment naming the
+     * attribute only through the role otherwise saw nothing recomputed, and
+     * nothing said so. Resolved on each call, the organization schema being
+     * read asynchronously.
+     *
+     * @returns the attribute name
+     */
+    private organizationPathAttribute;
+    /**
+     * The link and path attributes of the entries attached to an organization:
+     * those every loaded entity schema declares through the `organizationLink`
+     * and `organizationPath` roles, then the configured names.
+     *
+     * @returns distinct pairs, the ones declared by roles first
+     */
+    private linkedAttributes;
     hooks: Hooks;
+    /**
+     * Recompute the path of a renamed or moved organization and of every
+     * organization below it.
+     *
+     * A path names an organization's ancestors, root first, its own name last,
+     * the top organization left out. Moving or renaming one therefore changes
+     * the path of its whole subtree. Only the entries *linked* to the tree used
+     * to be updated, from paths the tree itself still held: the organizations
+     * kept the path of their former parent, the linked users were rewritten to
+     * it, and nothing could correct it since the path is computed by the server.
+     *
+     * Only organizations already holding a path are written.
+     *
+     * @param orgDn DN of the organization after the rename
+     */
+    private updateOrganizationPaths;
+    /**
+     * Read the path an organization holds.
+     *
+     * @param dn organization DN
+     * @returns its path, or null when it holds none or cannot be read
+     */
+    private readPath;
     /**
      * Update resources that are directly linked to the renamed organization
      */

package/dist/src/plugins/ldap/enterpriseRules.d.ts

@@ -0,0 +1,436 @@
+/**
+ * @module plugins/ldap/enterpriseRules
+ * @author Xavier Guimard <xguimard@linagora.com>
+ *
+ * Business rules an enterprise directory needs on top of declarative schema
+ * validation: uniqueness across a shared namespace, mail addresses confined to
+ * the domains an organization owns, computed organization paths, normalised
+ * quotas, and referential-integrity guards on deletion.
+ *
+ * Nothing here knows a concrete attribute name, a domain, or a nomenclature
+ * value. Every rule is driven by the loaded entity schemas — their semantic
+ * `role`s and their per-attribute markers (`unique`, `mailDomainScope`,
+ * `normalize`, `referentialIntegrity`, `deleteGuard`) — so the same code
+ * serves a directory laid out differently without a line of change.
+ *
+ * ## Order of evaluation
+ *
+ * Checks run **before** transformations, and both run inside the same hook.
+ * A check therefore always sees the payload as the client sent it: uniqueness
+ * and domain rules validate the address that was submitted, never one the
+ * server has already rewritten, and an identifier derived from that address
+ * cannot influence the check that justified it.
+ *
+ * ## What "a reference" is, and the one case this cannot see
+ *
+ * Two rules — the delete guard and the rename cascade — have to find every
+ * entry naming another one by its DN. They look in two places, both declared
+ * by the schemas: every `pointer` (single, or under `items`) whose `branch`
+ * admits the target, and every attribute carrying the `members` or `owners`
+ * role. The second is not redundant: a group's member list cannot be a
+ * pointer, since pointer validation requires the target to exist and a group
+ * legitimately holds the DN of an external member that has none.
+ *
+ * A deployment whose schema stores a DN in an attribute that is neither of
+ * those — a plain `string` carrying no role — is therefore not covered: its
+ * value is left naming the old DN after a rename, and does not hold a
+ * deletion back. Declare such an attribute as a `pointer`, or give it the
+ * role it plays. No marker is invented here to cover the gap: a marker
+ * meaning "this happens to contain a DN" would be a third way of saying what
+ * `pointer` and the roles already say.
+ * @group Plugins
+ */
+import type { Request } from 'express';
+import DmPlugin, { type Role } from '../../abstract/plugin';
+import type { DM } from '../../bin';
+import type { Hooks } from '../../hooks';
+import type { AttributeValue } from '../../lib/ldapActions';
+import type { Schema, SchemaAttribute } from '../../config/schema';
+/**
+ * One place a DN is stored: which entry, in which attribute, and what that
+ * attribute currently holds there.
+ */
+export interface DnReference {
+    /** Entry holding the reference */
+    dn: string;
+    /** Attribute it sits in, in the schema's spelling */
+    attribute: string;
+    /**
+     * Every value the attribute holds in that entry, as the directory spells
+     * them. Kept whole rather than reduced to the matching one: a rewrite
+     * deletes the spelling the directory actually stores, not the one the
+     * caller typed, and it has to know whether the new DN is already there.
+     */
+    values: string[];
+    /** True when the schema declares a list rather than a single value */
+    multiValued: boolean;
+}
+/** What a reference rewrite did, and what it could not do. */
+export interface ReferenceRewriteReport {
+    /** References rewritten */
+    updated: number;
+    /**
+     * References left naming the old DN, counted per attribute. The referring
+     * DNs are deliberately absent: the caller owns the entry it renamed, not
+     * the entries pointing at it — the same care `checkUnique` and
+     * `guardReferences` take. They are in the log.
+     */
+    failed: {
+        attribute: string;
+        count: number;
+    }[];
+}
+/**
+ * Read a human-readable size and return a number of bytes.
+ *
+ * `5GB`, `500 MB`, `2048` and `2048B` are all accepted; the multipliers are
+ * decimal (1 GB = 10⁹ bytes), which is what mail servers report.
+ *
+ * @param raw value as submitted
+ * @returns the size in bytes
+ * @throws BadRequestError when the value is not a size
+ */
+export declare function parseByteSize(raw: AttributeValue): number;
+/**
+ * Tell whether the enterprise rules fill a generated attribute: a default the
+ * server owns, applied on creation, or the organization path, derived from the
+ * link or from the tree.
+ *
+ * A function of the schema alone, so that `audit:directory` asks the same
+ * question the server asks without loading the plugin.
+ *
+ * @param name attribute name
+ * @param attr its schema definition
+ * @param schema schema it belongs to
+ * @returns true when the rules supply a value
+ */
+export declare function fillsGeneratedAttribute(name: string, attr: SchemaAttribute, schema: Schema): boolean;
+/**
+ * Parse a directory date: an LDAP generalized time or anything `Date`
+ * understands.
+ *
+ * A generalized time (RFC 4517 section 3.3.13) is `yyyyMMddHH`, then optional
+ * minutes and seconds, an optional fraction of the last unit given, and a zone:
+ * `Z` or an offset of hours with optional minutes (`+02`, `-0530`). `Date` reads
+ * none of the shorter forms, and not an offset of bare hours, so they are
+ * computed here rather than rewritten into an ISO string it might refuse.
+ *
+ * @param raw value as stored or submitted
+ * @returns the date, or null when it cannot be read
+ */
+export declare function parseDirectoryDate(raw: AttributeValue): Date | null;
+/**
+ * Start of a day, in UTC.
+ *
+ * A directory stores generalized times in UTC, and a console that lets someone
+ * pick a day stores it as `yyyyMMdd000000Z`. Comparing that against the
+ * server's *local* midnight refused a date picked today on every server west
+ * of UTC, where local midnight comes hours after midnight UTC: the deployment's
+ * timezone decided whether the form worked. Both sides are in UTC now.
+ *
+ * @param now instant to take the day from, the current one by default
+ * @returns midnight UTC of that day, in milliseconds
+ */
+export declare function startOfUtcDay(now?: Date): number;
+/**
+ * Tell whether a mail address belongs to one of a set of domains.
+ *
+ * The host is taken after the *last* `@`, so the comparison cannot be fooled
+ * by a prefix — the address format itself is the schema's business. A single
+ * `*` among the domains authorises every domain.
+ *
+ * @param mail address to test
+ * @param domains authorised domains; an empty list authorises everything
+ * @param allowSubdomains accept `list@lists.example.org` under `example.org`
+ * @returns true when the address is authorised
+ */
+export declare function mailInDomains(mail: string, domains: string[], allowSubdomains?: boolean): boolean;
+export default class LdapEnterpriseRules extends DmPlugin {
+    name: string;
+    roles: Role[];
+    /** Placeholder member some directories keep to satisfy `groupOfNames` */
+    private dummyMember?;
+    /** Root of the organization tree */
+    private topOrganization?;
+    constructor(server: DM);
+    /**
+     * Tell whether this plugin fills a given generated attribute.
+     *
+     * `ldapFlat` exempts a required attribute from its check when the schema
+     * marks it generated, which is only sound if something will honour the
+     * bargain. It asks every loaded plugin, so the answer has to be about this
+     * attribute, not about a role a dozen plugins happen to carry.
+     *
+     * @param name attribute the entity is about to demand
+     * @param attr its schema definition
+     * @param schema schema it belongs to
+     * @returns true when a hook here will supply a value
+     */
+    fillsGeneratedAttribute(name: string, attr: SchemaAttribute, schema: Schema): boolean;
+    /**
+     * Entities the rules apply to, rebuilt on each call.
+     *
+     * The organization and group plugins read their schema asynchronously, so a
+     * snapshot taken in the constructor would miss them; the list is cheap to
+     * rebuild since it only collects references.
+     *
+     * @returns one binding per entity whose schema is loaded
+     */
+    private bindings;
+    /**
+     * Find the entity a DN belongs to: the binding with the longest matching
+     * base, so a group branch nested inside the user branch still wins over it.
+     *
+     * @param dn entry being written
+     * @returns the binding, or undefined when the DN belongs to no known entity
+     */
+    private resolveEntity;
+    hooks: Hooks;
+    /**
+     * Validate a payload against the schema markers that need the directory:
+     * uniqueness, mail domains and lifecycle dates.
+     *
+     * @param entity entity the entry belongs to
+     * @param dn entry being written; excluded from uniqueness searches
+     * @param values attributes as submitted
+     * @param current entry as currently stored, on a modification
+     */
+    private runChecks;
+    /**
+     * Apply the value rewrites the server owns: normalisation, defaults for
+     * attributes it fills itself, and the organization path derived from the
+     * organization link.
+     *
+     * @param entity entity the entry belongs to
+     * @param values attributes as submitted; mutated in place
+     * @param creating true on a creation, where defaults apply
+     */
+    private runTransformations;
+    /**
+     * Refuse a value already used elsewhere.
+     *
+     * Two things the rule this replaces got wrong are fixed here: values are
+     * compared by content, and the entry being updated is excluded from the
+     * search — so re-sending an unchanged name no longer conflicts with itself.
+     *
+     * @param entity entity the entry belongs to
+     * @param name attribute being checked
+     * @param attr its schema definition
+     * @param values values submitted for it
+     * @param selfDn DN to exclude, on a modification
+     * @throws ConflictError naming the entry that already holds the value
+     */
+    private checkUnique;
+    /**
+     * Refuse a mail address outside the domains its organization may use.
+     *
+     * @param entity entity the entry belongs to
+     * @param attr schema definition of the mail attribute
+     * @param values addresses submitted
+     * @param submitted attributes as submitted, read for the organization link
+     * @param current entry as stored, when the link is not being changed
+     * @throws BadRequestError when no organization can be resolved
+     * @throws ConflictError when the address is outside the authorised domains
+     */
+    private checkMailDomains;
+    /**
+     * Domains an entry may use, walking up from its organization to the root of
+     * the tree and collecting what each level declares. An organization that
+     * declares none inherits whatever its ancestors allow; when nobody declares
+     * anything, no restriction applies.
+     *
+     * @param entity entity the entry belongs to
+     * @param submitted attributes as submitted
+     * @param current entry as stored, when the link is not being changed
+     * @returns the authorised domain names
+     */
+    private organizationDomains;
+    /**
+     * Attribute holding the mail domain of a domain entry.
+     *
+     * Role first, as its sibling `domainLink` is: a deployment naming the
+     * attribute otherwise and declaring the role is exactly what the marker is
+     * for, and reading only the option made the rule search an attribute its
+     * entries do not have — and accept every address, silently.
+     *
+     * @returns the attribute name
+     */
+    private domainNameAttribute;
+    /** Every mail domain declared anywhere in the directory. */
+    private directoryDomains;
+    /**
+     * Refuse a lifecycle date that has already passed. The comparison is against
+     * the start of the current day *in UTC*, the timezone the values themselves
+     * are written in, so scheduling something for today is allowed — which is
+     * what "not earlier than today" means to the person filling the form,
+     * wherever the server happens to stand.
+     *
+     * @param name attribute being checked
+     * @param attr its schema definition
+     * @param values dates submitted
+     * @throws BadRequestError when a date is unreadable or in the past
+     */
+    private checkNotInThePast;
+    /**
+     * Read the human-readable path of an organization.
+     *
+     * @param orgDn DN of the organization
+     * @returns the path, or undefined when the organization carries none
+     */
+    private organizationPath;
+    /**
+     * Refuse a deletion that would leave the directory inconsistent: an entry
+     * other entries still point at, or a group that still has members.
+     *
+     * @param dn entry about to be deleted
+     * @throws ConflictError naming what still depends on the entry
+     */
+    private guardDelete;
+    /**
+     * Refuse to delete an entry that a `referentialIntegrity: restrict` pointer
+     * still names. The pointers are read from the schemas themselves, so a new
+     * reference is protected by declaring it, not by editing this file.
+     *
+     * @param dn entry about to be deleted
+     * @throws ConflictError naming the first referencing entry
+     */
+    private guardReferences;
+    /**
+     * Every attribute of every loaded entity that could hold this DN.
+     *
+     * This is the traversal the delete guard and the rename cascade share: it
+     * knows no attribute name, only what the schemas declare — a `pointer`
+     * (single or under `items`) whose `branch` admits the DN's parent, or an
+     * attribute carrying the `members` or `owners` role. The module header says
+     * why both are needed and what neither covers.
+     *
+     * The branch narrowing is what keeps the searches few: only the attributes
+     * that could legally name an entry of this branch are looked into.
+     *
+     * @param dn entry being deleted or renamed
+     * @returns one candidate per (entity, attribute) pair
+     */
+    private referringAttributes;
+    /**
+     * Entries whose attribute holds a given DN.
+     *
+     * Run without a request, like every other lookup here: these rules answer
+     * about the directory as a whole. A rename that only rewrote the references
+     * its caller happens to be able to read would leave the rest silently
+     * wrong; the writes are authorized one by one instead.
+     *
+     * @param candidate entity and attribute to look into
+     * @param dn DN to look for
+     * @returns the matching entries, carrying that attribute
+     */
+    private searchReferrers;
+    /**
+     * Every reference the directory holds to a DN.
+     *
+     * A reference is a stored value, so this answers about a DN whether or not
+     * an entry still carries it — which is what lets the rename ask again
+     * afterwards, and what lets a repair run find what an interrupted one left
+     * behind.
+     *
+     * @param dn DN to look for
+     * @returns one entry per (referring entry, attribute) pair
+     */
+    findReferences(dn: string): Promise<DnReference[]>;
+    /**
+     * Identity of a reference, for comparing the two passes below.
+     *
+     * @param reference reference to name
+     * @returns a key equal for the same attribute of the same entry
+     */
+    private static referenceKey;
+    /**
+     * Point every reference at the new DN.
+     *
+     * Each rewrite is attempted on its own and its failure collected rather
+     * than thrown: the rename itself has already been committed by the time
+     * this runs, so refusing the whole thing would report a directory state
+     * that does not exist. The caller answers 207 with this report.
+     *
+     * The write is a plain modify, never the group plugin's member API: that
+     * one fires member validation, which creates missing external members —
+     * work that has no business running while an existing DN is being respelled.
+     *
+     * **The directory may have done part of the work already.** OpenLDAP's
+     * `refint` overlay rewrites the attributes it is configured for — `member`,
+     * `owner`, `uniqueMember`, `manager`, `memberOf` in the stock configuration
+     * — the moment a `modifyDN` lands, and knows nothing of the rest. Which
+     * attributes, and whether the overlay is there at all, is a property of the
+     * deployment. So the references are looked for a second time, *after* the
+     * rename: what is still stale is what this has to write, and what is no
+     * longer there was written by the directory itself and counts as done.
+     * Re-adding a value the overlay had already added is refused with
+     * `attributeOrValueExists`, which would have been reported as a 207 on a
+     * directory that was in fact perfectly consistent.
+     *
+     * @param references what {@link findReferences} found, before the rename
+     * @param oldDn DN as it was
+     * @param newDn DN as it now is
+     * @param req request the rename came from, so each write is authorized
+     * @returns how many references now name the new DN, and what was left behind
+     */
+    rewriteReferences(references: DnReference[], oldDn: string, newDn: string, req?: Request): Promise<ReferenceRewriteReport>;
+    /**
+     * Respell one reference, converging when the directory is respelling it at
+     * the same moment.
+     *
+     * `refint` does its fixups in a task of its own, *after* the `modifyDN` has
+     * answered, so a rewrite of one of its attributes is a race nobody can win
+     * by looking first: the overlay may land between the search and the modify.
+     * Both outcomes of that race say the same thing —
+     * `attributeOrValueExists` that the new DN is already in, `noSuchAttribute`
+     * that the old one is already out — so the entry is read again and the
+     * remaining half, if any, is applied. Anything else is a real failure.
+     *
+     * @param ldap directory to write through, bound to the request
+     * @param reference reference to rewrite
+     * @param stale canonical form of the old DN
+     * @param target canonical form of the new DN
+     * @param newDn new DN, as it is to be written
+     * @throws whatever the directory answered, when it is not a race
+     */
+    private applyRewrite;
+    /**
+     * Read one attribute of one entry, past the cache.
+     *
+     * The cached copy may predate a write nobody here made — `refint` fixing
+     * its own attributes — and the cache is only invalidated by the writes
+     * this process performs.
+     *
+     * @param dn entry to read
+     * @param name attribute to read
+     * @returns its values, as the directory spells them
+     */
+    private freshValues;
+    /**
+     * The modification that respells one reference.
+     *
+     * A list has the stale values deleted and the new one added, so the other
+     * members of a group are left alone — and nothing is added when the new DN
+     * is already there, which is what a repair run finds. A single-valued
+     * attribute is replaced instead: `ldapActions` emits an `add` before a
+     * `delete`, which a single-valued attribute refuses, and the replacement is
+     * built from the values read so that a directory holding more than the
+     * schema says loses none of them.
+     *
+     * @param reference reference to rewrite
+     * @param stale canonical form of the old DN
+     * @param target canonical form of the new DN
+     * @param newDn new DN, as it is to be written
+     * @returns the changes, or undefined when there is nothing to do
+     */
+    private rewrite;
+    /**
+     * Read a single entry, without a request so the lookup is not narrowed by
+     * the caller's own permissions: these rules answer about the directory as a
+     * whole, not about what one manager may see.
+     *
+     * @param dn entry to read
+     * @returns the entry, or null when it does not exist
+     */
+    private readEntry;
+}

package/dist/src/plugins/ldap/flatGeneric.d.ts

@@ -2,12 +2,41 @@ import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 import LdapFlat from '../../abstract/ldapFlat';
 import type { DM } from '../../bin';
+import type { LocalizedText } from '../../config/schema';
+/**
+ * Collections the other LDAP plugins serve under the same `/v1/ldap/` prefix,
+ * with the plugin that serves each: its registry name, and the module paths a
+ * configuration loads it by.
+ *
+ * They are listed rather than read from the plugins because those write their
+ * routes literally — `scripts/generate-openapi.ts` reads the route text, and a
+ * `${this.pluralName}` there would document `/v1/ldap/{resource}` instead of
+ * the real path. `test/plugins/ldap/flatGenericPluginClash.test.ts` checks
+ * this list against the routes those plugins really register, so it cannot
+ * drift away from them in silence.
+ */
+export declare const ldapPluginCollections: {
+    plugin: string;
+    modules: string[];
+    collection: string;
+}[];
 /**
  * Concrete implementation of LdapFlat for generic instances
  */
 declare class LdapFlatInstance extends LdapFlat {
     name: string;
     roles: Role[];
+    /** Names a client shows for the collection and for one entry */
+    label?: LocalizedText;
+    singularLabel?: LocalizedText;
+    /**
+     * What a client shows for an entry, keyed by its main attribute value. Also
+     * reachable nested in `schema.entity.valueLabels` (the whole schema file is
+     * exposed as `schema`); mirrored here, like `label`, so a client finds it
+     * at the top level of a `flatResources` entry rather than three levels
+     * down under a property `Schema` never declared.
+     */
+    valueLabels?: Record<string, LocalizedText>;
     dependencies: {
         departmentSync: string;
     };

package/dist/src/plugins/ldap/groups.d.ts

@@ -94,6 +94,28 @@ export default class LdapGroups extends DmPlugin {
      * API routes
      */
     api(app: Express): void;
+    /**
+     * Whether a member is the placeholder `groupOfNames` needs to stay valid
+     * with no real member.
+     *
+     * Compared as DNs, not as text: the directory answers with its own spelling
+     * of a DN, and `uid=fakeUser,ou=users,…` configured must match the
+     * `uid=fakeuser, ou=users,…` it may hold.
+     *
+     * @param member DN of a member
+     * @returns true for the placeholder
+     */
+    isDummyMember(member: string): boolean;
+    /**
+     * An entry with the placeholder taken out of its members. It is there for
+     * the directory's schema, not for anyone reading the group: listed, it
+     * reads as a person, and a client editing the list would offer to remove
+     * the one member the server refuses to remove.
+     *
+     * @param entry group as read
+     * @returns the same entry, members filtered
+     */
+    withoutDummyMember<T extends Record<string, unknown>>(entry: T): T;
     apiGet(req: Request, res: Response): Promise<void>;
     apiAdd(req: Request, res: Response, ...requiredFields: string[]): Promise<void>;
     apiDelete(req: Request, res: Response): Promise<void>;

package/dist/src/plugins/ldap/organizations.d.ts

@@ -121,9 +121,14 @@ export default class LdapOrganizations extends DmPlugin {
     checkDeptLink(entry: AttributesList): Promise<void>;
     /**
      * Check if the department path is valid
+     *
      * @param entry LDAP entry to check
+     * @param dn DN the entry is written at, when the caller knows it. It is
+     *   what says whether the entry is an organization and where it hangs
+     *   from; a modify carries the changed attributes alone, neither `ou` nor
+     *   `objectClass`, so without it the invariants below cannot be checked.
      */
-    checkDeptPath(entry: AttributesList): Promise<void>;
+    checkDeptPath(entry: AttributesList, dn?: string): Promise<void>;
     isEmptyOrganization(dn: string): Promise<void>;
     /**
      * Check if entry is an organisation
@@ -136,9 +141,25 @@ export default class LdapOrganizations extends DmPlugin {
     getOrganisationSubnodes(dn: string, req?: Request): Promise<AttributesList[]>;
     addOrganization(dn: string, entry: AttributesList, req?: Request): Promise<boolean>;
     modifyOrganization(dn: string, changes: ModifyRequest): Promise<boolean>;
-    validateNewOrganization(dn: string, entry: AttributesList): boolean;
-    validateChanges(dn: string, changes: ModifyRequest): boolean;
-    _validateOneChange(field: string, value: AttributeValue | null): boolean;
+    validateNewOrganization(dn: string, entry: AttributesList): Promise<boolean>;
+    /**
+     * Build the rejection message for a value that failed its schema `test`,
+     * quoting the `hint` when the schema carries one so the answer says what a
+     * valid value looks like.
+     *
+     * @param field attribute name
+     * @returns message for a `BadRequestError`
+     */
+    invalidValueMessage(field: string): string;
+    validateChanges(dn: string, changes: ModifyRequest): Promise<boolean>;
+    _validateOneChange(field: string, value: AttributeValue | null): Promise<boolean>;
+    /**
+     * Tell whether a DN names an existing entry.
+     *
+     * @param dn DN to look up
+     * @returns true when the directory holds it
+     */
+    private entryExists;
     /**
      * Move an organization to a different parent organization
      * Uses LDAP modifyDN to change the DN hierarchy