ldap-rest 1.2.1 → 1.3.0

package/dist/src/lib/utils.d.ts

@@ -22,42 +22,7 @@ export declare function getCompiledRegex(pattern: string, flags?: string): RegEx
  * @returns The escaped string safe for use in RegExp
  */
 export declare function escapeRegex(str: string): string;
-/**
- * Run a hook under its plugin's name and its own, for the lines it logs:
- * what `launchHooks` does, for a caller walking the hooks itself.
- *
- * @param hook the registered function
- * @param fn its run
- * @returns what `fn` returns
- */
-export declare const runAsHookOwner: <T>(hook: Function, fn: () => T) => T;
-export declare const launchHooks: (hooks: Function[] | undefined, ...args: unknown[]) => Promise<void>;
-/**
- * Record the plugin a hook function belongs to.
- *
- * @param fn the registered function
- * @param plugin the plugin's instance name
- * @param hook the hook it is registered under
- */
-export declare const recordHookOwner: (fn: Function, plugin: string, hook: string) => void;
-/**
- * The plugin a hook function belongs to, and the hook it is registered
- * under, when `registerPlugin` registered it.
- *
- * @param fn a hook function
- * @returns its plugin's instance name and hook name, or undefined
- */
-export declare const hookOwner: (fn: Function) => {
-    plugin: string;
-    hook: string;
-} | undefined;
-/**
- * Whether an error is an authorization plugin's refusal, by the marker its
- * message carries: a plain `Error` wrapping it keeps the message only. Its
- * message names the branch, so the client is told `AUTHZ_REFUSED` instead.
- */
-export declare const isAuthzRefusal: (err: unknown) => boolean;
-export declare const launchHooksChained: <T>(hooks: Function[] | undefined, args: T) => Promise<T>;
+export { hookOwner, recordHookOwner, runAsHookOwner } from './hookBus';
 export declare const transformSchemas: (schemas: string | Buffer, config: Config) => string;
 /**
  * Escape special characters in LDAP filter values according to RFC 4515
@@ -237,6 +202,36 @@ export declare function getRdn(dn: string): string;
  * ```
  */
 export declare function rdnValue(dn: string): string;
+/**
+ * Read the name of an entry written as a DN: the value of its first RDN when
+ * that RDN asserts `attribute` alone, under `base` when one is given.
+ *
+ * The value is decoded exactly as {@link rdnValue} decodes it: it is the
+ * naming attribute's value, the one a write puts back in
+ * `attribute=…,base`.
+ *
+ * @param dn - The DN to read
+ * @param attribute - The attribute the first RDN must assert
+ * @param base - The branch the entry belongs to, when the DN names it whole
+ * @returns The name, or `null` when the RDN asserts another attribute, names
+ * another branch, or is no DN
+ *
+ * @example
+ * ```typescript
+ * assertedRdnValue('uid=Smith\\,John,ou=users,dc=example,dc=com', 'uid')
+ * // => 'Smith,John'
+ * ```
+ */
+export declare function assertedRdnValue(dn: string, attribute: string, base?: string): string | null;
+/**
+ * Whether `attribute=` starts `id`: the caller sent a DN rather than a bare
+ * naming value.
+ *
+ * Deciding this before `assertedRdnValue` matters: a string it refuses — a
+ * multi-valued RDN, another branch — is still a DN, and read as a bare value
+ * it would be written whole.
+ */
+export declare function namesByDn(id: string, attribute: string): boolean;
 /**
  * Check if a DN is a child of another DN
  *

package/dist/src/lib/version.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The version of this package, read from the `package.json` that ships with
+ * it: the repository root when run from the sources, the installed package
+ * when run from the bundle. A build that moved the file elsewhere leaves it
+ * unknown rather than guessing.
+ *
+ * `start` is the directory the walk begins from; it defaults to this
+ * module's own and exists so the walk can be exercised on a fixture.
+ */
+export declare function readVersion(start?: string): string | undefined;
+/** The server's version, as its package declares it */
+export declare const SERVER_VERSION: string | undefined;

package/dist/src/plugins/auth/auth.options.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Authentication and authorization plugin options, see
+ * `docs/plugin-development/options.md`.
+ */
+import type { AuthConfig, Config } from '../../config/args';
+import { type OptionsOf } from '../../config/options';
+export declare const tokenOptions: {
+    auth_token: import("../../config/options").ArrayOption;
+};
+export type TokenOptions = OptionsOf<typeof tokenOptions>;
+export declare const fakeOptions: {
+    auth_fake_user: import("../../config/options").StringOption;
+};
+export type FakeOptions = OptionsOf<typeof fakeOptions>;
+export declare const totpOptions: {
+    auth_totp: import("../../config/options").ArrayOption;
+    auth_totp_window: import("../../config/options").NumberOption;
+    auth_totp_step: import("../../config/options").NumberOption;
+};
+export type TotpOptions = OptionsOf<typeof totpOptions>;
+export declare const hmacOptions: {
+    auth_hmac: import("../../config/options").ArrayOption;
+    auth_hmac_window: import("../../config/options").NumberOption;
+};
+export type HmacOptions = OptionsOf<typeof hmacOptions>;
+export declare const llngOptions: {
+    llng_ini: import("../../config/options").StringOption;
+    llng_username_header: import("../../config/options").StringOption;
+};
+export type LlngOptions = OptionsOf<typeof llngOptions>;
+export declare const perRouteOptions: {
+    authz_per_route: import("../../config/options").ArrayOption;
+};
+export type PerRouteOptions = OptionsOf<typeof perRouteOptions>;
+export declare const perBranchOptions: {
+    authz_per_branch_config: import("../../config/options").JsonOption<AuthConfig>;
+    authz_per_branch_cache_ttl: import("../../config/options").NumberOption;
+    ldap_group_member_attribute: import("../../config/options").StringOption;
+};
+export type PerBranchOptions = OptionsOf<typeof perBranchOptions>;
+export declare const dynamicOptions: {
+    authz_dynamic_bypass: import("../../config/options").ArrayOption;
+    authz_dynamic_base: import("../../config/options").StringOption;
+    authz_dynamic_cache_ttl: import("../../config/options").NumberOption;
+    authz_dynamic_token_attribute: import("../../config/options").StringOption;
+    authz_dynamic_config_attribute: import("../../config/options").StringOption;
+    authz_dynamic_tenant_attribute: import("../../config/options").StringOption;
+    authz_dynamic_reload_endpoint: import("../../config/options").BooleanOption;
+};
+export type DynamicOptions = OptionsOf<typeof dynamicOptions>;
+export declare const linid1Options: {
+    authz_local_admin_attribute: import("../../config/options").StringOption;
+    authz_global_branch: import("../../config/options").ArrayOption;
+    authz_global_write_branch: import("../../config/options").ArrayOption;
+    authz_global_organization: import("../../config/options").StringOption;
+};
+export type Linid1Options = OptionsOf<typeof linid1Options>;
+export declare const openidconnectOptions: {
+    oidc_server: import("../../config/options").StringOption;
+    oidc_username_claim: import("../../config/options").StringOption;
+    oidc_client_id: import("../../config/options").StringOption;
+    oidc_client_secret: import("../../config/options").StringOption;
+    base_url: import("../../config/options").StringOption;
+};
+export type OpenidconnectOptions = OptionsOf<typeof openidconnectOptions>;
+export declare const rateLimitOptions: {
+    rate_limit_window_ms: import("../../config/options").NumberOption;
+    rate_limit_max: import("../../config/options").NumberOption;
+};
+export type RateLimitOptions = OptionsOf<typeof rateLimitOptions>;
+export declare const crowdsecOptions: {
+    crowdsec_url: import("../../config/options").StringOption;
+    crowdsec_api_key: import("../../config/options").StringOption;
+    crowdsec_cache_ttl: import("../../config/options").NumberOption;
+};
+export type CrowdsecOptions = OptionsOf<typeof crowdsecOptions>;
+export declare const trustedProxyOptions: {
+    trusted_proxy: import("../../config/options").ArrayOption;
+    trusted_proxy_auth_header: import("../../config/options").StringOption;
+};
+export type TrustedProxyOptions = OptionsOf<typeof trustedProxyOptions>;
+/** The checked values for a caller that holds a Config instead of the plugin */
+export declare function totpOptionsOf(config: Config): TotpOptions;
+export declare function hmacOptionsOf(config: Config): HmacOptions;
+export declare function perBranchOptionsOf(config: Config): PerBranchOptions;
+export declare function dynamicOptionsOf(config: Config): DynamicOptions;
+export declare function rateLimitOptionsOf(config: Config): RateLimitOptions;
+export declare function crowdsecOptionsOf(config: Config): CrowdsecOptions;

package/dist/src/plugins/auth/authzDynamic.d.ts

@@ -51,6 +51,15 @@ export interface AuthzDynamicRequest extends DmRequest {
     authzToken?: TokenEntry;
 }
 export default class AuthzDynamic extends AuthBase {
+    static optionDefinitions: {
+        authz_dynamic_bypass: import("../../config/options").ArrayOption;
+        authz_dynamic_base: import("../../config/options").StringOption;
+        authz_dynamic_cache_ttl: import("../../config/options").NumberOption;
+        authz_dynamic_token_attribute: import("../../config/options").StringOption;
+        authz_dynamic_config_attribute: import("../../config/options").StringOption;
+        authz_dynamic_tenant_attribute: import("../../config/options").StringOption;
+        authz_dynamic_reload_endpoint: import("../../config/options").BooleanOption;
+    };
     name: string;
     roles: Role[];
     private tokens;
@@ -171,7 +180,7 @@ export default class AuthzDynamic extends AuthBase {
      */
     private activeToken;
     /**
-     * Throw a ForbiddenError (403) if the token cannot perform `permission` on
+     * Throw an AuthzRefusedError (403) if the token cannot perform `permission` on
      * the branch containing `branchOrDn`. Any ACL entry that is `branchOrDn`
      * itself or a parent of it (sub-branch match) qualifies.
      *

package/dist/src/plugins/auth/authzLinid1.d.ts

@@ -14,6 +14,12 @@ interface CachedPermissions {
     timestamp: number;
 }
 export default class AuthzLinid1 extends AuthzBase {
+    static optionDefinitions: {
+        authz_local_admin_attribute: import("../../config/options").StringOption;
+        authz_global_branch: import("../../config/options").ArrayOption;
+        authz_global_write_branch: import("../../config/options").ArrayOption;
+        authz_global_organization: import("../../config/options").StringOption;
+    };
     name: string;
     permissionsCache: Map<string, CachedPermissions>;
     constructor(server: DM);

package/dist/src/plugins/auth/authzPerBranch.d.ts

@@ -16,6 +16,11 @@ interface CachedGroups {
     timestamp: number;
 }
 export default class AuthzPerBranch extends AuthzBase {
+    static optionDefinitions: {
+        authz_per_branch_config: import("../../config/options").JsonOption<AuthConfig>;
+        authz_per_branch_cache_ttl: import("../../config/options").NumberOption;
+        ldap_group_member_attribute: import("../../config/options").StringOption;
+    };
     name: string;
     authConfig?: AuthConfig;
     groupCache: Map<string, CachedGroups>;
@@ -30,7 +35,11 @@ export default class AuthzPerBranch extends AuthzBase {
     /** `authConfig.groups` keyed by normalized DN, and the object it was built from. */
     private groupRulesIndex?;
     hooks: AuthzBase['hooks'] & Pick<Hooks, 'ldapadddone' | 'ldapmodifydone' | 'ldapdeletedone'>;
+    /** What the classes above declared, read once this one is constructed */
+    private readonly declaredByBase;
     constructor(server: DM);
+    /** The attribute a group lists its members in */
+    private get memberAttribute();
     /**
      * Whether a modify can change which groups a uid belongs to: it touches
      * the member attribute, or the attribute a uid is resolved by.

package/dist/src/plugins/auth/authzPerRoute.d.ts

@@ -11,6 +11,9 @@ import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 export declare function globToRegex(glob: string): RegExp;
 export default class AuthzPerRoute extends DmPlugin {
+    static optionDefinitions: {
+        authz_per_route: import("../../config/options").ArrayOption;
+    };
     name: string;
     roles: Role[];
     private rules;

package/dist/src/plugins/auth/authzScope.d.ts

@@ -1,19 +1,28 @@
-/**
- * @module plugins/auth/authzScope
- * @author Xavier Guimard <xguimard@linagora.com>
- *
- * Tells a client what the signed-in administrator may actually do, before it
- * offers them a button that will fail.
- *
- * In a local-administration model the scope *is* the interface: a manager
- * administers a few branches of the tree and nothing else, and an application
- * that cannot name those branches leaves them guessing. This endpoint answers
- * both halves — which branches, and which entities can be created in them —
- * by asking the authorization plugin in force, whichever one that is.
- * @group Plugins
- */
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
+export declare const ScopeResponse: import("@sinclair/typebox").TObject<{
+    user: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>;
+    unrestricted: import("@sinclair/typebox").TBoolean;
+    described: import("@sinclair/typebox").TBoolean;
+    source: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>;
+    sources: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    branches: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        dn: import("@sinclair/typebox").TString;
+        read: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        write: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        delete: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        name: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        path: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    }>>;
+    transit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>>;
+    linksAnyDomain: import("@sinclair/typebox").TBoolean;
+    passwordPolicies: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+    entities: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        name: import("@sinclair/typebox").TString;
+        base: import("@sinclair/typebox").TString;
+        create: import("@sinclair/typebox").TBoolean;
+    }>>;
+}>;
 export default class AuthzScope extends DmPlugin {
     name: string;
     roles: Role[];

package/dist/src/plugins/auth/crowdsec.d.ts

@@ -16,6 +16,11 @@
 import type { Express } from 'express';
 import DmPlugin, { Role } from '../../abstract/plugin';
 export default class CrowdSec extends DmPlugin {
+    static optionDefinitions: {
+        crowdsec_url: import("../../config/options").StringOption;
+        crowdsec_api_key: import("../../config/options").StringOption;
+        crowdsec_cache_ttl: import("../../config/options").NumberOption;
+    };
     name: string;
     roles: Role[];
     private apiUrl;

package/dist/src/plugins/auth/fake.d.ts

@@ -10,6 +10,9 @@ import type { Response } from 'express';
 import AuthBase, { type DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 export default class AuthFake extends AuthBase {
+    static optionDefinitions: {
+        auth_fake_user: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
     private readonly user;

package/dist/src/plugins/auth/hmac.d.ts

@@ -2,6 +2,10 @@ import type { Response } from 'express';
 import AuthBase, { type DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 export default class AuthHmac extends AuthBase {
+    static optionDefinitions: {
+        auth_hmac: import("../../config/options").ArrayOption;
+        auth_hmac_window: import("../../config/options").NumberOption;
+    };
     protected knownIdentities(): string[];
     protected identitySource(): string;
     name: string;

package/dist/src/plugins/auth/llng.d.ts

@@ -11,6 +11,10 @@ import AuthBase, { DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 type LlngHandler = typeof import('lemonldap-ng-handler');
 export default class AuthLLNG extends AuthBase {
+    static optionDefinitions: {
+        llng_ini: import("../../config/options").StringOption;
+        llng_username_header: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
     private handler?;

package/dist/src/plugins/auth/openidconnect.d.ts

@@ -4,6 +4,13 @@ import AuthBase, { DmRequest } from '../../lib/auth/base';
 import { type Role } from '../../abstract/plugin';
 import { DM } from '../../bin';
 export default class OpenIDConnect extends AuthBase {
+    static optionDefinitions: {
+        oidc_server: import("../../config/options").StringOption;
+        oidc_username_claim: import("../../config/options").StringOption;
+        oidc_client_id: import("../../config/options").StringOption;
+        oidc_client_secret: import("../../config/options").StringOption;
+        base_url: import("../../config/options").StringOption;
+    };
     name: string;
     configApiKey: string;
     roles: Role[];

package/dist/src/plugins/auth/rateLimit.d.ts

@@ -15,6 +15,10 @@
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 export default class RateLimit extends DmPlugin {
+    static optionDefinitions: {
+        rate_limit_window_ms: import("../../config/options").NumberOption;
+        rate_limit_max: import("../../config/options").NumberOption;
+    };
     name: string;
     roles: Role[];
     private store;

package/dist/src/plugins/auth/token.d.ts

@@ -9,6 +9,9 @@ import type { Response } from 'express';
 import AuthBase, { type DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 export default class AuthToken extends AuthBase {
+    static optionDefinitions: {
+        auth_token: import("../../config/options").ArrayOption;
+    };
     protected knownIdentities(): string[];
     protected identitySource(): string;
     name: string;

package/dist/src/plugins/auth/totp.d.ts

@@ -2,6 +2,11 @@ import type { Response } from 'express';
 import AuthBase, { type DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 export default class AuthTotp extends AuthBase {
+    static optionDefinitions: {
+        auth_totp: import("../../config/options").ArrayOption;
+        auth_totp_window: import("../../config/options").NumberOption;
+        auth_totp_step: import("../../config/options").NumberOption;
+    };
     protected knownIdentities(): string[];
     protected identitySource(): string;
     name: string;

package/dist/src/plugins/auth/trustedProxy.d.ts

@@ -34,6 +34,10 @@ declare global {
     }
 }
 export default class TrustedProxy extends DmPlugin {
+    static optionDefinitions: {
+        trusted_proxy: import("../../config/options").ArrayOption;
+        trusted_proxy_auth_header: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
     private trustedNetworks;

package/dist/src/plugins/bcl.d.ts

@@ -20,6 +20,9 @@ import DmPlugin from '../abstract/plugin';
 import type { DM } from '../bin';
 import type { OidcLogoutToken, OidcSessionClaims } from '../hooks';
 export default class Bcl extends DmPlugin {
+    static optionDefinitions: {
+        bcl_retention: import("../config/options").NumberOption;
+    };
     name: string;
     dependencies: {
         storage: string;

package/dist/src/plugins/bcl.options.d.ts

@@ -0,0 +1,8 @@
+/** Back-Channel Logout plugin options. */
+import type { Config } from '../config/args';
+import { type OptionsOf } from '../config/options';
+export declare const bclOptions: {
+    bcl_retention: import("../config/options").NumberOption;
+};
+export type BclOptions = OptionsOf<typeof bclOptions>;
+export declare function bclOptionsOf(config: Config): BclOptions;

package/dist/src/plugins/configApi.d.ts

@@ -10,16 +10,26 @@
  */
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../abstract/plugin';
+interface ConfigApiResponse {
+    apiPrefix: string;
+    ldapBase: string;
+    features: Record<string, unknown>;
+    /** Absent when the version could not be read at start-up */
+    version?: string;
+}
+/** The body of `GET /v1/config`, `version` left out when it is unknown. */
+export declare function configApiResponse(apiPrefix: string, ldapBase: string, features: Record<string, unknown>, version: string | undefined): ConfigApiResponse;
 /**
  * @openapi-component
  * Config:
  *   type: object
  *   description: |
- *     Aggregated server configuration. The top-level fields are always
- *     present; `features` is a dynamic map whose keys are the names of
- *     loaded plugins that declare the `configurable` role.  Each plugin
- *     contributes an arbitrary sub-object — consult the individual plugin
- *     documentation for its exact shape.
+ *     Aggregated server configuration. `apiPrefix`, `ldapBase` and
+ *     `features` are always present; `version` is present unless the server
+ *     could not read it at start-up; `features` is a dynamic map whose keys
+ *     are the names of loaded plugins that declare the `configurable` role.
+ *     Each plugin contributes an arbitrary sub-object — consult the
+ *     individual plugin documentation for its exact shape.
  *   additionalProperties: true
  *   properties:
  *     apiPrefix:
@@ -30,6 +40,13 @@ import DmPlugin, { type Role } from '../abstract/plugin';
  *       type: string
  *       description: The root LDAP suffix used by this server.
  *       example: dc=example,dc=com
+ *     version:
+ *       type: string
+ *       description: |
+ *         The server's version, as its package declares it. A client reads it
+ *         to tell an administrator the server is older than it supports; a
+ *         server that cannot tell its version leaves the field out.
+ *       example: 1.2.1
  *     features:
  *       type: object
  *       description: |
@@ -52,6 +69,7 @@ import DmPlugin, { type Role } from '../abstract/plugin';
  *   example:
  *     apiPrefix: /api
  *     ldapBase: dc=example,dc=com
+ *     version: 1.2.1
  *     features:
  *       ldapGroups:
  *         enabled: true
@@ -73,3 +91,4 @@ export default class ConfigApi extends DmPlugin {
      */
     private collectPluginConfigs;
 }
+export {};

package/dist/src/plugins/demo/helloworld.d.ts

@@ -6,26 +6,15 @@
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 /**
- * @openapi-component
- * Hello:
- *   type: object
- *   description: Response returned by the hello-world demo endpoint.
- *   properties:
- *     message:
- *       type: string
- *       description: Static greeting string.
- *       example: Hello
- *     hookResults:
- *       type: array
- *       description: |
- *         Results collected from every function registered on the `hello`
- *         hook.  Empty when no hook listeners are installed.
- *       items: {}
- *       example: []
- *   example:
- *     message: Hello
- *     hookResults: []
+ * The answer of the hello-world endpoint.
+ *
+ * Exported because the OpenAPI generator reads it without running the
+ * plugin, as it reads every schema a route declares.
  */
+export declare const HelloResponse: import("@sinclair/typebox").TObject<{
+    message: import("@sinclair/typebox").TString;
+    hookResults: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnknown>;
+}>;
 export default class HelloWorld extends DmPlugin {
     name: string;
     roles: Role[];

package/dist/src/plugins/ldap/accountLifecycle.d.ts

@@ -1,5 +1,22 @@
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
+export declare const StatusBody: import("@sinclair/typebox").TObject<{
+    state: import("@sinclair/typebox").TString;
+}>;
+export declare const PasswordBody: import("@sinclair/typebox").TObject<{
+    password: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    forceChange: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+}>;
+export declare const StatusResponse: import("@sinclair/typebox").TObject<{
+    success: import("@sinclair/typebox").TBoolean;
+    state: import("@sinclair/typebox").TString;
+}>;
+export declare const PasswordResponse: import("@sinclair/typebox").TObject<{
+    success: import("@sinclair/typebox").TBoolean;
+    generated: import("@sinclair/typebox").TBoolean;
+    forceChange: import("@sinclair/typebox").TBoolean;
+    password: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+}>;
 /**
  * Draw a password from {@link PASSWORD_ALPHABET} with a uniform distribution.
  *

package/dist/src/plugins/ldap/bulkImport.d.ts

@@ -6,85 +6,15 @@
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 import type { DM } from '../../bin';
-/**
- * Shared OpenAPI schemas surfaced by this plugin. Picked up by
- * scripts/generate-openapi.ts and merged into `components.schemas`.
- *
- * @openapi-component
- * BulkImportResult:
- *   type: object
- *   description: Summary returned after a bulk import operation.
- *   required: [success, total, created, updated, skipped, failed, errors, details]
- *   properties:
- *     success:
- *       type: boolean
- *       description: True when no fatal error aborted the import early.
- *     total:
- *       type: integer
- *       description: Total number of CSV data rows (excluding header).
- *       example: 42
- *     created:
- *       type: integer
- *       description: Entries successfully created (or that would be, in a dry run).
- *       example: 38
- *     updated:
- *       type: integer
- *       description: Existing entries updated (or that would be, in a dry run).
- *       example: 2
- *     skipped:
- *       type: integer
- *       description: Existing entries skipped because `updateExisting` was false.
- *       example: 1
- *     failed:
- *       type: integer
- *       description: Rows that caused an error.
- *       example: 1
- *     errors:
- *       type: array
- *       items:
- *         type: object
- *         required: [line, error]
- *         properties:
- *           line:
- *             type: integer
- *             description: 1-based CSV line number (2 = first data row).
- *           identifier:
- *             type: string
- *             description: Value of the main attribute for the failing row (if known).
- *           error:
- *             type: string
- *             description: Error message.
- *           code:
- *             type: string
- *             description: |
- *               `unique` or `mailDomain`, with `attribute`, `value` and
- *               `domains`, as in the `Error` answer of a single write;
- *               `forbidden` when the caller may not write the row.
- *           attribute: { type: string }
- *           value: { type: string }
- *           domains:
- *             type: array
- *             items: { type: string }
- *       example:
- *         - line: 5
- *           identifier: bob
- *           error: 'Missing required attribute: mail'
- *     details:
- *       type: object
- *       required: [duration, linesProcessed]
- *       properties:
- *         duration:
- *           type: string
- *           description: Wall-clock time for the import (e.g. `1.2s`).
- *           example: 1.2s
- *         linesProcessed:
- *           type: integer
- *           description: Total data rows attempted.
- *           example: 42
- */
 export default class LdapBulkImport extends DmPlugin {
+    static optionDefinitions: {
+        bulk_import_schemas: import("../../config/options").StringOption;
+        bulk_import_max_file_size: import("../../config/options").StringOption;
+        bulk_import_batch_size: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
+    private readonly settings;
     private resources;
     private upload;
     constructor(parent: DM);

package/dist/src/plugins/ldap/departmentSync.d.ts

@@ -12,6 +12,7 @@ import type { Hooks } from '../../hooks';
 export default class LdapDepartmentSync extends DmPlugin {
     name: string;
     roles: Role[];
+    private readonly settings;
     private linkAttr;
     private pathAttr;
     constructor(server: DM);