ldap-rest 1.2.0 → 1.3.0

package/dist/src/lib/route.d.ts

@@ -0,0 +1,99 @@
+/**
+ * @module lib/route
+ * @author Xavier Guimard <xguimard@linagora.com>
+ *
+ * One declaration per HTTP route: its input schemas, the handler that
+ * receives the checked values, and what the OpenAPI document says of it.
+ * @group Libraries
+ */
+import type { Static, TSchema } from '@sinclair/typebox';
+import type { Express, NextFunction, Request, RequestHandler, Response } from 'express';
+export type RouteMethod = 'get' | 'post' | 'put' | 'patch' | 'delete';
+/** What the handler receives for a part it declared no schema for. */
+type Input<T> = T extends TSchema ? Static<T> : unknown;
+/** What a handler receives once its request has been checked. */
+export interface RouteInput<P extends TSchema | undefined, Q extends TSchema | undefined, B extends TSchema | undefined> {
+    req: Request;
+    res: Response;
+    /** Express's own, for a handler that answers a failure itself */
+    next: NextFunction;
+    params: Input<P>;
+    query: Input<Q>;
+    body: Input<B>;
+}
+/**
+ * An answer: its schema, and the sentence the document gives it. A bare
+ * schema is described by its status (`Successful response`, `Bad request`…).
+ */
+export interface RouteResponse {
+    schema: TSchema;
+    description?: string;
+}
+/** A route, as declared and as recorded for the OpenAPI document. */
+export interface RouteDefinition<P extends TSchema | undefined = undefined, Q extends TSchema | undefined = undefined, B extends TSchema | undefined = undefined> {
+    method: RouteMethod;
+    path: string;
+    /** The path parameters, checked and converted from their string form */
+    params?: P;
+    /** The query parameters, checked and converted from their string form */
+    query?: Q;
+    /** The parsed body */
+    body?: B;
+    /**
+     * Whether a caller that does not accept JSON is refused before the handler
+     * (default). A route answering another media type sets it false.
+     */
+    json?: boolean;
+    /** Handlers run before the declaration's, as Express mounts them */
+    middleware?: RequestHandler | RequestHandler[];
+    /** The answers, for the OpenAPI document */
+    responses?: Partial<Record<number, TSchema | RouteResponse>>;
+    summary?: string;
+    description?: string;
+    tags?: string[];
+    handler: (input: RouteInput<P, Q, B>) => void | Promise<void>;
+}
+/** A route recorded on an app, with its schemas kept for the document. */
+export type RegisteredRoute = Omit<RouteDefinition<TSchema, TSchema, TSchema>, 'handler' | 'middleware'>;
+/**
+ * The routes `defineRoute` registered on an app, in declaration order.
+ *
+ * @param app the express app the plugin was given
+ * @returns its routes
+ */
+export declare const registeredRoutes: (app: Express) => readonly RegisteredRoute[];
+/** A route Express carries, as the stack spells it. */
+export interface StackRoute {
+    method: string;
+    path: string;
+}
+/**
+ * The routes an app carries that `defineRoute` did not declare.
+ *
+ * The stack is walked at any depth, so a mounted router's routes are seen
+ * too. A route is matched on its method and path, which is what the
+ * declaration records; a router's routes are router-relative (`/nested`,
+ * whatever the mount path), as Express keeps no mount path on a router, and
+ * `app.all` comes back as `_ALL`.
+ *
+ * @param app the express app
+ * @returns the undeclared routes, in stack order
+ */
+export declare const unregisteredRoutes: (app: Express) => StackRoute[];
+/**
+ * Declare an HTTP route.
+ *
+ * The declared schemas are checked before the handler runs; a request that
+ * fails them is a {@link BadRequestError} naming every failing path, so the
+ * middleware answers it as any other client error. The handler receives the
+ * checked values and answers through `res`, as with `asyncHandler`, whose
+ * rejections it still forwards.
+ *
+ * The declaration is recorded on the app, with its schemas, for the OpenAPI
+ * document and for the check that no route escapes it.
+ *
+ * @param app the express app the plugin was given
+ * @param route the declaration
+ */
+export declare const defineRoute: <P extends TSchema | undefined = undefined, Q extends TSchema | undefined = undefined, B extends TSchema | undefined = undefined>(app: Express, route: RouteDefinition<P, Q, B>) => void;
+export {};

package/dist/src/lib/utils.d.ts

@@ -22,42 +22,7 @@ export declare function getCompiledRegex(pattern: string, flags?: string): RegEx
  * @returns The escaped string safe for use in RegExp
  */
 export declare function escapeRegex(str: string): string;
-/**
- * Run a hook under its plugin's name and its own, for the lines it logs:
- * what `launchHooks` does, for a caller walking the hooks itself.
- *
- * @param hook the registered function
- * @param fn its run
- * @returns what `fn` returns
- */
-export declare const runAsHookOwner: <T>(hook: Function, fn: () => T) => T;
-export declare const launchHooks: (hooks: Function[] | undefined, ...args: unknown[]) => Promise<void>;
-/**
- * Record the plugin a hook function belongs to.
- *
- * @param fn the registered function
- * @param plugin the plugin's instance name
- * @param hook the hook it is registered under
- */
-export declare const recordHookOwner: (fn: Function, plugin: string, hook: string) => void;
-/**
- * The plugin a hook function belongs to, and the hook it is registered
- * under, when `registerPlugin` registered it.
- *
- * @param fn a hook function
- * @returns its plugin's instance name and hook name, or undefined
- */
-export declare const hookOwner: (fn: Function) => {
-    plugin: string;
-    hook: string;
-} | undefined;
-/**
- * Whether an error is an authorization plugin's refusal, by the marker its
- * message carries: a plain `Error` wrapping it keeps the message only. Its
- * message names the branch, so the client is told `AUTHZ_REFUSED` instead.
- */
-export declare const isAuthzRefusal: (err: unknown) => boolean;
-export declare const launchHooksChained: <T>(hooks: Function[] | undefined, args: T) => Promise<T>;
+export { hookOwner, recordHookOwner, runAsHookOwner } from './hookBus';
 export declare const transformSchemas: (schemas: string | Buffer, config: Config) => string;
 /**
  * Escape special characters in LDAP filter values according to RFC 4515
@@ -100,6 +65,12 @@ export declare function escapeLdapFilter(value: string): string;
  * ```
  */
 export declare function substringSearchFilter(match: string, attribute: string): string;
+/**
+ * `pattern` with every `placeholder` replaced by `value`, taken literally:
+ * `String.replace` would expand `$&`, `$'`, `` $` `` and `$$` in a value
+ * that a request chose.
+ */
+export declare function fillPattern(pattern: string, placeholder: string, value: string): string;
 /**
  * Escape special characters in LDAP DN attribute values according to RFC 4514
  * Prevents LDAP injection attacks by escaping characters that have special meaning in DNs
@@ -231,6 +202,36 @@ export declare function getRdn(dn: string): string;
  * ```
  */
 export declare function rdnValue(dn: string): string;
+/**
+ * Read the name of an entry written as a DN: the value of its first RDN when
+ * that RDN asserts `attribute` alone, under `base` when one is given.
+ *
+ * The value is decoded exactly as {@link rdnValue} decodes it: it is the
+ * naming attribute's value, the one a write puts back in
+ * `attribute=…,base`.
+ *
+ * @param dn - The DN to read
+ * @param attribute - The attribute the first RDN must assert
+ * @param base - The branch the entry belongs to, when the DN names it whole
+ * @returns The name, or `null` when the RDN asserts another attribute, names
+ * another branch, or is no DN
+ *
+ * @example
+ * ```typescript
+ * assertedRdnValue('uid=Smith\\,John,ou=users,dc=example,dc=com', 'uid')
+ * // => 'Smith,John'
+ * ```
+ */
+export declare function assertedRdnValue(dn: string, attribute: string, base?: string): string | null;
+/**
+ * Whether `attribute=` starts `id`: the caller sent a DN rather than a bare
+ * naming value.
+ *
+ * Deciding this before `assertedRdnValue` matters: a string it refuses — a
+ * multi-valued RDN, another branch — is still a DN, and read as a bare value
+ * it would be written whole.
+ */
+export declare function namesByDn(id: string, attribute: string): boolean;
 /**
  * Check if a DN is a child of another DN
  *

package/dist/src/lib/version.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The version of this package, read from the `package.json` that ships with
+ * it: the repository root when run from the sources, the installed package
+ * when run from the bundle. A build that moved the file elsewhere leaves it
+ * unknown rather than guessing.
+ *
+ * `start` is the directory the walk begins from; it defaults to this
+ * module's own and exists so the walk can be exercised on a fixture.
+ */
+export declare function readVersion(start?: string): string | undefined;
+/** The server's version, as its package declares it */
+export declare const SERVER_VERSION: string | undefined;

package/dist/src/plugins/auth/auth.options.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Authentication and authorization plugin options, see
+ * `docs/plugin-development/options.md`.
+ */
+import type { AuthConfig, Config } from '../../config/args';
+import { type OptionsOf } from '../../config/options';
+export declare const tokenOptions: {
+    auth_token: import("../../config/options").ArrayOption;
+};
+export type TokenOptions = OptionsOf<typeof tokenOptions>;
+export declare const fakeOptions: {
+    auth_fake_user: import("../../config/options").StringOption;
+};
+export type FakeOptions = OptionsOf<typeof fakeOptions>;
+export declare const totpOptions: {
+    auth_totp: import("../../config/options").ArrayOption;
+    auth_totp_window: import("../../config/options").NumberOption;
+    auth_totp_step: import("../../config/options").NumberOption;
+};
+export type TotpOptions = OptionsOf<typeof totpOptions>;
+export declare const hmacOptions: {
+    auth_hmac: import("../../config/options").ArrayOption;
+    auth_hmac_window: import("../../config/options").NumberOption;
+};
+export type HmacOptions = OptionsOf<typeof hmacOptions>;
+export declare const llngOptions: {
+    llng_ini: import("../../config/options").StringOption;
+    llng_username_header: import("../../config/options").StringOption;
+};
+export type LlngOptions = OptionsOf<typeof llngOptions>;
+export declare const perRouteOptions: {
+    authz_per_route: import("../../config/options").ArrayOption;
+};
+export type PerRouteOptions = OptionsOf<typeof perRouteOptions>;
+export declare const perBranchOptions: {
+    authz_per_branch_config: import("../../config/options").JsonOption<AuthConfig>;
+    authz_per_branch_cache_ttl: import("../../config/options").NumberOption;
+    ldap_group_member_attribute: import("../../config/options").StringOption;
+};
+export type PerBranchOptions = OptionsOf<typeof perBranchOptions>;
+export declare const dynamicOptions: {
+    authz_dynamic_bypass: import("../../config/options").ArrayOption;
+    authz_dynamic_base: import("../../config/options").StringOption;
+    authz_dynamic_cache_ttl: import("../../config/options").NumberOption;
+    authz_dynamic_token_attribute: import("../../config/options").StringOption;
+    authz_dynamic_config_attribute: import("../../config/options").StringOption;
+    authz_dynamic_tenant_attribute: import("../../config/options").StringOption;
+    authz_dynamic_reload_endpoint: import("../../config/options").BooleanOption;
+};
+export type DynamicOptions = OptionsOf<typeof dynamicOptions>;
+export declare const linid1Options: {
+    authz_local_admin_attribute: import("../../config/options").StringOption;
+    authz_global_branch: import("../../config/options").ArrayOption;
+    authz_global_write_branch: import("../../config/options").ArrayOption;
+    authz_global_organization: import("../../config/options").StringOption;
+};
+export type Linid1Options = OptionsOf<typeof linid1Options>;
+export declare const openidconnectOptions: {
+    oidc_server: import("../../config/options").StringOption;
+    oidc_username_claim: import("../../config/options").StringOption;
+    oidc_client_id: import("../../config/options").StringOption;
+    oidc_client_secret: import("../../config/options").StringOption;
+    base_url: import("../../config/options").StringOption;
+};
+export type OpenidconnectOptions = OptionsOf<typeof openidconnectOptions>;
+export declare const rateLimitOptions: {
+    rate_limit_window_ms: import("../../config/options").NumberOption;
+    rate_limit_max: import("../../config/options").NumberOption;
+};
+export type RateLimitOptions = OptionsOf<typeof rateLimitOptions>;
+export declare const crowdsecOptions: {
+    crowdsec_url: import("../../config/options").StringOption;
+    crowdsec_api_key: import("../../config/options").StringOption;
+    crowdsec_cache_ttl: import("../../config/options").NumberOption;
+};
+export type CrowdsecOptions = OptionsOf<typeof crowdsecOptions>;
+export declare const trustedProxyOptions: {
+    trusted_proxy: import("../../config/options").ArrayOption;
+    trusted_proxy_auth_header: import("../../config/options").StringOption;
+};
+export type TrustedProxyOptions = OptionsOf<typeof trustedProxyOptions>;
+/** The checked values for a caller that holds a Config instead of the plugin */
+export declare function totpOptionsOf(config: Config): TotpOptions;
+export declare function hmacOptionsOf(config: Config): HmacOptions;
+export declare function perBranchOptionsOf(config: Config): PerBranchOptions;
+export declare function dynamicOptionsOf(config: Config): DynamicOptions;
+export declare function rateLimitOptionsOf(config: Config): RateLimitOptions;
+export declare function crowdsecOptionsOf(config: Config): CrowdsecOptions;

package/dist/src/plugins/auth/authzDynamic.d.ts

@@ -51,6 +51,15 @@ export interface AuthzDynamicRequest extends DmRequest {
     authzToken?: TokenEntry;
 }
 export default class AuthzDynamic extends AuthBase {
+    static optionDefinitions: {
+        authz_dynamic_bypass: import("../../config/options").ArrayOption;
+        authz_dynamic_base: import("../../config/options").StringOption;
+        authz_dynamic_cache_ttl: import("../../config/options").NumberOption;
+        authz_dynamic_token_attribute: import("../../config/options").StringOption;
+        authz_dynamic_config_attribute: import("../../config/options").StringOption;
+        authz_dynamic_tenant_attribute: import("../../config/options").StringOption;
+        authz_dynamic_reload_endpoint: import("../../config/options").BooleanOption;
+    };
     name: string;
     roles: Role[];
     private tokens;
@@ -171,7 +180,7 @@ export default class AuthzDynamic extends AuthBase {
      */
     private activeToken;
     /**
-     * Throw a ForbiddenError (403) if the token cannot perform `permission` on
+     * Throw an AuthzRefusedError (403) if the token cannot perform `permission` on
      * the branch containing `branchOrDn`. Any ACL entry that is `branchOrDn`
      * itself or a parent of it (sub-branch match) qualifies.
      *

package/dist/src/plugins/auth/authzLinid1.d.ts

@@ -14,6 +14,12 @@ interface CachedPermissions {
     timestamp: number;
 }
 export default class AuthzLinid1 extends AuthzBase {
+    static optionDefinitions: {
+        authz_local_admin_attribute: import("../../config/options").StringOption;
+        authz_global_branch: import("../../config/options").ArrayOption;
+        authz_global_write_branch: import("../../config/options").ArrayOption;
+        authz_global_organization: import("../../config/options").StringOption;
+    };
     name: string;
     permissionsCache: Map<string, CachedPermissions>;
     constructor(server: DM);

package/dist/src/plugins/auth/authzPerBranch.d.ts

@@ -16,6 +16,11 @@ interface CachedGroups {
     timestamp: number;
 }
 export default class AuthzPerBranch extends AuthzBase {
+    static optionDefinitions: {
+        authz_per_branch_config: import("../../config/options").JsonOption<AuthConfig>;
+        authz_per_branch_cache_ttl: import("../../config/options").NumberOption;
+        ldap_group_member_attribute: import("../../config/options").StringOption;
+    };
     name: string;
     authConfig?: AuthConfig;
     groupCache: Map<string, CachedGroups>;
@@ -30,7 +35,11 @@ export default class AuthzPerBranch extends AuthzBase {
     /** `authConfig.groups` keyed by normalized DN, and the object it was built from. */
     private groupRulesIndex?;
     hooks: AuthzBase['hooks'] & Pick<Hooks, 'ldapadddone' | 'ldapmodifydone' | 'ldapdeletedone'>;
+    /** What the classes above declared, read once this one is constructed */
+    private readonly declaredByBase;
     constructor(server: DM);
+    /** The attribute a group lists its members in */
+    private get memberAttribute();
     /**
      * Whether a modify can change which groups a uid belongs to: it touches
      * the member attribute, or the attribute a uid is resolved by.

package/dist/src/plugins/auth/authzPerRoute.d.ts

@@ -11,6 +11,9 @@ import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 export declare function globToRegex(glob: string): RegExp;
 export default class AuthzPerRoute extends DmPlugin {
+    static optionDefinitions: {
+        authz_per_route: import("../../config/options").ArrayOption;
+    };
     name: string;
     roles: Role[];
     private rules;

package/dist/src/plugins/auth/authzScope.d.ts

@@ -1,19 +1,28 @@
-/**
- * @module plugins/auth/authzScope
- * @author Xavier Guimard <xguimard@linagora.com>
- *
- * Tells a client what the signed-in administrator may actually do, before it
- * offers them a button that will fail.
- *
- * In a local-administration model the scope *is* the interface: a manager
- * administers a few branches of the tree and nothing else, and an application
- * that cannot name those branches leaves them guessing. This endpoint answers
- * both halves — which branches, and which entities can be created in them —
- * by asking the authorization plugin in force, whichever one that is.
- * @group Plugins
- */
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
+export declare const ScopeResponse: import("@sinclair/typebox").TObject<{
+    user: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>;
+    unrestricted: import("@sinclair/typebox").TBoolean;
+    described: import("@sinclair/typebox").TBoolean;
+    source: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>;
+    sources: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    branches: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        dn: import("@sinclair/typebox").TString;
+        read: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        write: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        delete: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        name: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        path: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    }>>;
+    transit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>>;
+    linksAnyDomain: import("@sinclair/typebox").TBoolean;
+    passwordPolicies: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+    entities: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        name: import("@sinclair/typebox").TString;
+        base: import("@sinclair/typebox").TString;
+        create: import("@sinclair/typebox").TBoolean;
+    }>>;
+}>;
 export default class AuthzScope extends DmPlugin {
     name: string;
     roles: Role[];

package/dist/src/plugins/auth/crowdsec.d.ts

@@ -16,6 +16,11 @@
 import type { Express } from 'express';
 import DmPlugin, { Role } from '../../abstract/plugin';
 export default class CrowdSec extends DmPlugin {
+    static optionDefinitions: {
+        crowdsec_url: import("../../config/options").StringOption;
+        crowdsec_api_key: import("../../config/options").StringOption;
+        crowdsec_cache_ttl: import("../../config/options").NumberOption;
+    };
     name: string;
     roles: Role[];
     private apiUrl;

package/dist/src/plugins/auth/fake.d.ts

@@ -10,6 +10,9 @@ import type { Response } from 'express';
 import AuthBase, { type DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 export default class AuthFake extends AuthBase {
+    static optionDefinitions: {
+        auth_fake_user: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
     private readonly user;

package/dist/src/plugins/auth/hmac.d.ts

@@ -2,6 +2,10 @@ import type { Response } from 'express';
 import AuthBase, { type DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 export default class AuthHmac extends AuthBase {
+    static optionDefinitions: {
+        auth_hmac: import("../../config/options").ArrayOption;
+        auth_hmac_window: import("../../config/options").NumberOption;
+    };
     protected knownIdentities(): string[];
     protected identitySource(): string;
     name: string;

package/dist/src/plugins/auth/llng.d.ts

@@ -11,6 +11,10 @@ import AuthBase, { DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 type LlngHandler = typeof import('lemonldap-ng-handler');
 export default class AuthLLNG extends AuthBase {
+    static optionDefinitions: {
+        llng_ini: import("../../config/options").StringOption;
+        llng_username_header: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
     private handler?;

package/dist/src/plugins/auth/openidconnect.d.ts

@@ -4,6 +4,13 @@ import AuthBase, { DmRequest } from '../../lib/auth/base';
 import { type Role } from '../../abstract/plugin';
 import { DM } from '../../bin';
 export default class OpenIDConnect extends AuthBase {
+    static optionDefinitions: {
+        oidc_server: import("../../config/options").StringOption;
+        oidc_username_claim: import("../../config/options").StringOption;
+        oidc_client_id: import("../../config/options").StringOption;
+        oidc_client_secret: import("../../config/options").StringOption;
+        base_url: import("../../config/options").StringOption;
+    };
     name: string;
     configApiKey: string;
     roles: Role[];

package/dist/src/plugins/auth/rateLimit.d.ts

@@ -15,6 +15,10 @@
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 export default class RateLimit extends DmPlugin {
+    static optionDefinitions: {
+        rate_limit_window_ms: import("../../config/options").NumberOption;
+        rate_limit_max: import("../../config/options").NumberOption;
+    };
     name: string;
     roles: Role[];
     private store;

package/dist/src/plugins/auth/token.d.ts

@@ -9,6 +9,9 @@ import type { Response } from 'express';
 import AuthBase, { type DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 export default class AuthToken extends AuthBase {
+    static optionDefinitions: {
+        auth_token: import("../../config/options").ArrayOption;
+    };
     protected knownIdentities(): string[];
     protected identitySource(): string;
     name: string;

package/dist/src/plugins/auth/totp.d.ts

@@ -2,6 +2,11 @@ import type { Response } from 'express';
 import AuthBase, { type DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 export default class AuthTotp extends AuthBase {
+    static optionDefinitions: {
+        auth_totp: import("../../config/options").ArrayOption;
+        auth_totp_window: import("../../config/options").NumberOption;
+        auth_totp_step: import("../../config/options").NumberOption;
+    };
     protected knownIdentities(): string[];
     protected identitySource(): string;
     name: string;

package/dist/src/plugins/auth/trustedProxy.d.ts

@@ -34,6 +34,10 @@ declare global {
     }
 }
 export default class TrustedProxy extends DmPlugin {
+    static optionDefinitions: {
+        trusted_proxy: import("../../config/options").ArrayOption;
+        trusted_proxy_auth_header: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
     private trustedNetworks;

package/dist/src/plugins/bcl.d.ts

@@ -20,6 +20,9 @@ import DmPlugin from '../abstract/plugin';
 import type { DM } from '../bin';
 import type { OidcLogoutToken, OidcSessionClaims } from '../hooks';
 export default class Bcl extends DmPlugin {
+    static optionDefinitions: {
+        bcl_retention: import("../config/options").NumberOption;
+    };
     name: string;
     dependencies: {
         storage: string;

package/dist/src/plugins/bcl.options.d.ts

@@ -0,0 +1,8 @@
+/** Back-Channel Logout plugin options. */
+import type { Config } from '../config/args';
+import { type OptionsOf } from '../config/options';
+export declare const bclOptions: {
+    bcl_retention: import("../config/options").NumberOption;
+};
+export type BclOptions = OptionsOf<typeof bclOptions>;
+export declare function bclOptionsOf(config: Config): BclOptions;

package/dist/src/plugins/configApi.d.ts

@@ -10,16 +10,26 @@
  */
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../abstract/plugin';
+interface ConfigApiResponse {
+    apiPrefix: string;
+    ldapBase: string;
+    features: Record<string, unknown>;
+    /** Absent when the version could not be read at start-up */
+    version?: string;
+}
+/** The body of `GET /v1/config`, `version` left out when it is unknown. */
+export declare function configApiResponse(apiPrefix: string, ldapBase: string, features: Record<string, unknown>, version: string | undefined): ConfigApiResponse;
 /**
  * @openapi-component
  * Config:
  *   type: object
  *   description: |
- *     Aggregated server configuration. The top-level fields are always
- *     present; `features` is a dynamic map whose keys are the names of
- *     loaded plugins that declare the `configurable` role.  Each plugin
- *     contributes an arbitrary sub-object — consult the individual plugin
- *     documentation for its exact shape.
+ *     Aggregated server configuration. `apiPrefix`, `ldapBase` and
+ *     `features` are always present; `version` is present unless the server
+ *     could not read it at start-up; `features` is a dynamic map whose keys
+ *     are the names of loaded plugins that declare the `configurable` role.
+ *     Each plugin contributes an arbitrary sub-object — consult the
+ *     individual plugin documentation for its exact shape.
  *   additionalProperties: true
  *   properties:
  *     apiPrefix:
@@ -30,6 +40,13 @@ import DmPlugin, { type Role } from '../abstract/plugin';
  *       type: string
  *       description: The root LDAP suffix used by this server.
  *       example: dc=example,dc=com
+ *     version:
+ *       type: string
+ *       description: |
+ *         The server's version, as its package declares it. A client reads it
+ *         to tell an administrator the server is older than it supports; a
+ *         server that cannot tell its version leaves the field out.
+ *       example: 1.2.1
  *     features:
  *       type: object
  *       description: |
@@ -52,6 +69,7 @@ import DmPlugin, { type Role } from '../abstract/plugin';
  *   example:
  *     apiPrefix: /api
  *     ldapBase: dc=example,dc=com
+ *     version: 1.2.1
  *     features:
  *       ldapGroups:
  *         enabled: true
@@ -73,3 +91,4 @@ export default class ConfigApi extends DmPlugin {
      */
     private collectPluginConfigs;
 }
+export {};

package/dist/src/plugins/demo/helloworld.d.ts

@@ -6,26 +6,15 @@
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 /**
- * @openapi-component
- * Hello:
- *   type: object
- *   description: Response returned by the hello-world demo endpoint.
- *   properties:
- *     message:
- *       type: string
- *       description: Static greeting string.
- *       example: Hello
- *     hookResults:
- *       type: array
- *       description: |
- *         Results collected from every function registered on the `hello`
- *         hook.  Empty when no hook listeners are installed.
- *       items: {}
- *       example: []
- *   example:
- *     message: Hello
- *     hookResults: []
+ * The answer of the hello-world endpoint.
+ *
+ * Exported because the OpenAPI generator reads it without running the
+ * plugin, as it reads every schema a route declares.
  */
+export declare const HelloResponse: import("@sinclair/typebox").TObject<{
+    message: import("@sinclair/typebox").TString;
+    hookResults: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnknown>;
+}>;
 export default class HelloWorld extends DmPlugin {
     name: string;
     roles: Role[];