ldap-rest 1.2.1 → 1.3.0

package/dist/src/plugins/ldap/enterpriseRules.d.ts

@@ -89,7 +89,8 @@ export interface ReferenceRewriteReport {
  *
  * @param raw value as submitted
  * @returns the size in bytes
- * @throws BadRequestError when the value is not a size
+ * @throws BadRequestError when the value is not a size, or when its number of
+ * bytes is one a `Number` cannot hold exactly
  */
 export declare function parseByteSize(raw: AttributeValue): number;
 /**
@@ -147,12 +148,18 @@ export declare function startOfUtcDay(now?: Date): number;
  */
 export declare function mailInDomains(mail: string, domains: string[], allowSubdomains?: boolean): boolean;
 export default class LdapEnterpriseRules extends DmPlugin {
+    static optionDefinitions: {
+        enterprise_domain_name_attribute: import("../../config/options").StringOption;
+        enterprise_domain_link_attribute: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
     /** Placeholder member some directories keep to satisfy `groupOfNames` */
     private dummyMember?;
     /** Root of the organization tree */
     private topOrganization?;
+    private readonly enterpriseSettings;
+    private readonly orgSettings;
     constructor(server: DM);
     /**
      * Tell whether this plugin fills a given generated attribute.

package/dist/src/plugins/ldap/externalUsersInGroups.d.ts

@@ -16,6 +16,10 @@ import ldapActions from '../../lib/ldapActions';
  */
 export declare const mailDomainOf: (mail: string) => string;
 export default class ExternalUsersInGroups extends DmPlugin {
+    static optionDefinitions: {
+        external_members_branch: import("../../config/options").StringOption;
+        external_branch_class: import("../../config/options").ArrayOption;
+    };
     name: string;
     roles: Role[];
     dependencies: {

package/dist/src/plugins/ldap/flatGeneric.d.ts

@@ -50,6 +50,10 @@ declare class LdapFlatInstance extends LdapFlat {
     constructor(server: DM, config: ConstructorParameters<typeof LdapFlat>[1]);
 }
 export default class LdapFlatGeneric extends DmPlugin {
+    static optionDefinitions: {
+        ldap_flat_schema: import("../../config/options").ArrayOption;
+        ldap_flat_auto_repair: import("../../config/options").BooleanOption;
+    };
     name: string;
     roles: Role[];
     instances: LdapFlatInstance[];

package/dist/src/plugins/ldap/groups.d.ts

@@ -1,15 +1,7 @@
-/**
- * @module plugins/ldap/groups
- * @author Xavier Guimard <xguimard@linagora.com>
- *
- * Plugin to manage groups into LDAP server
- * - add/delete groups
- * - add/delete members of groups
- * - detect user deletion to remove them from groups (hook)
- */
 import type { Express, Request, Response } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 import type { DM } from '../../bin';
+import type { OptionSet } from '../../config/options';
 import type { Hooks } from '../../hooks';
 import type ldapActions from '../../lib/ldapActions';
 import type { AttributesList, AttributeValue, LdapList, ModifyRequest } from '../../lib/ldapActions';
@@ -111,13 +103,37 @@ export type postModify = ModifyRequest;
  *     attribute: attribute
  *     value: value
  */
+export declare const GroupsQuery: import("@sinclair/typebox").TObject<{
+    match: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    attribute: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    attributes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+}>;
+export declare const GroupParams: import("@sinclair/typebox").TObject<{
+    cn: import("@sinclair/typebox").TString;
+}>;
+export declare const GroupMemberParams: import("@sinclair/typebox").TObject<{
+    cn: import("@sinclair/typebox").TString;
+    member: import("@sinclair/typebox").TString;
+}>;
+export declare const GroupMembersBody: import("@sinclair/typebox").TObject<{
+    member: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>]>;
+}>;
+export declare const GroupMoveBody: import("@sinclair/typebox").TObject<{
+    targetOrgDn: import("@sinclair/typebox").TString;
+}>;
+export declare const GroupRenameBody: import("@sinclair/typebox").TObject<{
+    newCn: import("@sinclair/typebox").TString;
+}>;
 export default class LdapGroups extends DmPlugin {
+    static optionDefinitions: OptionSet;
     name: string;
     roles: Role[];
     base?: string;
     ldap: ldapActions;
     cn: string;
     schema?: Schema;
+    private get groupSettings();
+    private get orgSettings();
     constructor(server: DM);
     /**
      * The loaded group schema, before it is used: a subclass declares there
@@ -146,7 +162,7 @@ export default class LdapGroups extends DmPlugin {
      * @param member DN of a member
      * @returns true for the placeholder
      */
-    isDummyMember(member: string): boolean;
+    isDummyMember(member: string, placeholder?: string): boolean;
     /**
      * An entry with the placeholder taken out of its members. It is there for
      * the directory's schema, not for anyone reading the group: listed, it
@@ -298,7 +314,7 @@ export default class LdapGroups extends DmPlugin {
      * With `req`, each member is looked up as the caller sees the directory:
      * an entry an authorization plugin hides from them is refused as one that
      * does not exist, so that an administrator cannot put an account of
-     * another branch in a group of theirs. `--group-allow-unexistent-members`
+     * another branch in a group of theirs. `--groups-allow-unexistent-members`
      * still accepts a member that does not exist, but not one that does and
      * is hidden — which tells the caller it exists, a smaller leak than the
      * membership it would otherwise grant.

package/dist/src/plugins/ldap/ldap.options.d.ts

@@ -0,0 +1,75 @@
+import type { Config } from '../../config/args';
+import type { AttributesList } from '../../lib/ldapActions';
+import { type OptionsOf } from '../../config/options';
+export declare const organizationOptions: {
+    ldap_top_organization: import("../../config/options").StringOption;
+    ldap_organization_class: import("../../config/options").ArrayOption;
+    ldap_organization_link_attribute: import("../../config/options").StringOption;
+    ldap_organization_path_attribute: import("../../config/options").StringOption;
+    ldap_organization_path_separator: import("../../config/options").StringOption;
+    ldap_organization_max_subnodes: import("../../config/options").NumberOption;
+    organization_schema: import("../../config/options").StringOption;
+};
+export type OrganizationOptions = OptionsOf<typeof organizationOptions>;
+export declare const enterpriseRulesOptions: {
+    enterprise_domain_name_attribute: import("../../config/options").StringOption;
+    enterprise_domain_link_attribute: import("../../config/options").StringOption;
+};
+export type EnterpriseRulesOptions = OptionsOf<typeof enterpriseRulesOptions>;
+export declare const groupsOptions: {
+    ldap_group_base: import("../../config/options").StringOption;
+    ldap_groups_main_attribute: import("../../config/options").StringOption;
+    group_class: import("../../config/options").ArrayOption;
+    groups_allow_unexistent_members: import("../../config/options").BooleanOption;
+    group_default_attributes: import("../../config/options").JsonOption<AttributesList>;
+    group_dummy_user: import("../../config/options").StringOption;
+    group_schema: import("../../config/options").StringOption;
+};
+export type GroupsOptions = OptionsOf<typeof groupsOptions>;
+export declare const externalUsersOptions: {
+    external_members_branch: import("../../config/options").StringOption;
+    external_branch_class: import("../../config/options").ArrayOption;
+};
+export type ExternalUsersOptions = OptionsOf<typeof externalUsersOptions>;
+export declare const flatGenericOptions: {
+    ldap_flat_schema: import("../../config/options").ArrayOption;
+    ldap_flat_auto_repair: import("../../config/options").BooleanOption;
+};
+export type FlatGenericOptions = OptionsOf<typeof flatGenericOptions>;
+export declare const rawOptions: {
+    ldap_raw_base: import("../../config/options").ArrayOption;
+    ldap_raw_hidden_attribute: import("../../config/options").ArrayOption;
+    ldap_raw_show_secrets: import("../../config/options").BooleanOption;
+    ldap_raw_max_results: import("../../config/options").NumberOption;
+    ldap_raw_schema_cache_ttl: import("../../config/options").NumberOption;
+};
+export type RawOptions = OptionsOf<typeof rawOptions>;
+export declare const bulkImportOptions: {
+    bulk_import_schemas: import("../../config/options").StringOption;
+    bulk_import_max_file_size: import("../../config/options").StringOption;
+    bulk_import_batch_size: import("../../config/options").StringOption;
+};
+export type BulkImportOptions = OptionsOf<typeof bulkImportOptions>;
+export declare const trashOptions: {
+    trash_base: import("../../config/options").StringOption;
+    trash_watched_bases: import("../../config/options").StringOption;
+    trash_add_metadata: import("../../config/options").StringOption;
+    trash_auto_create: import("../../config/options").StringOption;
+};
+export type TrashOptions = OptionsOf<typeof trashOptions>;
+export declare const passwordPolicyOptions: {
+    ppolicy_default_dn: import("../../config/options").StringOption;
+    ppolicy_base: import("../../config/options").StringOption;
+    ppolicy_warn_days: import("../../config/options").NumberOption;
+    ppolicy_validate_complexity: import("../../config/options").BooleanOption;
+    ppolicy_min_length: import("../../config/options").NumberOption;
+    ppolicy_require_uppercase: import("../../config/options").BooleanOption;
+    ppolicy_require_lowercase: import("../../config/options").BooleanOption;
+    ppolicy_require_digit: import("../../config/options").BooleanOption;
+    ppolicy_require_special: import("../../config/options").BooleanOption;
+    ldap_users_base: import("../../config/options").StringOption;
+};
+export type PasswordPolicyOptions = OptionsOf<typeof passwordPolicyOptions>;
+export declare function organizationOptionsOf(config: Config): OrganizationOptions;
+export declare function groupsOptionsOf(config: Config): GroupsOptions;
+export declare function trashOptionsOf(config: Config): TrashOptions;

package/dist/src/plugins/ldap/onChange.d.ts

@@ -20,6 +20,14 @@ export type ChangesToNotify = Record<string, [
  * and so are two orderings of the same values.
  */
 export declare function diffEntries(before: Entry | null, after: Entry | null): ChangesToNotify;
+declare const events: {
+    readonly mail_attribute: "onLdapMailChange";
+    readonly quota_attribute: "onLdapQuotaChange";
+    readonly alias_attribute: "onLdapAliasChange";
+    readonly forward_attribute: "onLdapForwardChange";
+    readonly drive_quota_attribute: "onLdapDriveQuotaChange";
+};
+type AttributeHook = (typeof events)[keyof typeof events];
 declare class OnLdapChange extends DmPlugin {
     name: string;
     roles: Role[];
@@ -33,8 +41,8 @@ declare class OnLdapChange extends DmPlugin {
     read(dn: string): Promise<Entry | undefined>;
     publish(dn: string, before: Entry | null, after: Entry | null, context?: ChangeContext): void;
     notify(dn: string, changes: ChangesToNotify, before: Entry | null, after: Entry | null): void;
-    notifyAttributeChange(attribute: string, hookName: keyof Hooks, dn: string, changes: ChangesToNotify, stringOnly?: boolean): void;
-    notifyAttributeChangeWithMail(attribute: string, hookName: keyof Hooks, dn: string, changes: ChangesToNotify, after: Entry | null): void;
+    notifyAttributeChange(attribute: string, hookName: AttributeHook, dn: string, changes: ChangesToNotify, stringOnly?: boolean): void;
+    notifyAttributeChangeWithMail(attribute: string, hookName: AttributeHook, dn: string, changes: ChangesToNotify, after: Entry | null): void;
     /**
      * The name the James plugin gives an identity, in the same order: the
      * display name attribute, then cn, then givenName + sn

package/dist/src/plugins/ldap/organizations.d.ts

@@ -94,9 +94,25 @@ import type { Schema } from '../../config/schema';
  *   example:
  *     description: Updated description for Marketing
  */
+export declare const OrganizationParams: import("@sinclair/typebox").TObject<{
+    dn: import("@sinclair/typebox").TString;
+}>;
+export declare const OrganizationSearchQuery: import("@sinclair/typebox").TObject<{
+    q: import("@sinclair/typebox").TString;
+}>;
 export default class LdapOrganizations extends DmPlugin {
+    static optionDefinitions: {
+        ldap_top_organization: import("../../config/options").StringOption;
+        ldap_organization_class: import("../../config/options").ArrayOption;
+        ldap_organization_link_attribute: import("../../config/options").StringOption;
+        ldap_organization_path_attribute: import("../../config/options").StringOption;
+        ldap_organization_path_separator: import("../../config/options").StringOption;
+        ldap_organization_max_subnodes: import("../../config/options").NumberOption;
+        organization_schema: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
+    private readonly settings;
     pathAttr: string;
     linkAttr: string;
     schema?: Schema;

package/dist/src/plugins/ldap/passwordPolicy.d.ts

@@ -232,7 +232,38 @@ import DmPlugin, { type Role } from '../../abstract/plugin';
  *       description: List of failed rule descriptions (empty when valid).
  *       example: []
  */
+export declare const PolicyParams: import("@sinclair/typebox").TObject<{
+    cn: import("@sinclair/typebox").TString;
+}>;
+export declare const PolicyUserParams: import("@sinclair/typebox").TObject<{
+    id: import("@sinclair/typebox").TString;
+}>;
+export declare const ExpiringQuery: import("@sinclair/typebox").TObject<{
+    days: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+}>;
+export declare const AssignPolicyBody: import("@sinclair/typebox").TObject<{
+    policy: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>;
+}>;
+export declare const UnlockResponse: import("@sinclair/typebox").TObject<{
+    success: import("@sinclair/typebox").TBoolean;
+    message: import("@sinclair/typebox").TString;
+}>;
+export declare const ValidatePasswordBody: import("@sinclair/typebox").TObject<{
+    password: import("@sinclair/typebox").TString;
+}>;
 export default class PasswordPolicy extends DmPlugin {
+    static optionDefinitions: {
+        ppolicy_default_dn: import("../../config/options").StringOption;
+        ppolicy_base: import("../../config/options").StringOption;
+        ppolicy_warn_days: import("../../config/options").NumberOption;
+        ppolicy_validate_complexity: import("../../config/options").BooleanOption;
+        ppolicy_min_length: import("../../config/options").NumberOption;
+        ppolicy_require_uppercase: import("../../config/options").BooleanOption;
+        ppolicy_require_lowercase: import("../../config/options").BooleanOption;
+        ppolicy_require_digit: import("../../config/options").BooleanOption;
+        ppolicy_require_special: import("../../config/options").BooleanOption;
+        ldap_users_base: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
     private policyCache;
@@ -241,6 +272,7 @@ export default class PasswordPolicy extends DmPlugin {
     private warnedMissingBase;
     private warnedUnreadableSchema;
     private readonly POLICY_CACHE_TTL;
+    private get settings();
     api(app: Express): void;
     /**
      * Get password status for a user
@@ -320,7 +352,6 @@ export default class PasswordPolicy extends DmPlugin {
     private updatePolicy;
     private deletePolicy;
     private assignPolicy;
-    private param;
     /**
      * Parse GeneralizedTime (YYYYMMDDHHmmssZ) to Date
      */

package/dist/src/plugins/ldap/raw.d.ts

@@ -1,20 +1,3 @@
-/**
- * @module plugins/ldap/raw
- * @author Xavier Guimard <xguimard@linagora.com>
- *
- * Low-level LDAP browsing API (read-only).
- *
- * Where the other plugins expose business objects (users, groups,
- * organizations), this one exposes the directory itself: the root DSE, the
- * schema, and entries addressed by their DN. It is the server side of a
- * phpLDAPadmin-like interface.
- *
- * Every directory access goes through `server.ldap`, so the authorization,
- * trash and logging hooks apply exactly as they do for the high-level APIs.
- * Root DSE and schema are directory metadata rather than user data and are
- * read with the service account, so that a UI can render attribute names and
- * types even when the caller is restricted to a branch.
- */
 import type { Express, Request } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 import type { DM } from '../../bin';
@@ -103,13 +86,45 @@ export interface RawSearchResult {
 }
 declare const VALID_SCOPES: readonly ["base", "one", "sub"];
 type Scope = (typeof VALID_SCOPES)[number];
+export declare const RawSearchQuery: import("@sinclair/typebox").TObject<{
+    base: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    scope: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    filter: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    attributes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    limit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+}>;
+export declare const RawDnParams: import("@sinclair/typebox").TObject<{
+    dn: import("@sinclair/typebox").TString;
+}>;
+export declare const RawChildrenQuery: import("@sinclair/typebox").TObject<{
+    children: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+}>;
 export default class LdapRaw extends DmPlugin {
+    static optionDefinitions: {
+        ldap_raw_base: import("../../config/options").ArrayOption;
+        ldap_raw_hidden_attribute: import("../../config/options").ArrayOption;
+        ldap_raw_show_secrets: import("../../config/options").BooleanOption;
+        ldap_raw_max_results: import("../../config/options").NumberOption;
+        ldap_raw_schema_cache_ttl: import("../../config/options").NumberOption;
+    };
     name: string;
     roles: Role[];
     /** Subtrees the API is allowed to expose */
     bases: string[];
     /** Attributes never returned, whatever the request (lowercase) */
     hiddenAttributes: Set<string>;
+    /**
+     * The hidden attributes resolved to their directory types: OID and every
+     * name the schema gives them, once it has been read. Undefined until then,
+     * when only the configured names are compared.
+     */
+    private hiddenTypeNames?;
+    /**
+     * The hidden types plus their supertypes, which a filter assertion also
+     * tests (RFC 4511 §4.5.1.7.1). A result still answers under the subtype's
+     * own name, so only the filter check reads this set.
+     */
+    private hiddenFilterNames?;
     /** True when credential attributes are served instead of being hidden */
     showSecrets: boolean;
     /** Maximum entries returned by a search or a children listing */
@@ -124,16 +139,32 @@ export default class LdapRaw extends DmPlugin {
      * @throws ForbiddenError when the DN is outside every configured base
      */
     checkDn(dn: string): void;
+    /**
+     * Resolve the hidden attribute names to the directory's attribute types: a
+     * type answers under its OID and under each of its names, so comparing the
+     * configured spelling alone would let an alias or an OID through.
+     *
+     * @returns the names to compare, configured spellings included
+     */
+    private hiddenNames;
+    /** Whether an attribute description names one of the hidden types */
+    private isHidden;
     /**
      * Reject a malformed LDAP filter before it reaches the directory. Parsing
      * it here turns what would surface as an opaque server error into a 400
      * naming the offending expression — a search box hands us whatever the
      * user typed, and `gov` is a filter typo, not a server fault.
      *
+     * The filter is also the way a client could ask whether a hidden value
+     * matches without it being served, since the search runs with the service
+     * account's rights: an assertion on a hidden type is refused.
+     *
      * @param filter filter to validate
-     * @throws BadRequestError when the filter cannot be parsed
+     * @param hidden hidden types, the configured names when not resolved yet
+     * @throws BadRequestError when the filter cannot be parsed or tests a
+     *   hidden attribute
      */
-    checkFilter(filter: string): void;
+    checkFilter(filter: string, hidden: ReadonlySet<string>): void;
     /**
      * Convert an ldapts entry into its JSON representation: values are always
      * arrays and hidden attributes are dropped.

package/dist/src/plugins/ldap/trash.d.ts

@@ -14,6 +14,12 @@
 import DmPlugin, { type Role } from '../../abstract/plugin';
 import type { Hooks } from '../../hooks';
 declare class TrashPlugin extends DmPlugin {
+    static optionDefinitions: {
+        trash_base: import("../../config/options").StringOption;
+        trash_watched_bases: import("../../config/options").StringOption;
+        trash_add_metadata: import("../../config/options").StringOption;
+        trash_auto_create: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
     private watchedBases;

package/dist/src/plugins/metrics.d.ts

@@ -2,6 +2,9 @@ import type { Express } from 'express';
 import DmPlugin from '../abstract/plugin';
 import type { DM } from '../bin';
 export default class Metrics extends DmPlugin {
+    static optionDefinitions: {
+        metrics_port: import("../config/options").NumberOption;
+    };
     name: string;
     /** The gauges read at scrape time and the process metrics */
     private readonly own;

package/dist/src/plugins/metrics.options.d.ts

@@ -0,0 +1,8 @@
+/** Metrics plugin options, see `docs/plugin-development/options.md`. */
+import type { Config } from '../config/args';
+import { type OptionsOf } from '../config/options';
+export declare const metricsOptions: {
+    metrics_port: import("../config/options").NumberOption;
+};
+export type MetricsOptions = OptionsOf<typeof metricsOptions>;
+export declare function metricsOptionsOf(config: Config): MetricsOptions;

package/dist/src/plugins/rabbitmq.d.ts

@@ -61,6 +61,9 @@ interface RabbitClientOptions {
     logger: ClientLogger;
 }
 export default class RabbitMq extends DmPlugin {
+    static optionDefinitions: {
+        rabbitmq_url: import("../config/options").StringOption;
+    };
     name: string;
     private readonly rabbitmqUrl;
     private client;

package/dist/src/plugins/rabbitmq.options.d.ts

@@ -0,0 +1,8 @@
+/** RabbitMQ plugin options, see `docs/plugin-development/options.md`. */
+import type { Config } from '../config/args';
+import { type OptionsOf } from '../config/options';
+export declare const rabbitmqOptions: {
+    rabbitmq_url: import("../config/options").StringOption;
+};
+export type RabbitmqOptions = OptionsOf<typeof rabbitmqOptions>;
+export declare function rabbitmqOptionsOf(config: Config): RabbitmqOptions;

package/dist/src/plugins/scim/baseResolver.d.ts

@@ -1,5 +1,6 @@
 import type { Config } from '../../config/args';
 import { type DmRequest } from '../../lib/auth/base';
+import { type ScimOptions } from './scim.options';
 export interface BaseMapEntry {
     userBase?: string;
     groupBase?: string;
@@ -16,7 +17,7 @@ export declare class BaseResolver {
     private readonly headerRoot;
     /** Kept so a base is keyed on whatever `--authz-identity` names. */
     private readonly config;
-    constructor(config: Config);
+    constructor(config: Config, options?: ScimOptions);
     private applyTemplate;
     /** Read a request header by name, tolerating Express req or a plain object. */
     private readHeader;

package/dist/src/plugins/scim/bulk.d.ts

@@ -11,29 +11,28 @@
  * dispatch).
  */
 import type winston from 'winston';
-import type { Config } from '../../config/args';
 import type { DmRequest } from '../../lib/auth/base';
+import type HookBus from '../../lib/hookBus';
 import type { ScimUsers } from './users';
+import type { ScimOptions } from './scim.options';
 import type { ScimGroups } from './groups';
 import { type BulkRequest, type BulkResponse } from './types';
 import { writeScimErrorFromException } from './errors';
 export interface ScimBulkOptions {
-    config: Config;
+    options: ScimOptions;
     logger: winston.Logger;
     users: ScimUsers;
     groups: ScimGroups;
     scimPrefix: string;
-    hooks: {
-        [K: string]: Function[] | undefined;
-    };
+    hookBus: HookBus;
 }
 export declare class ScimBulk {
-    private readonly config;
+    private readonly options;
     private readonly logger;
     private readonly users;
     private readonly groups;
     private readonly scimPrefix;
-    private readonly hooks;
+    private readonly hookBus;
     constructor(opts: ScimBulkOptions);
     execute(req: DmRequest, body: BulkRequest): Promise<BulkResponse>;
     private executeOne;

package/dist/src/plugins/scim/discovery.d.ts

@@ -1,8 +1,10 @@
 import type { Config } from '../../config/args';
 import type { DmRequest } from '../../lib/auth/base';
+import type { ScimOptions } from './scim.options';
 import { type ResourceTypeDefinition, type ServiceProviderConfig, type SchemaDefinition } from './types';
 export interface DiscoveryOptions {
     config: Config;
+    options: ScimOptions;
     schemaDir: string;
     scimPrefix: string;
     loadedPlugins: {
@@ -11,6 +13,7 @@ export interface DiscoveryOptions {
 }
 export declare class ScimDiscovery {
     private readonly config;
+    private readonly options;
     private readonly schemaDir;
     private readonly scimPrefix;
     private readonly loadedPlugins;

package/dist/src/plugins/scim/errors.d.ts

@@ -32,7 +32,8 @@ export declare function writeScimError(res: Response, status: number, detail: st
  * Split out from `writeScimErrorFromException` so `/Bulk`, which reports a
  * status per operation instead of writing a response, applies exactly the
  * same translations — including the ones that matter: an authorization
- * refusal is a 403 with the internal marker stripped, not a 500 quoting it.
+ * refusal is a 403 saying `AUTHZ_REFUSED`, not a 500 quoting the branch it
+ * judged.
  */
 export declare function scimErrorFromException(err: unknown, fallbackStatus?: number): ScimErrorResponse;
 export declare function writeScimErrorFromException(res: Response, err: unknown, fallbackStatus?: number): void;

package/dist/src/plugins/scim/groups.d.ts

@@ -8,9 +8,11 @@ import type winston from 'winston';
 import type ldapActions from '../../lib/ldapActions';
 import type { Config } from '../../config/args';
 import type { DmRequest } from '../../lib/auth/base';
+import type HookBus from '../../lib/hookBus';
 import { BaseResolver } from './baseResolver';
 import { type ResourceMapping, type ScimGroup, type ListResponse, type PatchRequest } from './types';
 import type { ScimUsers } from './users';
+import type { ScimOptions } from './scim.options';
 export interface GroupListQuery {
     filter?: string;
     startIndex?: number;
@@ -21,20 +23,20 @@ export interface GroupListQuery {
 export interface ScimGroupsOptions {
     ldap: ldapActions;
     config: Config;
+    options: ScimOptions;
     logger: winston.Logger;
     baseResolver: BaseResolver;
     users: ScimUsers;
-    hooks: {
-        [K: string]: Function[] | undefined;
-    };
+    hookBus: HookBus;
 }
 export declare class ScimGroups {
     private readonly ldap;
     private readonly config;
+    private readonly options;
     private readonly logger;
     private readonly baseResolver;
     private readonly users;
-    private readonly hooks;
+    private readonly hookBus;
     private readonly mapping;
     private readonly attributes;
     private readonly rdnAttribute;