ldap-rest 1.2.1 → 1.3.0

package/dist/plugins/auth/rateLimit.js

@@ -1 +1 @@
-import t from"../../abstract/plugin.js";class RateLimit extends t{constructor(...t){super(...t),this.name="rateLimit",this.roles=["protect"],this.store=new Map,this.windowMs=this.config.rate_limit_window_ms||9e5,this.maxRequests=this.config.rate_limit_max||100,this.logger.info(`Auth rate limiting enabled: ${this.maxRequests} failed attempts per ${this.windowMs/1e3} seconds`)}api(t){this.server.loadedPlugins.trustedProxy||this.logger.warn("Auth rate limiting keys on X-Forwarded-For but core/auth/trustedProxy is not loaded: a client can forge that header and evade the limit. Load core/auth/trustedProxy, or put the API behind a proxy that overwrites the header."),t.use((t,e,s)=>{const i=this.getClientIp(t),r=Date.now(),o=this.store.get(i);o&&r>o.resetTime&&this.store.delete(i);const a=this.store.get(i);if(a&&a.count>=this.maxRequests&&r<=a.resetTime)return this.logger.warn(`Rate limiting ${i}: ${a.count}/${this.maxRequests} failed attempts`),e.status(429).json({error:"Too many authentication attempts, please try again later",retryAfter:Math.ceil((a.resetTime-r)/1e3)});e.on("finish",()=>{if(401===e.statusCode||403===e.statusCode){const t=this.store.get(i),e=Date.now();!t||e>t.resetTime?this.store.set(i,{count:1,resetTime:e+this.windowMs}):t.count++,this.logger.debug(`Failed auth from ${i}: ${this.store.get(i)?.count}/${this.maxRequests}`)}}),s()})}getClientIp(t){const e=t.headers["x-forwarded-for"];if(e){return(Array.isArray(e)?e[0]:e).split(",")[0].trim()}return t.socket.remoteAddress||"unknown"}}export{RateLimit as default};
+import t from"../../abstract/plugin.js";import{rateLimitOptions as e}from"./auth.options.js";class RateLimit extends t{static optionDefinitions=e;name="rateLimit";roles=["protect"];store=new Map;windowMs;maxRequests;constructor(...t){super(...t);const s=this.options(e);this.windowMs=s.rate_limit_window_ms,this.maxRequests=s.rate_limit_max,this.logger.info(`Auth rate limiting enabled: ${this.maxRequests} failed attempts per ${this.windowMs/1e3} seconds`)}api(t){this.server.loadedPlugins.trustedProxy||this.logger.warn("Auth rate limiting keys on X-Forwarded-For but core/auth/trustedProxy is not loaded: a client can forge that header and evade the limit. Load core/auth/trustedProxy, or put the API behind a proxy that overwrites the header."),t.use((t,e,s)=>{const i=this.getClientIp(t),r=Date.now(),o=this.store.get(i);o&&r>o.resetTime&&this.store.delete(i);const a=this.store.get(i);if(a&&a.count>=this.maxRequests&&r<=a.resetTime)return this.logger.warn(`Rate limiting ${i}: ${a.count}/${this.maxRequests} failed attempts`),e.status(429).json({error:"Too many authentication attempts, please try again later",retryAfter:Math.ceil((a.resetTime-r)/1e3)});e.on("finish",()=>{if(401===e.statusCode||403===e.statusCode){const t=this.store.get(i),e=Date.now();!t||e>t.resetTime?this.store.set(i,{count:1,resetTime:e+this.windowMs}):t.count++,this.logger.debug(`Failed auth from ${i}: ${this.store.get(i)?.count}/${this.maxRequests}`)}}),s()})}getClientIp(t){const e=t.headers["x-forwarded-for"];if(e){return(Array.isArray(e)?e[0]:e).split(",")[0].trim()}return t.socket.remoteAddress||"unknown"}}export{RateLimit as default};

package/dist/plugins/auth/token.js

@@ -1 +1 @@
-import{unauthorized as t}from"../../lib/expressFormatedResponses.js";import e from"../../lib/auth/base.js";class AuthToken extends e{knownIdentities(){return[...new Set(this.tokenMap.values())]}identitySource(){return"req.user and req.userName: the name given in --auth-token"}constructor(...t){super(...t),this.name="authToken",this.roles=["auth"],this.tokenMap=new Map;const e=this.config.auth_token;e&&Array.isArray(e)&&e.forEach((t,e)=>{if(t.includes(":")){const[e,s]=t.split(":",2);this.tokenMap.set(e.trim(),s.trim())}else this.tokenMap.set(t.trim(),`token ${e}`)})}authMethod(e,s,n){let r=e.headers.authorization;if(!r||!/^Bearer .+/.test(r))return this.logger.warn("Missing or invalid Authorization header"),t(s);r=r.split(" ")[1];const i=this.tokenMap.get(r);if(!i){const e=r.length>8?`${r.substring(0,8)}...`:"***";return this.logger.warn(`Unauthorized token: ${e}`),t(s)}this.publishIdentity(e,i),n()}}export{AuthToken as default};
+import{unauthorized as t}from"../../lib/expressFormatedResponses.js";import e from"../../lib/auth/base.js";import{tokenOptions as n}from"./auth.options.js";class AuthToken extends e{static optionDefinitions=n;knownIdentities(){return[...new Set(this.tokenMap.values())]}identitySource(){return"req.user and req.userName: the name given in --auth-token"}name="authToken";roles=["auth"];tokenMap=new Map;constructor(...t){super(...t);this.options(n).auth_token.forEach((t,e)=>{if(t.includes(":")){const[e,n]=t.split(":",2);this.tokenMap.set(e.trim(),n.trim())}else this.tokenMap.set(t.trim(),`token ${e}`)})}authMethod(e,n,s){let i=e.headers.authorization;if(!i||!/^Bearer .+/.test(i))return this.logger.warn("Missing or invalid Authorization header"),t(n);i=i.split(" ")[1];const o=this.tokenMap.get(i);if(!o){const e=i.length>8?`${i.substring(0,8)}...`:"***";return this.logger.warn(`Unauthorized token: ${e}`),t(n)}this.publishIdentity(e,o),s()}}export{AuthToken as default};

package/dist/plugins/auth/totp.js

@@ -1 +1 @@
-import{createHmac as t}from"crypto";import{unauthorized as e}from"../../lib/expressFormatedResponses.js";import s from"../../lib/auth/base.js";class AuthTotp extends s{knownIdentities(){return this.totpUsers.map(t=>t.name)}identitySource(){return"req.user and req.userName: the name given in --auth-totp"}constructor(...t){super(...t),this.name="authTotp",this.roles=["auth"],this.totpUsers=[];const e=this.config.auth_totp;this.window=this.config.auth_totp_window??1,this.step=this.config.auth_totp_step??30,e&&Array.isArray(e)&&e.forEach((t,e)=>{const s=t.split(":"),[r,i,o]=s.map(t=>t.trim()),n=void 0===o?6:Number(o),fail=t=>{throw new Error(`Invalid --auth-totp entry at index ${e}: ${t}; entries are separated by \`,\`, \`;\` or newlines`)};(s.length<2||s.length>3||!r||!i)&&fail('expected "secret:name[:digits]"'),this.isValidBase32(r)||fail("the secret is not Base32"),(""===o||!Number.isInteger(n)||n<6||n>10)&&fail("digits must be an integer from 6 to 10"),this.totpUsers.push({name:i,secret:r,digits:n})}),0===this.totpUsers.length?this.logger.warn("No valid TOTP users configured"):this.logger.info(`TOTP authentication initialized with ${this.totpUsers.length} user(s)`)}authMethod(t,s,r){const i=t.headers.authorization;if(!i||!/^Bearer .+/.test(i))return this.logger.warn("Missing or invalid Authorization header"),e(s);const o=i.split(" ")[1];for(const e of this.totpUsers)if(this.verifyTotp(e.secret,o,e.digits))return this.logger.debug(`TOTP authentication successful for user: ${e.name}`),this.publishIdentity(t,e.name),r();return this.logger.warn(`Unauthorized TOTP token: ${o}`),e(s)}verifyTotp(t,e,s){const r=Math.floor(Date.now()/1e3);for(let i=-this.window;i<=this.window;i++){const o=Math.floor(r/this.step)+i;if(this.generateTotp(t,o,s)===e)return!0}return!1}generateTotp(e,s,r){const i=this.base32Decode(e),o=Buffer.alloc(8);o.writeBigUInt64BE(BigInt(s));const n=t("sha1",i);n.update(o);const a=n.digest(),h=15&a[a.length-1];return(((127&a[h])<<24|(255&a[h+1])<<16|(255&a[h+2])<<8|255&a[h+3])%Math.pow(10,r)).toString().padStart(r,"0")}base32Decode(t){let e=t.toUpperCase();for(;e.endsWith("=");)e=e.slice(0,-1);let s=0,r=0;const i=[];for(let t=0;t<e.length;t++){const o="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567".indexOf(e[t]);if(-1===o)throw new Error(`Invalid Base32 character: ${e[t]}`);r=r<<5|o,s+=5,s>=8&&(i.push(r>>>s-8&255),s-=8)}return Buffer.from(i)}isValidBase32(t){return/^[A-Z2-7]+=*$/.test(t.toUpperCase())}}export{AuthTotp as default};
+import{createHmac as t}from"crypto";import{unauthorized as e}from"../../lib/expressFormatedResponses.js";import s from"../../lib/auth/base.js";import{totpOptions as r}from"./auth.options.js";class AuthTotp extends s{static optionDefinitions=r;knownIdentities(){return this.totpUsers.map(t=>t.name)}identitySource(){return"req.user and req.userName: the name given in --auth-totp"}name="authTotp";roles=["auth"];totpUsers=[];window;step;constructor(...t){super(...t);const e=this.options(r),s=e.auth_totp;this.window=e.auth_totp_window,this.step=e.auth_totp_step,s.forEach((t,e)=>{const s=t.split(":"),[r,i,o]=s.map(t=>t.trim()),n=void 0===o?6:Number(o),fail=t=>{throw new Error(`Invalid --auth-totp entry at index ${e}: ${t}; entries are separated by \`,\`, \`;\` or newlines`)};(s.length<2||s.length>3||!r||!i)&&fail('expected "secret:name[:digits]"'),this.isValidBase32(r)||fail("the secret is not Base32"),(""===o||!Number.isInteger(n)||n<6||n>10)&&fail("digits must be an integer from 6 to 10"),this.totpUsers.push({name:i,secret:r,digits:n})}),0===this.totpUsers.length?this.logger.warn("No valid TOTP users configured"):this.logger.info(`TOTP authentication initialized with ${this.totpUsers.length} user(s)`)}authMethod(t,s,r){const i=t.headers.authorization;if(!i||!/^Bearer .+/.test(i))return this.logger.warn("Missing or invalid Authorization header"),e(s);const o=i.split(" ")[1];for(const e of this.totpUsers)if(this.verifyTotp(e.secret,o,e.digits))return this.logger.debug(`TOTP authentication successful for user: ${e.name}`),this.publishIdentity(t,e.name),r();return this.logger.warn(`Unauthorized TOTP token: ${o}`),e(s)}verifyTotp(t,e,s){const r=Math.floor(Date.now()/1e3);for(let i=-this.window;i<=this.window;i++){const o=Math.floor(r/this.step)+i;if(this.generateTotp(t,o,s)===e)return!0}return!1}generateTotp(e,s,r){const i=this.base32Decode(e),o=Buffer.alloc(8);o.writeBigUInt64BE(BigInt(s));const n=t("sha1",i);n.update(o);const a=n.digest(),h=15&a[a.length-1];return(((127&a[h])<<24|(255&a[h+1])<<16|(255&a[h+2])<<8|255&a[h+3])%Math.pow(10,r)).toString().padStart(r,"0")}base32Decode(t){let e=t.toUpperCase();for(;e.endsWith("=");)e=e.slice(0,-1);let s=0,r=0;const i=[];for(let t=0;t<e.length;t++){const o="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567".indexOf(e[t]);if(-1===o)throw new Error(`Invalid Base32 character: ${e[t]}`);r=r<<5|o,s+=5,s>=8&&(i.push(r>>>s-8&255),s-=8)}return Buffer.from(i)}isValidBase32(t){return/^[A-Z2-7]+=*$/.test(t.toUpperCase())}}export{AuthTotp as default};

package/dist/plugins/auth/trustedProxy.js

@@ -1 +1 @@
-import r from"../../abstract/plugin.js";class TrustedProxy extends r{constructor(...r){super(...r),this.name="trustedProxy",this.roles=["protect"],this.trustedNetworks=[];const e=this.config.trusted_proxy;if(!e||!Array.isArray(e)||0===e.length)throw new Error("TrustedProxy plugin requires trusted_proxy configuration (array of IPs or CIDR ranges)");for(const r of e)try{this.trustedNetworks.push(this.parseCIDR(r))}catch(e){throw new Error(`Invalid trusted proxy address "${r}": ${e instanceof Error?e.message:String(e)}`)}this.authHeader=(this.config.trusted_proxy_auth_header||"Auth-User").toLowerCase(),this.logger.info(`Trusted proxy validation enabled for ${e.length} address(es): ${e.join(", ")} (auth header: ${this.authHeader})`)}api(r){r.use((r,e,s)=>{const t=r.socket.remoteAddress;if(!t)return this.logger.debug("No remote address, removing X-Forwarded-For header"),delete r.headers["x-forwarded-for"],s();const o=r.headers["x-forwarded-for"];if(this.isTrustedProxy(t)){r.trustedProxy=!0;const e=r.headers[this.authHeader];e?(r.proxyAuthUser=Array.isArray(e)?e[0]:e,this.logger.debug(`Request from trusted proxy ${t}, Auth-User: ${r.proxyAuthUser}, X-Forwarded-For: ${o?String(o):"(none)"}`)):this.logger.debug(`Request from trusted proxy ${t}, X-Forwarded-For: ${o?String(o):"(none)"}`)}else r.trustedProxy=!1,o&&(this.logger.warn(`Removing X-Forwarded-For header from untrusted source ${t} (was: ${String(o)})`),delete r.headers["x-forwarded-for"]);s()})}isTrustedProxy(r){try{const e=this.normalizeIP(r),s=this.parseIP(e);for(const r of this.trustedNetworks)if(s.isIPv6===r.isIPv6&&(s.ip&r.mask)===(r.ip&r.mask))return!0;return!1}catch(e){return this.logger.error(`Failed to parse IP address "${r}": ${e instanceof Error?e.message:String(e)}`),!1}}normalizeIP(r){const e=r.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);return e?e[1]:r}parseIP(r){return r.includes(":")?{ip:this.parseIPv6(r),isIPv6:!0}:{ip:this.parseIPv4(r),isIPv6:!1}}parseCIDR(r){const[e,s]=r.split("/"),t=e.includes(":");let o,n;const i=t?128:32;if(o=t?this.parseIPv6(e):this.parseIPv4(e),void 0!==s){const r=parseInt(s,10);if(isNaN(r)||r<0||r>i)throw new Error(`Invalid prefix length: ${s}`);if(0===r)n=0n;else{const e=BigInt(i);n=(1n<<e)-1n^(1n<<e-BigInt(r))-1n}}else n=t?(1n<<128n)-1n:(1n<<32n)-1n;return{ip:o,mask:n,isIPv6:t}}parseIPv4(r){const e=r.split(".");if(4!==e.length)throw new Error(`Invalid IPv4 address: ${r}`);let s=0n;for(const t of e){const e=parseInt(t,10);if(isNaN(e)||e<0||e>255)throw new Error(`Invalid IPv4 address: ${r}`);s=s<<8n|BigInt(e)}return s}parseIPv6(r){let e=r;if(r.includes("::")){const s=r.split("::");if(s.length>2)throw new Error(`Invalid IPv6 address: ${r}`);const t=s[0]?s[0].split(":"):[],o=s[1]?s[1].split(":"):[],n=8-t.length-o.length;if(n<0)throw new Error(`Invalid IPv6 address: ${r}`);const i=Array(n).fill("0");e=[...t,...i,...o].join(":")}const s=e.split(":");if(8!==s.length)throw new Error(`Invalid IPv6 address: ${r}`);let t=0n;for(const e of s){const s=parseInt(e||"0",16);if(isNaN(s)||s<0||s>65535)throw new Error(`Invalid IPv6 address: ${r}`);t=t<<16n|BigInt(s)}return t}}export{TrustedProxy as default};
+import r from"../../abstract/plugin.js";import{trustedProxyOptions as e}from"./auth.options.js";class TrustedProxy extends r{static optionDefinitions=e;name="trustedProxy";roles=["protect"];trustedNetworks=[];authHeader;constructor(...r){super(...r);const t=this.options(e),s=t.trusted_proxy;if(0===s.length)throw new Error("TrustedProxy plugin requires trusted_proxy configuration (array of IPs or CIDR ranges)");for(const r of s)try{this.trustedNetworks.push(this.parseCIDR(r))}catch(e){throw new Error(`Invalid trusted proxy address "${r}": ${e instanceof Error?e.message:String(e)}`)}this.authHeader=t.trusted_proxy_auth_header.toLowerCase(),this.logger.info(`Trusted proxy validation enabled for ${s.length} address(es): ${s.join(", ")} (auth header: ${this.authHeader})`)}api(r){r.use((r,e,t)=>{const s=r.socket.remoteAddress;if(!s)return this.logger.debug("No remote address, removing X-Forwarded-For header"),delete r.headers["x-forwarded-for"],t();const o=r.headers["x-forwarded-for"];if(this.isTrustedProxy(s)){r.trustedProxy=!0;const e=r.headers[this.authHeader];e?(r.proxyAuthUser=Array.isArray(e)?e[0]:e,this.logger.debug(`Request from trusted proxy ${s}, Auth-User: ${r.proxyAuthUser}, X-Forwarded-For: ${o?String(o):"(none)"}`)):this.logger.debug(`Request from trusted proxy ${s}, X-Forwarded-For: ${o?String(o):"(none)"}`)}else r.trustedProxy=!1,o&&(this.logger.warn(`Removing X-Forwarded-For header from untrusted source ${s} (was: ${String(o)})`),delete r.headers["x-forwarded-for"]);t()})}isTrustedProxy(r){try{const e=this.normalizeIP(r),t=this.parseIP(e);for(const r of this.trustedNetworks)if(t.isIPv6===r.isIPv6&&(t.ip&r.mask)===(r.ip&r.mask))return!0;return!1}catch(e){return this.logger.error(`Failed to parse IP address "${r}": ${e instanceof Error?e.message:String(e)}`),!1}}normalizeIP(r){const e=r.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);return e?e[1]:r}parseIP(r){return r.includes(":")?{ip:this.parseIPv6(r),isIPv6:!0}:{ip:this.parseIPv4(r),isIPv6:!1}}parseCIDR(r){const[e,t]=r.split("/"),s=e.includes(":");let o,n;const i=s?128:32;if(o=s?this.parseIPv6(e):this.parseIPv4(e),void 0!==t){const r=parseInt(t,10);if(isNaN(r)||r<0||r>i)throw new Error(`Invalid prefix length: ${t}`);if(0===r)n=0n;else{const e=BigInt(i);n=(1n<<e)-1n^(1n<<e-BigInt(r))-1n}}else n=s?(1n<<128n)-1n:(1n<<32n)-1n;return{ip:o,mask:n,isIPv6:s}}parseIPv4(r){const e=r.split(".");if(4!==e.length)throw new Error(`Invalid IPv4 address: ${r}`);let t=0n;for(const s of e){const e=parseInt(s,10);if(isNaN(e)||e<0||e>255)throw new Error(`Invalid IPv4 address: ${r}`);t=t<<8n|BigInt(e)}return t}parseIPv6(r){let e=r;if(r.includes("::")){const t=r.split("::");if(t.length>2)throw new Error(`Invalid IPv6 address: ${r}`);const s=t[0]?t[0].split(":"):[],o=t[1]?t[1].split(":"):[],n=8-s.length-o.length;if(n<0)throw new Error(`Invalid IPv6 address: ${r}`);const i=Array(n).fill("0");e=[...s,...i,...o].join(":")}const t=e.split(":");if(8!==t.length)throw new Error(`Invalid IPv6 address: ${r}`);let s=0n;for(const e of t){const t=parseInt(e||"0",16);if(isNaN(t)||t<0||t>65535)throw new Error(`Invalid IPv6 address: ${r}`);s=s<<16n|BigInt(t)}return s}}export{TrustedProxy as default};

package/dist/plugins/bcl.js

@@ -1 +1 @@
-import s from"../abstract/plugin.js";const t="bcl";class Bcl extends s{constructor(s){super(s),this.name="bcl",this.dependencies={storage:"core/storage"},this.hooks={oidclogouttoken:async s=>{const e=Bcl.keys(s);if(0===e.length)return void this.logger.warn(`${this.name}: a logout token carried no sid nor sub`);const o=Date.now()+this.retention;await Promise.all(e.map(s=>this.store.set(t,s,"1",o)))},oidclogin:async s=>{await Promise.all(Bcl.keys(s).map(s=>this.store.delete(t,s)))},oidcsessionvalid:async([s,e])=>{if(!e)return[s,e];for(const e of Bcl.keys(s))if(null!==await this.store.get(t,e))return[s,!1];return[s,!0]}},this.retention=1e3*(s.config.bcl_retention||604800)}api(){const s=this.requirePlugin("storage");if(!s)throw new Error("bcl: needs core/storage loaded, and --storage-backend set. Without somewhere to keep what a logout killed, every session would outlive the logout that closed it and nothing would say so.");this.storage=s}get store(){if(!this.storage)throw new Error("bcl: the store was asked for before api() took hold of it. A plugin built outside registerPlugin has to call api() as it does.");return this.storage.store}static keys(s){const t=[];return s.sid&&t.push(`${s.iss}|sid|${s.sid}`),s.sub&&t.push(`${s.iss}|sub|${s.sub}`),s.session&&t.push(`${s.iss}|session|${s.session}`),t}}export{Bcl as default};
+import s from"../abstract/plugin.js";import{bclOptions as t}from"./bcl.options.js";const e="bcl";class Bcl extends s{static optionDefinitions=t;name="bcl";dependencies={storage:"core/storage"};storage;retention;constructor(s){super(s),this.retention=1e3*this.options(t).bcl_retention}api(){const s=this.requirePlugin("storage");if(!s)throw new Error("bcl: needs core/storage loaded, and --storage-backend set. Without somewhere to keep what a logout killed, every session would outlive the logout that closed it and nothing would say so.");this.storage=s}get store(){if(!this.storage)throw new Error("bcl: the store was asked for before api() took hold of it. A plugin built outside registerPlugin has to call api() as it does.");return this.storage.store}static keys(s){const t=[];return s.sid&&t.push(`${s.iss}|sid|${s.sid}`),s.sub&&t.push(`${s.iss}|sub|${s.sub}`),s.session&&t.push(`${s.iss}|session|${s.session}`),t}hooks={oidclogouttoken:async s=>{const t=Bcl.keys(s);if(0===t.length)return void this.logger.warn(`${this.name}: a logout token carried no sid nor sub`);const o=Date.now()+this.retention;await Promise.all(t.map(s=>this.store.set(e,s,"1",o)))},oidclogin:async s=>{await Promise.all(Bcl.keys(s).map(s=>this.store.delete(e,s)))},oidcsessionvalid:async([s,t])=>{if(!t)return[s,t];for(const t of Bcl.keys(s))if(null!==await this.store.get(e,t))return[s,!1];return[s,!0]}}}export{Bcl as default};

package/dist/plugins/bcl.options.js

@@ -0,0 +1 @@
+import{defineOptions as n,opt as o,readOptions as t}from"../config/options.js";const i=n({bcl_retention:o.number({env:"DM_BCL_RETENTION",default:604800,min:1})});function bclOptionsOf(n){return t(i,n)}export{i as bclOptions,bclOptionsOf};

package/dist/plugins/configApi.js

@@ -1 +1 @@
-import i from"../abstract/plugin.js";import{wantJson as t}from"../lib/expressFormatedResponses.js";import{asyncHandler as o}from"../lib/utils.js";class ConfigApi extends i{constructor(){super(...arguments),this.name="configApi",this.roles=["api"]}api(i){const s=this.config.api_prefix||"/api";i.get(`${s}/v1/config`,o(async(i,o)=>{if(!t(i,o))return;const e={apiPrefix:s,ldapBase:this.config.ldap_base||"",features:await this.collectPluginConfigs()};o.json(e)})),this.logger.info(`Configuration API registered at ${s}/v1/config`)}async collectPluginConfigs(){const i={};for(const[t,o]of Object.entries(this.server.loadedPlugins))if("configApi"!==t&&o.roles?.includes("configurable")&&o.getConfigApiData)try{const s=await o.getConfigApiData();s&&(i[o.configApiKey??t]=s)}catch(i){this.logger.warn(`Failed to get config from plugin ${t}: ${String(i)}`)}return i}}export{ConfigApi as default};
+import i from"../abstract/plugin.js";import{wantJson as o}from"../lib/expressFormatedResponses.js";import{SERVER_VERSION as e}from"../lib/version.js";import{defineRoute as n}from"../lib/route.js";function configApiResponse(i,o,e,n){return{apiPrefix:i,ldapBase:o,features:e,...n?{version:n}:{}}}class ConfigApi extends i{name="configApi";roles=["api"];api(i){const s=this.config.api_prefix||"/api";n(i,{method:"get",path:`${s}/v1/config`,handler:async({req:i,res:n})=>{o(i,n)&&n.json(configApiResponse(s,this.config.ldap_base||"",await this.collectPluginConfigs(),e))}}),this.logger.info(`Configuration API registered at ${s}/v1/config`)}async collectPluginConfigs(){const i={};for(const[o,e]of Object.entries(this.server.loadedPlugins))if("configApi"!==o&&e.roles?.includes("configurable")&&e.getConfigApiData)try{const n=await e.getConfigApiData();n&&(i[e.configApiKey??o]=n)}catch(i){this.logger.warn(`Failed to get config from plugin ${o}: ${String(i)}`)}return i}}export{configApiResponse,ConfigApi as default};

package/dist/plugins/demo/helloworld.js

@@ -1 +1 @@
-import o from"../../abstract/plugin.js";import{asyncHandler as s,runAsHookOwner as e}from"../../lib/utils.js";class HelloWorld extends o{constructor(){super(...arguments),this.name="hello",this.roles=["demo"]}api(o){o.get(`${this.config.api_prefix}/hello`,s(async(o,s)=>{const l={message:"Hello",hookResults:[]};if(this.server.hooks&&this.server.hooks.hello)for(const o of this.server.hooks.hello){const s=o;l.hookResults.push(await e(o,()=>s()))}s.json(l)}))}}export{HelloWorld as default};
+import{Type as e}from"@sinclair/typebox";import o from"../../abstract/plugin.js";import{defineRoute as l}from"../../lib/route.js";const s=e.Object({message:e.String({description:"Static greeting string.",example:"Hello"}),hookResults:e.Array(e.Unknown(),{description:"Results collected from every function registered on the `hello` hook. Empty when no hook listeners are installed.",example:[]})},{description:"Response returned by the hello-world demo endpoint.",example:{message:"Hello",hookResults:[]}});class HelloWorld extends o{name="hello";roles=["demo"];api(e){l(e,{method:"get",path:`${this.config.api_prefix}/hello`,responses:{200:{schema:s,description:"Greeting with hook results."}},summary:"Demo hello-world endpoint",description:"Exists exclusively as a minimal example for plugin development. The handler fires the `hello` hook and collects the results from every registered listener into `hookResults`. In a production deployment this plugin is normally disabled; enabling it is safe but adds no functional value.",handler:async({res:e})=>{e.json({message:"Hello",hookResults:await this.hookBus.call("hello")})}})}}export{s as HelloResponse,HelloWorld as default};

package/dist/plugins/ldap/accountLifecycle.js

@@ -1 +1 @@
-import{randomBytes as e}from"crypto";import t from"../../abstract/plugin.js";import{roleAttribute as s}from"../../config/schema.js";import{asyncHandler as o}from"../../lib/utils.js";import{jsonBody as a}from"../../lib/expressFormatedResponses.js";import{BadRequestError as n,NotFoundError as r}from"../../lib/errors.js";const c="abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%*-_=+";function generatePassword(t=16){const s=67*Math.floor(256/67);let o="";for(;o.length<t;)for(const a of e(t))if(!(a>=s)&&(o+=c[a%67],o.length===t))break;return o}class LdapAccountLifecycle extends t{constructor(){super(...arguments),this.name="ldapAccountLifecycle",this.roles=["api"],this.dependencies={ldapFlatGeneric:"core/ldap/flatGeneric"}}api(e){const t=this.server.loadedPlugins.ldapFlatGeneric;if(!t?.instances?.length)return void this.logger.warn("accountLifecycle: no flat entity is loaded, no endpoint registered");const a=`${this.config.api_prefix}/v1/ldap`;for(const n of t.instances){const t=s(n.schema,"accountStatus"),r=t?n.schema?.attributes[t]?.states:void 0;t&&r&&Object.keys(r).length>0&&(e.post(`${a}/${n.pluralName}/:id/status`,o(async(e,s)=>this.setStatus(n,t,r,e,s))),this.logger.info(`accountLifecycle: ${n.pluralName} states = ${Object.keys(r).join(", ")}`));const c=s(n.schema,"password");c&&e.post(`${a}/${n.pluralName}/:id/password`,o(async(e,t)=>this.resetPassword(n,c,e,t)))}}async setStatus(e,t,s,o,r){const c=a(o,r,"state");if(!c)return;if(!Object.prototype.hasOwnProperty.call(s,c.state))throw new n(`Unknown state "${c.state}" for ${e.singularName}; known states: ${Object.keys(s).join(", ")}`);const i=s[c.state],d=decodeURIComponent(o.params.id);await this.modify(e,d,{replace:{[t]:i}},o),r.json({success:!0,state:c.state})}async resetPassword(e,t,o,r){const c=a(o,r);if(!c)return;const i=c.password;if(void 0!==i&&("string"!=typeof i||""===i))throw new n("Field password must be a non-empty string; omit it to have one generated");if("string"==typeof i){if([...i].length>256)throw new n("Field password must be at most 256 characters");if(/[\u0000-\u001f\u007f-\u009f]/.test(i))throw new n("Field password must not contain control characters")}if(void 0!==c.forceChange&&"boolean"!=typeof c.forceChange)throw new n("Field forceChange must be a boolean");const d=void 0===i,f=d?generatePassword():i,l={[t]:f},p=s(e.schema,"passwordReset"),h=!1!==c.forceChange;if(p){const t=e.schema?.attributes[p],s=t?.states,o=h?s?.required??"TRUE":s?.cleared??"FALSE";l[p]=o}const m=decodeURIComponent(o.params.id);await this.modify(e,m,{replace:l},o),r.json({success:!0,generated:d,forceChange:Boolean(p)&&h,...d?{password:f}:{}})}async modify(e,t,s,o){try{await e.modifyEntry(t,s,o)}catch(t){if(32===t.code)throw new r(`${e.singularName} not found`);throw t}}}export{LdapAccountLifecycle as default,generatePassword};
+import{randomBytes as e}from"crypto";import{Type as t}from"@sinclair/typebox";import s from"../../abstract/plugin.js";import{roleAttribute as o}from"../../config/schema.js";import{BadRequestError as a,NotFoundError as n}from"../../lib/errors.js";import{defineRoute as r}from"../../lib/route.js";const c=t.Object({state:t.String()}),i=t.Object({password:t.Optional(t.String()),forceChange:t.Optional(t.Boolean())}),d=t.Object({success:t.Boolean(),state:t.String()}),l=t.Object({success:t.Boolean(),generated:t.Boolean(),forceChange:t.Boolean(),password:t.Optional(t.String())}),p="abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%*-_=+";function generatePassword(t=16){const s=67*Math.floor(256/67);let o="";for(;o.length<t;)for(const a of e(t))if(!(a>=s)&&(o+=p[a%67],o.length===t))break;return o}class LdapAccountLifecycle extends s{name="ldapAccountLifecycle";roles=["api"];dependencies={ldapFlatGeneric:"core/ldap/flatGeneric"};api(e){const t=this.server.loadedPlugins.ldapFlatGeneric;if(!t?.instances?.length)return void this.logger.warn("accountLifecycle: no flat entity is loaded, no endpoint registered");const s=`${this.config.api_prefix}/v1/ldap`;for(const a of t.instances){const t=o(a.schema,"accountStatus"),n=t?a.schema?.attributes[t]?.states:void 0;t&&n&&Object.keys(n).length>0&&(r(e,{method:"post",path:`${s}/${a.pluralName}/:id/status`,body:c,responses:{200:d},handler:async({req:e,res:s})=>this.setStatus(a,t,n,e,s)}),this.logger.info(`accountLifecycle: ${a.pluralName} states = ${Object.keys(n).join(", ")}`));const p=o(a.schema,"password");p&&r(e,{method:"post",path:`${s}/${a.pluralName}/:id/password`,body:i,responses:{200:l},handler:async({req:e,res:t})=>this.resetPassword(a,p,e,t)})}}async setStatus(e,t,s,o,n){const r=o.body;if(!Object.hasOwn(s,r.state))throw new a(`Unknown state "${r.state}" for ${e.singularName}; known states: ${Object.keys(s).join(", ")}`);const c=s[r.state],i=decodeURIComponent(o.params.id);await this.modify(e,i,{replace:{[t]:c}},o),n.json({success:!0,state:r.state})}async resetPassword(e,t,s,n){const r=s.body,c=r.password;if(""===c)throw new a("Field password must be a non-empty string; omit it to have one generated");if(void 0!==c){if([...c].length>256)throw new a("Field password must be at most 256 characters");if(/[\u0000-\u001f\u007f-\u009f]/.test(c))throw new a("Field password must not contain control characters")}const i=void 0===c,d=i?generatePassword():c,l={[t]:d},p=o(e.schema,"passwordReset"),f=!1!==r.forceChange;if(p){const t=e.schema?.attributes[p],s=t?.states,o=f?s?.required??"TRUE":s?.cleared??"FALSE";l[p]=o}const h=decodeURIComponent(s.params.id);await this.modify(e,h,{replace:l},s),n.json({success:!0,generated:i,forceChange:Boolean(p)&&f,...i?{password:d}:{}})}async modify(e,t,s,o){try{await e.modifyEntry(t,s,o)}catch(t){if(32===t.code)throw new n(`${e.singularName} not found`);throw t}}}export{i as PasswordBody,l as PasswordResponse,c as StatusBody,d as StatusResponse,LdapAccountLifecycle as default,generatePassword};

package/dist/plugins/ldap/bulkImport.js

@@ -1 +1 @@
-import t from"multer";import{parse as e}from"csv-parse/sync";import r from"../../abstract/plugin.js";import{badRequest as i,serverError as s}from"../../lib/expressFormatedResponses.js";import{errorBody as o,AUTHZ_REFUSED as a,HttpError as n}from"../../lib/errors.js";import{loadSchemaFile as c}from"../../lib/schemaFile.js";import{isAuthzRefusal as l,validateDnValue as d,escapeDnValue as p}from"../../lib/utils.js";const u=/^([A-Za-z][A-Za-z0-9-]*|\d+(\.\d+)+)(;[A-Za-z0-9-]+)*$/;class LdapBulkImport extends r{constructor(e){super(e),this.name="ldapBulkImport",this.roles=["configurable"],this.resources=new Map;const r=parseInt(this.config.bulk_import_max_file_size,10)||10485760;this.upload=t({storage:t.memoryStorage(),limits:{fileSize:r},fileFilter:(t,e,r)=>{"text/csv"===e.mimetype||e.originalname.endsWith(".csv")?r(null,!0):r(new Error("Only CSV files are allowed"))}});const i=this.config.bulk_import_schemas;if(!i)return void this.logger.warn("No bulk import schemas configured");const s=i.split(",").map(t=>t.trim());for(const t of s){const[e,r]=t.split(":").map(t=>t.trim());if(e&&r)try{const t=c(r,{config:this.config});this.resources.set(e,{name:e,schema:t,base:t.base||this.config.ldap_base,mainAttribute:t.mainAttribute||"cn"}),this.logger.info(`Loaded bulk import resource: ${e} from ${r}`)}catch(t){this.logger.error(`Failed to load schema for ${e}: ${t.message}`)}else this.logger.warn(`Invalid schema entry: ${t}`)}}api(t){for(const[e,r]of this.resources)t.get(`${this.config.api_prefix}/v1/ldap/bulk-import/${e}/template.csv`,(t,e)=>this.getTemplate(t,e,r)),t.post(`${this.config.api_prefix}/v1/ldap/bulk-import/${e}`,this.upload.single("file"),async(t,e)=>this.bulkImport(t,e,r))}getTemplate(t,e,r){const i=this.getEditableAttributes(r.schema);i.push("organizationDn"),e.setHeader("Content-Type","text/csv; charset=utf-8"),e.setHeader("Content-Disposition",`attachment; filename="${r.name}-template.csv"`),e.send(i.join(",")+"\n")}async bulkImport(t,r,c){if(!t.file)return i(r,"No file uploaded");const d="true"===t.body.dryRun||!0===t.body.dryRun,p="true"===t.body.updateExisting||!0===t.body.updateExisting,u="false"!==t.body.continueOnError&&!1!==t.body.continueOnError,h=Date.now(),f={success:!0,total:0,created:0,updated:0,skipped:0,failed:0,errors:[],details:{duration:"",linesProcessed:0}};try{const i=t.file.buffer.toString("utf-8"),s=e(i,{columns:!0,skip_empty_lines:!0,trim:!0});f.total=s.length;for(let e=0;e<s.length;e++){const r=e+2,i=s[e];try{const{dn:e,entry:r,orgDn:s}=this.buildRecord(i,c);await this.authorizeRow(e,r,t),await this.completeRecord(r,s,c);const o=await this.entryExists(e);if(o&&!p){f.skipped++;continue}if(d){o||await this.server.ldap.authorize("ldapaddrequest",[e,r,t]),o&&await this.server.ldap.authorize("ldapmodifyrequest",[e,{replace:r},this.opNumber(),t]),o?f.updated++:f.created++;continue}o&&p?(await this.server.ldap.modify(e,{replace:r},t),f.updated++):(await this.server.ldap.add(e,r,t),f.created++)}catch(t){if(f.failed++,f.errors.push({line:r,identifier:i[c.mainAttribute],...l(t)?o(t,a):{error:t.message,...t instanceof n?t.refusal:void 0}}),!u)throw t}}f.details.linesProcessed=s.length,f.details.duration=`${((Date.now()-h)/1e3).toFixed(1)}s`,r.json(f)}catch(t){return s(r,t)}}async authorizeRow(t,e,r){try{await this.server.ldap.authorize("ldapaddrequest",[t,e,r])}catch(i){if(!l(i))throw i;try{await this.server.ldap.authorize("ldapmodifyrequest",[t,{replace:e},this.opNumber(),r])}catch{throw i}}}buildRecord(t,e){const r={},i=e.schema,s=t.organizationDn;delete t.organizationDn;const o=new Set;for(const[t,e]of Object.entries(i.properties||{}))if(!0===e.fixed){const i=e.default||e.const;void 0!==i&&(r[t]=i,o.add(t.toLowerCase()))}for(const[e,i]of Object.entries(t))if(i&&""!==i.trim()){if(!u.test(e))throw new Error(`Invalid column name: ${e}`);if(o.has(e.split(";")[0].toLowerCase()))throw new Error(`Attribute "${e}" is fixed and cannot be imported`);r[e]=i.includes(";")?i.split(";").map(t=>t.trim()):i}if(s){const t=this.findAttributeByRole(i,"organizationLink");t&&(r[t]=s)}const a=e.mainAttribute,n=r[a];if(!n)throw new Error(`Missing main attribute: ${a}`);const c=Array.isArray(n)?String(n[0]):String(n);d(c,a);return{dn:`${a}=${p(c)},${e.base}`,entry:r,orgDn:s}}async completeRecord(t,e,r){const i=r.schema;if(e){const r=this.findAttributeByRole(i,"organizationPath");if(r){const i=(await this.fetchOrganization(e))[r];t[r]=Array.isArray(i)?i[0]:i}}for(const[e,r]of Object.entries(i.properties||{}))if(!0===r.required&&!t[e])throw new Error(`Missing required attribute: ${e}`)}getEditableAttributes(t){const e=[];for(const[r,i]of Object.entries(t.properties||{}))!0!==i.fixed&&(i.role?.includes("organizationLink")||i.role?.includes("organizationPath")||e.push(r));return e}findAttributeByRole(t,e){for(const[r,i]of Object.entries(t.properties||{}))if(i.role?.includes(e))return r;return null}async fetchOrganization(t){const e=await this.server.ldap.system.search({paged:!1,scope:"base"},t);if(0===e.searchEntries.length)throw new Error(`Organization not found: ${t}`);return e.searchEntries[0]}async entryExists(t){try{return(await this.server.ldap.system.search({paged:!1,scope:"base"},t)).searchEntries.length>0}catch(t){return!1}}getConfigApiData(){const t=this.config.api_prefix||"/api",e=[];return this.resources.forEach((r,i)=>{e.push({name:i,mainAttribute:r.mainAttribute,base:r.base,maxFileSize:parseInt(this.config.bulk_import_max_file_size,10)||10485760,batchSize:parseInt(this.config.bulk_import_batch_size,10)||100,endpoints:{template:`${t}/v1/ldap/bulk-import/${i}/template.csv`,import:`${t}/v1/ldap/bulk-import/${i}`}})}),{enabled:!0,resources:e}}}export{LdapBulkImport as default};
+import t from"multer";import{parse as e}from"csv-parse/sync";import r from"../../abstract/plugin.js";import{badRequest as i,serverError as s}from"../../lib/expressFormatedResponses.js";import{isAuthzRefusal as o,errorBody as a,AUTHZ_REFUSED as n,HttpError as l}from"../../lib/errors.js";import{loadSchemaFile as c}from"../../lib/schemaFile.js";import{validateDnValue as p,escapeDnValue as d}from"../../lib/utils.js";import{bulkImportOptions as u}from"./ldap.options.js";import{defineRoute as m}from"../../lib/route.js";const h=/^([A-Za-z][A-Za-z0-9-]*|\d+(\.\d+)+)(;[A-Za-z0-9-]+)*$/;class LdapBulkImport extends r{static optionDefinitions=u;name="ldapBulkImport";roles=["configurable"];settings;resources=new Map;upload;constructor(e){super(e),this.settings=this.options(u);const r=parseInt(this.settings.bulk_import_max_file_size,10)||10485760;this.upload=t({storage:t.memoryStorage(),limits:{fileSize:r},fileFilter:(t,e,r)=>{"text/csv"===e.mimetype||e.originalname.endsWith(".csv")?r(null,!0):r(new Error("Only CSV files are allowed"))}});const i=this.settings.bulk_import_schemas;if(!i)return void this.logger.warn("No bulk import schemas configured");const s=i.split(",").map(t=>t.trim());for(const t of s){const[e,r]=t.split(":").map(t=>t.trim());if(e&&r)try{const t=c(r,{config:this.config});this.resources.set(e,{name:e,schema:t,base:t.base||this.config.ldap_base,mainAttribute:t.mainAttribute||"cn"}),this.logger.info(`Loaded bulk import resource: ${e} from ${r}`)}catch(t){this.logger.error(`Failed to load schema for ${e}: ${t.message}`)}else this.logger.warn(`Invalid schema entry: ${t}`)}}api(t){for(const[e,r]of this.resources)m(t,{method:"get",path:`${this.config.api_prefix}/v1/ldap/bulk-import/${e}/template.csv`,json:!1,handler:({req:t,res:e})=>this.getTemplate(t,e,r)}),m(t,{method:"post",path:`${this.config.api_prefix}/v1/ldap/bulk-import/${e}`,middleware:this.upload.single("file"),handler:async({req:t,res:e})=>this.bulkImport(t,e,r)})}getTemplate(t,e,r){const i=this.getEditableAttributes(r.schema);i.push("organizationDn"),e.setHeader("Content-Type","text/csv; charset=utf-8"),e.setHeader("Content-Disposition",`attachment; filename="${r.name}-template.csv"`),e.send(i.join(",")+"\n")}async bulkImport(t,r,c){if(!t.file)return i(r,"No file uploaded");const p="true"===t.body.dryRun||!0===t.body.dryRun,d="true"===t.body.updateExisting||!0===t.body.updateExisting,u="false"!==t.body.continueOnError&&!1!==t.body.continueOnError,m=Date.now(),h={success:!0,total:0,created:0,updated:0,skipped:0,failed:0,errors:[],details:{duration:"",linesProcessed:0}};try{const i=t.file.buffer.toString("utf-8"),s=e(i,{columns:!0,skip_empty_lines:!0,trim:!0});h.total=s.length;for(let e=0;e<s.length;e++){const r=e+2,i=s[e];try{const{dn:e,entry:r,orgDn:s}=this.buildRecord(i,c);await this.authorizeRow(e,r,t),await this.completeRecord(r,s,c);const o=await this.entryExists(e);if(o&&!d){h.skipped++;continue}if(p){o||await this.server.ldap.authorize("ldapaddrequest",[e,r,t]),o&&await this.server.ldap.authorize("ldapmodifyrequest",[e,{replace:r},this.opNumber(),t]),o?h.updated++:h.created++;continue}o&&d?(await this.server.ldap.modify(e,{replace:r},t),h.updated++):(await this.server.ldap.add(e,r,t),h.created++)}catch(t){if(h.failed++,h.errors.push({line:r,identifier:i[c.mainAttribute],...o(t)?a(t,n):{error:t.message,...t instanceof l?t.refusal:void 0}}),!u)throw t}}h.details.linesProcessed=s.length,h.details.duration=`${((Date.now()-m)/1e3).toFixed(1)}s`,r.json(h)}catch(t){return s(r,t)}}async authorizeRow(t,e,r){try{await this.server.ldap.authorize("ldapaddrequest",[t,e,r])}catch(i){if(!o(i))throw i;try{await this.server.ldap.authorize("ldapmodifyrequest",[t,{replace:e},this.opNumber(),r])}catch{throw i}}}buildRecord(t,e){const r={},i=e.schema,s=t.organizationDn;delete t.organizationDn;const o=new Set;for(const[t,e]of Object.entries(i.properties||{}))if(!0===e.fixed){const i=e.default||e.const;void 0!==i&&(r[t]=i,o.add(t.toLowerCase()))}for(const[e,i]of Object.entries(t))if(i&&""!==i.trim()){if(!h.test(e))throw new Error(`Invalid column name: ${e}`);if(o.has(e.split(";")[0].toLowerCase()))throw new Error(`Attribute "${e}" is fixed and cannot be imported`);r[e]=i.includes(";")?i.split(";").map(t=>t.trim()):i}if(s){const t=this.findAttributeByRole(i,"organizationLink");t&&(r[t]=s)}const a=e.mainAttribute,n=r[a];if(!n)throw new Error(`Missing main attribute: ${a}`);const l=Array.isArray(n)?String(n[0]):String(n);p(l,a);return{dn:`${a}=${d(l)},${e.base}`,entry:r,orgDn:s}}async completeRecord(t,e,r){const i=r.schema;if(e){const r=this.findAttributeByRole(i,"organizationPath");if(r){const i=(await this.fetchOrganization(e))[r];t[r]=Array.isArray(i)?i[0]:i}}for(const[e,r]of Object.entries(i.properties||{}))if(!0===r.required&&!t[e])throw new Error(`Missing required attribute: ${e}`)}getEditableAttributes(t){const e=[];for(const[r,i]of Object.entries(t.properties||{}))!0!==i.fixed&&(i.role?.includes("organizationLink")||i.role?.includes("organizationPath")||e.push(r));return e}findAttributeByRole(t,e){for(const[r,i]of Object.entries(t.properties||{}))if(i.role?.includes(e))return r;return null}async fetchOrganization(t){const e=await this.server.ldap.system.search({paged:!1,scope:"base"},t);if(0===e.searchEntries.length)throw new Error(`Organization not found: ${t}`);return e.searchEntries[0]}async entryExists(t){try{return(await this.server.ldap.system.search({paged:!1,scope:"base"},t)).searchEntries.length>0}catch(t){return!1}}getConfigApiData(){const t=this.config.api_prefix||"/api",e=[];return this.resources.forEach((r,i)=>{e.push({name:i,mainAttribute:r.mainAttribute,base:r.base,maxFileSize:parseInt(this.settings.bulk_import_max_file_size,10)||10485760,batchSize:parseInt(this.settings.bulk_import_batch_size,10)||100,endpoints:{template:`${t}/v1/ldap/bulk-import/${i}/template.csv`,import:`${t}/v1/ldap/bulk-import/${i}`}})}),{enabled:!0,resources:e}}}export{LdapBulkImport as default};

package/dist/plugins/ldap/departmentSync.js

@@ -1 +1 @@
-import t from"../../abstract/plugin.js";import{roleAttribute as e}from"../../config/schema.js";import{isDnInBranch as a,parseDn as r,normalizeDn as n,getParentDn as i,rdnValue as s,escapeLdapFilter as o}from"../../lib/utils.js";class LdapDepartmentSync extends t{constructor(t){super(t),this.name="ldapDepartmentSync",this.roles=["consistency"],this.hooks={ldaprenamedone:async([t,e])=>{if(/^ou=/.test(t)){this.logger.info(`Organization renamed from ${t} to ${e}, synchronizing linked resources...`);try{const a=this.config.ldap_top_organization.replace(/^ou=[^,]+,/,"");await this.updateOrganizationPaths(e);for(const r of this.linkedAttributes())await this.updateLinkedResources(t,e,a,r),await this.updateDescendantReferences(t,e,a,r)}catch(t){this.logger.error(`Error synchronizing department links after rename: ${t}`)}}}},this.linkAttr=this.config.ldap_organization_link_attribute||"twakeDepartmentLink",this.pathAttr=this.config.ldap_organization_path_attribute||"twakeDepartmentPath"}organizationPathAttribute(){const t=this.server.loadedPlugins.ldapOrganizations;return e(t?.schema,"organizationPath")||this.pathAttr}linkedAttributes(){const t=[],a=this.server.loadedPlugins.ldapFlatGeneric;for(const e of a?.instances||[])t.push(e.schema);const r=this.server.loadedPlugins.ldapGroups;t.push(r?.schema);const n=[];for(const a of t){const t=e(a,"organizationLink");t&&n.push({link:t,path:e(a,"organizationPath")||this.pathAttr})}n.push({link:this.linkAttr,path:this.pathAttr});const i=new Set;return n.filter(({link:t,path:e})=>{const a=`${t.toLowerCase()} ${e.toLowerCase()}`;return!i.has(a)&&(i.add(a),!0)})}async updateOrganizationPaths(t){const e=this.organizationPathAttribute(),o=this.config.ldap_top_organization;if(!o||!a(t,o))return;const h=this.config.ldap_organization_path_separator||" / ",c=await this.server.ldap.system.search({paged:!0,scope:"sub",filter:`(${e}=*)`,attributes:[e]},t),d=[];for await(const t of c)for(const a of t.searchEntries){const t=String(a.dn);if(!/^ou=/i.test(t))continue;const r=a[e];d.push({dn:t,path:String(Array.isArray(r)?r[0]:r)})}d.sort((t,e)=>r(t.dn).length-r(e.dn).length);const l=n(o),g=new Map;let p=0;for(const{dn:t,path:a}of d){const r=i(t),o=n(r);let c;if(o!==l&&(c=g.get(o)??await this.readPath(r)??void 0,void 0===c)){this.logger.warn(`Organization ${r} has no ${e}: the path of ${t} is left as it is`);continue}const d=s(t),u=c?`${c}${h}${d}`:d;if(g.set(n(t),u),u!==a)try{await this.server.ldap.system.modify(t,{replace:{[e]:u}}),p++}catch(e){this.logger.error(`Failed to update the path of ${t} after organization rename: ${e}`)}}this.logger.info(`Updated the path of ${p} organizations below ${t}`)}async readPath(t){const e=this.organizationPathAttribute();try{const a=await this.server.ldap.system.search({paged:!1,scope:"base",attributes:[e]},t),r=a.searchEntries[0]?.[e];return void 0===r?null:String(Array.isArray(r)?r[0]:r)}catch{return null}}async updateLinkedResources(t,e,a,r){const n=`(${r.link}=${o(t)})`;this.logger.debug(`Searching for resources directly linked to ${t}: ${n}`);const i=await this.server.ldap.system.search({paged:!0,filter:n,attributes:[r.link,r.path]},a);let s=0;for await(const t of i)for(const a of t.searchEntries){const t=String(a.dn);try{const a=await this.getDepartmentPath(e);await this.server.ldap.system.modify(t,{replace:{[r.link]:e,[r.path]:a}}),s++,this.logger.debug(`Updated ${t}: ${r.link}=${e}, ${r.path}=${a}`)}catch(e){this.logger.error(`Failed to update ${t} after organization rename: ${e}`)}}this.logger.info(`Updated ${s} resources directly linked to the renamed organization`)}async updateDescendantReferences(t,e,a,r){const n=`(${r.link}=*)`;this.logger.debug(`Searching for resources linked to descendants of ${t}: ${n}`);const i=await this.server.ldap.system.search({paged:!0,filter:n,attributes:[r.link,r.path]},a);let s=0;for await(const a of i)for(const n of a.searchEntries){const a=String(n.dn),i=n[r.link],o=Array.isArray(i)?String(i[0]):String(i);if(o!==t&&o.endsWith(`,${t}`))try{const n=o.replace(`,${t}`,()=>`,${e}`),i=await this.getDepartmentPath(n);await this.server.ldap.system.modify(a,{replace:{[r.link]:n,[r.path]:i}}),s++,this.logger.debug(`Updated descendant link ${a}: ${r.link}=${n}, ${r.path}=${i}`)}catch(t){this.logger.error(`Failed to update descendant reference ${a}: ${t}`)}}this.logger.info(`Updated ${s} resources linked to descendants of the renamed organization`)}async getDepartmentPath(t){const e=this.organizationPathAttribute();try{const a=await this.server.ldap.system.search({paged:!1,scope:"base",attributes:[e,"ou","o"]},t);if(!a.searchEntries||0===a.searchEntries.length)throw new Error(`Organization ${t} not found`);const r=a.searchEntries[0];if(r[e]){const t=r[e];return Array.isArray(t)?String(t[0]):String(t)}const n=r.ou||r.o;if(n){return`/${Array.isArray(n)?String(n[0]):String(n)}`}return this.logger.warn(`Organization ${t} has no ${e} attribute, using DN`),t}catch(e){throw new Error(`Failed to fetch organization ${t}: ${e}`)}}}export{LdapDepartmentSync as default};
+import t from"../../abstract/plugin.js";import{roleAttribute as e}from"../../config/schema.js";import{isDnInBranch as r,parseDn as a,normalizeDn as s,getParentDn as n,rdnValue as i,escapeLdapFilter as o}from"../../lib/utils.js";import{organizationOptionsOf as h}from"./ldap.options.js";class LdapDepartmentSync extends t{name="ldapDepartmentSync";roles=["consistency"];settings;linkAttr;pathAttr;constructor(t){super(t),this.settings=h(t.config),this.linkAttr=this.settings.ldap_organization_link_attribute,this.pathAttr=this.settings.ldap_organization_path_attribute}organizationPathAttribute(){const t=this.server.loadedPlugins.ldapOrganizations;return e(t?.schema,"organizationPath")||this.pathAttr}linkedAttributes(){const t=[],r=this.server.loadedPlugins.ldapFlatGeneric;for(const e of r?.instances||[])t.push(e.schema);const a=this.server.loadedPlugins.ldapGroups;t.push(a?.schema);const s=[];for(const r of t){const t=e(r,"organizationLink");t&&s.push({link:t,path:e(r,"organizationPath")||this.pathAttr})}s.push({link:this.linkAttr,path:this.pathAttr});const n=new Set;return s.filter(({link:t,path:e})=>{const r=`${t.toLowerCase()} ${e.toLowerCase()}`;return!n.has(r)&&(n.add(r),!0)})}hooks={ldaprenamedone:async(t,e)=>{if(/^ou=/.test(t)){this.logger.info(`Organization renamed from ${t} to ${e}, synchronizing linked resources...`);try{const r=this.settings.ldap_top_organization.replace(/^ou=[^,]+,/,"");await this.updateOrganizationPaths(e);for(const a of this.linkedAttributes())await this.updateLinkedResources(t,e,r,a),await this.updateDescendantReferences(t,e,r,a)}catch(t){this.logger.error(`Error synchronizing department links after rename: ${t}`)}}}};async updateOrganizationPaths(t){const e=this.organizationPathAttribute(),o=this.settings.ldap_top_organization;if(!o||!r(t,o))return;const h=this.settings.ldap_organization_path_separator,c=await this.server.ldap.system.search({paged:!0,scope:"sub",filter:`(${e}=*)`,attributes:[e]},t),d=[];for await(const t of c)for(const r of t.searchEntries){const t=String(r.dn);if(!/^ou=/i.test(t))continue;const a=r[e];d.push({dn:t,path:String(Array.isArray(a)?a[0]:a)})}d.sort((t,e)=>a(t.dn).length-a(e.dn).length);const g=s(o),l=new Map;let p=0;for(const{dn:t,path:r}of d){const a=n(t),o=s(a);let c;if(o!==g&&(c=l.get(o)??await this.readPath(a)??void 0,void 0===c)){this.logger.warn(`Organization ${a} has no ${e}: the path of ${t} is left as it is`);continue}const d=i(t),u=c?`${c}${h}${d}`:d;if(l.set(s(t),u),u!==r)try{await this.server.ldap.system.modify(t,{replace:{[e]:u}}),p++}catch(e){this.logger.error(`Failed to update the path of ${t} after organization rename: ${e}`)}}this.logger.info(`Updated the path of ${p} organizations below ${t}`)}async readPath(t){const e=this.organizationPathAttribute();try{const r=await this.server.ldap.system.search({paged:!1,scope:"base",attributes:[e]},t),a=r.searchEntries[0]?.[e];return void 0===a?null:String(Array.isArray(a)?a[0]:a)}catch{return null}}async updateLinkedResources(t,e,r,a){const s=`(${a.link}=${o(t)})`;this.logger.debug(`Searching for resources directly linked to ${t}: ${s}`);const n=await this.server.ldap.system.search({paged:!0,filter:s,attributes:[a.link,a.path]},r);let i=0;for await(const t of n)for(const r of t.searchEntries){const t=String(r.dn);try{const r=await this.getDepartmentPath(e);await this.server.ldap.system.modify(t,{replace:{[a.link]:e,[a.path]:r}}),i++,this.logger.debug(`Updated ${t}: ${a.link}=${e}, ${a.path}=${r}`)}catch(e){this.logger.error(`Failed to update ${t} after organization rename: ${e}`)}}this.logger.info(`Updated ${i} resources directly linked to the renamed organization`)}async updateDescendantReferences(t,e,r,a){const s=`(${a.link}=*)`;this.logger.debug(`Searching for resources linked to descendants of ${t}: ${s}`);const n=await this.server.ldap.system.search({paged:!0,filter:s,attributes:[a.link,a.path]},r);let i=0;for await(const r of n)for(const s of r.searchEntries){const r=String(s.dn),n=s[a.link],o=Array.isArray(n)?String(n[0]):String(n);if(o!==t&&o.endsWith(`,${t}`))try{const s=o.replace(`,${t}`,()=>`,${e}`),n=await this.getDepartmentPath(s);await this.server.ldap.system.modify(r,{replace:{[a.link]:s,[a.path]:n}}),i++,this.logger.debug(`Updated descendant link ${r}: ${a.link}=${s}, ${a.path}=${n}`)}catch(t){this.logger.error(`Failed to update descendant reference ${r}: ${t}`)}}this.logger.info(`Updated ${i} resources linked to descendants of the renamed organization`)}async getDepartmentPath(t){const e=this.organizationPathAttribute();try{const r=await this.server.ldap.system.search({paged:!1,scope:"base",attributes:[e,"ou","o"]},t);if(!r.searchEntries||0===r.searchEntries.length)throw new Error(`Organization ${t} not found`);const a=r.searchEntries[0];if(a[e]){const t=a[e];return Array.isArray(t)?String(t[0]):String(t)}const s=a.ou||a.o;if(s){return`/${Array.isArray(s)?String(s[0]):String(s)}`}return this.logger.warn(`Organization ${t} has no ${e} attribute, using DN`),t}catch(e){throw new Error(`Failed to fetch organization ${t}: ${String(e)}`,{cause:e})}}}export{LdapDepartmentSync as default};

package/dist/plugins/ldap/enterpriseRules.js

@@ -1 +1 @@
-import e from"../../abstract/plugin.js";import{roleAttribute as t,hasRole as n,invalidValueMessage as r}from"../../config/schema.js";import{movedToTrash as s,normalizeDn as i,isDnInBranch as a,getParentDn as o,rdnValue as c,escapeLdapFilter as l,isDummyMemberDn as u}from"../../lib/utils.js";import{BadRequestError as f,ConflictError as d}from"../../lib/errors.js";import{extractLdapCode as h}from"../../lib/ldapCodes.js";function valueList(e){return null==e?[]:Array.isArray(e)?e.map(e=>String(e)):[String(e)]}function entryValues(e,t){for(const[n,r]of Object.entries(e))if(spells(n,t))return valueList(r);return[]}function spells(e,t){return e.split(";")[0].toLowerCase()===t.toLowerCase()}function allValues(e,t){return Object.entries(e||{}).filter(([e])=>spells(e,t)).flatMap(([,e])=>valueList(e))}function respell(e,t){if(!t)return;const n=Object.keys(e.attributes);for(const e of Object.keys(t)){if(e.includes(";"))continue;const r=n.find(t=>t!==e&&spells(e,t));r&&!(r in t)&&(t[r]=t[e],delete t[e])}}function asDn(e){try{return i(e)}catch{return e}}function uniquenessBases(e,t){const contains=(e,t)=>t===e||t.endsWith(`,${e}`),n=[];for(const r of[e,...t||[]]){const e=r.toLowerCase();if(!n.some(t=>contains(t.toLowerCase(),e))){for(let t=n.length-1;t>=0;t--)contains(e,n[t].toLowerCase())&&n.splice(t,1);n.push(r)}}return n}const m={B:1,KB:1e3,MB:1e6,GB:1e9,TB:1e12};function parseByteSize(e){if("number"==typeof e)return Math.round(e);const t=String(e).trim(),n=/^(\d+(?:\.\d+)?)\s*(B|KB|MB|GB|TB)?$/i.exec(t);if(!n)throw new f(`"${t}" is not a valid size`);const r=(n[2]||"B").toUpperCase();return Math.round(parseFloat(n[1])*m[r])}function fillsGeneratedAttribute(e,n,r){return!(void 0===n.default||!n.generated&&!n.normalize)||t(r,"organizationPath")===e}function parseDirectoryDate(e){const t=String(e).trim(),n=/^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})?(\d{2})?(?:[.,](\d+))?(Z|[+-]\d{2}(?::?\d{2})?)?$/.exec(t);if(!n){const e=new Date(t);return isNaN(e.getTime())?null:e}const[,r,s,i,a,o,c,l,u]=n,[f,d,h,m,p,g]=[r,s,i,a,o,c].map(e=>void 0===e?0:Number(e));if(d<1||d>12||m>23||p>59||g>60)return null;let b=Date.UTC(f,d-1,h,m,p,g);const y=new Date(b);if(y.getUTCMonth()!==d-1||y.getUTCDate()!==h)return null;if(void 0!==l){const e=void 0!==c?1e3:void 0!==o?6e4:36e5;b+=Math.round(Number(`0.${l}`)*e)}if(u&&"Z"!==u){const e=u.slice(1).replace(":",""),t=Number(e.slice(0,2)),n=e.length>2?Number(e.slice(2,4)):0;if(t>23||n>59)return null;b-=("-"===u[0]?-1:1)*(60*t+n)*6e4}return new Date(b)}function startOfUtcDay(e=new Date){return Date.UTC(e.getUTCFullYear(),e.getUTCMonth(),e.getUTCDate())}function mailInDomains(e,t,n=!1){if(0===t.length)return!0;if(t.includes("*"))return!0;const r=e.lastIndexOf("@");if(r<0)return!1;const s=e.slice(r+1).toLowerCase();return t.some(e=>{const t=e.toLowerCase();return s===t||n&&s.endsWith(`.${t}`)})}class LdapEnterpriseRules extends e{constructor(e){super(e),this.name="ldapEnterpriseRules",this.roles=["consistency"],this.hooks={ldapaddrequest:async([e,t,n])=>{const r=this.resolveEntity(e);return r&&(respell(r.schema,t),await this.runChecks(r,e,t,null),await this.runTransformations(r,e,t,!0)),void 0!==n?[e,t,n]:[e,t]},ldapmodifyrequest:async([e,n,r,s])=>{const i=this.resolveEntity(e);if(!i)return[e,n,r,s];respell(i.schema,n.add),respell(i.schema,n.replace);const a={...n.add||{},...n.replace||{}};if(0===Object.keys(a).length)return[e,n,r,s];const o=await this.readEntry(e),c=t(i.schema,"organizationLink"),l={...a},sent=e=>Object.keys(l).some(t=>spells(t,e));if(c&&sent(c)&&o)for(const[e,t]of Object.entries(i.schema.attributes)){if(!t.mailDomainScope)continue;if(sent(e))continue;const n=allValues(o,e);n.length&&(l[e]=n)}await this.runChecks(i,e,l,o),await this.runTransformations(i,e,a,!1);for(const[e,t]of Object.entries(a))n.replace&&e in n.replace?n.replace[e]=t:n.add&&e in n.add?n.add[e]=t:(n.replace=n.replace||{},n.replace[e]=t);return[e,n,r,s]},ldapdeleterequest:async([e,t])=>{for(const t of Array.isArray(e)?e:[e])await this.guardDelete(t);return[e,t]},ldapdeletedone:async(e,t)=>{for(const n of Array.isArray(e)?e:[e])await this.removeReferences(n,t)},ldaprenamedone:async([e,t],n)=>{s(this.config.trash_base,e,t)&&await this.removeReferences(e,n)}},this.missingBases=new Set,this.dummyMember=this.config.group_dummy_user,this.topOrganization=this.config.ldap_top_organization,this.logger.info("Enterprise directory rules enabled")}fillsGeneratedAttribute(e,t,n){return fillsGeneratedAttribute(e,t,n)}bindings(){const e=[],t=this.server.loadedPlugins.ldapFlatGeneric;for(const n of t?.instances||[])n.schema&&e.push({base:n.base,subtree:!1,schema:n.schema,label:n.singularName});const n=this.server.loadedPlugins.ldapGroups;n?.base&&n.schema&&e.push({base:n.base,subtree:!0,schema:n.schema,label:"group"});const r=this.server.loadedPlugins.ldapOrganizations;return r?.schema&&this.topOrganization&&e.push({base:this.topOrganization,subtree:!0,schema:r.schema,label:"organization"}),e}resolveEntity(e){const t=i(e);let n,r=-1;for(const s of this.bindings()){const c=i(s.base);if(t===c)continue;if(!a(e,s.base))continue;if(!s.subtree&&i(o(e))!==c)continue;const l=c.split(",").length;l>r&&(n=s,r=l)}return n}async runChecks(e,t,r,s){const i=Object.keys(e.schema.attributes);for(const[a,o]of Object.entries(r)){const c=i.find(e=>spells(a,e));if(!c)continue;const l=e.schema.attributes[c],u=valueList(o);0!==u.length&&(l.unique&&await this.checkUnique(e,c,l,u,t,s),l.mailDomainScope&&await this.checkMailDomains(e,c,l,u,r,s),n(l,"accountExpiry")&&this.checkNotInThePast(c,l,u))}}async runTransformations(e,n,s,i){for(const[t,n]of Object.entries(e.schema.attributes)){if(i&&void 0===s[t]&&void 0!==n.default&&(n.generated||n.normalize)&&(s[t]=Array.isArray(n.default)?n.default.map(e=>String(e)):String(n.default),"pointer"===n.type||"pointer"===n.items?.type))for(const e of valueList(s[t]))if(!await this.readEntry(e))throw new f(`Schema default for "${t}" points to a non-existent entry: ${e}`);if("byteSize"===n.normalize&&void 0!==s[t]){const e=valueList(s[t]);try{s[t]=Array.isArray(s[t])?e.map(e=>String(parseByteSize(e))):String(parseByteSize(e[0]))}catch{throw new f(r(t,n))}}}const a=t(e.schema,"organizationPath");if(!a)return;if(!e.schema.attributes[a]?.generated&&void 0!==s[a])return;const l=t(e.schema,"organizationLink");if(l){const e=valueList(s[l])[0];if(!e)return;const t=await this.organizationPath(e);if(void 0===t)throw new f(`Organization ${e} has no ${a}, so "${a}" cannot be computed`);return void(s[a]=t)}if(!i)return;const u=valueList(s[t(e.schema,"identifier")||""])[0]||c(n);if(!u)return;const d=o(n),h=(this.topOrganization||this.config.ldap_base||"").toLowerCase(),m=!h||d.toLowerCase().endsWith(`,${h}`)?await this.organizationPath(d):void 0,p=this.config.ldap_organization_path_separator||" / ";s[a]=m?`${m}${p}${u}`:u}async checkUnique(e,t,n,r,s,i){const o="object"==typeof n.unique?n.unique:{},c=[t,...o.attributes||[]],u=i?s:null,f=uniquenessBases(e.base,o.branches),h=new Set(c.filter(n=>{if(n===t)return!0;const r=e.schema.attributes[n]?.unique;if(!r)return!1;const s="object"==typeof r?r:{},i=[n,...s.attributes||[]],l=uniquenessBases(e.base,s.branches);return(!s.filter||s.filter===o.filter)&&s.sentinel===o.sentinel&&c.every(e=>i.includes(e))&&f.every(e=>l.some(t=>a(e,t)))}).flatMap(e=>allValues(i,e)));for(const n of r){if(void 0!==o.sentinel&&n===o.sentinel)continue;if(h.has(n))continue;const r=c.map(e=>`(${e}=${l(n)})`).join("");let s=c.length>1?`(|${r})`:r;o.filter&&(s=`(&${o.filter}${s})`);for(const r of f){const i=await this.server.ldap.system.search({paged:!1,scope:"sub",filter:s,attributes:["dn"]},r);for(const r of i.searchEntries||[]){const s=String(r.dn);if(!u||s.toLowerCase()!==u.toLowerCase())throw this.logger.warn(`${t}="${n}" refused for ${u||"a new entry"}: already held by ${s}`),new d(`${e.label}: "${n}" is already used (${t} must be unique)`,{code:"unique",attribute:t,value:n})}}}}async checkMailDomains(e,t,n,r,s,i){const a="directory"===n.mailDomainScope?await this.directoryDomains():await this.organizationDomains(e,s,i);if(0!==a.length)for(const e of r)if(!mailInDomains(e,a,n.allowSubdomains))throw new d(`The mail domain of "${e}" is not one of the authorised domains (${a.join(", ")})`,{code:"mailDomain",attribute:t,value:e,domains:a})}async organizationDomains(e,n,r){const s=t(e.schema,"organizationLink");if(!s)return[];const i=allValues(n,s)[0]||allValues(r,s)[0]||void 0;if(!i)return[];const a=this.bindings().find(e=>"organization"===e.label)?.schema,c=t(a,"domainLink")||this.config.enterprise_domain_link_attribute;if(!c)return[];const l=[],u=new Set;let f=i;const d=(this.topOrganization||this.config.ldap_base||"").toLowerCase(),h=this.domainNameAttribute();for(;f&&!u.has(f.toLowerCase());){u.add(f.toLowerCase());const e=await this.readEntry(f);for(const t of valueList(e?.[c])){const e=await this.readEntry(t),n=valueList(e?.[h]);0===n.length&&this.logger.warn(`Organization ${f} links to domain ${t}, which has no "${h}": no mail domain restriction comes from it`),l.push(...n)}if(f.toLowerCase()===d)break;const t=o(f);f=t===f?void 0:t}return l.filter((e,t)=>l.findIndex(t=>t.toLowerCase()===e.toLowerCase())===t)}domainNameAttribute(){for(const e of this.bindings()){const n=t(e.schema,"domainName");if(n)return n}return this.config.enterprise_domain_name_attribute||"associatedDomain"}async directoryDomains(){const e=this.config.ldap_base;if(!e)return[];const t=this.domainNameAttribute(),n=await this.server.ldap.system.search({paged:!1,scope:"sub",filter:`(${t}=*)`,attributes:[t]},e),r=[];for(const e of n.searchEntries||[])r.push(...valueList(e[t]));return r}checkNotInThePast(e,t,n){const s=startOfUtcDay();for(const i of n){const n=parseDirectoryDate(i);if(!n)throw new f(r(e,t));if(n.getTime()<s)throw new f(`Attribute "${e}" must not be earlier than today`)}}async organizationPath(e){const n=this.bindings().find(e=>"organization"===e.label)?.schema,r=t(n,"organizationPath")||this.config.ldap_organization_path_attribute;if(!r)return;const s=await this.readEntry(e);return s?valueList(s[r])[0]:void 0}async guardDelete(e){const t=this.resolveEntity(e);if(t)for(const[n,r]of Object.entries(t.schema.attributes)){if("nonEmpty"!==r.deleteGuard)continue;const s=await this.readEntry(e),i=valueList(s?.[n]).filter(e=>!u(e,this.dummyMember));if(i.length>0)throw new d(`Cannot delete ${t.label} ${e}: it still has ${i.length} member(s)`)}await this.guardReferences(e)}async guardReferences(e){for(const t of this.referringAttributes(e)){if(!t.pointer)continue;if("restrict"!==t.attr.referentialIntegrity)continue;const n=(await this.searchReferrers(t,e))[0];if(n)throw this.logger.warn(`Delete of ${e} refused: still referenced by ${String(n.dn)} (${t.name})`),new d(`Cannot delete ${e}: still referenced by another entry (${t.name})`)}}async removeReferences(e,t){const n=asDn(e),r=new Set;for(const s of this.referringAttributes(e)){if("remove"!==s.attr.referentialIntegrity)continue;let i;try{i=await this.searchReferrers(s,e)}catch(t){this.logger.error(`Delete of ${e}: could not look for ${s.name} references: ${String(t)}`);continue}for(const a of i){const i=String(a.dn),o=`${asDn(i)} ${s.name.toLowerCase()}`;if(r.has(o))continue;r.add(o);const c=entryValues(a,s.name).filter(e=>asDn(e)===n);if(0!==c.length)try{await this.server.ldap.system.modify(i,{delete:{[s.name]:c}},void 0,{context:t})}catch(t){if(16===h(t))continue;this.logger.error(`Delete of ${e}: could not remove it from ${s.name} of ${i}: ${String(t)}`)}}}}referringAttributes(e){const t=o(e),r=[];for(const e of this.bindings())for(const[s,i]of Object.entries(e.schema.attributes)){const o="pointer"===i.type?i:i.items,c=n(i,"members")||n(i,"owners");if(!o&&!c)continue;const l=o?.branch||[];l.length>0&&!l.some(e=>a(t,e))||r.push({binding:e,name:s,attr:i,pointer:o,multiValued:"array"===i.type})}return r}async searchReferrers(e,t){return(await this.server.ldap.system.search({paged:!1,scope:"sub",filter:`(${e.name}=${l(t)})`,attributes:["dn",e.name]},e.binding.base).catch(t=>{if(32!==h(t))throw t;const n=e.binding.base;return this.missingBases.has(n)||(this.missingBases.add(n),this.logger.warn(`${this.name}: ${n} is not in the directory: no reference to an entry is looked for there`)),{searchEntries:[]}})).searchEntries||[]}async findReferences(e){const t=[],n=new Set;return await Promise.all(this.referringAttributes(e).map(r=>this.server.ldap.queryLimit(async()=>{for(const s of await this.searchReferrers(r,e)){const e=String(s.dn),i=`${asDn(e)} ${r.name.toLowerCase()}`;n.has(i)||(n.add(i),t.push({dn:e,attribute:r.name,values:entryValues(s,r.name),multiValued:r.multiValued}))}}))),t}static referenceKey(e){return`${asDn(e.dn)} ${e.attribute.toLowerCase()}`}async rewriteReferences(e,t,n,r){const s=asDn(t),i=asDn(n);if(s===i)return{updated:0,failed:[]};const a=r?this.server.ldap.forRequest(r):{modify:(e,t)=>this.server.ldap.system.modify(e,t)},o=new Map;for(const e of await this.findReferences(t))o.set(LdapEnterpriseRules.referenceKey(e),e);let c=e.filter(e=>!o.has(LdapEnterpriseRules.referenceKey(e))).length;const l=new Map;return await Promise.all([...o.values()].map(e=>this.server.ldap.queryLimit(async()=>{try{await this.applyRewrite(a,e,s,i,n),c++}catch(r){this.logger.error(`Rename ${t} -> ${n}: could not rewrite ${e.attribute} of ${e.dn}: ${String(r)}`),l.set(e.attribute,(l.get(e.attribute)||0)+1)}}))),{updated:c,failed:[...l].map(([e,t])=>({attribute:e,count:t}))}}async applyRewrite(e,t,n,r,s){const i=this.rewrite(t,n,r,s);if(!i)return;try{return void await e.modify(t.dn,i)}catch(e){const n=e.code;if(20!==n&&16!==n)throw e;this.logger.debug(`Rewrite of ${t.attribute} on ${t.dn} met a concurrent one (code ${n}); reading it back`)}const a={...t,values:await this.freshValues(t.dn,t.attribute)},o=this.rewrite(a,n,r,s);o&&await e.modify(a.dn,o)}async freshValues(e,t){this.server.ldap.invalidateCache(e);const n=await this.server.ldap.system.search({paged:!1,scope:"base",attributes:[t]},e),r=n.searchEntries?.[0];return r?entryValues(r,t):[]}rewrite(e,t,n,r){const s=e.attribute;if(t===n)return;const i=e.values.filter(e=>asDn(e)===t);if(0===i.length)return;const a=e.values.some(e=>asDn(e)===n);if(!e.multiValued){const n=[];for(const s of e.values){const e=asDn(s)===t?r:s;n.some(t=>asDn(t)===asDn(e))||n.push(e)}return{replace:{[s]:n}}}return a?{delete:{[s]:i}}:{delete:{[s]:i},add:{[s]:r}}}async readEntry(e){try{const t=await this.server.ldap.system.search({paged:!1,scope:"base"},e);return t?.searchEntries?.[0]||null}catch(e){return null}}}export{LdapEnterpriseRules as default,fillsGeneratedAttribute,mailInDomains,parseByteSize,parseDirectoryDate,startOfUtcDay};
+import e from"../../abstract/plugin.js";import{roleAttribute as t,hasRole as n,invalidValueMessage as r}from"../../config/schema.js";import{normalizeDn as s,isDnInBranch as i,getParentDn as a,movedToTrash as o,rdnValue as c,escapeLdapFilter as l,isDummyMemberDn as u}from"../../lib/utils.js";import{BadRequestError as f,ConflictError as d}from"../../lib/errors.js";import{extractLdapCode as h}from"../../lib/ldapCodes.js";import{enterpriseRulesOptions as m,organizationOptionsOf as p,groupsOptionsOf as g}from"./ldap.options.js";function valueList(e){return null==e?[]:Array.isArray(e)?e.map(e=>String(e)):[String(e)]}function entryValues(e,t){for(const[n,r]of Object.entries(e))if(spells(n,t))return valueList(r);return[]}function spells(e,t){return e.split(";")[0].toLowerCase()===t.toLowerCase()}function allValues(e,t){return Object.entries(e||{}).filter(([e])=>spells(e,t)).flatMap(([,e])=>valueList(e))}function respell(e,t){if(!t)return;const n=Object.keys(e.attributes);for(const e of Object.keys(t)){if(e.includes(";"))continue;const r=n.find(t=>t!==e&&spells(e,t));r&&!(r in t)&&(t[r]=t[e],delete t[e])}}function asDn(e){try{return s(e)}catch{return e}}function uniquenessBases(e,t){const contains=(e,t)=>t===e||t.endsWith(`,${e}`),n=[];for(const r of[e,...t||[]]){const e=r.toLowerCase();if(!n.some(t=>contains(t.toLowerCase(),e))){for(let t=n.length-1;t>=0;t--)contains(e,n[t].toLowerCase())&&n.splice(t,1);n.push(r)}}return n}const b={B:1,KB:1e3,MB:1e6,GB:1e9,TB:1e12};function parseByteSize(e){if("number"==typeof e)return assertSafeSize(Math.round(e));const t=String(e).trim(),n=/^(\d+(?:\.\d+)?)\s*(B|KB|MB|GB|TB)?$/i.exec(t);if(!n)throw new f(`"${t}" is not a valid size`);const r=(n[2]||"B").toUpperCase();return assertSafeSize(Math.round(parseFloat(n[1])*b[r]))}function assertSafeSize(e){if(!Number.isSafeInteger(e))throw new f("the size is too large to be written");return e}function fillsGeneratedAttribute(e,n,r){return!(void 0===n.default||!n.generated&&!n.normalize)||t(r,"organizationPath")===e}function parseDirectoryDate(e){const t=String(e).trim(),n=/^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})?(\d{2})?(?:[.,](\d+))?(Z|[+-]\d{2}(?::?\d{2})?)?$/.exec(t);if(!n){const e=new Date(t);return isNaN(e.getTime())?null:e}const[,r,s,i,a,o,c,l,u]=n,[f,d,h,m,p,g]=[r,s,i,a,o,c].map(e=>void 0===e?0:Number(e));if(d<1||d>12||m>23||p>59||g>60)return null;const b=new Date(0);if(b.setUTCFullYear(f,d-1,h),b.getUTCMonth()!==d-1||b.getUTCDate()!==h)return null;b.setUTCHours(m,p,g);let y=b.getTime();if(void 0!==l){const e=void 0!==c?1e3:void 0!==o?6e4:36e5;y+=Math.round(Number(`0.${l}`)*e)}if(u&&"Z"!==u){const e=u.slice(1).replace(":",""),t=Number(e.slice(0,2)),n=e.length>2?Number(e.slice(2,4)):0;if(t>23||n>59)return null;y-=("-"===u[0]?-1:1)*(60*t+n)*6e4}return new Date(y)}function startOfUtcDay(e=new Date){return Date.UTC(e.getUTCFullYear(),e.getUTCMonth(),e.getUTCDate())}function mailInDomains(e,t,n=!1){if(0===t.length)return!0;if(t.includes("*"))return!0;const r=e.lastIndexOf("@");if(r<0)return!1;const s=e.slice(r+1).toLowerCase();return t.some(e=>{const t=e.toLowerCase();return s===t||n&&s.endsWith(`.${t}`)})}class LdapEnterpriseRules extends e{static optionDefinitions=m;name="ldapEnterpriseRules";roles=["consistency"];dummyMember;topOrganization;enterpriseSettings;orgSettings;constructor(e){super(e),this.enterpriseSettings=this.options(m),this.orgSettings=p(e.config),this.dummyMember=g(e.config).group_dummy_user,this.topOrganization=this.orgSettings.ldap_top_organization,this.logger.info("Enterprise directory rules enabled")}fillsGeneratedAttribute(e,t,n){return fillsGeneratedAttribute(e,t,n)}bindings(){const e=[],t=this.server.loadedPlugins.ldapFlatGeneric;for(const n of t?.instances||[])n.schema&&e.push({base:n.base,subtree:!1,schema:n.schema,label:n.singularName});const n=this.server.loadedPlugins.ldapGroups;n?.base&&n.schema&&e.push({base:n.base,subtree:!0,schema:n.schema,label:"group"});const r=this.server.loadedPlugins.ldapOrganizations;return r?.schema&&this.topOrganization&&e.push({base:this.topOrganization,subtree:!0,schema:r.schema,label:"organization"}),e}resolveEntity(e){const t=s(e);let n,r=-1;for(const o of this.bindings()){const c=s(o.base);if(t===c)continue;if(!i(e,o.base))continue;if(!o.subtree&&s(a(e))!==c)continue;const l=c.split(",").length;l>r&&(n=o,r=l)}return n}hooks={ldapaddrequest:async([e,t,n])=>{const r=this.resolveEntity(e);return r&&(respell(r.schema,t),await this.runChecks(r,e,t,null),await this.runTransformations(r,e,t,!0)),void 0!==n?[e,t,n]:[e,t]},ldapmodifyrequest:async([e,n,r,s])=>{const i=this.resolveEntity(e);if(!i)return[e,n,r,s];respell(i.schema,n.add),respell(i.schema,n.replace);const a={...n.add||{},...n.replace||{}};if(0===Object.keys(a).length)return[e,n,r,s];const o=await this.readEntry(e),c=t(i.schema,"organizationLink"),l={...a},sent=e=>Object.keys(l).some(t=>spells(t,e));if(c&&sent(c)&&o)for(const[e,t]of Object.entries(i.schema.attributes)){if(!t.mailDomainScope)continue;if(sent(e))continue;const n=allValues(o,e);n.length&&(l[e]=n)}await this.runChecks(i,e,l,o),await this.runTransformations(i,e,a,!1);for(const[e,t]of Object.entries(a))n.replace&&e in n.replace?n.replace[e]=t:n.add&&e in n.add?n.add[e]=t:(n.replace=n.replace||{},n.replace[e]=t);return[e,n,r,s]},ldapdeleterequest:async([e,t])=>{for(const t of Array.isArray(e)?e:[e])await this.guardDelete(t);return[e,t]},ldapdeletedone:async(e,t)=>{for(const n of Array.isArray(e)?e:[e])await this.removeReferences(n,t)},ldaprenamedone:async(e,t,n)=>{o(this.config.trash_base,e,t)&&await this.removeReferences(e,n)}};async runChecks(e,t,r,s){const i=Object.keys(e.schema.attributes);for(const[a,o]of Object.entries(r)){const c=i.find(e=>spells(a,e));if(!c)continue;const l=e.schema.attributes[c],u=valueList(o);0!==u.length&&(l.unique&&await this.checkUnique(e,c,l,u,t,s),l.mailDomainScope&&await this.checkMailDomains(e,c,l,u,r,s),n(l,"accountExpiry")&&this.checkNotInThePast(c,l,u))}}async runTransformations(e,n,s,i){for(const[t,n]of Object.entries(e.schema.attributes)){if(i&&void 0===s[t]&&void 0!==n.default&&(n.generated||n.normalize)&&(s[t]=Array.isArray(n.default)?n.default.map(e=>String(e)):String(n.default),"pointer"===n.type||"pointer"===n.items?.type))for(const e of valueList(s[t]))if(!await this.readEntry(e))throw new f(`Schema default for "${t}" points to a non-existent entry: ${e}`);if("byteSize"===n.normalize&&void 0!==s[t]){const e=valueList(s[t]);try{s[t]=Array.isArray(s[t])?e.map(e=>String(parseByteSize(e))):String(parseByteSize(e[0]))}catch{throw new f(r(t,n))}}}const o=t(e.schema,"organizationPath");if(!o)return;if(!e.schema.attributes[o]?.generated&&void 0!==s[o])return;const l=t(e.schema,"organizationLink");if(l){const e=valueList(s[l])[0];if(!e)return;const t=await this.organizationPath(e);if(void 0===t)throw new f(`Organization ${e} has no ${o}, so "${o}" cannot be computed`);return void(s[o]=t)}if(!i)return;const u=valueList(s[t(e.schema,"identifier")||""])[0]||c(n);if(!u)return;const d=a(n),h=(this.topOrganization||this.config.ldap_base||"").toLowerCase(),m=!h||d.toLowerCase().endsWith(`,${h}`)?await this.organizationPath(d):void 0,p=this.orgSettings.ldap_organization_path_separator;s[o]=m?`${m}${p}${u}`:u}async checkUnique(e,t,n,r,s,a){const o="object"==typeof n.unique?n.unique:{},c=[t,...o.attributes||[]],u=a?s:null,f=uniquenessBases(e.base,o.branches),h=new Set(c.filter(n=>{if(n===t)return!0;const r=e.schema.attributes[n]?.unique;if(!r)return!1;const s="object"==typeof r?r:{},a=[n,...s.attributes||[]],l=uniquenessBases(e.base,s.branches);return(!s.filter||s.filter===o.filter)&&s.sentinel===o.sentinel&&c.every(e=>a.includes(e))&&f.every(e=>l.some(t=>i(e,t)))}).flatMap(e=>allValues(a,e)));for(const n of r){if(void 0!==o.sentinel&&n===o.sentinel)continue;if(h.has(n))continue;const r=c.map(e=>`(${e}=${l(n)})`).join("");let s=c.length>1?`(|${r})`:r;o.filter&&(s=`(&${o.filter}${s})`);for(const r of f){const i=await this.server.ldap.system.search({paged:!1,scope:"sub",filter:s,attributes:["dn"]},r);for(const r of i.searchEntries||[]){const s=String(r.dn);if(!u||s.toLowerCase()!==u.toLowerCase())throw this.logger.warn(`${t}="${n}" refused for ${u||"a new entry"}: already held by ${s}`),new d(`${e.label}: "${n}" is already used (${t} must be unique)`,{code:"unique",attribute:t,value:n})}}}}async checkMailDomains(e,t,n,r,s,i){const a="directory"===n.mailDomainScope?await this.directoryDomains():await this.organizationDomains(e,s,i);if(0!==a.length)for(const e of r)if(!mailInDomains(e,a,n.allowSubdomains))throw new d(`The mail domain of "${e}" is not one of the authorised domains (${a.join(", ")})`,{code:"mailDomain",attribute:t,value:e,domains:a})}async organizationDomains(e,n,r){const s=t(e.schema,"organizationLink");if(!s)return[];const i=allValues(n,s)[0]||allValues(r,s)[0]||void 0;if(!i)return[];const o=this.bindings().find(e=>"organization"===e.label)?.schema,c=t(o,"domainLink")||this.enterpriseSettings.enterprise_domain_link_attribute;if(!c)return[];const l=[],u=new Set;let f=i;const d=(this.topOrganization||this.config.ldap_base||"").toLowerCase(),h=this.domainNameAttribute();for(;f&&!u.has(f.toLowerCase());){u.add(f.toLowerCase());const e=await this.readEntry(f);for(const t of valueList(e?.[c])){const e=await this.readEntry(t),n=valueList(e?.[h]);0===n.length&&this.logger.warn(`Organization ${f} links to domain ${t}, which has no "${h}": no mail domain restriction comes from it`),l.push(...n)}if(f.toLowerCase()===d)break;const t=a(f);f=t===f?void 0:t}return l.filter((e,t)=>l.findIndex(t=>t.toLowerCase()===e.toLowerCase())===t)}domainNameAttribute(){for(const e of this.bindings()){const n=t(e.schema,"domainName");if(n)return n}return this.enterpriseSettings.enterprise_domain_name_attribute}async directoryDomains(){const e=this.config.ldap_base;if(!e)return[];const t=this.domainNameAttribute(),n=await this.server.ldap.system.search({paged:!1,scope:"sub",filter:`(${t}=*)`,attributes:[t]},e),r=[];for(const e of n.searchEntries||[])r.push(...valueList(e[t]));return r}checkNotInThePast(e,t,n){const s=startOfUtcDay();for(const i of n){const n=parseDirectoryDate(i);if(!n)throw new f(r(e,t));if(n.getTime()<s)throw new f(`Attribute "${e}" must not be earlier than today`)}}async organizationPath(e){const n=this.bindings().find(e=>"organization"===e.label)?.schema,r=t(n,"organizationPath")||this.orgSettings.ldap_organization_path_attribute;if(!r)return;const s=await this.readEntry(e);return s?valueList(s[r])[0]:void 0}async guardDelete(e){const t=this.resolveEntity(e);if(t)for(const[n,r]of Object.entries(t.schema.attributes)){if("nonEmpty"!==r.deleteGuard)continue;const s=await this.readEntry(e),i=valueList(s?.[n]).filter(e=>!u(e,this.dummyMember));if(i.length>0)throw new d(`Cannot delete ${t.label} ${e}: it still has ${i.length} member(s)`)}await this.guardReferences(e)}async guardReferences(e){for(const t of this.referringAttributes(e)){if(!t.pointer)continue;if("restrict"!==t.attr.referentialIntegrity)continue;const n=(await this.searchReferrers(t,e))[0];if(n)throw this.logger.warn(`Delete of ${e} refused: still referenced by ${String(n.dn)} (${t.name})`),new d(`Cannot delete ${e}: still referenced by another entry (${t.name})`)}}async removeReferences(e,t){const n=asDn(e),r=new Set;for(const s of this.referringAttributes(e)){if("remove"!==s.attr.referentialIntegrity)continue;let i;try{i=await this.searchReferrers(s,e)}catch(t){this.logger.error(`Delete of ${e}: could not look for ${s.name} references: ${String(t)}`);continue}for(const a of i){const i=String(a.dn),o=`${asDn(i)} ${s.name.toLowerCase()}`;if(r.has(o))continue;r.add(o);const c=entryValues(a,s.name).filter(e=>asDn(e)===n);if(0!==c.length)try{await this.server.ldap.system.modify(i,{delete:{[s.name]:c}},void 0,{context:t})}catch(t){if(16===h(t))continue;this.logger.error(`Delete of ${e}: could not remove it from ${s.name} of ${i}: ${String(t)}`)}}}}referringAttributes(e){const t=a(e),r=[];for(const e of this.bindings())for(const[s,a]of Object.entries(e.schema.attributes)){const o="pointer"===a.type?a:a.items,c=n(a,"members")||n(a,"owners");if(!o&&!c)continue;const l=o?.branch||[];l.length>0&&!l.some(e=>i(t,e))||r.push({binding:e,name:s,attr:a,pointer:o,multiValued:"array"===a.type})}return r}missingBases=new Set;async searchReferrers(e,t){return(await this.server.ldap.system.search({paged:!1,scope:"sub",filter:`(${e.name}=${l(t)})`,attributes:["dn",e.name]},e.binding.base).catch(t=>{if(32!==h(t))throw t;const n=e.binding.base;return this.missingBases.has(n)||(this.missingBases.add(n),this.logger.warn(`${this.name}: ${n} is not in the directory: no reference to an entry is looked for there`)),{searchEntries:[]}})).searchEntries||[]}async findReferences(e){const t=[],n=new Set;return await Promise.all(this.referringAttributes(e).map(r=>this.server.ldap.queryLimit(async()=>{for(const s of await this.searchReferrers(r,e)){const e=String(s.dn),i=`${asDn(e)} ${r.name.toLowerCase()}`;n.has(i)||(n.add(i),t.push({dn:e,attribute:r.name,values:entryValues(s,r.name),multiValued:r.multiValued}))}}))),t}static referenceKey(e){return`${asDn(e.dn)} ${e.attribute.toLowerCase()}`}async rewriteReferences(e,t,n,r){const s=asDn(t),i=asDn(n);if(s===i)return{updated:0,failed:[]};const a=r?this.server.ldap.forRequest(r):{modify:(e,t)=>this.server.ldap.system.modify(e,t)},o=new Map;for(const e of await this.findReferences(t))o.set(LdapEnterpriseRules.referenceKey(e),e);let c=e.filter(e=>!o.has(LdapEnterpriseRules.referenceKey(e))).length;const l=new Map;return await Promise.all([...o.values()].map(e=>this.server.ldap.queryLimit(async()=>{try{await this.applyRewrite(a,e,s,i,n),c++}catch(r){this.logger.error(`Rename ${t} -> ${n}: could not rewrite ${e.attribute} of ${e.dn}: ${String(r)}`),l.set(e.attribute,(l.get(e.attribute)||0)+1)}}))),{updated:c,failed:[...l].map(([e,t])=>({attribute:e,count:t}))}}async applyRewrite(e,t,n,r,s){const i=this.rewrite(t,n,r,s);if(!i)return;try{return void await e.modify(t.dn,i)}catch(e){const n=e.code;if(20!==n&&16!==n)throw e;this.logger.debug(`Rewrite of ${t.attribute} on ${t.dn} met a concurrent one (code ${n}); reading it back`)}const a={...t,values:await this.freshValues(t.dn,t.attribute)},o=this.rewrite(a,n,r,s);o&&await e.modify(a.dn,o)}async freshValues(e,t){this.server.ldap.invalidateCache(e);const n=await this.server.ldap.system.search({paged:!1,scope:"base",attributes:[t]},e),r=n.searchEntries?.[0];return r?entryValues(r,t):[]}rewrite(e,t,n,r){const s=e.attribute;if(t===n)return;const i=e.values.filter(e=>asDn(e)===t);if(0===i.length)return;const a=e.values.some(e=>asDn(e)===n);if(!e.multiValued){const n=[];for(const s of e.values){const e=asDn(s)===t?r:s;n.some(t=>asDn(t)===asDn(e))||n.push(e)}return{replace:{[s]:n}}}return a?{delete:{[s]:i}}:{delete:{[s]:i},add:{[s]:r}}}async readEntry(e){try{const t=await this.server.ldap.system.search({paged:!1,scope:"base"},e);return t?.searchEntries?.[0]||null}catch(e){return null}}}export{LdapEnterpriseRules as default,fillsGeneratedAttribute,mailInDomains,parseByteSize,parseDirectoryDate,startOfUtcDay};

package/dist/plugins/ldap/externalUsersInGroups.js

@@ -1 +1 @@
-import r from"../../abstract/plugin.js";import{HttpError as e}from"../../lib/errors.js";import{declaredMailDomains as t}from"../../lib/mailDomains.js";import{launchHooksChained as s,launchHooks as a,parseDn as n,normalizeDn as i,unescapeDnValue as o}from"../../lib/utils.js";const mailDomainOf=r=>{const e=r.lastIndexOf("@");return e<1?"":r.slice(e+1).trim().toLowerCase().replace(/\.$/,"")};class ExternalUsersInGroups extends r{constructor(r){super(r),this.name="externalUsersInGroups",this.roles=["consistency","configurable"],this.dependencies={ldapGroups:"core/ldap/groups"},this.hooks={ldapgroupvalidatemembers:async([r,t])=>{let n;return await Promise.all(t.map(r=>this.server.ldap.queryLimit(async()=>{const t=this.externalAddress(r);if(null===t)return!1;try{return await this.ldap.system.search({paged:!1,scope:"base"},r),!0}catch{if(!t)throw new Error(`Malformed member ${r}`);const i=mailDomainOf(t);if(!i)throw new Error(`Malformed member ${r}`);if(n??(n=this.managedDomains()),(await n).includes(i))throw new Error(`Cannot create external user with managed domain: ${t}`);let o={objectClass:this.config.external_branch_class||this.config.user_class,mail:t,[this.config.ldap_groups_main_attribute]:t,sn:t};[r,o]=await s(this.registeredHooks.externaluserentry,[r,o]);try{return await this.ldap.system.add(r,o),a(this.registeredHooks.externaluseradded,r,o),!0}catch(t){if(t instanceof e)throw t;throw new Error(`Unable to insert ${r}: ${t instanceof Error?t.message:String(t)}`)}}}))),[r,t]}},this.ldap=r.ldap}externalAddress(r){const e=this.config.external_members_branch;if(!e)return null;const[t,...s]=n(r);if(!t||i(s.join(","))!==i(e))return null;const a=t.indexOf("=");if(a<0||"mail"!==t.slice(0,a).trim().toLowerCase())return null;const l=t.slice(a+1).trim();return/(^|[^\\])(\\\\)*\+/.test(l)?null:o(l)}async managedDomains(){return[...new Set([...this.configuredDomains(),...await t(this.server)])]}configuredDomains(){const r=this.config.mail_domain;return Array.isArray(r)?r.map(r=>String(r).toLowerCase()):[]}async getConfigApiData(){let r;try{r=await this.managedDomains()}catch(e){this.logger.warn(`${this.name}: the directory's mail domains could not be read: ${String(e)}`),r=this.configuredDomains()}return{enabled:!0,branch:this.config.external_members_branch,rdnAttribute:"mail",managedDomains:r}}}export{ExternalUsersInGroups as default,mailDomainOf};
+import r from"../../abstract/plugin.js";import{HttpError as e}from"../../lib/errors.js";import{declaredMailDomains as t}from"../../lib/mailDomains.js";import{parseDn as s,normalizeDn as a,unescapeDnValue as n}from"../../lib/utils.js";import{externalUsersOptions as i,groupsOptionsOf as o}from"./ldap.options.js";const mailDomainOf=r=>{const e=r.lastIndexOf("@");return e<1?"":r.slice(e+1).trim().toLowerCase().replace(/\.$/,"")};class ExternalUsersInGroups extends r{static optionDefinitions=i;name="externalUsersInGroups";roles=["consistency","configurable"];dependencies={ldapGroups:"core/ldap/groups"};ldap;constructor(r){super(r),this.ldap=r.ldap}hooks={ldapgroupvalidatemembers:async([r,t])=>{let s;return await Promise.all(t.map(r=>this.server.ldap.queryLimit(async()=>{const t=this.externalAddress(r);if(null===t)return!1;try{return await this.ldap.system.search({paged:!1,scope:"base"},r),!0}catch{if(!t)throw new Error(`Malformed member ${r}`);const a=mailDomainOf(t);if(!a)throw new Error(`Malformed member ${r}`);if(s??=this.managedDomains(),(await s).includes(a))throw new Error(`Cannot create external user with managed domain: ${t}`);let n={objectClass:this.options(i).external_branch_class,mail:t,[o(this.config).ldap_groups_main_attribute]:t,sn:t};[r,n]=await this.hookBus.chain("externaluserentry",[r,n]);try{return await this.ldap.system.add(r,n),this.hookBus.notify("externaluseradded",r,n),!0}catch(t){if(t instanceof e)throw t;throw new Error(`Unable to insert ${r}: ${t instanceof Error?t.message:String(t)}`)}}}))),[r,t]}};externalAddress(r){const e=this.options(i).external_members_branch;if(!e)return null;const[t,...o]=s(r);if(!t||a(o.join(","))!==a(e))return null;const l=t.indexOf("=");if(l<0||"mail"!==t.slice(0,l).trim().toLowerCase())return null;const m=t.slice(l+1).trim();return/(^|[^\\])(\\\\)*\+/.test(m)?null:n(m)}async managedDomains(){return[...new Set([...this.configuredDomains(),...await t(this.server)])]}configuredDomains(){const r=this.config.mail_domain;return Array.isArray(r)?r.map(r=>String(r).toLowerCase()):[]}async getConfigApiData(){let r;try{r=await this.managedDomains()}catch(e){this.logger.warn(`${this.name}: the directory's mail domains could not be read: ${String(e)}`),r=this.configuredDomains()}return{enabled:!0,branch:this.options(i).external_members_branch,rdnAttribute:"mail",managedDomains:r}}}export{ExternalUsersInGroups as default,mailDomainOf};

package/dist/plugins/ldap/flatGeneric.js

@@ -1 +1 @@
-import e from"../../abstract/plugin.js";import t from"../../abstract/ldapFlat.js";import{loadSchemaFile as a}from"../../lib/schemaFile.js";import{staticSchemaUrl as l}from"../../lib/staticFiles.js";const i=[{plugin:"ldapGroups",modules:["ldap/groups"],collection:"groups"},{plugin:"ldapOrganizations",modules:["ldap/organizations","ldap/organization"],collection:"organizations"},{plugin:"ldapRaw",modules:["ldap/raw"],collection:"raw"},{plugin:"ldapBulkImport",modules:["ldap/bulkImport"],collection:"bulk-import"}];function pluginModule(e){return e.split(":")[0].replace(/\.[cm]?js$/,"").split("/").slice(-2).join("/")}class LdapFlatInstance extends t{constructor(e,t){super(e,t),this.name="ldapFlatInstance",this.roles=["api"],this.dependencies={departmentSync:"core/ldap/departmentSync"}}}class LdapFlatGeneric extends e{constructor(e){super(e),this.name="ldapFlatGeneric",this.roles=["configurable"],this.instances=[],this.schemaPaths=[];const t=this.config.ldap_flat_schema||[],l=new Map,n=new Map;if(0===t.length)return void this.logger.warn("No schemas provided for ldapFlatGeneric plugin");const s=(this.config.plugin||[]).map(pluginModule),r=new Map;for(const{plugin:e,modules:t,collection:a}of i)(this.server.loadedPlugins[e]||t.some(e=>s.includes(e)))&&r.set(a,`plugin ${e}`);t.forEach(t=>{try{const i=a(t,{config:this.config});if(!i.entity)throw new Error(`Schema ${t} is missing "entity" metadata section`);const s=["name","mainAttribute","objectClass","singularName","pluralName","base"];for(const e of s)if(!i.entity[e])throw new Error(`Schema ${t} is missing entity.${e}`);const o=l.get(i.entity.name);if(o)throw new Error(`entity "${i.entity.name}" is already declared by ${o}`);const p=n.get(i.entity.pluralName)||r.get(i.entity.pluralName);if(p)throw new Error(`entity "${i.entity.name}" wants the URL of "${i.entity.pluralName}", already served by ${p}`);let c=i.entity.base;c=c.replace(/\{([^}]+)\}/g,(e,t)=>{const a=t,l=this.config[a];return"string"==typeof l?l:e});const u=new LdapFlatInstance(e,{base:c,mainAttribute:i.entity.mainAttribute,objectClass:i.entity.objectClass,defaultAttributes:i.entity.defaultAttributes||{},schemaPath:t,singularName:i.entity.singularName,pluralName:i.entity.pluralName,hookPrefix:`ldap${i.entity.name}`});u.label=i.entity.label,u.singularLabel=i.entity.singularLabel,u.valueLabels=i.entity.valueLabels,u.name=`ldapFlat:${i.entity.name}`,this.instances.push(u),this.schemaPaths.push(t),l.set(i.entity.name,t),n.set(i.entity.pluralName,t),this.logger.info(`Created ldapFlat instance for "${i.entity.name}" (${i.entity.pluralName})`)}catch(e){this.logger.error(`Failed to load schema ${t}: ${e}`)}})}api(e){this.instances.forEach(t=>{t.api(e)})}getConfigApiData(){const e=this.config.api_prefix||"/api";return{flatResources:this.instances.map((t,a)=>{const i=this.schemaPaths[a]?l(this.server,this.schemaPaths[a]):void 0;return{name:t.name.replace("ldapFlat:",""),singularName:t.singularName,pluralName:t.pluralName,label:t.label,singularLabel:t.singularLabel,valueLabels:t.valueLabels,mainAttribute:t.mainAttribute,objectClass:t.objectClass,base:t.base,schema:t.schema||{strict:!1,attributes:{}},schemaUrl:i,endpoints:{list:`${e}/v1/ldap/${t.pluralName}`,get:`${e}/v1/ldap/${t.pluralName}/:id`,create:`${e}/v1/ldap/${t.pluralName}`,update:`${e}/v1/ldap/${t.pluralName}/:id`,delete:`${e}/v1/ldap/${t.pluralName}/:id`,rename:`${e}/v1/ldap/${t.pluralName}/:id/rename`}}})}}}export{LdapFlatGeneric as default,i as ldapPluginCollections};
+import e from"../../abstract/plugin.js";import a from"../../abstract/ldapFlat.js";import{loadSchemaFile as t}from"../../lib/schemaFile.js";import{staticSchemaUrl as l}from"../../lib/staticFiles.js";import{flatGenericOptions as i}from"./ldap.options.js";const n=[{plugin:"ldapGroups",modules:["ldap/groups"],collection:"groups"},{plugin:"ldapOrganizations",modules:["ldap/organizations","ldap/organization"],collection:"organizations"},{plugin:"ldapRaw",modules:["ldap/raw"],collection:"raw"},{plugin:"ldapBulkImport",modules:["ldap/bulkImport"],collection:"bulk-import"}];function pluginModule(e){return e.split(":")[0].replace(/\.[cm]?js$/,"").split("/").slice(-2).join("/")}class LdapFlatInstance extends a{name="ldapFlatInstance";roles=["api"];label;singularLabel;valueLabels;dependencies={departmentSync:"core/ldap/departmentSync"};constructor(e,a){super(e,a)}}class LdapFlatGeneric extends e{static optionDefinitions=i;name="ldapFlatGeneric";roles=["configurable"];instances=[];schemaPaths=[];constructor(e){super(e);const a=this.options(i).ldap_flat_schema,l=new Map,s=new Map;if(0===a.length)return void this.logger.warn("No schemas provided for ldapFlatGeneric plugin");const r=(this.config.plugin||[]).map(pluginModule),o=new Map;for(const{plugin:e,modules:a,collection:t}of n)(this.server.loadedPlugins[e]||a.some(e=>r.includes(e)))&&o.set(t,`plugin ${e}`);a.forEach(a=>{try{const i=t(a,{config:this.config});if(!i.entity)throw new Error(`Schema ${a} is missing "entity" metadata section`);const n=["name","mainAttribute","objectClass","singularName","pluralName","base"];for(const e of n)if(!i.entity[e])throw new Error(`Schema ${a} is missing entity.${e}`);const r=l.get(i.entity.name);if(r)throw new Error(`entity "${i.entity.name}" is already declared by ${r}`);const p=s.get(i.entity.pluralName)||o.get(i.entity.pluralName);if(p)throw new Error(`entity "${i.entity.name}" wants the URL of "${i.entity.pluralName}", already served by ${p}`);let c=i.entity.base;c=c.replace(/\{([^}]+)\}/g,(e,a)=>{const t=a,l=this.config[t];return"string"==typeof l?l:e});const u=new LdapFlatInstance(e,{base:c,mainAttribute:i.entity.mainAttribute,objectClass:i.entity.objectClass,defaultAttributes:i.entity.defaultAttributes||{},schemaPath:a,singularName:i.entity.singularName,pluralName:i.entity.pluralName,hookPrefix:`ldap${i.entity.name}`});u.label=i.entity.label,u.singularLabel=i.entity.singularLabel,u.valueLabels=i.entity.valueLabels,u.name=`ldapFlat:${i.entity.name}`,this.instances.push(u),this.schemaPaths.push(a),l.set(i.entity.name,a),s.set(i.entity.pluralName,a),this.logger.info(`Created ldapFlat instance for "${i.entity.name}" (${i.entity.pluralName})`)}catch(e){this.logger.error(`Failed to load schema ${a}: ${e}`)}})}api(e){this.instances.forEach(a=>{a.api(e)})}getConfigApiData(){const e=this.config.api_prefix||"/api";return{flatResources:this.instances.map((a,t)=>{const i=this.schemaPaths[t]?l(this.server,this.schemaPaths[t]):void 0;return{name:a.name.replace("ldapFlat:",""),singularName:a.singularName,pluralName:a.pluralName,label:a.label,singularLabel:a.singularLabel,valueLabels:a.valueLabels,mainAttribute:a.mainAttribute,objectClass:a.objectClass,base:a.base,schema:a.schema||{strict:!1,attributes:{}},schemaUrl:i,endpoints:{list:`${e}/v1/ldap/${a.pluralName}`,get:`${e}/v1/ldap/${a.pluralName}/:id`,create:`${e}/v1/ldap/${a.pluralName}`,update:`${e}/v1/ldap/${a.pluralName}/:id`,delete:`${e}/v1/ldap/${a.pluralName}/:id`,rename:`${e}/v1/ldap/${a.pluralName}/:id/rename`}}})}}}export{LdapFlatGeneric as default,n as ldapPluginCollections};

package/dist/plugins/ldap/groups.js

@@ -1 +1 @@
-import e from"../../abstract/plugin.js";import{assertModifyRequest as t}from"../../lib/ldapActions.js";import{wantJson as r,jsonBody as i,tryMethod as s,ok as a}from"../../lib/expressFormatedResponses.js";import{extractLdapCode as o}from"../../lib/ldapCodes.js";import{loadSchemaFileAsync as n}from"../../lib/schemaFile.js";import{staticSchemaUrl as h}from"../../lib/staticFiles.js";import{movedToTrash as d,asyncHandler as p,isDummyMemberDn as c,validateDnValue as u,escapeDnValue as m,launchHooksChained as l,launchHooks as g,escapeLdapFilter as f,organizationLink as w,isDnSyntax as b,normalizeDn as y,isDnInBranch as $,getRdn as v,isAuthzRefusal as G,substringSearchFilter as _}from"../../lib/utils.js";import{NotFoundError as D,BadRequestError as q,HttpError as C,ConflictError as j}from"../../lib/errors.js";import{assertClientMaySet as A,modifiedAttributeNames as k,toDirectoryEntry as M}from"../../config/schema.js";import{applyFixedDefaults as E,EntityValidator as N}from"../../lib/entitySchema/validator.js";class LdapGroups extends e{constructor(e){if(super(e),this.name="ldapGroups",this.roles=["api","configurable"],this.hooks={ldapdeletedone:async e=>{const t=Array.isArray(e)?e:[e];this.logger.debug(`User deletion detected, removing from groups: ${t.join(", ")}`),await Promise.all(t.map(e=>this.deleteMemberFromAll(e))).catch(e=>{this.logger.error("Failed to process user deletion in groups:",e)})},ldaprenamedone:async([e,t])=>{d(this.config.trash_base,e,t)&&await this.deleteMemberFromAll(e).catch(e=>{this.logger.error("Failed to process a move to the trash in groups:",e)})}},this.ldap=e.ldap,this.base=this.config.ldap_group_base,this.cn=this.config.ldap_groups_main_attribute,this.base||(this.base=this.config.ldap_base,this.logger.warn(`LDAP group base is not defined, using "${this.base}"`)),!this.base)throw new Error("LDAP base is not defined, please set --ldap-group-base");if(this.config.ldap_group_base&&e.ldap.declareObjectClasses(this.base,this.config.group_class||[]),this.config.group_schema){const e=this.config.group_schema;n(e,{config:this.config}).then(e=>{this.schema=this.adaptSchema(e),this.server.ldap.knowAttributeNames(Object.keys(this.schema.attributes)),this.logger.debug("Group schema loaded")}).catch(t=>this.logger.error(`Failed to load group schema from ${e}: ${t}`))}}adaptSchema(e){return e}api(e){e.get(`${this.config.api_prefix}/v1/ldap/groups`,p(async(e,t)=>{if(!r(e,t))return;const i={};if(e.query.match){if("string"!=typeof e.query.match)throw new q("Invalid match query");if("string"==typeof e.query.attribute&&e.query.attribute)i.filter=_(e.query.match,e.query.attribute);else if(/=/.test(e.query.match)){if(!/^[\w*=()&|, .@'-]+$/.test(e.query.match))throw new q("Invalid match query: contains forbidden characters");i.filter=e.query.match}else{const t=f(e.query.match);i.filter=`(${this.cn}=${t})`}}e.query.attributes&&"string"==typeof e.query.attributes&&(i.attributes=e.query.attributes.split(","));const s=await this.listGroups({...i,req:e});return a(t,this.hideNeverReturn(s))})),e.get(`${this.config.api_prefix}/v1/ldap/groups/:cn`,p(async(e,t)=>this.apiGet(e,t))),e.post(`${this.config.api_prefix}/v1/ldap/groups`,p(async(e,t)=>this.apiAdd(e,t,this.cn))),e.delete(`${this.config.api_prefix}/v1/ldap/groups/:cn`,p(async(e,t)=>this.apiDelete(e,t))),e.put(`${this.config.api_prefix}/v1/ldap/groups/:cn`,p(async(e,t)=>this.apiModify(e,t))),e.post(`${this.config.api_prefix}/v1/ldap/groups/:cn/members`,p(async(e,t)=>{const r=decodeURIComponent(e.params.cn);if(!r)throw new q("cn is required");const a=this.routeGroupDn(r),o=i(e,t,"member");if(!o)return;const n=Array.isArray(o.member)?o.member:[o.member];if(n.some(e=>"string"!=typeof e))throw new q("member must be a string or string array");await this.judgedGroup(a,()=>this.ldap.authorize("ldapmodifyrequest",[a,{add:{member:n}},this.opNumber(),e])),await s(t,this.addMember.bind(this),r,o.member,e)})),e.delete(`${this.config.api_prefix}/v1/ldap/groups/:cn/members/:member`,p(async(e,t)=>{if(!r(e,t))return;const i=decodeURIComponent(e.params.cn),a=decodeURIComponent(e.params.member);if(!i||!a)throw new q("cn and member are required");const o=this.routeGroupDn(i);await this.judgedGroup(o,()=>this.ldap.authorize("ldapmodifyrequest",[o,{delete:{member:[a]}},this.opNumber(),e])),await s(t,this.deleteMember.bind(this),i,a,e)})),this.config.ldap_organization_link_attribute&&this.config.ldap_organization_path_attribute&&e.post(`${this.config.api_prefix}/v1/ldap/groups/:cn/move`,p(async(e,t)=>{if(!r(e,t))return;const a=decodeURIComponent(e.params.cn);if(!a)throw new q("cn is required");const o=this.routeGroupDn(a),n=i(e,t,"targetOrgDn");if(!n)return;if("string"!=typeof n.targetOrgDn)throw new q("targetOrgDn must be a string");const h=this.config.ldap_organization_link_attribute;await this.judgedGroup(o,()=>this.ldap.authorize("ldapmodifyrequest",[o,{replace:{[h]:n.targetOrgDn}},this.opNumber(),e])),await s(t,this.moveGroup.bind(this),a,n.targetOrgDn,e)})),e.post(`${this.config.api_prefix}/v1/ldap/groups/:cn/rename`,p(async(e,t)=>{if(!r(e,t))return;const a=decodeURIComponent(e.params.cn);if(!a)throw new q("cn is required");const o=this.routeGroupDn(a),n=i(e,t,"newCn");if(!n)return;if("string"!=typeof n.newCn)throw new q("newCn must be a string");const h=/,/.test(n.newCn)?this.routeGroupDn(n.newCn):this.toGroupDn(n.newCn);await this.judgedGroup(o,()=>this.ldap.authorize("ldaprenamerequest",[o,h,e])),await s(t,this.renameGroup.bind(this),a,n.newCn,e)}))}isDummyMember(e){return c(e,this.config.group_dummy_user)}withoutDummyMember(e){const t=e.member;if(void 0===t)return e;const r=Array.isArray(t)?t:[t];return{...e,member:r.filter(e=>!this.isDummyMember(e))}}async apiGet(e,t){if(!r(e,t))return;const i=decodeURIComponent(e.params.cn),s=this.routeGroupDn(i);try{const r=await this.ldap.search({paged:!1,scope:"base",filter:this.groupFilter()},s,e);if(0===r.searchEntries.length)throw new D("Group not found");t.json(this.hideNeverReturn(this.withoutDummyMember(r.searchEntries[0])))}catch(e){if(e.code&&32===e.code)throw new D("Group not found");if(34===o(e))throw new q(`${i} is not a valid DN`);throw e}}async apiAdd(e,t,...r){const a=i(e,t,...r);if(!a)return;await this.server.ldap.canonicalAttributes(a),A(this.schema,Object.keys(a),this.cn);const o=a[this.cn];"string"==typeof o&&(/,/.test(o)||new RegExp(`^${this.cn}=`,"i").test(o))&&this.routeGroupDn(/,/.test(o)?o:`${o},${this.base}`);const n=a.member?Array.isArray(a.member)?a.member:[a.member]:[],h=Object.fromEntries(Object.entries(a).filter(([e,t])=>e!==this.cn&&"member"!==e&&"objectClass"!==e&&void 0!==t));await s(t,this.addGroup.bind(this),o,n,h,e)}async apiDelete(e,t){if(!r(e,t))return;const i=decodeURIComponent(e.params.cn);if(!i)throw new q("cn is required");const a=this.routeGroupDn(i);await this.judgedGroup(a,()=>this.ldap.authorize("ldapdeleterequest",[a,e])),await s(t,this.deleteGroup.bind(this),i,e)}async apiModify(e,r){const a=i(e,r);if(!a)return;t(a);const o=decodeURIComponent(e.params.cn);if(!o)throw new q("cn is required");const n=this.routeGroupDn(o);await this.server.ldap.canonicalChanges(a),A(this.schema,k(a)),await this.judgedGroup(n,()=>this.ldap.authorize("ldapmodifyrequest",[n,a,this.opNumber(),e])),await s(r,this.modifyGroup.bind(this),n,a,e)}async addGroup(e,t=[],r={},i){let s;await this.server.ldap.canonicalAttributes(r),new RegExp(`^${this.cn}=`,"i").test(e)?(s=/,/.test(e)?e:`${e},${this.base}`,e=e.replace(new RegExp(`^${this.cn}=((?:\\\\.|[^,])+)(?:,.*)?$`,"i"),"$1")):(u(e,this.cn),s=`${this.cn}=${m(e)},${this.base}`);let a=this.candidateGroup(e,t,r);await this.ldap.authorize("ldapaddrequest",[s,{...a},i]),await this.validateMembers(s,t,i);const o=await this.validateNewGroup(s,{objectClass:a.objectClass,[this.cn]:e,member:t,...r});let n;delete o.member,Object.assign(a,o),M(this.schema,a),[s,a]=await l(this.registeredHooks.ldapgroupadd,[s,a]);try{n=await this.ldap.add(s,a,i)}catch(e){if(e instanceof C)throw e;throw new Error(`Failed to add group ${s}: ${e}`)}return g(this.registeredHooks.ldapgroupadddone,[s,a]),n}candidateGroup(e,t,r){const i=[...this.config.group_class];!(r.mail||r.twakeMailboxType||r.twakeDepartmentLink||r.twakeDepartmentPath)||i.includes("twakeGroup")||i.includes("twakeStaticGroup")||i.push("twakeGroup");const s={objectClass:i,...this.config.group_default_attributes,[this.cn]:e,member:[this.config.group_dummy_user],...r};return t.length&&s.member.push(...t),E(this.schema,s),s}async modifyGroup(e,t,r){await this.server.ldap.canonicalChanges(t);let i=this.toGroupDn(e);const s=this.opNumber();if([i,t]=await l(this.registeredHooks.ldapgroupmodify,[i,t,s]),t.add){if(t.add.member)throw new q("Use dedicated API to add members");if(t.add[this.cn])throw new q(`${this.cn} attribute is unique, cannot add`)}if(t.delete){if(t.delete instanceof Object){if(t.delete.member)throw new q("Use dedicated API to delete members");if(t.delete[this.cn])throw new q(`Cannot delete ${this.cn} attribute`)}if(Array.isArray(t.delete)){if(t.delete.includes("member"))throw new q("Use dedicated API to delete members");if(t.delete.includes(this.cn))throw new q(`Cannot delete ${this.cn} attribute`)}}if(t.replace){if(t.replace.member)throw new q("Use dedicated API to replace members");if(t.replace[this.cn])throw new q(`Use dedicated API to change ${this.cn} attribute`)}await this.ldap.authorize("ldapmodifyrequest",[i,t,s,r]),t=await this.validateChanges(i,t);const a=await this.ldap.modify(i,t,r);return g(this.registeredHooks.ldapgroupmodifydone,[i,t,s]),a}async renameGroup(e,t,r){/,/.test(e)||u(e,this.cn),/,/.test(t)||u(t,this.cn);let i=this.toGroupDn(e),s=this.toGroupDn(t);[i,s]=await l(this.registeredHooks.ldapgrouprename,[i,s]);const a=await this.ldap.rename(i,s,r);return g(this.registeredHooks.ldapgrouprenamedone,[i,s]),a}async deleteGroup(e,t){let r=this.toGroupDn(e);r=await l(this.registeredHooks.ldapgroupdelete,r);const i=await this.ldap.delete(r,t);return g(this.registeredHooks.ldapgroupdeletedone,r),i}async addMember(e,t,r){const i=this.toGroupDn(e);return Array.isArray(t)||(t=[t]),[e,t]=await l(this.registeredHooks.ldapgroupaddmember,[e,t]),await this.ldap.authorize("ldapmodifyrequest",[i,{add:{member:t}},this.opNumber(),r]),await this.validateMembers(i,t,r),await this.ldap.modify(i,{add:{member:t}},r).catch(e=>{if(e instanceof C)throw e;throw new Error(`Failed to add member(s) to ${i}: ${e}`)})}async deleteMember(e,t,r){const i=this.toGroupDn(e);if([e,t]=await l(this.registeredHooks.ldapgroupdeletemember,[e,t]),this.isDummyMember(t))throw new q("Cannot delete dummy member from group");return await this.removeMember(i,t,r).catch(e=>{if(16===o(e))throw new D(`${t} is not a member of ${i}`);if(e instanceof C)throw e;throw new Error(`Failed to delete member ${t} from ${i}: ${e}`)})}async removeMember(e,t,r){return await this.ldap.modify(e,{delete:{member:t}},r).catch(i=>{if(65!==o(i))throw i;const s=this.config.group_dummy_user;if(!s)throw new j(`Cannot remove ${t}, the last member of ${e}: a group needs at least one member`);return this.ldap.modify(e,{add:{member:s},delete:{member:t}},r)})}async deleteMemberFromAll(e){const t=await this.ldap.system.search({filter:`member=${f(e)}`,paged:!1,attributes:[this.cn]},this.base).catch(e=>{throw new Error(`Failed to search groups from ${this.base}: ${e}`)});await Promise.all(t.searchEntries.map(t=>this.removeMember(t.dn,e).catch(r=>{const i=o(r);16!==i&&32!==i&&this.logger.error(`Failed to remove ${e} from group ${t.dn}:`,r)})))}async moveGroup(e,t,r){const i=this.config.ldap_organization_link_attribute,s=this.config.ldap_organization_path_attribute,a=this.toGroupDn(e);let n;await this.ldap.authorize("ldapmodifyrequest",[a,{replace:{[i]:t}},this.opNumber(),r]);try{n=await this.ldap.system.search({paged:!1,scope:"base"},a)}catch(e){if(32===o(e))throw new D(`Group ${a} not found`);throw e}if(0===n.searchEntries.length)throw new D(`Group ${a} not found`);const h=n.searchEntries[0],d=w(h[i]);if(!d)throw new q(`Group ${a} does not have ${i} attribute and cannot be moved`);if(d===t)throw new q("Group is already in the target organization");let p;try{p=await this.ldap.system.search({paged:!1,scope:"base",attributes:[s,"ou","o"]},t)}catch(e){const r=o(e);if(32===r)throw new D(`Target organization ${t} not found`);if(34===r)throw new q(`${t} is not a valid DN`);throw new Error(`Target organization ${t} not found: ${e instanceof Error&&e.message?e.message:String(e)}`)}if(0===p.searchEntries.length)throw new D(`Target organization ${t} not found`);const c=p.searchEntries[0][s];if(!c)throw new Error(`Target organization ${t} does not have ${s} attribute`);return await this.ldap.modify(a,{replace:{[i]:t,[s]:c}},r),this.logger.info(`Group ${a} moved from ${d} to ${t}`),{success:!0}}async listGroups({filter:e,attributes:t,req:r}={}){const i=await this.ldap.search({filter:e||"(objectClass=*)",attributes:t||[this.cn,"member"],paged:!0},this.base,r).catch(e=>{throw new Error(`Failed to list groups from ${this.base}: ${e}`)});let s={};for await(const e of i)for(const t of e.searchEntries){const e=t[this.cn];if(Array.isArray(e)&&0===e.length)continue;e&&(s[e]=this.withoutDummyMember(t))}return s=await l(this.registeredHooks._ldapgrouplist,s),s}async searchGroupsByName(e,t=!1,r=[this.cn,"member"],i){const s=f(e),a=t?`(${this.cn}=*${s}*)`:`(${this.cn}=${s})`;return await this.listGroups({filter:a,attributes:r,req:i})}toGroupDn(e){if(!/,/.test(e))return`${this.cn}=${m(e)},${this.base}`;if(!b(e))throw new q(`${e} is not a valid DN`);return e}routeGroupDn(e){const t=this.toGroupDn(e),r=this.base,i=y(`${this.cn}=x`).split("=")[0];if(!$(t,r)||y(t)===y(r)||!y(v(t)).split(/(?<!\\)\+/).some(e=>e.startsWith(`${i}=`)))throw new D("Group not found");return t}groupFilter(){return`(|${[...new Set([...this.config.group_class??[],"groupOfNames","groupOfUniqueNames","groupOfURLs","posixGroup"].filter(e=>e&&"top"!==e.toLowerCase()))].map(e=>`(objectClass=${f(e)})`).join("")})`}async judgedGroup(e,t){let r;await t();try{r=await this.ldap.system.search({paged:!1,scope:"base",filter:this.groupFilter(),attributes:["1.1"]},e)}catch(t){const r=o(t);if(32===r)throw new D("Group not found");if(34===r)throw new q(`${e} is not a valid DN`);throw t}if(!r.searchEntries?.length)throw new D("Group not found")}async validateMembers(e,t,r){[e,t]=await l(this.server.hooks.ldapgroupvalidatemembers,[e,t]);const i=Boolean(this.config.groups_allow_unexistent_members);if((!i||r)&&t&&t.length)try{await Promise.all(t.map(e=>this.server.ldap.queryLimit(async()=>{let t;try{t=await this.ldap.search({paged:!1,scope:"base"},e,r)}catch(t){if(G(t))throw t;if(i)return;const r=o(t);if(32===r)throw new q(`Member ${e} not found`);if(34===r)throw new q(`Member ${e} is not a valid DN`);throw new Error(`Member ${e} not found: ${t}`)}if(r&&!t.searchEntries?.length)throw new q(`Member ${e} not found`)})))}catch(e){if(e instanceof C||G(e))throw e;throw new Error(`Failed to find member(s): ${e}`)}}async validateNewGroup(e,t){return[e,t]=await l(this.server.hooks.ldapgroupvalidatenew,[e,t]),await this.validator().validateNew(t),t}async validateChanges(e,t){return[e,t]=await l(this.server.hooks.ldapgroupvalidatechanges,[e,t]),await this.validator().validateChanges(t),t}validator(){return new N(this.schema,{entryExists:async e=>{try{return(await this.ldap.system.search({paged:!1,scope:"base",attributes:["dn"]},e)).searchEntries.length>0}catch{return!1}},loadedPlugins:this.server.loadedPlugins,singularName:"group"})}getConfigApiData(){const e=this.config.api_prefix||"/api",t=this.config.group_schema?h(this.server,this.config.group_schema):void 0;return{enabled:!0,base:this.base||"",mainAttribute:this.cn||"cn",objectClass:this.config.group_class||["top","groupOfNames"],schema:this.schema,schemaUrl:t,endpoints:{list:`${e}/v1/ldap/groups`,get:`${e}/v1/ldap/groups/:id`,create:`${e}/v1/ldap/groups`,update:`${e}/v1/ldap/groups/:id`,delete:`${e}/v1/ldap/groups/:id`,addMember:`${e}/v1/ldap/groups/:id/members`,removeMember:`${e}/v1/ldap/groups/:id/members/:memberId`,rename:`${e}/v1/ldap/groups/:id/rename`,move:`${e}/v1/ldap/groups/:id/move`}}}}export{LdapGroups as default};
+import{Type as t}from"@sinclair/typebox";import e from"../../abstract/plugin.js";import{assertModifyRequest as r}from"../../lib/ldapActions.js";import{wantJson as s,jsonBody as i,tryMethod as a,WriteResponse as o,ok as n}from"../../lib/expressFormatedResponses.js";import{extractLdapCode as h}from"../../lib/ldapCodes.js";import{loadSchemaFileAsync as d}from"../../lib/schemaFile.js";import{staticSchemaUrl as p}from"../../lib/staticFiles.js";import{movedToTrash as c,isDummyMemberDn as u,namesByDn as m,parseDn as l,assertedRdnValue as g,escapeDnValue as b,validateDnValue as f,escapeLdapFilter as w,organizationLink as y,isDnSyntax as $,normalizeDn as v,isDnInBranch as G,getRdn as _,substringSearchFilter as S}from"../../lib/utils.js";import{NotFoundError as D,BadRequestError as j,HttpError as A,isAuthzRefusal as C,ConflictError as q}from"../../lib/errors.js";import{assertClientMaySet as k,modifiedAttributeNames as M,toDirectoryEntry as E}from"../../config/schema.js";import{applyFixedDefaults as N,EntityValidator as O}from"../../lib/entitySchema/validator.js";import{groupsOptions as z,groupsOptionsOf as x,organizationOptionsOf as F}from"./ldap.options.js";import{defineRoute as U}from"../../lib/route.js";const I=t.Object({match:t.Optional(t.String()),attribute:t.Optional(t.String()),attributes:t.Optional(t.String())}),B=t.Object({cn:t.String({minLength:1})}),P=t.Object({cn:t.String({minLength:1}),member:t.String({minLength:1})}),R=t.Object({member:t.Union([t.String(),t.Array(t.String())])}),L=t.Object({targetOrgDn:t.String()}),T=t.Object({newCn:t.String()});class LdapGroups extends e{static optionDefinitions=z;name="ldapGroups";roles=["api","configurable"];base;ldap;cn;schema;get groupSettings(){return x(this.config)}get orgSettings(){return F(this.config)}constructor(t){if(super(t),this.ldap=t.ldap,this.base=this.groupSettings.ldap_group_base,this.cn=this.groupSettings.ldap_groups_main_attribute,this.base||(this.base=this.config.ldap_base,this.logger.warn(`LDAP group base is not defined, using "${this.base}"`)),!this.base)throw new Error("LDAP base is not defined, please set --ldap-group-base");if(this.groupSettings.ldap_group_base&&t.ldap.declareObjectClasses(this.base,this.groupSettings.group_class),this.groupSettings.group_schema){const t=this.groupSettings.group_schema;d(t,{config:this.config}).then(t=>{this.schema=this.adaptSchema(t),this.server.ldap.knowAttributeNames(Object.keys(this.schema.attributes)),this.logger.debug("Group schema loaded")}).catch(e=>this.logger.error(`Failed to load group schema from ${t}: ${e}`))}}adaptSchema(t){return t}hooks={ldapdeletedone:async t=>{const e=Array.isArray(t)?t:[t];this.logger.debug(`User deletion detected, removing from groups: ${e.join(", ")}`),await Promise.all(e.map(t=>this.deleteMemberFromAll(t))).catch(t=>{this.logger.error("Failed to process user deletion in groups:",t)})},ldaprenamedone:async(t,e)=>{c(this.config.trash_base,t,e)&&await this.deleteMemberFromAll(t).catch(t=>{this.logger.error("Failed to process a move to the trash in groups:",t)})}};api(t){U(t,{method:"get",path:`${this.config.api_prefix}/v1/ldap/groups`,query:I,handler:async({req:t,res:e,query:r})=>{const s={};if(r.match)if(r.attribute)s.filter=S(r.match,r.attribute);else if(/=/.test(r.match)){if(!/^[\w*=()&|, .@'-]+$/.test(r.match))throw new j("Invalid match query: contains forbidden characters");s.filter=r.match}else{const t=w(r.match);s.filter=`(${this.cn}=${t})`}r.attributes&&(s.attributes=r.attributes.split(","));const i=await this.listGroups({...s,req:t});return n(e,this.hideNeverReturn(i))}}),U(t,{method:"get",path:`${this.config.api_prefix}/v1/ldap/groups/:cn`,params:B,handler:async({req:t,res:e})=>this.apiGet(t,e)}),U(t,{method:"post",path:`${this.config.api_prefix}/v1/ldap/groups`,responses:{200:o},handler:async({req:t,res:e})=>this.apiAdd(t,e,this.cn)}),U(t,{method:"delete",path:`${this.config.api_prefix}/v1/ldap/groups/:cn`,responses:{200:o},params:B,handler:async({req:t,res:e})=>this.apiDelete(t,e)}),U(t,{method:"put",path:`${this.config.api_prefix}/v1/ldap/groups/:cn`,responses:{200:o},params:B,handler:async({req:t,res:e})=>this.apiModify(t,e)}),U(t,{method:"post",path:`${this.config.api_prefix}/v1/ldap/groups/:cn/members`,responses:{200:o},params:B,body:R,handler:async({req:t,params:e,res:r,body:s})=>{const i=decodeURIComponent(e.cn),o=this.routeGroupDn(i),n=Array.isArray(s.member)?s.member:[s.member];await this.judgedGroup(o,()=>this.ldap.authorize("ldapmodifyrequest",[o,{add:{member:n}},this.opNumber(),t])),await a(r,this.addMember.bind(this),i,s.member,t)}}),U(t,{method:"delete",path:`${this.config.api_prefix}/v1/ldap/groups/:cn/members/:member`,responses:{200:o},params:P,handler:async({req:t,params:e,res:r})=>{const s=decodeURIComponent(e.cn),i=decodeURIComponent(e.member),o=this.routeGroupDn(s);await this.judgedGroup(o,()=>this.ldap.authorize("ldapmodifyrequest",[o,{delete:{member:[i]}},this.opNumber(),t])),await a(r,this.deleteMember.bind(this),s,i,t)}}),this.orgSettings.ldap_organization_link_attribute&&this.orgSettings.ldap_organization_path_attribute&&U(t,{method:"post",path:`${this.config.api_prefix}/v1/ldap/groups/:cn/move`,responses:{200:o},params:B,body:L,handler:async({req:t,params:e,res:r,body:s})=>{const i=decodeURIComponent(e.cn),o=this.routeGroupDn(i),n=this.orgSettings.ldap_organization_link_attribute;await this.judgedGroup(o,()=>this.ldap.authorize("ldapmodifyrequest",[o,{replace:{[n]:s.targetOrgDn}},this.opNumber(),t])),await a(r,this.moveGroup.bind(this),i,s.targetOrgDn,t)}}),U(t,{method:"post",path:`${this.config.api_prefix}/v1/ldap/groups/:cn/rename`,responses:{200:o},params:B,body:T,handler:async({req:t,params:e,res:r,body:s})=>{const i=decodeURIComponent(e.cn),o=this.routeGroupDn(i),n=/,/.test(s.newCn)?this.routeGroupDn(s.newCn):this.toGroupDn(s.newCn);await this.judgedGroup(o,()=>this.ldap.authorize("ldaprenamerequest",[o,n,t])),await a(r,this.renameGroup.bind(this),i,s.newCn,t)}})}isDummyMember(t,e=this.groupSettings.group_dummy_user){return u(t,e)}withoutDummyMember(t){const e=t.member;if(void 0===e)return t;const r=Array.isArray(e)?e:[e],s=this.groupSettings.group_dummy_user;return{...t,member:r.filter(t=>!this.isDummyMember(t,s))}}async apiGet(t,e){if(!s(t,e))return;const r=decodeURIComponent(t.params.cn),i=this.routeGroupDn(r);try{const r=await this.ldap.search({paged:!1,scope:"base",filter:this.groupFilter()},i,t);if(0===r.searchEntries.length)throw new D("Group not found");e.json(this.hideNeverReturn(this.withoutDummyMember(r.searchEntries[0])))}catch(t){if(t.code&&32===t.code)throw new D("Group not found");if(34===h(t))throw new j(`${r} is not a valid DN`);throw t}}async apiAdd(t,e,...r){const s=i(t,e,...r);if(!s)return;await this.server.ldap.canonicalAttributes(s),k(this.schema,Object.keys(s),this.cn);const o=s[this.cn];"string"==typeof o&&m(o,this.cn)&&this.routeGroupDn(/,/.test(o)?o:`${o},${this.base}`);const n=s.member?Array.isArray(s.member)?s.member:[s.member]:[],h=Object.fromEntries(Object.entries(s).filter(([t,e])=>t!==this.cn&&"member"!==t&&"objectClass"!==t&&void 0!==e));await a(e,this.addGroup.bind(this),o,n,h,t)}async apiDelete(t,e){if(!s(t,e))return;const r=decodeURIComponent(t.params.cn);if(!r)throw new j("cn is required");const i=this.routeGroupDn(r);await this.judgedGroup(i,()=>this.ldap.authorize("ldapdeleterequest",[i,t])),await a(e,this.deleteGroup.bind(this),r,t)}async apiModify(t,e){const s=i(t,e);if(!s)return;r(s);const o=decodeURIComponent(t.params.cn);if(!o)throw new j("cn is required");const n=this.routeGroupDn(o);await this.server.ldap.canonicalChanges(s),k(this.schema,M(s)),await this.judgedGroup(n,()=>this.ldap.authorize("ldapmodifyrequest",[n,s,this.opNumber(),t])),await a(e,this.modifyGroup.bind(this),n,s,t)}async addGroup(t,e=[],r={},s){let i;if(await this.server.ldap.canonicalAttributes(r),m(t,this.cn)){i=l(t).length>1?t:`${t},${this.base}`;const e=g(t,this.cn);if(null===e)throw new j(`${this.cn} must be a value, or a "${this.cn}=…,${this.base}" DN`);t=e}else i=`${this.cn}=${b(t)},${this.base}`;try{f(t,this.cn)}catch(t){throw new j(t instanceof Error?t.message:"Invalid name")}let a=this.candidateGroup(t,e,r);await this.ldap.authorize("ldapaddrequest",[i,{...a},s]),await this.validateMembers(i,e,s);const o=await this.validateNewGroup(i,{objectClass:a.objectClass,[this.cn]:t,member:e,...r});let n;delete o.member,a={...this.candidateGroup(t,[],{}),member:a.member,...o},E(this.schema,a),[i,a]=await this.hookBus.chain("ldapgroupadd",[i,a]);try{n=await this.ldap.add(i,a,s)}catch(t){if(t instanceof A||C(t))throw t;throw new Error(`Failed to add group ${i}: ${String(t)}`,{cause:t})}return this.hookBus.notify("ldapgroupadddone",i,a),n}candidateGroup(t,e,r){const s=[...this.groupSettings.group_class];!(r.mail||r.twakeMailboxType||r.twakeDepartmentLink||r.twakeDepartmentPath)||s.includes("twakeGroup")||s.includes("twakeStaticGroup")||s.push("twakeGroup");const i={objectClass:s,...this.groupSettings.group_default_attributes,[this.cn]:t,member:[this.groupSettings.group_dummy_user],...r};return e.length&&i.member.push(...e),N(this.schema,i),i}async modifyGroup(t,e,r){await this.server.ldap.canonicalChanges(e);let s=this.toGroupDn(t);const i=this.opNumber();if([s,e]=await this.hookBus.chain("ldapgroupmodify",[s,e,i]),e.add){if(e.add.member)throw new j("Use dedicated API to add members");if(e.add[this.cn])throw new j(`${this.cn} attribute is unique, cannot add`)}if(e.delete){if(e.delete instanceof Object){if(e.delete.member)throw new j("Use dedicated API to delete members");if(e.delete[this.cn])throw new j(`Cannot delete ${this.cn} attribute`)}if(Array.isArray(e.delete)){if(e.delete.includes("member"))throw new j("Use dedicated API to delete members");if(e.delete.includes(this.cn))throw new j(`Cannot delete ${this.cn} attribute`)}}if(e.replace){if(e.replace.member)throw new j("Use dedicated API to replace members");if(e.replace[this.cn])throw new j(`Use dedicated API to change ${this.cn} attribute`)}await this.ldap.authorize("ldapmodifyrequest",[s,e,i,r]),e=await this.validateChanges(s,e);const a=await this.ldap.modify(s,e,r);return this.hookBus.notify("ldapgroupmodifydone",s,e,i),a}async renameGroup(t,e,r){/,/.test(t)||f(t,this.cn),/,/.test(e)||f(e,this.cn);let s=this.toGroupDn(t),i=this.toGroupDn(e);[s,i]=await this.hookBus.chain("ldapgrouprename",[s,i]);const a=await this.ldap.rename(s,i,r);return this.hookBus.notify("ldapgrouprenamedone",s,i),a}async deleteGroup(t,e){let r=this.toGroupDn(t);r=await this.hookBus.chain("ldapgroupdelete",r);const s=await this.ldap.delete(r,e);return this.hookBus.notify("ldapgroupdeletedone",r),s}async addMember(t,e,r){const s=this.toGroupDn(t);return Array.isArray(e)||(e=[e]),[t,e]=await this.hookBus.chain("ldapgroupaddmember",[t,e]),await this.ldap.authorize("ldapmodifyrequest",[s,{add:{member:e}},this.opNumber(),r]),await this.validateMembers(s,e,r),await this.ldap.modify(s,{add:{member:e}},r).catch(t=>{if(t instanceof A||C(t))throw t;throw new Error(`Failed to add member(s) to ${s}: ${String(t)}`,{cause:t})})}async deleteMember(t,e,r){const s=this.toGroupDn(t);if([t,e]=await this.hookBus.chain("ldapgroupdeletemember",[t,e]),this.isDummyMember(e))throw new j("Cannot delete dummy member from group");return await this.removeMember(s,e,r).catch(t=>{if(16===h(t))throw new D(`${e} is not a member of ${s}`);if(t instanceof A||C(t))throw t;throw new Error(`Failed to delete member ${e} from ${s}: ${String(t)}`,{cause:t})})}async removeMember(t,e,r){return await this.ldap.modify(t,{delete:{member:e}},r).catch(s=>{if(65!==h(s))throw s;const i=this.groupSettings.group_dummy_user;if(!i)throw new q(`Cannot remove ${e}, the last member of ${t}: a group needs at least one member`);return this.ldap.modify(t,{add:{member:i},delete:{member:e}},r)})}async deleteMemberFromAll(t){const e=await this.ldap.system.search({filter:`member=${w(t)}`,paged:!1,attributes:[this.cn]},this.base).catch(t=>{throw new Error(`Failed to search groups from ${this.base}: ${String(t)}`,{cause:t})});await Promise.all(e.searchEntries.map(e=>this.removeMember(e.dn,t).catch(r=>{const s=h(r);16!==s&&32!==s&&this.logger.error(`Failed to remove ${t} from group ${e.dn}:`,r)})))}async moveGroup(t,e,r){const s=this.orgSettings.ldap_organization_link_attribute,i=this.orgSettings.ldap_organization_path_attribute,a=this.toGroupDn(t);let o;await this.ldap.authorize("ldapmodifyrequest",[a,{replace:{[s]:e}},this.opNumber(),r]);try{o=await this.ldap.system.search({paged:!1,scope:"base"},a)}catch(t){if(32===h(t))throw new D(`Group ${a} not found`);throw t}if(0===o.searchEntries.length)throw new D(`Group ${a} not found`);const n=o.searchEntries[0],d=y(n[s]);if(!d)throw new j(`Group ${a} does not have ${s} attribute and cannot be moved`);if(d===e)throw new j("Group is already in the target organization");let p;try{p=await this.ldap.system.search({paged:!1,scope:"base",attributes:[i,"ou","o"]},e)}catch(t){const r=h(t);if(32===r)throw new D(`Target organization ${e} not found`);if(34===r)throw new j(`${e} is not a valid DN`);throw new Error(`Target organization ${e} not found: ${t instanceof Error&&t.message?t.message:String(t)}`)}if(0===p.searchEntries.length)throw new D(`Target organization ${e} not found`);const c=p.searchEntries[0][i];if(!c)throw new Error(`Target organization ${e} does not have ${i} attribute`);return await this.ldap.modify(a,{replace:{[s]:e,[i]:c}},r),this.logger.info(`Group ${a} moved from ${d} to ${e}`),{success:!0}}async listGroups({filter:t,attributes:e,req:r}={}){const s=await this.ldap.search({filter:t||"(objectClass=*)",attributes:e||[this.cn,"member"],paged:!0},this.base,r).catch(t=>{throw new Error(`Failed to list groups from ${this.base}: ${String(t)}`,{cause:t})});let i={};for await(const t of s)for(const e of t.searchEntries){const t=e[this.cn];if(Array.isArray(t)&&0===t.length)continue;t&&(i[t]=this.withoutDummyMember(e))}return i=await this.hookBus.chain("_ldapgrouplist",i),i}async searchGroupsByName(t,e=!1,r=[this.cn,"member"],s){const i=w(t),a=e?`(${this.cn}=*${i}*)`:`(${this.cn}=${i})`;return await this.listGroups({filter:a,attributes:r,req:s})}toGroupDn(t){if(!/[,;]/.test(t)&&!m(t,this.cn))return`${this.cn}=${b(t)},${this.base}`;if(!$(t))throw new j(`${t} is not a valid DN`);return t}routeGroupDn(t){const e=this.toGroupDn(t),r=this.base,s=v(`${this.cn}=x`).split("=")[0];if(!G(e,r)||v(e)===v(r)||!v(_(e)).split(/(?<!\\)\+/).some(t=>t.startsWith(`${s}=`)))throw new D("Group not found");return e}groupFilter(){return`(|${[...new Set([...this.groupSettings.group_class,"groupOfNames","groupOfUniqueNames","groupOfURLs","posixGroup"].filter(t=>t&&"top"!==t.toLowerCase()))].map(t=>`(objectClass=${w(t)})`).join("")})`}async judgedGroup(t,e){let r;await e();try{r=await this.ldap.system.search({paged:!1,scope:"base",filter:this.groupFilter(),attributes:["1.1"]},t)}catch(e){const r=h(e);if(32===r)throw new D("Group not found");if(34===r)throw new j(`${t} is not a valid DN`);throw e}if(!r.searchEntries?.length)throw new D("Group not found")}async validateMembers(t,e,r){[t,e]=await this.hookBus.chain("ldapgroupvalidatemembers",[t,e]);const s=this.groupSettings.groups_allow_unexistent_members;if((!s||r)&&e&&e.length)try{await Promise.all(e.map(t=>this.server.ldap.queryLimit(async()=>{let e;try{e=await this.ldap.search({paged:!1,scope:"base"},t,r)}catch(e){if(C(e))throw e;if(s)return;const r=h(e);if(32===r)throw new j(`Member ${t} not found`);if(34===r)throw new j(`Member ${t} is not a valid DN`);throw new Error(`Member ${t} not found: ${e}`)}if(r&&!e.searchEntries?.length)throw new j(`Member ${t} not found`)})))}catch(t){if(t instanceof A||C(t))throw t;throw new Error(`Failed to find member(s): ${String(t)}`,{cause:t})}}async validateNewGroup(t,e){return[t,e]=await this.hookBus.chain("ldapgroupvalidatenew",[t,e]),await this.validator().validateNew(e)}async validateChanges(t,e){return[t,e]=await this.hookBus.chain("ldapgroupvalidatechanges",[t,e]),await this.validator().validateChanges(e),e}validator(){return new O(this.schema,{entryExists:async t=>{try{return(await this.ldap.system.search({paged:!1,scope:"base",attributes:["dn"]},t)).searchEntries.length>0}catch{return!1}},loadedPlugins:this.server.loadedPlugins,singularName:"group"})}getConfigApiData(){const t=this.config.api_prefix||"/api",e=this.groupSettings.group_schema?p(this.server,this.groupSettings.group_schema):void 0;return{enabled:!0,base:this.base||"",mainAttribute:this.cn||"cn",objectClass:this.groupSettings.group_class,schema:this.schema,schemaUrl:e,endpoints:{list:`${t}/v1/ldap/groups`,get:`${t}/v1/ldap/groups/:id`,create:`${t}/v1/ldap/groups`,update:`${t}/v1/ldap/groups/:id`,delete:`${t}/v1/ldap/groups/:id`,addMember:`${t}/v1/ldap/groups/:id/members`,removeMember:`${t}/v1/ldap/groups/:id/members/:memberId`,rename:`${t}/v1/ldap/groups/:id/rename`,move:`${t}/v1/ldap/groups/:id/move`}}}}export{P as GroupMemberParams,R as GroupMembersBody,L as GroupMoveBody,B as GroupParams,T as GroupRenameBody,I as GroupsQuery,LdapGroups as default};

package/dist/plugins/ldap/ldap.options.js

@@ -0,0 +1 @@
+import{join as _,dirname as e}from"path";import{fileURLToPath as a}from"url";import{defineOptions as t,opt as n,readOptions as r}from"../../config/options.js";const i=t({ldap_top_organization:n.string({env:"DM_LDAP_TOP_ORGANIZATION",default:""}),ldap_organization_class:n.array({env:"DM_LDAP_ORGANIZATION_CLASSES",default:["top","organizationalUnit","twakeDepartment"],plural:"ldap-organization-classes",kind:"identifiers"}),ldap_organization_link_attribute:n.string({env:"DM_LDAP_ORGANIZATION_LINK_ATTRIBUTE",default:"twakeDepartmentLink"}),ldap_organization_path_attribute:n.string({env:"DM_LDAP_ORGANIZATION_PATH_ATTRIBUTE",default:"twakeDepartmentPath"}),ldap_organization_path_separator:n.string({env:"DM_LDAP_ORGANIZATION_PATH_SEPARATOR",default:" / "}),ldap_organization_max_subnodes:n.number({env:"DM_LDAP_ORGANIZATION_MAX_SUBNODES",default:50,min:1}),organization_schema:n.string({env:"DM_ORGANIZATION_SCHEMA",default:""})}),l=t({enterprise_domain_name_attribute:n.string({env:"DM_ENTERPRISE_DOMAIN_NAME_ATTRIBUTE",default:"associatedDomain"}),enterprise_domain_link_attribute:n.string({env:"DM_ENTERPRISE_DOMAIN_LINK_ATTRIBUTE",default:""})}),s=t({ldap_group_base:n.string({env:"DM_LDAP_GROUP_BASE",default:""}),ldap_groups_main_attribute:n.string({env:"DM_LDAP_GROUPS_MAIN_ATTRIBUTE",default:"cn"}),group_class:n.array({env:"DM_GROUP_CLASSES",default:["top","groupOfNames"],plural:"group-classes",kind:"identifiers"}),groups_allow_unexistent_members:n.boolean({env:"DM_ALLOW_UNEXISTENT_MEMBERS",default:!1}),group_default_attributes:n.json({env:"DM_GROUP_DEFAULT_ATTRIBUTES",default:{}}),group_dummy_user:n.string({env:"DM_GROUP_DUMMY_USER",default:"cn=fakeuser",emptyIsValue:!0}),group_schema:n.string({env:"DM_GROUP_SCHEMA",default:((...t)=>_(e(a(import.meta.url)),"..","..","..","static","schemas",...t))("twake","groups.json"),emptyIsValue:!0})}),o=t({external_members_branch:n.string({env:"DM_EXTERNAL_MEMBERS_BRANCH",default:"ou=contacts,dc=example,dc=com"}),external_branch_class:n.array({env:"DM_EXTERNAL_BRANCH_CLASSES",default:["top","inetOrgPerson"],plural:"external-branch-classes",kind:"identifiers"})}),u=t({ldap_flat_schema:n.array({env:"DM_LDAP_FLAT_SCHEMA",default:[],plural:"ldap-flat-schemas"}),ldap_flat_auto_repair:n.boolean({env:"DM_LDAP_FLAT_AUTO_REPAIR",default:!0})}),A=t({ldap_raw_base:n.array({env:"DM_LDAP_RAW_BASE",default:[],plural:"ldap-raw-bases",kind:"dns"}),ldap_raw_hidden_attribute:n.array({env:"DM_LDAP_RAW_HIDDEN_ATTRIBUTES",default:[],plural:"ldap-raw-hidden-attributes",kind:"identifiers"}),ldap_raw_show_secrets:n.boolean({env:"DM_LDAP_RAW_SHOW_SECRETS",default:!1}),ldap_raw_max_results:n.number({env:"DM_LDAP_RAW_MAX_RESULTS",default:200,min:1}),ldap_raw_schema_cache_ttl:n.number({env:"DM_LDAP_RAW_SCHEMA_CACHE_TTL",default:3600})}),d=t({bulk_import_schemas:n.string({env:"DM_BULK_IMPORT_SCHEMAS",default:""}),bulk_import_max_file_size:n.string({env:"DM_BULK_IMPORT_MAX_FILE_SIZE",default:"10485760"}),bulk_import_batch_size:n.string({env:"DM_BULK_IMPORT_BATCH_SIZE",default:"100"})}),p=t({trash_base:n.string({env:"DM_TRASH_BASE",default:""}),trash_watched_bases:n.string({env:"DM_TRASH_WATCHED_BASES",default:""}),trash_add_metadata:n.string({env:"DM_TRASH_ADD_METADATA",default:"true"}),trash_auto_create:n.string({env:"DM_TRASH_AUTO_CREATE",default:"true"})}),D=t({ppolicy_default_dn:n.string({env:"DM_PPOLICY_DEFAULT_DN",default:""}),ppolicy_base:n.string({env:"DM_PPOLICY_BASE",default:""}),ppolicy_warn_days:n.number({env:"DM_PPOLICY_WARN_DAYS",default:14,min:1}),ppolicy_validate_complexity:n.boolean({env:"DM_PPOLICY_VALIDATE_COMPLEXITY",default:!1}),ppolicy_min_length:n.number({env:"DM_PPOLICY_MIN_LENGTH",default:12,min:1}),ppolicy_require_uppercase:n.boolean({env:"DM_PPOLICY_REQUIRE_UPPERCASE",default:!0}),ppolicy_require_lowercase:n.boolean({env:"DM_PPOLICY_REQUIRE_LOWERCASE",default:!0}),ppolicy_require_digit:n.boolean({env:"DM_PPOLICY_REQUIRE_DIGIT",default:!0}),ppolicy_require_special:n.boolean({env:"DM_PPOLICY_REQUIRE_SPECIAL",default:!0}),ldap_users_base:n.string({env:"DM_LDAP_USERS_BASE",default:""})});function organizationOptionsOf(_){return r(i,_)}function groupsOptionsOf(_){return r(s,_)}function trashOptionsOf(_){return r(p,_)}export{d as bulkImportOptions,l as enterpriseRulesOptions,o as externalUsersOptions,u as flatGenericOptions,s as groupsOptions,groupsOptionsOf,i as organizationOptions,organizationOptionsOf,D as passwordPolicyOptions,A as rawOptions,p as trashOptions,trashOptionsOf};

package/dist/plugins/ldap/onChange.js

@@ -1 +1 @@
-import e from"../../abstract/plugin.js";import{launchHooks as t}from"../../lib/utils.js";import{currentOperation as n}from"../../lib/operation.js";const normalize=e=>(void 0===e?[]:Array.isArray(e)?e:[e]).map(e=>Buffer.isBuffer(e)?e.toString("base64"):String(e)).sort();function diffEntries(e,t){const index=e=>new Map(Object.keys(e||{}).filter(e=>"dn"!==e).map(e=>[e.toLowerCase(),e])),n=index(e),i=index(t),a={};for(const r of new Set([...n.keys(),...i.keys()])){const s=n.get(r),o=i.get(r),d=s?e[s]:void 0,l=o?t[o]:void 0,h=normalize(d),u=normalize(l);h.length===u.length&&h.every((e,t)=>e===u[t])||(a[o||s]=[h.length?d:null,u.length?l:null])}return a}const i={mail_attribute:"onLdapMailChange",quota_attribute:"onLdapQuotaChange",alias_attribute:"onLdapAliasChange",forward_attribute:"onLdapForwardChange",display_name_attribute:"onLdapDisplayNameChange",drive_quota_attribute:"onLdapDriveQuotaChange"};class OnLdapChange extends e{constructor(){super(...arguments),this.name="onLdapChange",this.roles=["consistency"],this.stack={},this.pendingDeletions=new Map,this.pendingRenames=new Map,this.hooks={ldapadddone:async([e,t],n)=>{const i=await this.read(e)||{dn:e,...t};this.publish(e,null,i,n)},ldapmodifyrequest:async([e,t,n,i])=>{const a=await this.read(e);return a?this.stack[n]=a:this.logger.warn(`Could not read ${e} before modification`),[e,t,n,i]},ldapmodifydone:async([e,t,n],i)=>{const a=this.stack[n];if(delete this.stack[n],!a)return void this.logger.warn(`Received a ldapmodifydone for an unknown operation (${n})`);if(0===Object.keys(t).length)return;const r=await this.read(e);r?this.publish(e,a,r,i):this.logger.warn(`Could not read ${e} after modification`)},ldapmodifyend:e=>{delete this.stack[e]},ldaprenamerequest:async([e,t,i])=>{const a=n(),r=void 0===a?void 0:await this.read(e);return void 0!==a&&r&&this.pendingRenames.set(a,{dn:e,entry:r}),[e,t,i]},ldaprenamedone:async([e,t],i)=>{const a=n(),r=void 0===a?void 0:this.pendingRenames.get(a);if(!r||r.dn!==e)return void this.logger.debug(`${e}: no snapshot: a move made outside a request`);this.pendingRenames.delete(a);const s=await this.read(t);s?this.publish(t,r.entry,s,i):this.logger.warn(`Could not read ${t} after the rename of ${e}`)},ldaprenameend:e=>{this.pendingRenames.delete(e)},ldapdeleterequest:async([e,t])=>{const i=n();if(void 0===i)return[e,t];for(const t of Array.isArray(e)?e:[e]){const e=await this.read(t);if(!e)continue;let n=this.pendingDeletions.get(i);n||this.pendingDeletions.set(i,n=new Map),n.set(t,e)}return[e,t]},ldapdeletedone:(e,t)=>{const i=n(),a=void 0===i?void 0:this.pendingDeletions.get(i);for(const n of Array.isArray(e)?e:[e]){const e=a?.get(n);e&&(a.delete(n),this.publish(n,e,null,t))}},ldapdeleteend:e=>{this.pendingDeletions.delete(e)}}}async read(e){const t=new Set(Object.values(this.server.loadedPlugins).flatMap(e=>e.followedOperationalAttributes||[]));try{const n=(await this.server.ldap.system.search({paged:!1,scope:"base",...t.size?{attributes:["*",...t]}:{}},e)).searchEntries[0];if(!n)return;return Object.fromEntries(Object.entries(n).filter(([,e])=>!Array.isArray(e)||e.length>0))}catch(e){return}}publish(e,n,i,a={}){const r=diffEntries(n,i);0===Object.keys(r).length&&n?.dn===i?.dn||(t(this.server.hooks.onLdapEntryChange,e,n,i,a),this.notify(e,r,n,i))}notify(e,n,a,r){t(this.server.hooks.onLdapChange,e,n);const s=null===r;for(const[a,o]of Object.entries(i))if((!s||"onLdapMailChange"===o)&&this.config[a]&&n[this.config[a]])if("onLdapQuotaChange"===o||"onLdapForwardChange"===o||"onLdapAliasChange"===o)this.notifyAttributeChangeWithMail(this.config[a],o,e,n,r);else if("onLdapMailChange"===o)this.notifyAttributeChange(this.config[a],o,e,n);else if("onLdapDriveQuotaChange"===o){const[i,r]=n[this.config[a]]||[],s=i?Number(i):null,o=r?Number(r):null;s!==o&&t(this.server.hooks.onLdapDriveQuotaChange,e,s,o)}const o=this.reconstructDisplayName(a),d=this.reconstructDisplayName(r);s||o===d||t(this.server.hooks.onLdapDisplayNameChange,e,o,d)}notifyAttributeChange(e,n,i,a,r=!1){const[s,o]=a[e]||[];void 0===s&&void 0===o||(r&&(Array.isArray(s)||Array.isArray(o))?this.logger.error(`Attribute ${e} change detected but one of the values is an array, cannot handle that`):s!==o&&t(this.server.hooks[n],i,s,o))}notifyAttributeChangeWithMail(e,n,i,a,r){const[s,o]=a[e]||[];if(void 0===s&&void 0===o)return;const d=this.config.mail_attribute||"mail",l=a[d];let h;if(l?.[1])h=Array.isArray(l[1])?String(l[1][0]):String(l[1]);else{if(l)return void this.logger.debug(`${i} lost its mail, skipping ${n} notification`);if(!r?.[d])return void this.logger.warn(`Could not find mail for ${i}, skipping ${n} notification`);{const e=r[d];h=Array.isArray(e)?String(e[0]):String(e)}}if("onLdapQuotaChange"===n){const e=s?Number(s):0,a=o?Number(o):0;e!==a&&t(this.server.hooks[n],i,h,e,a)}else if("onLdapForwardChange"===n||"onLdapAliasChange"===n){const e=s?Array.isArray(s)?s:[s]:[],a=o?Array.isArray(o)?o:[o]:[];(e.length>0||a.length>0)&&t(this.server.hooks[n],i,h,e,a)}}reconstructDisplayName(e){const getValue=t=>{if(!e)return null;const n=Object.keys(e).find(e=>e.toLowerCase()===t.toLowerCase()),i=void 0===n?void 0:e[n];return i?Array.isArray(i)?i.length>0?String(i[0]):null:String(i):null},t=getValue(this.config.display_name_attribute||"displayName");if(t)return t;const n=getValue("cn");if(n)return n;const i=getValue("givenName"),a=getValue("sn");if(i||a){const e=[];return i&&e.push(i),a&&e.push(a),e.join(" ")}return null}}export{OnLdapChange as default,diffEntries};
+import t from"../../abstract/plugin.js";import{currentOperation as e}from"../../lib/operation.js";const normalize=t=>(void 0===t?[]:Array.isArray(t)?t:[t]).map(t=>Buffer.isBuffer(t)?t.toString("base64"):String(t)).sort();function diffEntries(t,e){const index=t=>new Map(Object.keys(t||{}).filter(t=>"dn"!==t).map(t=>[t.toLowerCase(),t])),n=index(t),i=index(e),a={};for(const o of new Set([...n.keys(),...i.keys()])){const r=n.get(o),s=i.get(o),d=r?t[r]:void 0,l=s?e[s]:void 0,h=normalize(d),u=normalize(l);h.length===u.length&&h.every((t,e)=>t===u[e])||(a[s||r]=[h.length?d:null,u.length?l:null])}return a}const n={mail_attribute:"onLdapMailChange",quota_attribute:"onLdapQuotaChange",alias_attribute:"onLdapAliasChange",forward_attribute:"onLdapForwardChange",drive_quota_attribute:"onLdapDriveQuotaChange"};class OnLdapChange extends t{name="onLdapChange";roles=["consistency"];stack={};pendingDeletions=new Map;pendingRenames=new Map;hooks={ldapadddone:async(t,e,n)=>{const i=await this.read(t)||{dn:t,...e};this.publish(t,null,i,n)},ldapmodifyrequest:async([t,e,n,i])=>{const a=await this.read(t);return a?this.stack[n]=a:this.logger.warn(`Could not read ${t} before modification`),[t,e,n,i]},ldapmodifydone:async(t,e,n,i)=>{const a=this.stack[n];if(delete this.stack[n],!a)return void this.logger.warn(`Received a ldapmodifydone for an unknown operation (${n})`);if(0===Object.keys(e).length)return;const o=await this.read(t);o?this.publish(t,a,o,i):this.logger.warn(`Could not read ${t} after modification`)},ldapmodifyend:t=>{delete this.stack[t]},ldaprenamerequest:async([t,n,i])=>{const a=e(),o=void 0===a?void 0:await this.read(t);return void 0!==a&&o&&this.pendingRenames.set(a,{dn:t,entry:o}),[t,n,i]},ldaprenamedone:async(t,n,i)=>{const a=e(),o=void 0===a?void 0:this.pendingRenames.get(a);if(!o||o.dn!==t)return void this.logger.debug(`${t}: no snapshot: a move made outside a request`);this.pendingRenames.delete(a);const r=await this.read(n);r?this.publish(n,o.entry,r,i):this.logger.warn(`Could not read ${n} after the rename of ${t}`)},ldaprenameend:t=>{this.pendingRenames.delete(t)},ldapdeleterequest:async([t,n])=>{const i=e();if(void 0===i)return[t,n];for(const e of Array.isArray(t)?t:[t]){const t=await this.read(e);if(!t)continue;let n=this.pendingDeletions.get(i);n||this.pendingDeletions.set(i,n=new Map),n.set(e,t)}return[t,n]},ldapdeletedone:(t,n)=>{const i=e(),a=void 0===i?void 0:this.pendingDeletions.get(i);for(const e of Array.isArray(t)?t:[t]){const t=a?.get(e);t&&(a.delete(e),this.publish(e,t,null,n))}},ldapdeleteend:t=>{this.pendingDeletions.delete(t)}};async read(t){const e=new Set(Object.values(this.server.loadedPlugins).flatMap(t=>t.followedOperationalAttributes||[]));try{const n=(await this.server.ldap.system.search({paged:!1,scope:"base",...e.size?{attributes:["*",...e]}:{}},t)).searchEntries[0];if(!n)return;return Object.fromEntries(Object.entries(n).filter(([,t])=>!Array.isArray(t)||t.length>0))}catch(t){return}}publish(t,e,n,i={}){const a=diffEntries(e,n);0===Object.keys(a).length&&e?.dn===n?.dn||(this.hookBus.notify("onLdapEntryChange",t,e,n,i),this.notify(t,a,e,n))}notify(t,e,i,a){this.hookBus.notify("onLdapChange",t,e);const o=null===a;for(const[i,r]of Object.entries(n)){if(o&&"onLdapMailChange"!==r)continue;const n=this.config[i];if(n&&e[n])if("onLdapQuotaChange"===r||"onLdapForwardChange"===r||"onLdapAliasChange"===r)this.notifyAttributeChangeWithMail(n,r,t,e,a);else if("onLdapMailChange"===r)this.notifyAttributeChange(n,"onLdapMailChange",t,e);else if("onLdapDriveQuotaChange"===r){const[i,a]=e[n]||[],o=i?Number(i):null,r=a?Number(a):null;o!==r&&this.hookBus.notify("onLdapDriveQuotaChange",t,o,r)}}const r=this.reconstructDisplayName(i),s=this.reconstructDisplayName(a);o||r===s||this.hookBus.notify("onLdapDisplayNameChange",t,r,s)}notifyAttributeChange(t,e,n,i,a=!1){const[o,r]=i[t]||[];void 0===o&&void 0===r||(a&&(Array.isArray(o)||Array.isArray(r))?this.logger.error(`Attribute ${t} change detected but one of the values is an array, cannot handle that`):o!==r&&this.hookBus.notify("onLdapMailChange",n,o,r))}notifyAttributeChangeWithMail(t,e,n,i,a){const[o,r]=i[t]||[];if(void 0===o&&void 0===r)return;const s=this.config.mail_attribute||"mail",d=i[s];let l;if(d?.[1])l=Array.isArray(d[1])?String(d[1][0]):String(d[1]);else{if(d)return void this.logger.debug(`${n} lost its mail, skipping ${e} notification`);if(!a?.[s])return void this.logger.warn(`Could not find mail for ${n}, skipping ${e} notification`);{const t=a[s];l=Array.isArray(t)?String(t[0]):String(t)}}if("onLdapQuotaChange"===e){const t=o?Number(o):0,i=r?Number(r):0;t!==i&&this.hookBus.notify(e,n,l,t,i)}else if("onLdapForwardChange"===e||"onLdapAliasChange"===e){const t=o?Array.isArray(o)?o:[o]:[],i=r?Array.isArray(r)?r:[r]:[];(t.length>0||i.length>0)&&this.hookBus.notify(e,n,l,t,i)}}reconstructDisplayName(t){const getValue=e=>{if(!t)return null;const n=Object.keys(t).find(t=>t.toLowerCase()===e.toLowerCase()),i=void 0===n?void 0:t[n];return i?Array.isArray(i)?i.length>0?String(i[0]):null:String(i):null},e=getValue(this.config.display_name_attribute||"displayName");if(e)return e;const n=getValue("cn");if(n)return n;const i=getValue("givenName"),a=getValue("sn");if(i||a){const t=[];return i&&t.push(i),a&&t.push(a),t.join(" ")}return null}}export{OnLdapChange as default,diffEntries};

package/dist/plugins/ldap/organizations.js

@@ -1 +1 @@
-import t from"../../abstract/plugin.js";import{assertModifyRequest as i}from"../../lib/ldapActions.js";import{tryMethodData as a,jsonBody as e,tryMethod as n,wantJson as s}from"../../lib/expressFormatedResponses.js";import{asyncHandler as r,validateDnValue as o,escapeDnValue as h,getRdn as c,isDnInBranch as d,rdnValue as l,normalizeDn as g,getParentDn as p,escapeLdapFilter as u,launchHooksChained as f,isAuthzRefusal as w,isChildOf as m,substringSearchFilter as z}from"../../lib/utils.js";import{BadRequestError as y,NotFoundError as b,ConflictError as $,HttpError as _}from"../../lib/errors.js";import{extractLdapCode as v}from"../../lib/ldapCodes.js";import{loadSchemaFileAsync as O}from"../../lib/schemaFile.js";import{staticSchemaUrl as E}from"../../lib/staticFiles.js";import{assertClientMaySet as A,modifiedAttributeNames as C}from"../../config/schema.js";import{applyFixedDefaults as L,EntityValidator as k}from"../../lib/entitySchema/validator.js";class LdapOrganizations extends t{constructor(t){if(super(t),this.name="ldapOrganizations",this.roles=["api","consistency","configurable"],this.hooks={ldapaddrequest:async([t,i,a])=>(this.isOu(i)||await this.checkDeptLink(i),this.isOu(i)&&await this.checkDeptPath(i,t),void 0!==a?[t,i,a]:[t,i]),ldapmodifyrequest:async([t,i,a,e])=>{let n,s={},r={};const checkIsOu=async()=>{if(void 0!==n)return n;if(i.replace?.objectClass)n=this.isOu({objectClass:i.replace.objectClass});else if(i.add?.objectClass)n=this.isOu({objectClass:i.add.objectClass});else{const i=await this.server.ldap.system.search({paged:!1,scope:"base"},t);n=i.searchEntries.length>0&&this.isOu(i.searchEntries[0])}return n};if(i.delete){const t=(Array.isArray(i.delete)?i.delete.map(String):Object.keys(i.delete)).map(t=>t.split(";")[0].toLowerCase()),a=t.includes(this.linkAttr.toLowerCase()),e=t.includes(this.pathAttr.toLowerCase());if(a||e){if(!await checkIsOu()&&a)throw new y("An organization link cannot be deleted");if(e)throw new y("An organization path cannot be deleted")}}if(i.replace&&(i.replace[this.linkAttr]&&(s={...i.replace}),i.replace[this.pathAttr]&&(r={...i.replace})),i.add&&(i.add[this.linkAttr]&&(s={...s,...i.add}),i.add[this.pathAttr]&&(r={...r,...i.add})),Object.keys(s).length>0){await checkIsOu()||await this.checkDeptLink(s)}if(Object.keys(r).length>0){await checkIsOu()&&await this.checkDeptPath(r,t)}return[t,i,a,e]},ldapdeleterequest:async([t,i])=>{const a=Array.isArray(t)?t:[t];for(const t of a)/^\s*ou\s*=/i.test(t)&&await this.isEmptyOrganization(t);return[t,i]},ldaprenamerequest:([t,i,a])=>[t,i,a]},this.sizeLimitWarned=new Set,!this.config.ldap_top_organization)throw new Error("Missing --ldap-top-organization");if(this.pathAttr=this.config.ldap_organization_path_attribute,this.linkAttr=this.config.ldap_organization_link_attribute,t.ldap.declareObjectClasses(this.config.ldap_top_organization,this.config.ldap_organization_class||[],!0),this.config.organization_schema){const t=this.config.organization_schema;O(t,{config:this.config}).then(t=>{this.schema=t,this.server.ldap.knowAttributeNames(Object.keys(t.attributes)),this.logger.debug("Organization schema loaded")}).catch(i=>this.logger.error(`Failed to load organization schema from ${t}: ${i}`))}}api(t){t.get(`${this.config.api_prefix}/v1/ldap/organizations/top`,async(t,i)=>{await a(i,async()=>this.hideNeverReturn(await this.getOrganisationTop(t)))}),t.get(`${this.config.api_prefix}/v1/ldap/organizations/:dn`,async(t,i)=>{const e=decodeURIComponent(t.params.dn);await a(i,async()=>this.hideNeverReturn(await this.getOrganisationByDn(e,t)))}),t.get(`${this.config.api_prefix}/v1/ldap/organizations/:dn/subnodes`,async(t,i)=>{const e=decodeURIComponent(t.params.dn);await a(i,async()=>this.hideNeverReturn(await this.getOrganisationSubnodes(e,t)))}),t.get(`${this.config.api_prefix}/v1/ldap/organizations/:dn/subnodes/search`,r(async(t,i)=>{const e=decodeURIComponent(t.params.dn),n=t.query.q;if(!n)throw new y('query parameter "q" is required');await a(i,async()=>this.hideNeverReturn(await this.searchOrganisationSubnodes(e,n,t)))})),t.get(`${this.config.api_prefix}/v1/ldap/organizations/:dn/search`,r(async(t,i)=>{const e=decodeURIComponent(t.params.dn),n=t.query.q;if(!n)throw new y('query parameter "q" is required');await a(i,async()=>this.hideNeverReturn(await this.searchOrganisationTree(e,n,t)))})),t.post(`${this.config.api_prefix}/v1/ldap/organizations`,r(async(t,i)=>this.apiAdd(t,i))),t.put(`${this.config.api_prefix}/v1/ldap/organizations/:dn`,r(async(t,i)=>this.apiModify(t,i))),t.delete(`${this.config.api_prefix}/v1/ldap/organizations/:dn`,r(async(t,i)=>this.apiDelete(t,i))),t.post(`${this.config.api_prefix}/v1/ldap/organizations/:dn/move`,r(async(t,i)=>this.apiMove(t,i)))}async apiAdd(t,i){const a=e(t,i,"ou");if(!a)return;A(this.schema,Object.keys(a),"ou"),o(a.ou,"ou");const s=a.parentDn||this.config.ldap_top_organization,r=`ou=${h(a.ou)},${s}`,c={ou:a.ou,...Object.fromEntries(Object.entries(a).filter(([t])=>"ou"!==t&&"parentDn"!==t)),objectClass:this.config.ldap_organization_class};await n(i,this.addOrganization.bind(this),r,c,t)}async apiModify(t,a){const s=e(t,a);if(!s)return;i(s);const r=decodeURIComponent(t.params.dn);if(!r)throw new y("dn is required");A(this.schema,C(s)),await n(a,this.modifyOrganization.bind(this),r,s,t)}async apiDelete(t,i){if(!s(t,i))return;const a=decodeURIComponent(t.params.dn);if(!a)throw new y("dn is required");await n(i,this.deleteOrganization.bind(this),a,t)}async apiMove(t,i){if(!s(t,i))return;const n=e(t,i,"targetOrgDn");if(!n)return;const r=decodeURIComponent(t.params.dn);if(!r)throw new y("dn is required");const{targetOrgDn:o}=n;if(!o||"string"!=typeof o)throw new y("Missing or invalid targetOrgDn in request body");await a(i,this.moveOrganization.bind(this),r,o,t)}async checkDeptLink(t){if(t[this.linkAttr]){const i=t[this.linkAttr],a=Array.isArray(i)?i[0]:i,e=await this.server.ldap.system.search({paged:!1,scope:"base"},a);if(0===e.searchEntries.length)throw new b(`Organization ${a} does not exist`);if(!new RegExp(`(.*,)?${this.config.ldap_top_organization}`).test(e.searchEntries[0].dn))throw new y(`Entry ${a} isn't in top organization branch`)}}async checkDeptPath(t,i){if(t[this.pathAttr]){const a=t[this.pathAttr],e=Array.isArray(a)?a[0]:a,n=this.config.ldap_organization_path_separator||" / ",s=this.config.ldap_top_organization||"",r=i&&s&&/^ou=/i.test(c(i))&&d(i,s)?l(i):void 0,o=t.ou,h=(Array.isArray(o)?o[0]:o)||r;let f=e;if((this.isOu(t)||void 0!==r)&&h){const t=s?l(s):"";if(t&&e.startsWith(h+n)&&e.endsWith(n+t))return;if(e===h){const t=s?g(s):"";if(!i||!t||!d(i,s)||g(i)===t||g(p(i))===t)return;throw new y(`Organization path "${e}" names no parent, but ${i} is not directly under ${s}`)}if(!e.endsWith(n+h))throw new y(`Organization path must end with its own name, preceded by separator "${n}"`);f=e.slice(0,e.length-n.length-h.length)}const w=await this.server.ldap.system.search({paged:!1,scope:"sub",filter:`(${this.pathAttr}=${u(f)})`,attributes:["dn"]},this.config.ldap_top_organization);if(!w.searchEntries||0===w.searchEntries.length)throw new y(`Invalid organization path ${e}: no organization holds "${f}"`)}}async isEmptyOrganization(t){if((await this.server.ldap.system.search({paged:!1,filter:`(${this.config.ldap_organization_link_attribute}=${u(t)})`})).searchEntries.length>0)throw new $(`Organization ${t} is not empty`)}isOu(t){if(!t.objectClass)return!1;const i=[].concat(t.objectClass).map(t=>String(t).toLowerCase());return this.config.ldap_organization_class.filter(t=>"top"!==t.toLowerCase()).some(t=>i.includes(t.toLowerCase()))}async getOrganisationTop(t){if(!this.config.ldap_top_organization)throw new y("No top organization configured");const i=await this.server.ldap.search({paged:!1,scope:"base"},this.config.ldap_top_organization,t);if(1!==i.searchEntries.length)throw new b("Top organization not found");const[,a]=await f(this.registeredHooks.getOrganisationTop,[t,i.searchEntries[0]]);return a}async getOrganisationByDn(t,i){let a;try{a=await this.server.ldap.search({paged:!1,scope:"base",filter:"(objectClass=organizationalUnit)"},t,i)}catch(i){const a=v(i);if(32===a)throw new b(`Organization ${t} not found`);if(34===a)throw new y(`${t} is not a valid DN`);throw i}if(1!==a.searchEntries.length)throw new b(`Organization ${t} not found`);return a.searchEntries[0]}async getOrganisationSubnodes(t,i){const a=[],e=this.config.ldap_organization_max_subnodes||50,n=i?.query?.objectClass;n&&"organizationalUnit"!==n||a.push(...await this.childOrganizations(t,"(objectClass=organizationalUnit)",e,i));const s=this.config.ldap_top_organization,r=p(s);let o=`(${this.config.ldap_organization_link_attribute}=${u(t)})`;return n&&(o=`(&${o}(objectClass=${u(n)}))`),this.server.logger.debug(`Searching for linked entities with filter: ${o} in ${r}`),a.push(...await this.linkedEntities(r,o,e,t,i)),a}warnSizeLimit(t,i){this.sizeLimitWarned.has(t)?this.server.logger.debug(i):(this.sizeLimitWarned.size<LdapOrganizations.SIZE_LIMIT_WARNED_MAX&&this.sizeLimitWarned.add(t),this.server.logger.warn(i))}static moreIndicator(t,i,a,e){return{dn:t,cn:[i],objectClass:["moreIndicator"],_isMoreIndicator:"true",...void 0===e?{}:{_totalCount:e.toString()},_displayedCount:a.toString()}}async childOrganizations(t,i,a,e){try{const a=await this.server.ldap.search({paged:!0,scope:"one",filter:i},t,e),n=[];for await(const t of a)n.push(...t.searchEntries);return this.server.logger.debug(`Found ${n.length} sub-OUs for ${t}`),n}catch(i){const a=v(i);if(32===a)return this.server.logger.debug(`No sub-OUs for ${t}: the node holds none`),[];if(34===a)throw new y(`${t} is not a valid DN`);if(4!==a)throw i}const n=(await this.server.ldap.search({paged:!1,scope:"one",filter:i,sizeLimit:a+1},t,e)).searchEntries.slice(0,a);return this.warnSizeLimit(`children:${t}`,`Organization ${t} holds more child organizations than the directory will list in one answer, so ${n.length} are returned and the rest are hidden. Raise the size limit for the account ldap-rest binds as (olcLimits, or olcSizeLimit) to list them all.`),[...n,LdapOrganizations.moreIndicator(`more-organizations-${t}`,"... more organizations than the directory will list",n.length)]}async linkedEntities(t,i,a,e,n){const s=[];let r=0;try{const e=await this.server.ldap.search({paged:!0,filter:i},t,n);for await(const t of e){r+=t.searchEntries.length;const i=a-s.length;i>0&&s.push(...t.searchEntries.slice(0,i))}}catch(s){if(t!==e&&(w(s)||403===s?.statusCode))return this.linkedEntities(e,i,a,e,n);if(4!==v(s))throw s;const r=await this.server.ldap.search({paged:!1,filter:i,sizeLimit:a+1},t,n);this.warnSizeLimit(`linked:${e}`,`More entries are attached to ${e} than the directory will list in one answer. Raise the size limit for the account ldap-rest binds as (olcLimits, or olcSizeLimit) to count them all.`);const o=r.searchEntries.slice(0,a);return[...o,LdapOrganizations.moreIndicator(`more-${e}`,"... more elements than the directory will list",o.length)]}return this.server.logger.debug(`Found ${r} linked entities for ${e}, returning ${s.length}`),r<=a?s:[...s,LdapOrganizations.moreIndicator(`more-${e}`,`... ${r-a} more ${r-a===1?"element":"elements"}`,a,r)]}async addOrganization(t,i,a){return L(this.schema,i),await this.server.ldap.authorize("ldapaddrequest",[t,i,a]),await this.validator().validateNew(i),await this.server.ldap.add(t,i,a)}async modifyOrganization(t,i,a){return await this.server.ldap.authorize("ldapmodifyrequest",[t,i,this.opNumber(),a]),await this.validator().validateChanges(i),await this.server.ldap.modify(t,i,a)}validator(){return new k(this.schema,{entryExists:t=>this.entryExists(t),loadedPlugins:this.server.loadedPlugins,singularName:"organization"})}async entryExists(t){try{return(await this.server.ldap.system.search({paged:!1,scope:"base",attributes:["dn"]},t)).searchEntries.length>0}catch{return!1}}async moveOrganization(t,i,a){const e=`${c(t)},${i}`;let n,s;await this.server.ldap.authorize("ldaprenamerequest",[t,e,a]);try{n=await this.server.ldap.system.search({paged:!1,scope:"base"},i)}catch(t){throw new b(`Target organization ${i} not found: ${t instanceof Error?t.message:String(t)}`)}if(!n.searchEntries||0===n.searchEntries.length)throw new b(`Target organization ${i} not found`);if(!this.isOu(n.searchEntries[0]))throw new y(`Target ${i} is not an organizational unit`);try{s=await this.server.ldap.system.search({paged:!1,scope:"base"},t)}catch(t){throw new b(`Source organization not found: ${t}`)}if(!s.searchEntries||0===s.searchEntries.length)throw new b(`Source organization ${t} not found`);if(e===t)throw new y("Cannot move organization to its current location");if(i.toLowerCase()===t.toLowerCase()||m(i,t))throw new y("Cannot move organization into itself or its descendant");try{await this.server.ldap.rename(t,e,a),this.logger.info(`Moved organization from ${t} to ${e}`)}catch(t){if(t instanceof _)throw t;throw new Error(`Failed to move organization: ${t}`)}return{newDn:e}}async deleteOrganization(t,i){try{return await this.server.ldap.delete(t,i)}catch(i){if(32===v(i))throw new b(`Organization ${t} not found`);throw i}}async searchOrganisationSubnodes(t,i,a){const e=[],n=this.config.ldap_organization_max_subnodes||50;e.push(...await this.childOrganizations(t,`(&(objectClass=organizationalUnit)${z(i,"ou,description")})`,n,a));const s=this.config.ldap_top_organization,r=p(s),o=u(t),h=this.config.display_name_attribute||"displayName",c=`(&(${this.config.ldap_organization_link_attribute}=${o})${z(i,`uid,cn,mail,sn,givenName,${h}`)})`;return this.server.logger.debug(`Searching for linked entities with filter: ${c} in ${r}`),e.push(...await this.linkedEntities(r,c,n,t,a)),e}async searchOrganisationTree(t,i,a){const e=this.config.ldap_organization_max_subnodes||50,n=this.pathAttr?`ou,description,${this.pathAttr}`:"ou,description",s=`(&(objectClass=organizationalUnit)${z(i,n)})`,r=[];let o=0;try{const i=await this.server.ldap.search({paged:!0,scope:"sub",filter:s},t,a);for await(const t of i){o+=t.searchEntries.length;const i=e-r.length;i>0&&r.push(...t.searchEntries.slice(0,i))}}catch(i){const n=v(i);if(32===n)return this.server.logger.debug(`No organizations under ${t}: no such node`),[];if(34===n)throw new y(`${t} is not a valid DN`);if(4!==n)throw i;const r=(await this.server.ldap.search({paged:!1,scope:"sub",filter:s,sizeLimit:e+1},t,a)).searchEntries.slice(0,e);return this.warnSizeLimit(`search:${t}`,`A search under ${t} matched more organizations than the directory will list in one answer, so ${r.length} are returned and the rest are hidden. Raise the size limit for the account ldap-rest binds as (olcLimits, or olcSizeLimit) to search them all.`),[...r,LdapOrganizations.moreIndicator(`more-organizations-${t}`,"... more organizations than the directory will list",r.length)]}if(o<=e)return r;const h=o-e;return[...r,LdapOrganizations.moreIndicator(`more-organizations-${t}`,`... ${h} more ${1===h?"organization":"organizations"}, narrow the search`,e,o)]}getConfigApiData(){const t=this.config.api_prefix||"/api",i=this.config.organization_schema?E(this.server,this.config.organization_schema):void 0;return{enabled:!0,topOrganization:this.config.ldap_top_organization||"",organizationClass:this.config.ldap_organization_class||["top","organizationalUnit"],linkAttribute:this.linkAttr||"",pathAttribute:this.pathAttr||"",pathSeparator:this.config.ldap_organization_path_separator||" / ",maxSubnodes:this.config.ldap_organization_max_subnodes||50,schema:this.schema,schemaUrl:i,endpoints:{getTop:`${t}/v1/ldap/organizations/top`,get:`${t}/v1/ldap/organizations/:dn`,getSubnodes:`${t}/v1/ldap/organizations/:dn/subnodes`,searchSubnodes:`${t}/v1/ldap/organizations/:dn/subnodes/search`,search:`${t}/v1/ldap/organizations/:dn/search`,create:`${t}/v1/ldap/organizations`,update:`${t}/v1/ldap/organizations/:dn`,move:`${t}/v1/ldap/organizations/:dn/move`,delete:`${t}/v1/ldap/organizations/:dn`}}}}LdapOrganizations.SIZE_LIMIT_WARNED_MAX=500;export{LdapOrganizations as default};
+import{Type as t}from"@sinclair/typebox";import i from"../../abstract/plugin.js";import{assertModifyRequest as e}from"../../lib/ldapActions.js";import{jsonBody as a,tryMethod as s,wantJson as n,tryMethodData as r,WriteResponse as o}from"../../lib/expressFormatedResponses.js";import{validateDnValue as h,escapeDnValue as d,getRdn as c,isDnInBranch as l,rdnValue as p,normalizeDn as g,getParentDn as u,escapeLdapFilter as m,isChildOf as w,substringSearchFilter as f}from"../../lib/utils.js";import{BadRequestError as z,NotFoundError as y,ConflictError as b,isAuthzRefusal as $,HttpError as _}from"../../lib/errors.js";import{extractLdapCode as v}from"../../lib/ldapCodes.js";import{loadSchemaFileAsync as O}from"../../lib/schemaFile.js";import{staticSchemaUrl as E}from"../../lib/staticFiles.js";import{assertClientMaySet as A,modifiedAttributeNames as C}from"../../config/schema.js";import{applyFixedDefaults as L,EntityValidator as k}from"../../lib/entitySchema/validator.js";import{organizationOptions as j}from"./ldap.options.js";import{defineRoute as S}from"../../lib/route.js";const q=t.Object({dn:t.String({minLength:1})}),x=t.Object({q:t.String({minLength:1})});class LdapOrganizations extends i{static optionDefinitions=j;name="ldapOrganizations";roles=["api","consistency","configurable"];settings;pathAttr;linkAttr;schema;constructor(t){if(super(t),this.settings=this.options(j),!this.settings.ldap_top_organization)throw new Error("Missing --ldap-top-organization");if(this.pathAttr=this.settings.ldap_organization_path_attribute,this.linkAttr=this.settings.ldap_organization_link_attribute,t.ldap.declareObjectClasses(this.settings.ldap_top_organization,this.settings.ldap_organization_class,!0),this.settings.organization_schema){const t=this.settings.organization_schema;O(t,{config:this.config}).then(t=>{this.schema=t,this.server.ldap.knowAttributeNames(Object.keys(t.attributes)),this.logger.debug("Organization schema loaded")}).catch(i=>this.logger.error(`Failed to load organization schema from ${t}: ${i}`))}}api(t){S(t,{method:"get",path:`${this.config.api_prefix}/v1/ldap/organizations/top`,handler:async({req:t,res:i})=>{await r(i,async()=>this.hideNeverReturn(await this.getOrganisationTop(t)))}}),S(t,{method:"get",path:`${this.config.api_prefix}/v1/ldap/organizations/:dn`,params:q,handler:async({req:t,params:i,res:e})=>{const a=decodeURIComponent(i.dn);await r(e,async()=>this.hideNeverReturn(await this.getOrganisationByDn(a,t)))}}),S(t,{method:"get",path:`${this.config.api_prefix}/v1/ldap/organizations/:dn/subnodes`,params:q,handler:async({req:t,params:i,res:e})=>{const a=decodeURIComponent(i.dn);await r(e,async()=>this.hideNeverReturn(await this.getOrganisationSubnodes(a,t)))}}),S(t,{method:"get",path:`${this.config.api_prefix}/v1/ldap/organizations/:dn/subnodes/search`,params:q,query:x,handler:async({req:t,params:i,query:e,res:a})=>{const s=decodeURIComponent(i.dn);await r(a,async()=>this.hideNeverReturn(await this.searchOrganisationSubnodes(s,e.q,t)))}}),S(t,{method:"get",path:`${this.config.api_prefix}/v1/ldap/organizations/:dn/search`,params:q,query:x,handler:async({req:t,params:i,query:e,res:a})=>{const s=decodeURIComponent(i.dn);await r(a,async()=>this.hideNeverReturn(await this.searchOrganisationTree(s,e.q,t)))}}),S(t,{method:"post",path:`${this.config.api_prefix}/v1/ldap/organizations`,responses:{200:o},handler:async({req:t,res:i})=>this.apiAdd(t,i)}),S(t,{method:"put",path:`${this.config.api_prefix}/v1/ldap/organizations/:dn`,responses:{200:o},params:q,handler:async({req:t,res:i})=>this.apiModify(t,i)}),S(t,{method:"delete",path:`${this.config.api_prefix}/v1/ldap/organizations/:dn`,responses:{200:o},params:q,handler:async({req:t,res:i})=>this.apiDelete(t,i)}),S(t,{method:"post",path:`${this.config.api_prefix}/v1/ldap/organizations/:dn/move`,responses:{200:o},params:q,handler:async({req:t,res:i})=>this.apiMove(t,i)})}async apiAdd(t,i){const e=a(t,i,"ou");if(!e)return;A(this.schema,Object.keys(e),"ou"),h(e.ou,"ou");const n=e.parentDn||this.settings.ldap_top_organization,r=`ou=${d(e.ou)},${n}`,o={ou:e.ou,...Object.fromEntries(Object.entries(e).filter(([t])=>"ou"!==t&&"parentDn"!==t)),objectClass:this.settings.ldap_organization_class};await s(i,this.addOrganization.bind(this),r,o,t)}async apiModify(t,i){const n=a(t,i);if(!n)return;e(n);const r=decodeURIComponent(t.params.dn);if(!r)throw new z("dn is required");A(this.schema,C(n)),await s(i,this.modifyOrganization.bind(this),r,n,t)}async apiDelete(t,i){if(!n(t,i))return;const e=decodeURIComponent(t.params.dn);if(!e)throw new z("dn is required");await s(i,this.deleteOrganization.bind(this),e,t)}async apiMove(t,i){if(!n(t,i))return;const e=a(t,i,"targetOrgDn");if(!e)return;const s=decodeURIComponent(t.params.dn);if(!s)throw new z("dn is required");const{targetOrgDn:o}=e;if(!o||"string"!=typeof o)throw new z("Missing or invalid targetOrgDn in request body");await r(i,this.moveOrganization.bind(this),s,o,t)}hooks={ldapaddrequest:async([t,i,e])=>(this.isOu(i)||await this.checkDeptLink(i),this.isOu(i)&&await this.checkDeptPath(i,t),void 0!==e?[t,i,e]:[t,i]),ldapmodifyrequest:async([t,i,e,a])=>{let s,n={},r={};const checkIsOu=async()=>{if(void 0!==s)return s;if(i.replace?.objectClass)s=this.isOu({objectClass:i.replace.objectClass});else if(i.add?.objectClass)s=this.isOu({objectClass:i.add.objectClass});else{const i=await this.server.ldap.system.search({paged:!1,scope:"base"},t);s=i.searchEntries.length>0&&this.isOu(i.searchEntries[0])}return s};if(i.delete){const t=(Array.isArray(i.delete)?i.delete.map(String):Object.keys(i.delete)).map(t=>t.split(";")[0].toLowerCase()),e=t.includes(this.linkAttr.toLowerCase()),a=t.includes(this.pathAttr.toLowerCase());if(e||a){if(!await checkIsOu()&&e)throw new z("An organization link cannot be deleted");if(a)throw new z("An organization path cannot be deleted")}}if(i.replace&&(i.replace[this.linkAttr]&&(n={...i.replace}),i.replace[this.pathAttr]&&(r={...i.replace})),i.add&&(i.add[this.linkAttr]&&(n={...n,...i.add}),i.add[this.pathAttr]&&(r={...r,...i.add})),Object.keys(n).length>0){await checkIsOu()||await this.checkDeptLink(n)}if(Object.keys(r).length>0){await checkIsOu()&&await this.checkDeptPath(r,t)}return[t,i,e,a]},ldapdeleterequest:async([t,i])=>{const e=Array.isArray(t)?t:[t];for(const t of e)/^\s*ou\s*=/i.test(t)&&await this.isEmptyOrganization(t);return[t,i]},ldaprenamerequest:([t,i,e])=>[t,i,e]};async checkDeptLink(t){if(t[this.linkAttr]){const i=t[this.linkAttr],e=Array.isArray(i)?i[0]:i,a=await this.server.ldap.system.search({paged:!1,scope:"base"},e);if(0===a.searchEntries.length)throw new y(`Organization ${e} does not exist`);if(!new RegExp(`(.*,)?${this.settings.ldap_top_organization}`).test(a.searchEntries[0].dn))throw new z(`Entry ${e} isn't in top organization branch`)}}async checkDeptPath(t,i){if(t[this.pathAttr]){const e=t[this.pathAttr],a=Array.isArray(e)?e[0]:e,s=this.settings.ldap_organization_path_separator,n=this.settings.ldap_top_organization,r=i&&n&&/^ou=/i.test(c(i))&&l(i,n)?p(i):void 0,o=t.ou,h=(Array.isArray(o)?o[0]:o)||r;let d=a;if((this.isOu(t)||void 0!==r)&&h){const t=n?p(n):"";if(t&&a.startsWith(h+s)&&a.endsWith(s+t))return;if(a===h){const t=n?g(n):"";if(!i||!t||!l(i,n)||g(i)===t||g(u(i))===t)return;throw new z(`Organization path "${a}" names no parent, but ${i} is not directly under ${n}`)}if(!a.endsWith(s+h))throw new z(`Organization path must end with its own name, preceded by separator "${s}"`);d=a.slice(0,a.length-s.length-h.length)}const w=await this.server.ldap.system.search({paged:!1,scope:"sub",filter:`(${this.pathAttr}=${m(d)})`,attributes:["dn"]},this.settings.ldap_top_organization);if(!w.searchEntries||0===w.searchEntries.length)throw new z(`Invalid organization path ${a}: no organization holds "${d}"`)}}async isEmptyOrganization(t){if((await this.server.ldap.system.search({paged:!1,filter:`(${this.settings.ldap_organization_link_attribute}=${m(t)})`})).searchEntries.length>0)throw new b(`Organization ${t} is not empty`)}isOu(t){if(!t.objectClass)return!1;const i=[].concat(t.objectClass).map(t=>String(t).toLowerCase());return this.settings.ldap_organization_class.filter(t=>"top"!==t.toLowerCase()).some(t=>i.includes(t.toLowerCase()))}async getOrganisationTop(t){if(!this.settings.ldap_top_organization)throw new z("No top organization configured");const i=await this.server.ldap.search({paged:!1,scope:"base"},this.settings.ldap_top_organization,t);if(1!==i.searchEntries.length)throw new y("Top organization not found");const e=i.searchEntries[0],[,a]=await this.hookBus.chain("getOrganisationTop",[t,e]);return a}async getOrganisationByDn(t,i){let e;try{e=await this.server.ldap.search({paged:!1,scope:"base",filter:"(objectClass=organizationalUnit)"},t,i)}catch(i){const e=v(i);if(32===e)throw new y(`Organization ${t} not found`);if(34===e)throw new z(`${t} is not a valid DN`);throw i}if(1!==e.searchEntries.length)throw new y(`Organization ${t} not found`);return e.searchEntries[0]}async getOrganisationSubnodes(t,i){const e=[],a=this.settings.ldap_organization_max_subnodes,s=i?.query?.objectClass;s&&"organizationalUnit"!==s||e.push(...await this.childOrganizations(t,"(objectClass=organizationalUnit)",a,i));const n=this.settings.ldap_top_organization,r=u(n);let o=`(${this.settings.ldap_organization_link_attribute}=${m(t)})`;return s&&(o=`(&${o}(objectClass=${m(s)}))`),this.server.logger.debug(`Searching for linked entities with filter: ${o} in ${r}`),e.push(...await this.linkedEntities(r,o,a,t,i)),e}sizeLimitWarned=new Set;static SIZE_LIMIT_WARNED_MAX=500;warnSizeLimit(t,i){this.sizeLimitWarned.has(t)?this.server.logger.debug(i):(this.sizeLimitWarned.size<LdapOrganizations.SIZE_LIMIT_WARNED_MAX&&this.sizeLimitWarned.add(t),this.server.logger.warn(i))}static moreIndicator(t,i,e,a){return{dn:t,cn:[i],objectClass:["moreIndicator"],_isMoreIndicator:"true",...void 0===a?{}:{_totalCount:a.toString()},_displayedCount:e.toString()}}async childOrganizations(t,i,e,a){try{const e=await this.server.ldap.search({paged:!0,scope:"one",filter:i},t,a),s=[];for await(const t of e)s.push(...t.searchEntries);return this.server.logger.debug(`Found ${s.length} sub-OUs for ${t}`),s}catch(i){const e=v(i);if(32===e)return this.server.logger.debug(`No sub-OUs for ${t}: the node holds none`),[];if(34===e)throw new z(`${t} is not a valid DN`);if(4!==e)throw i}const s=(await this.server.ldap.search({paged:!1,scope:"one",filter:i,sizeLimit:e+1},t,a)).searchEntries.slice(0,e);return this.warnSizeLimit(`children:${t}`,`Organization ${t} holds more child organizations than the directory will list in one answer, so ${s.length} are returned and the rest are hidden. Raise the size limit for the account ldap-rest binds as (olcLimits, or olcSizeLimit) to list them all.`),[...s,LdapOrganizations.moreIndicator(`more-organizations-${t}`,"... more organizations than the directory will list",s.length)]}async linkedEntities(t,i,e,a,s){const n=[];let r=0;try{const a=await this.server.ldap.search({paged:!0,filter:i},t,s);for await(const t of a){r+=t.searchEntries.length;const i=e-n.length;i>0&&n.push(...t.searchEntries.slice(0,i))}}catch(n){if(t!==a&&($(n)||403===n?.statusCode))return this.linkedEntities(a,i,e,a,s);if(4!==v(n))throw n;const r=await this.server.ldap.search({paged:!1,filter:i,sizeLimit:e+1},t,s);this.warnSizeLimit(`linked:${a}`,`More entries are attached to ${a} than the directory will list in one answer. Raise the size limit for the account ldap-rest binds as (olcLimits, or olcSizeLimit) to count them all.`);const o=r.searchEntries.slice(0,e);return[...o,LdapOrganizations.moreIndicator(`more-${a}`,"... more elements than the directory will list",o.length)]}return this.server.logger.debug(`Found ${r} linked entities for ${a}, returning ${n.length}`),r<=e?n:[...n,LdapOrganizations.moreIndicator(`more-${a}`,`... ${r-e} more ${r-e===1?"element":"elements"}`,e,r)]}async addOrganization(t,i,e){return L(this.schema,i),await this.server.ldap.authorize("ldapaddrequest",[t,i,e]),i=await this.validator().validateNew(i),await this.server.ldap.add(t,i,e)}async modifyOrganization(t,i,e){return await this.server.ldap.authorize("ldapmodifyrequest",[t,i,this.opNumber(),e]),await this.validator().validateChanges(i),await this.server.ldap.modify(t,i,e)}validator(){return new k(this.schema,{entryExists:t=>this.entryExists(t),loadedPlugins:this.server.loadedPlugins,singularName:"organization"})}async entryExists(t){try{return(await this.server.ldap.system.search({paged:!1,scope:"base",attributes:["dn"]},t)).searchEntries.length>0}catch{return!1}}async moveOrganization(t,i,e){const a=`${c(t)},${i}`;let s,n;await this.server.ldap.authorize("ldaprenamerequest",[t,a,e]);try{s=await this.server.ldap.system.search({paged:!1,scope:"base"},i)}catch(t){throw new y(`Target organization ${i} not found: ${t instanceof Error?t.message:String(t)}`)}if(!s.searchEntries||0===s.searchEntries.length)throw new y(`Target organization ${i} not found`);if(!this.isOu(s.searchEntries[0]))throw new z(`Target ${i} is not an organizational unit`);try{n=await this.server.ldap.system.search({paged:!1,scope:"base"},t)}catch(t){throw new y(`Source organization not found: ${t}`)}if(!n.searchEntries||0===n.searchEntries.length)throw new y(`Source organization ${t} not found`);if(a===t)throw new z("Cannot move organization to its current location");if(i.toLowerCase()===t.toLowerCase()||w(i,t))throw new z("Cannot move organization into itself or its descendant");try{await this.server.ldap.rename(t,a,e),this.logger.info(`Moved organization from ${t} to ${a}`)}catch(t){if(t instanceof _||$(t))throw t;throw new Error(`Failed to move organization: ${String(t)}`,{cause:t})}return{newDn:a}}async deleteOrganization(t,i){try{return await this.server.ldap.delete(t,i)}catch(i){if(32===v(i))throw new y(`Organization ${t} not found`);throw i}}async searchOrganisationSubnodes(t,i,e){const a=[],s=this.settings.ldap_organization_max_subnodes;a.push(...await this.childOrganizations(t,`(&(objectClass=organizationalUnit)${f(i,"ou,description")})`,s,e));const n=this.settings.ldap_top_organization,r=u(n),o=m(t),h=this.config.display_name_attribute||"displayName",d=`(&(${this.settings.ldap_organization_link_attribute}=${o})${f(i,`uid,cn,mail,sn,givenName,${h}`)})`;return this.server.logger.debug(`Searching for linked entities with filter: ${d} in ${r}`),a.push(...await this.linkedEntities(r,d,s,t,e)),a}async searchOrganisationTree(t,i,e){const a=this.settings.ldap_organization_max_subnodes,s=this.pathAttr?`ou,description,${this.pathAttr}`:"ou,description",n=`(&(objectClass=organizationalUnit)${f(i,s)})`,r=[];let o=0;try{const i=await this.server.ldap.search({paged:!0,scope:"sub",filter:n},t,e);for await(const t of i){o+=t.searchEntries.length;const i=a-r.length;i>0&&r.push(...t.searchEntries.slice(0,i))}}catch(i){const s=v(i);if(32===s)return this.server.logger.debug(`No organizations under ${t}: no such node`),[];if(34===s)throw new z(`${t} is not a valid DN`);if(4!==s)throw i;const r=(await this.server.ldap.search({paged:!1,scope:"sub",filter:n,sizeLimit:a+1},t,e)).searchEntries.slice(0,a);return this.warnSizeLimit(`search:${t}`,`A search under ${t} matched more organizations than the directory will list in one answer, so ${r.length} are returned and the rest are hidden. Raise the size limit for the account ldap-rest binds as (olcLimits, or olcSizeLimit) to search them all.`),[...r,LdapOrganizations.moreIndicator(`more-organizations-${t}`,"... more organizations than the directory will list",r.length)]}if(o<=a)return r;const h=o-a;return[...r,LdapOrganizations.moreIndicator(`more-organizations-${t}`,`... ${h} more ${1===h?"organization":"organizations"}, narrow the search`,a,o)]}getConfigApiData(){const t=this.config.api_prefix||"/api",i=this.settings.organization_schema?E(this.server,this.settings.organization_schema):void 0;return{enabled:!0,topOrganization:this.settings.ldap_top_organization,organizationClass:this.settings.ldap_organization_class,linkAttribute:this.linkAttr||"",pathAttribute:this.pathAttr||"",pathSeparator:this.settings.ldap_organization_path_separator,maxSubnodes:this.settings.ldap_organization_max_subnodes,schema:this.schema,schemaUrl:i,endpoints:{getTop:`${t}/v1/ldap/organizations/top`,get:`${t}/v1/ldap/organizations/:dn`,getSubnodes:`${t}/v1/ldap/organizations/:dn/subnodes`,searchSubnodes:`${t}/v1/ldap/organizations/:dn/subnodes/search`,search:`${t}/v1/ldap/organizations/:dn/search`,create:`${t}/v1/ldap/organizations`,update:`${t}/v1/ldap/organizations/:dn`,move:`${t}/v1/ldap/organizations/:dn/move`,delete:`${t}/v1/ldap/organizations/:dn`}}}}export{q as OrganizationParams,x as OrganizationSearchQuery,LdapOrganizations as default};