ldap-rest 1.1.0 → 1.2.1

package/dist/src/bin/index.d.ts

@@ -30,7 +30,9 @@ export declare class DM {
     app: express.Express;
     config: Config;
     ready: Promise<void>;
-    server?: import('http').Server;
+    /** The listener, once `run()` opened it; shared by the `withConfig` views */
+    get server(): import('http').Server | undefined;
+    set server(server: import('http').Server | undefined);
     hooks: {
         [K in keyof Hooks]?: Function[];
     };
@@ -60,6 +62,21 @@ export declare class DM {
      * assembled by hand — is checked on its own as it arrives.
      */
     private _composed;
+    /** Every plugin loaded and the composition checked */
+    get composed(): boolean;
+    /**
+     * The listener, the shutdown once started, and the rejections nobody
+     * handled since the start. In an object, shared by the `withConfig` views
+     * as `_authState` is: a view with a flag of its own would stop on its own,
+     * and one without the listener would not close it.
+     */
+    private readonly life;
+    /** The responses not sent yet, told to close their connection on a stop */
+    private readonly inFlight;
+    /** Told to stop: the readiness says so, what is in flight finishes */
+    get stopping(): boolean;
+    /** Rejections nobody handled since the start, logged and counted */
+    get unhandledRejections(): number;
     private _errorMiddleware?;
     /**
      * The loads of `--plugin` entries without overrides, keyed by resolved
@@ -195,8 +212,36 @@ export declare class DM {
      */
     warnUnauthenticatedRoutes(): string[];
     setupErrorMiddleware(): void;
+    /**
+     * Exit on a failure nothing caught: an exception leaves the process in a
+     * state nobody knows, so it shuts down as cleanly as it can, within the
+     * shutdown budget, and exits with 1 for its supervisor to start it again.
+     * A rejection nothing handled is logged and counted; the request that
+     * owned it has been answered or will time out.
+     *
+     * For the binary; a host assembling the server decides for itself, and
+     * without it Node's own action applies.
+     */
+    exitOnCrash(): void;
     run(): Promise<void>;
     stop(): void;
+    /**
+     * Stop serving: the readiness answers 503, the listening socket closes,
+     * what is in flight finishes, then every plugin's `close()` runs and the
+     * directory connections are closed, the whole within `--shutdown-timeout`
+     * whatever hangs. Called once; a second call waits for the first.
+     *
+     * @returns when everything let go, resolved whatever failed on the way
+     */
+    shutdown(): Promise<void>;
+    private letGo;
+    /** @returns whether `done` settled before `ms` passed */
+    private static within;
+    /**
+     * Shut down on SIGTERM and SIGINT, then let the signal end the process.
+     * For the binary; a host assembling the server decides for itself.
+     */
+    shutdownOnSignals(): void;
     /**
      * The module part of a `--plugin` entry.
      *

package/dist/src/config/args.d.ts

@@ -32,7 +32,10 @@ export interface Config {
     plugin?: string[];
     schemas_path: string;
     log_level: 'error' | 'warn' | 'notice' | 'info' | 'debug';
-    logger: 'console';
+    shutdown_timeout?: number;
+    debug: boolean;
+    logger: 'console' | 'file';
+    log_file?: string;
     api_prefix: string;
     mail_domain?: string[];
     ldap_base?: string;
@@ -53,6 +56,8 @@ export interface Config {
     groups_allow_unexistent_members?: boolean;
     group_dummy_user?: string;
     group_schema?: string;
+    /** Where core/metrics serves `GET /metrics` */
+    metrics_port?: number;
     /**
      * Keyed storage, shared by whoever needs to keep something with a
      * deadline. `storage_backend` names the sub-plugin that keeps it; the rest
@@ -197,6 +202,12 @@ export interface Config {
     james_mailbox_type_attribute?: string;
     james_sync_forwards?: boolean;
     james_team_mailbox_any_domain?: boolean;
+    migration_proxy_url?: string;
+    migration_proxy_token?: string;
+    migration_proxy_branch?: string[];
+    migration_proxy_concurrency?: number;
+    migration_proxy_retry_attempts?: number;
+    migration_proxy_retry_delay?: number;
     twake_drive_webadmin_url?: string;
     twake_drive_webadmin_token?: string;
     twake_drive_concurrency?: number;

package/dist/src/lib/changeContext.d.ts

@@ -14,6 +14,17 @@ export interface ChangeContext {
  * @param source its name, e.g. `scim`
  */
 export declare function setChangeSource(req: Request, source: string): void;
+/**
+ * The identifier of a request, shared by its writes, its log lines and the
+ * `X-Request-Id` of its answer.
+ *
+ * Generated rather than read from an `X-Request-Id` header: a client could
+ * otherwise make the writes of two requests look like one.
+ *
+ * @param req the request
+ * @returns its identifier, the same on every call
+ */
+export declare function requestId(req: Request): string;
 /**
  * The context of a write, handed to the "done" hooks.
  *

package/dist/src/lib/entitySchema/validator.d.ts

@@ -0,0 +1,64 @@
+import type { AttributesList, AttributeValue, ModifyRequest } from '../ldapActions';
+import type { Schema } from '../../config/schema';
+export interface EntityValidatorDeps {
+    /**
+     * Tells whether a DN names an entry. Asked as the server: a reference to
+     * an entry the caller cannot read is still a valid reference.
+     */
+    entryExists: (dn: string) => Promise<boolean>;
+    /** Asked whether a `generated` attribute will be filled after validation */
+    loadedPlugins: Record<string, unknown>;
+    /** Names the entity in the messages */
+    singularName: string;
+}
+/**
+ * Enforces an entity schema on what a client sends: the entry of a creation
+ * and the parts of a change. Every refusal is a `BadRequestError`.
+ *
+ * See `docs/client-development/schemas/README.md` for the rules.
+ */
+export declare class EntityValidator {
+    private readonly schema;
+    private readonly deps;
+    constructor(schema: Schema | undefined, deps: EntityValidatorDeps);
+    /**
+     * Check a new entry, then convert it in place for the directory.
+     *
+     * @param entry entry as the client sent it, `objectClass` included
+     */
+    validateNew(entry: AttributesList): Promise<void>;
+    /**
+     * Check the parts of a change, then convert them in place. No value under
+     * a name is the empty list for the directory layer, which clears the
+     * attribute in a `replace` and refuses it in an `add`.
+     *
+     * @param changes change as the client sent it
+     */
+    validateChanges(changes: ModifyRequest): Promise<void>;
+    /**
+     * Check one value against its attribute's rules: its shape, then the
+     * entries a pointer names, then the pattern.
+     *
+     * @param field attribute name, as the client wrote it
+     * @param value value sent; no value clears the attribute
+     * @returns the value in the shape of the type: one value for a
+     *   single-valued attribute, a list for an `array`
+     */
+    validateValue(field: string, value: AttributeValue | null | undefined): Promise<AttributeValue | null | undefined>;
+    /**
+     * The schema's definition of an attribute, under any case.
+     *
+     * @throws BadRequestError for a name a strict schema does not declare
+     */
+    private attribute;
+}
+/**
+ * Write every fixed attribute with a default as the schema says, whatever
+ * the request carried. `objectClass` is left to the entity's configuration.
+ * Run on the entry an authorization judges, so that it judges the entry
+ * written.
+ *
+ * @param schema entity schema, nothing to apply without one
+ * @param entry entry about to be created, changed in place
+ */
+export declare function applyFixedDefaults(schema: Schema | undefined, entry: AttributesList): void;

package/dist/src/lib/expressFormatedResponses.d.ts

@@ -13,6 +13,25 @@ import type winston from 'winston';
 export declare const setLogger: (logger: winston.Logger | undefined) => void;
 /** @returns the installed logger, or undefined before any `DM` exists */
 export declare const getLogger: () => winston.Logger | undefined;
+/**
+ * Whether `serverError` names the failure in its answer: the `--debug` of
+ * the server, installed as its logger is.
+ *
+ * @param debug true to name the failure in the response
+ */
+export declare const setDebug: (debug: boolean) => void;
+/**
+ * The body of a 5xx answer, for the error middleware of `DM` and
+ * `serverError` alike. The failure is for the logs: the message names it
+ * only under `--debug`.
+ *
+ * @param err what failed
+ * @param debug whether to name the failure; `serverError`'s setting by default
+ */
+export declare const serverErrorBody: (err: unknown, debug?: boolean) => {
+    error: string;
+    message: string;
+};
 export declare const tryMethod: (res: Response, method: Function, ...args: unknown[]) => Promise<void>;
 export declare const tryMethodData: (res: Response, method: Function, ...args: unknown[]) => Promise<void>;
 export declare const ok: (res: Response, data?: object) => void;

package/dist/src/lib/health.d.ts

@@ -0,0 +1,63 @@
+import type { Express } from 'express';
+import type { MaybePromise } from '../hooks';
+/** What a plugin answers about the resources it depends on */
+export type HealthStatus = 'ok' | 'degraded';
+/** The paths of the two probes, served before authentication */
+export declare const HEALTH_PATHS: readonly ["/healthz", "/readyz"];
+/** How long one readiness answer serves */
+export declare const PROBE_TTL_MS = 5000;
+/**
+ * How long a readiness answer may take, the directory and every plugin
+ * asked at once: under the 3 s a kubelet waits, so that a hanging resource
+ * is reported, not timed out
+ */
+export declare const PROBE_TIMEOUT_MS = 2000;
+/** What the readiness probe reads of the server */
+export interface Probed {
+    /** Every plugin loaded and the composition checked */
+    readonly composed: boolean;
+    /** Told to stop: what is in flight finishes, nothing new is taken */
+    readonly stopping: boolean;
+    readonly ldap: {
+        ping: (timeoutMs: number) => Promise<void>;
+    };
+    readonly loadedPlugins: {
+        [name: string]: {
+            health?: () => MaybePromise<HealthStatus>;
+        };
+    };
+}
+export interface Readiness {
+    /** `starting`, `stopping` and `unavailable` answer 503, the two others 200 */
+    status: 'starting' | 'stopping' | 'ok' | 'degraded' | 'unavailable';
+    ldap?: 'ok' | 'failed';
+    /** The plugins implementing `health()`; `failed` when it threw or hung */
+    plugins?: {
+        [name: string]: HealthStatus | 'failed';
+    };
+}
+/**
+ * Tell whether the server can serve: loaded, with a directory that answers.
+ * A plugin's resource being down degrades the answer without failing it,
+ * so that one broken outbound service does not take every replica out of
+ * rotation.
+ *
+ * One answer serves `PROBE_TTL_MS`, and the probes arriving while it is
+ * made share it: a probe every few seconds from every replica, or a flood
+ * on an unauthenticated route, must not become a load on the directory nor
+ * on what the plugins ask.
+ *
+ * @param server what is probed
+ * @param now the moment, for the answer's age
+ * @param timeoutMs how long the whole answer may take
+ */
+export declare function readiness(server: Probed, now?: number, timeoutMs?: number): Promise<Readiness>;
+/**
+ * Serve `GET /healthz`, which answers as long as the process serves, and
+ * `GET /readyz`, which answers 200 when `readiness` says the server can
+ * serve. Both are outside the API prefix and carry no identity.
+ *
+ * @param app the application, before its authentication
+ * @param server what the readiness probe reads
+ */
+export declare function mountHealth(app: Express, server: Probed): void;

package/dist/src/lib/instanceProviders.d.ts

@@ -69,6 +69,8 @@ export interface InstanceProvider {
 declare abstract class HttpProvider {
     protected readonly domain: string;
     protected readonly timeout: number;
+    /** The `target` label of this provider's calls in the outbound metrics */
+    protected abstract readonly target: string;
     constructor(domain: string, timeout: number);
     address(request: InstanceRequest): string;
     protected call(url: string, init?: RequestInit): Promise<Response>;
@@ -79,6 +81,7 @@ export declare class ClouderyProvider extends HttpProvider implements InstancePr
     private readonly url;
     private readonly token;
     private readonly offer;
+    protected readonly target = "cloudery";
     constructor(url: string, token: string, domain: string, offer: string, timeout: number);
     private headers;
     create(request: InstanceRequest): Promise<undefined>;
@@ -97,6 +100,7 @@ export declare class CozyStackProvider extends HttpProvider implements InstanceP
     private readonly url;
     private readonly context;
     private readonly apps;
+    protected readonly target = "cozy-stack";
     private readonly auth;
     constructor(url: string, user: string, passphrase: string, domain: string, context: string, apps: string, timeout: number);
     private headers;

package/dist/src/lib/ldapActions.d.ts

@@ -126,11 +126,39 @@ declare class ldapActions {
      * Uses a flag to prevent concurrent cleanup operations
      */
     private cleanupExpiredConnections;
+    /**
+     * Ask the directory for its root DSE on a connection of its own, bound
+     * as the server and closed after: the readiness probe. Neither the pool
+     * nor the search cache nor the hooks answer for a directory that does
+     * not, and a directory that stops answering holds nothing of the pool.
+     * The URLs are tried as `createConnection` tries them.
+     *
+     * @param timeoutMs how long the connection, the bind and the search may
+     *   each take; the client closes the socket when it passes
+     * @throws when no URL answers in time
+     */
+    ping(timeoutMs: number): Promise<void>;
+    /** Set by `close`: no connection is handed out any more */
+    private closed;
+    /**
+     * Close every pooled connection, the ones in use included: an operation
+     * still running on one is rejected by the client, and a waiter is refused
+     * rather than kept.
+     */
+    close(): Promise<void>;
     /**
      * Acquire a connection from the pool or create a new one
      * Optimized for O(1) lookup using separate available connections queue
      */
     private acquireConnection;
+    /** The pool as it is, for the metrics */
+    poolStats(): {
+        busy: number;
+        idle: number;
+        waiting: number;
+        max: number;
+    };
+    private takeConnection;
     /**
      * Release a connection back to the pool
      * If there are waiting requests, hand off the connection directly
@@ -335,10 +363,12 @@ declare class ldapActions {
      * the directory applies both, and only one would have been judged.
      *
      * Without the schema, the case is still set, and a name given as an OID,
-     * which nothing here could resolve, is refused.
+     * which nothing here could resolve, is refused. So is, with or without
+     * it, a name that is neither a descriptor nor a numeric OID.
      *
      * @param entry attributes of an add, or one part of a modify
-     * @throws BadRequestError on an option, or on one attribute named twice
+     * @throws BadRequestError on an option, on a name that describes no
+     * attribute, or on one attribute named twice
      */
     canonicalAttributes(entry: AttributesList | undefined): Promise<void>;
     /**

package/dist/src/lib/metrics.d.ts

@@ -0,0 +1,44 @@
+/**
+ * What the server measures of itself, for `core/metrics` to expose; see
+ * docs/usage/operations.md#metrics
+ * @module lib/metrics
+ */
+import type { Request } from 'express';
+import { Counter, Histogram, Registry } from 'prom-client';
+/** The instruments below register here; `core/metrics` adds its own */
+export declare const registry: Registry<"text/plain; version=0.0.4; charset=utf-8">;
+export declare const httpRequestDuration: Histogram<"status" | "method" | "route">;
+export type LdapOperation = 'bind' | 'search' | 'add' | 'modify' | 'rename' | 'delete';
+export declare const ldapOperationDuration: Histogram<"operation" | "result">;
+export declare const ldapPoolWait: Histogram<string>;
+export declare const ldapSearchCache: Counter<"result">;
+export declare const hookFailures: Counter<"plugin" | "hook">;
+export declare const outboundRequestDuration: Histogram<"status" | "target">;
+export declare const unhandledRejections: Counter<string>;
+/**
+ * The `result` label of a directory call that threw: a refusal is the
+ * directory answering, by its result code (32 for an entry that is not
+ * there); `error` is for not answering.
+ */
+export declare const ldapResult: (err: unknown) => string;
+/** @returns the seconds since `started`, a `process.hrtime.bigint()` */
+export declare const secondsSince: (started: bigint) => number;
+/**
+ * Time a directory call into the operation histogram, whatever becomes of
+ * it.
+ */
+export declare function timedLdap<T>(operation: LdapOperation, call: () => Promise<T>): Promise<T>;
+/**
+ * Time a call to another service into the outbound histogram, to its
+ * answer's headers: the body is read by the caller, at its own pace.
+ */
+export declare function timedOutbound<T extends {
+    status: number;
+}>(target: string, call: () => Promise<T>): Promise<T>;
+/**
+ * The template of the route that answered, never the URL: a label per URL
+ * would grow without bound. See docs/usage/operations.md#metrics.
+ *
+ * @returns the template, `none` when no route matched
+ */
+export declare const routeTemplate: (req: Request) => string;

package/dist/src/lib/requestContext.d.ts

@@ -21,3 +21,43 @@ export declare function outsideRequest<T>(fn: () => T): T;
  * @returns the request, or undefined outside any, or as the server
  */
 export declare function currentRequest(): Request | undefined;
+/** What a log line carries beside what it says */
+export interface LogContext {
+    /** The request being served */
+    requestId?: string;
+    /** The plugin whose hook is running */
+    plugin?: string;
+    /** That hook */
+    op?: string;
+}
+/**
+ * Run something that outlives the request being served, a connection
+ * opened for the pool or a client kept for the process: its operations are
+ * judged by nobody, and what it logs later is nobody's request.
+ *
+ * @param fn what to run
+ * @returns what it returns
+ */
+export declare function outsideAnyRequest<T>(fn: () => T): T;
+/**
+ * Serve a request with its log context: what runs inside, synchronously or
+ * not, logs with it.
+ *
+ * @param context what the lines carry
+ * @param fn what serves the request
+ * @returns what `fn` returns
+ */
+export declare function runWithLogContext<T>(context: LogContext, fn: () => T): T;
+/**
+ * Run a hook: what it logs names its plugin and itself, under the request
+ * being served; a hook no plugin registered names none, even inside
+ * another's.
+ *
+ * @param plugin the plugin's instance name, none for an unregistered hook
+ * @param op the hook
+ * @param fn the hook's run
+ * @returns what `fn` returns
+ */
+export declare function runAsPlugin<T>(plugin: string | undefined, op: string | undefined, fn: () => T): T;
+/** The log context of what is running, if any: request, plugin, hook */
+export declare function currentLogContext(): LogContext | undefined;

package/dist/src/lib/shutdown.d.ts

@@ -0,0 +1,20 @@
+export type ShutdownCallback = () => void | Promise<void>;
+/**
+ * How long the shutdown callbacks get before the signal is raised again.
+ * The binary sets it from `--shutdown-timeout`.
+ */
+export declare const shutdownTimeout: {
+    ms: number;
+};
+/**
+ * Run a callback when the process is told to stop. The first registration
+ * installs the signal listeners; a callback registered while the shutdown
+ * runs is awaited with the others.
+ *
+ * Once every callback has settled, or the timeout has passed, the signal is
+ * raised again for its default action, unless another listener is there to
+ * decide.
+ *
+ * @param cb what to run, awaited when it answers a promise
+ */
+export declare function registerProcessShutdown(cb: ShutdownCallback): void;

package/dist/src/lib/staticFiles.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Where the static plugins serve a schema file, for another plugin to
+ * announce it
+ * @module lib/staticFiles
+ */
+import type { DM } from '../bin';
+/** A static plugin, as another plugin asks it where it serves a file */
+export interface StaticFiles {
+    schemaUrlOf(file: string): string | undefined;
+    servedPath(): string;
+}
+/** Told by its methods, not its class: another copy of ldap-rest has its own */
+export declare const isStaticFiles: (plugin: unknown) => plugin is StaticFiles;
+/**
+ * The static plugins loaded, whatever their class or name: one loaded under
+ * another name, or with a name or a directory of its own, serves files
+ * elsewhere or not at all. The one registered as `static` comes first; one
+ * whose path an earlier plugin took, lies under it or holds it, is left
+ * out, the earlier one's routes answering first.
+ *
+ * @param server the server whose plugins are asked
+ * @returns the plugins, in the order to ask them
+ */
+export declare function staticPlugins(server: Pick<DM, 'loadedPlugins'>): StaticFiles[];
+/**
+ * URL a static plugin serves a schema file at, merged, asked of
+ * {@link staticPlugins} in their order
+ *
+ * @param server the server whose plugins are asked
+ * @param file the file, as the plugin announcing it reads it
+ * @returns its URL, or undefined when no static plugin serves it merged
+ */
+export declare function staticSchemaUrl(server: Pick<DM, 'loadedPlugins'>, file: string): string | undefined;

package/dist/src/lib/storage/store.d.ts

@@ -26,6 +26,7 @@
  * @group Libraries
  */
 import type winston from 'winston';
+import type { HealthStatus } from '../health';
 /** What a backend keeps: a value, and when it stops counting. */
 export interface StoredRecord {
     value: string;
@@ -45,6 +46,11 @@ export default abstract class Store {
     protected abstract drop(key: string): Promise<void>;
     /** Drop every expired record. Returns how many went. */
     abstract sweep(): Promise<number>;
+    /**
+     * Whether the backend answers, asked by the readiness probe; a backend
+     * with a resource of its own asks it and throws when it does not answer.
+     */
+    health(): Promise<HealthStatus>;
     /**
      * The key a backend actually sees, namespaced so two consumers cannot
      * collide.
@@ -72,6 +78,8 @@ export default abstract class Store {
      * operator reads it, instead of the first request that needs the store.
      */
     open(): Promise<void>;
+    /** Set by `close`: a backend opens nothing past it */
+    protected closed: boolean;
     /** Stop sweeping and let go of any connection. */
     close(): Promise<void>;
     /**

package/dist/src/lib/utils.d.ts

@@ -22,6 +22,15 @@ export declare function getCompiledRegex(pattern: string, flags?: string): RegEx
  * @returns The escaped string safe for use in RegExp
  */
 export declare function escapeRegex(str: string): string;
+/**
+ * Run a hook under its plugin's name and its own, for the lines it logs:
+ * what `launchHooks` does, for a caller walking the hooks itself.
+ *
+ * @param hook the registered function
+ * @param fn its run
+ * @returns what `fn` returns
+ */
+export declare const runAsHookOwner: <T>(hook: Function, fn: () => T) => T;
 export declare const launchHooks: (hooks: Function[] | undefined, ...args: unknown[]) => Promise<void>;
 /**
  * Record the plugin a hook function belongs to.
@@ -91,6 +100,12 @@ export declare function escapeLdapFilter(value: string): string;
  * ```
  */
 export declare function substringSearchFilter(match: string, attribute: string): string;
+/**
+ * `pattern` with every `placeholder` replaced by `value`, taken literally:
+ * `String.replace` would expand `$&`, `$'`, `` $` `` and `$$` in a value
+ * that a request chose.
+ */
+export declare function fillPattern(pattern: string, placeholder: string, value: string): string;
 /**
  * Escape special characters in LDAP DN attribute values according to RFC 4514
  * Prevents LDAP injection attacks by escaping characters that have special meaning in DNs

package/dist/src/logger/winston.d.ts

@@ -5,4 +5,8 @@ declare module 'winston' {
         notice: winston.LeveledLogMethod;
     }
 }
+/**
+ * @throws when `--logger` names no known logger, or `--logger file` has no
+ * file: never a file nobody asked for
+ */
 export declare const buildLogger: (config: Config) => winston.Logger;

package/dist/src/plugins/ldap/groups.d.ts

@@ -14,6 +14,7 @@ import type { Hooks } from '../../hooks';
 import type ldapActions from '../../lib/ldapActions';
 import type { AttributesList, AttributeValue, LdapList, ModifyRequest } from '../../lib/ldapActions';
 import type { Schema } from '../../config/schema';
+import { EntityValidator } from '../../lib/entitySchema/validator';
 export interface postAdd {
     cn?: string;
     [key: string]: AttributeValue | undefined;
@@ -308,9 +309,23 @@ export default class LdapGroups extends DmPlugin {
      * @returns nothing, throw if error
      */
     validateMembers(dn: string, members: string[], req?: Request): Promise<void>;
-    validateNewGroup(dn: string, entry: AttributesList): Promise<boolean>;
-    validateChanges(dn: string, changes: ModifyRequest): Promise<boolean>;
-    _validateOneChange(field: string, value: AttributeValue | null): Promise<boolean>;
+    /**
+     * Check a new group's entry, after the `ldapgroupvalidatenew` hooks, and
+     * convert it in place.
+     *
+     * @returns the entry the hooks handed on; `addGroup` writes its
+     *   attributes over the entry it judged, the members aside
+     */
+    validateNewGroup(dn: string, entry: AttributesList): Promise<AttributesList>;
+    /**
+     * Check a change, after the `ldapgroupvalidatechanges` hooks, and convert
+     * it in place.
+     *
+     * @returns the change the hooks handed on
+     */
+    validateChanges(dn: string, changes: ModifyRequest): Promise<ModifyRequest>;
+    /** The schema's rules; the pointer lookups run as the server */
+    validator(): EntityValidator;
     /**
      * Provide configuration for config API
      */

package/dist/src/plugins/ldap/organizations.d.ts

@@ -2,7 +2,7 @@ import type { Express, Request, Response } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 import { DM } from '../../bin';
 import { Hooks } from '../../hooks';
-import { AttributesList, AttributeValue, ModifyRequest } from '../../lib/ldapActions';
+import { AttributesList, ModifyRequest } from '../../lib/ldapActions';
 import type { Schema } from '../../config/schema';
 /**
  * Shared OpenAPI schemas surfaced by this plugin. Picked up by
@@ -231,10 +231,8 @@ export default class LdapOrganizations extends DmPlugin {
     private linkedEntities;
     addOrganization(dn: string, entry: AttributesList, req?: Request): Promise<boolean>;
     modifyOrganization(dn: string, changes: ModifyRequest, req?: Request): Promise<boolean>;
-    validateNewOrganization(dn: string, entry: AttributesList): Promise<boolean>;
-    invalidValueMessage(field: string): string;
-    validateChanges(dn: string, changes: ModifyRequest): Promise<boolean>;
-    _validateOneChange(field: string, value: AttributeValue | null): Promise<boolean>;
+    /** The schema's rules; the pointer lookups run as the server */
+    private validator;
     /**
      * Tell whether a DN names an existing entry.
      *

package/dist/src/plugins/metrics.d.ts

@@ -0,0 +1,17 @@
+import type { Express } from 'express';
+import DmPlugin from '../abstract/plugin';
+import type { DM } from '../bin';
+export default class Metrics extends DmPlugin {
+    name: string;
+    /** The gauges read at scrape time and the process metrics */
+    private readonly own;
+    private readonly exposed;
+    private listener?;
+    constructor(server: DM);
+    /** Open the listener; the server does not start on a port it cannot take */
+    api(_app: Express): Promise<void>;
+    /** @returns the port the metrics are served on, once `api` opened it */
+    port(): number | undefined;
+    private answer;
+    close(): Promise<void>;
+}