ldap-rest 1.2.1 → 2.0.0

package/dist/src/lib/utils.d.ts

@@ -22,42 +22,7 @@ export declare function getCompiledRegex(pattern: string, flags?: string): RegEx
  * @returns The escaped string safe for use in RegExp
  */
 export declare function escapeRegex(str: string): string;
-/**
- * Run a hook under its plugin's name and its own, for the lines it logs:
- * what `launchHooks` does, for a caller walking the hooks itself.
- *
- * @param hook the registered function
- * @param fn its run
- * @returns what `fn` returns
- */
-export declare const runAsHookOwner: <T>(hook: Function, fn: () => T) => T;
-export declare const launchHooks: (hooks: Function[] | undefined, ...args: unknown[]) => Promise<void>;
-/**
- * Record the plugin a hook function belongs to.
- *
- * @param fn the registered function
- * @param plugin the plugin's instance name
- * @param hook the hook it is registered under
- */
-export declare const recordHookOwner: (fn: Function, plugin: string, hook: string) => void;
-/**
- * The plugin a hook function belongs to, and the hook it is registered
- * under, when `registerPlugin` registered it.
- *
- * @param fn a hook function
- * @returns its plugin's instance name and hook name, or undefined
- */
-export declare const hookOwner: (fn: Function) => {
-    plugin: string;
-    hook: string;
-} | undefined;
-/**
- * Whether an error is an authorization plugin's refusal, by the marker its
- * message carries: a plain `Error` wrapping it keeps the message only. Its
- * message names the branch, so the client is told `AUTHZ_REFUSED` instead.
- */
-export declare const isAuthzRefusal: (err: unknown) => boolean;
-export declare const launchHooksChained: <T>(hooks: Function[] | undefined, args: T) => Promise<T>;
+export { hookOwner, recordHookOwner, runAsHookOwner } from './hookBus';
 export declare const transformSchemas: (schemas: string | Buffer, config: Config) => string;
 /**
  * Escape special characters in LDAP filter values according to RFC 4515
@@ -190,6 +155,30 @@ export declare function parseDn(dn: string): string[];
  * @returns whether it reads as a DN
  */
 export declare function isDnSyntax(dn: string): boolean;
+/**
+ * Whether every escape in `dn` is one RFC 4514 §3 defines: an escaped
+ * special (`" + , ; < > \ # =` or a space) or a pair of hex digits.
+ *
+ * {@link parseDn} and {@link unescapeDnValue} read a DN permissively, as a
+ * directory may answer one; a DN a caller writes is held to the grammar.
+ *
+ * @param dn - The DN to check
+ * @returns whether its escapes are RFC 4514 escapes
+ */
+export declare function hasOnlyRfc4514Escapes(dn: string): boolean;
+/**
+ * Refuse a DN a client wrote when it holds an escape RFC 4514 does not
+ * define.
+ *
+ * The readers here are permissive on purpose, because they also read what a
+ * directory answers. A DN a caller sends is held to the grammar instead, so
+ * the server only ever writes a spelling the directory would produce itself.
+ *
+ * @param dn - The DN the client wrote
+ * @param what - What to name in the refusal
+ * @throws BadRequestError when an escape is not one RFC 4514 defines
+ */
+export declare function assertRfc4514Escapes(dn: string, what: string): void;
 /**
  * Extract the parent DN from a DN
  * Removes the first RDN component to get the parent branch
@@ -237,6 +226,38 @@ export declare function getRdn(dn: string): string;
  * ```
  */
 export declare function rdnValue(dn: string): string;
+/**
+ * Read the name of an entry written as a DN: the value of its first RDN when
+ * that RDN asserts `attribute` alone, under `base` when one is given.
+ *
+ * The value is decoded as {@link rdnValue} decodes it, then folded as the
+ * directory folds it ({@link foldRdnValue}): it is the naming attribute's
+ * value, the one a write puts back in `attribute=…,base`, and a caller
+ * spelling it in a way the directory considers the same name gets that name,
+ * not a second one.
+ *
+ * @param dn - The DN to read
+ * @param attribute - The attribute the first RDN must assert
+ * @param base - The branch the entry belongs to, when the DN names it whole
+ * @returns The name, or `null` when the RDN asserts another attribute, names
+ * another branch, or is no DN
+ *
+ * @example
+ * ```typescript
+ * assertedRdnValue('uid=Smith\\,John,ou=users,dc=example,dc=com', 'uid')
+ * // => 'Smith,John'
+ * ```
+ */
+export declare function assertedRdnValue(dn: string, attribute: string, base?: string): string | null;
+/**
+ * Whether `attribute=` starts `id`: the caller sent a DN rather than a bare
+ * naming value.
+ *
+ * Deciding this before `assertedRdnValue` matters: a string it refuses — a
+ * multi-valued RDN, another branch — is still a DN, and read as a bare value
+ * it would be written whole.
+ */
+export declare function namesByDn(id: string, attribute: string): boolean;
 /**
  * Check if a DN is a child of another DN
  *
@@ -254,6 +275,26 @@ export declare function rdnValue(dn: string): string;
  * ```
  */
 export declare function isChildOf(dn: string, parentDn: string): boolean;
+/**
+ * Whether `dn` names a direct child of `base`: its parent is `base`, compared
+ * as the directory compares DNs.
+ *
+ * `isChildOf` answers ancestry; this answers parent equality, which is what a
+ * route that only serves one branch requires of a DN a client writes. The
+ * comparison folds case, spacing and the escapes the directory reads, so a
+ * DN created under one spelling is addressed under another.
+ *
+ * @param dn - The DN to check
+ * @param base - The branch its parent has to be
+ * @returns True when the DN has a parent and that parent is `base`
+ *
+ * @example
+ * ```typescript
+ * isDirectChildOf('uid=x,OU=Users , dc=example,dc=com', 'ou=users,dc=example,dc=com')
+ * // => true
+ * ```
+ */
+export declare function isDirectChildOf(dn: string, base: string): boolean;
 /**
  * Teach {@link normalizeDn} the names and OIDs of attribute types: each is
  * read as the type's first name.
@@ -304,6 +345,15 @@ export declare function rdnTypes(dn: string): string[];
  * ```
  */
 export declare function normalizeDn(dn: string): string;
+/**
+ * A DN's structure normalized as {@link normalizeDn} does, with the case of
+ * its values kept.
+ *
+ * A configured expression compiled to ignore case reads a DN through this
+ * form: its values are folded as the directory folds them, but a value it
+ * captures keeps the spelling the caller wrote.
+ */
+export declare function canonicalDn(dn: string): string;
 /**
  * Whether a member DN is the placeholder a `groupOfNames` holds so it stays
  * valid with no real member (`--group-dummy-user`).
@@ -379,6 +429,20 @@ export declare function isDnInBranch(dn: string, base: string): boolean;
  * @returns true when the entry entered the trash branch
  */
 export declare function movedToTrash(trashBase: string | undefined, oldDn: string, newDn: string): boolean;
+/**
+ * Parse a directory date: an LDAP generalized time or anything `Date`
+ * understands.
+ *
+ * A generalized time (RFC 4517 section 3.3.13) is `yyyyMMddHH`, then optional
+ * minutes and seconds, an optional fraction of the last unit given, and a zone:
+ * `Z` or an offset of hours with optional minutes (`+02`, `-0530`). `Date` reads
+ * none of the shorter forms, and not an offset of bare hours, so they are
+ * computed here rather than rewritten into an ISO string it might refuse.
+ *
+ * @param raw value as stored or submitted
+ * @returns the date, or null when it cannot be read
+ */
+export declare function parseDirectoryDate(raw: AttributeValue): Date | null;
 /**
  * Wrapper for async Express route handlers to catch errors and pass them to error middleware
  * This ensures that errors in async routes are properly handled and don't crash the server

package/dist/src/lib/version.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The version of this package, read from the `package.json` that ships with
+ * it: the repository root when run from the sources, the installed package
+ * when run from the bundle. A build that moved the file elsewhere leaves it
+ * unknown rather than guessing.
+ *
+ * `start` is the directory the walk begins from; it defaults to this
+ * module's own and exists so the walk can be exercised on a fixture.
+ */
+export declare function readVersion(start?: string): string | undefined;
+/** The server's version, as its package declares it */
+export declare const SERVER_VERSION: string | undefined;

package/dist/src/plugins/auth/auth.options.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Authentication and authorization plugin options, see
+ * `docs/plugin-development/options.md`.
+ */
+import type { AuthConfig, Config } from '../../config/args';
+import { type OptionsOf } from '../../config/options';
+export declare const tokenOptions: {
+    auth_token: import("../../config/options").ArrayOption;
+};
+export type TokenOptions = OptionsOf<typeof tokenOptions>;
+export declare const fakeOptions: {
+    auth_fake_user: import("../../config/options").StringOption;
+};
+export type FakeOptions = OptionsOf<typeof fakeOptions>;
+export declare const totpOptions: {
+    auth_totp: import("../../config/options").ArrayOption;
+    auth_totp_window: import("../../config/options").NumberOption;
+    auth_totp_step: import("../../config/options").NumberOption;
+};
+export type TotpOptions = OptionsOf<typeof totpOptions>;
+export declare const hmacOptions: {
+    auth_hmac: import("../../config/options").ArrayOption;
+    auth_hmac_window: import("../../config/options").NumberOption;
+};
+export type HmacOptions = OptionsOf<typeof hmacOptions>;
+export declare const llngOptions: {
+    llng_ini: import("../../config/options").StringOption;
+    llng_username_header: import("../../config/options").StringOption;
+};
+export type LlngOptions = OptionsOf<typeof llngOptions>;
+export declare const perRouteOptions: {
+    authz_per_route: import("../../config/options").ArrayOption;
+};
+export type PerRouteOptions = OptionsOf<typeof perRouteOptions>;
+export declare const perBranchOptions: {
+    authz_per_branch_config: import("../../config/options").JsonOption<AuthConfig>;
+    authz_per_branch_cache_ttl: import("../../config/options").NumberOption;
+    ldap_group_member_attribute: import("../../config/options").StringOption;
+};
+export type PerBranchOptions = OptionsOf<typeof perBranchOptions>;
+export declare const dynamicOptions: {
+    authz_dynamic_bypass: import("../../config/options").ArrayOption;
+    authz_dynamic_base: import("../../config/options").StringOption;
+    authz_dynamic_cache_ttl: import("../../config/options").NumberOption;
+    authz_dynamic_token_attribute: import("../../config/options").StringOption;
+    authz_dynamic_config_attribute: import("../../config/options").StringOption;
+    authz_dynamic_tenant_attribute: import("../../config/options").StringOption;
+    authz_dynamic_reload_endpoint: import("../../config/options").BooleanOption;
+};
+export type DynamicOptions = OptionsOf<typeof dynamicOptions>;
+export declare const linid1Options: {
+    authz_local_admin_attribute: import("../../config/options").StringOption;
+    authz_global_branch: import("../../config/options").ArrayOption;
+    authz_global_write_branch: import("../../config/options").ArrayOption;
+    authz_global_organization: import("../../config/options").StringOption;
+};
+export type Linid1Options = OptionsOf<typeof linid1Options>;
+export declare const openidconnectOptions: {
+    oidc_server: import("../../config/options").StringOption;
+    oidc_username_claim: import("../../config/options").StringOption;
+    oidc_client_id: import("../../config/options").StringOption;
+    oidc_client_secret: import("../../config/options").StringOption;
+    base_url: import("../../config/options").StringOption;
+};
+export type OpenidconnectOptions = OptionsOf<typeof openidconnectOptions>;
+export declare const rateLimitOptions: {
+    rate_limit_window_ms: import("../../config/options").NumberOption;
+    rate_limit_max: import("../../config/options").NumberOption;
+};
+export type RateLimitOptions = OptionsOf<typeof rateLimitOptions>;
+export declare const crowdsecOptions: {
+    crowdsec_url: import("../../config/options").StringOption;
+    crowdsec_api_key: import("../../config/options").StringOption;
+    crowdsec_cache_ttl: import("../../config/options").NumberOption;
+};
+export type CrowdsecOptions = OptionsOf<typeof crowdsecOptions>;
+export declare const trustedProxyOptions: {
+    trusted_proxy: import("../../config/options").ArrayOption;
+    trusted_proxy_auth_header: import("../../config/options").StringOption;
+};
+export type TrustedProxyOptions = OptionsOf<typeof trustedProxyOptions>;
+/** The checked values for a caller that holds a Config instead of the plugin */
+export declare function totpOptionsOf(config: Config): TotpOptions;
+export declare function hmacOptionsOf(config: Config): HmacOptions;
+export declare function perBranchOptionsOf(config: Config): PerBranchOptions;
+export declare function dynamicOptionsOf(config: Config): DynamicOptions;
+export declare function rateLimitOptionsOf(config: Config): RateLimitOptions;
+export declare function crowdsecOptionsOf(config: Config): CrowdsecOptions;

package/dist/src/plugins/auth/authzDynamic.d.ts

@@ -51,6 +51,15 @@ export interface AuthzDynamicRequest extends DmRequest {
     authzToken?: TokenEntry;
 }
 export default class AuthzDynamic extends AuthBase {
+    static optionDefinitions: {
+        authz_dynamic_bypass: import("../../config/options").ArrayOption;
+        authz_dynamic_base: import("../../config/options").StringOption;
+        authz_dynamic_cache_ttl: import("../../config/options").NumberOption;
+        authz_dynamic_token_attribute: import("../../config/options").StringOption;
+        authz_dynamic_config_attribute: import("../../config/options").StringOption;
+        authz_dynamic_tenant_attribute: import("../../config/options").StringOption;
+        authz_dynamic_reload_endpoint: import("../../config/options").BooleanOption;
+    };
     name: string;
     roles: Role[];
     private tokens;
@@ -171,7 +180,7 @@ export default class AuthzDynamic extends AuthBase {
      */
     private activeToken;
     /**
-     * Throw a ForbiddenError (403) if the token cannot perform `permission` on
+     * Throw an AuthzRefusedError (403) if the token cannot perform `permission` on
      * the branch containing `branchOrDn`. Any ACL entry that is `branchOrDn`
      * itself or a parent of it (sub-branch match) qualifies.
      *

package/dist/src/plugins/auth/authzLinid1.d.ts

@@ -14,6 +14,12 @@ interface CachedPermissions {
     timestamp: number;
 }
 export default class AuthzLinid1 extends AuthzBase {
+    static optionDefinitions: {
+        authz_local_admin_attribute: import("../../config/options").StringOption;
+        authz_global_branch: import("../../config/options").ArrayOption;
+        authz_global_write_branch: import("../../config/options").ArrayOption;
+        authz_global_organization: import("../../config/options").StringOption;
+    };
     name: string;
     permissionsCache: Map<string, CachedPermissions>;
     constructor(server: DM);

package/dist/src/plugins/auth/authzPerBranch.d.ts

@@ -16,6 +16,11 @@ interface CachedGroups {
     timestamp: number;
 }
 export default class AuthzPerBranch extends AuthzBase {
+    static optionDefinitions: {
+        authz_per_branch_config: import("../../config/options").JsonOption<AuthConfig>;
+        authz_per_branch_cache_ttl: import("../../config/options").NumberOption;
+        ldap_group_member_attribute: import("../../config/options").StringOption;
+    };
     name: string;
     authConfig?: AuthConfig;
     groupCache: Map<string, CachedGroups>;
@@ -30,7 +35,11 @@ export default class AuthzPerBranch extends AuthzBase {
     /** `authConfig.groups` keyed by normalized DN, and the object it was built from. */
     private groupRulesIndex?;
     hooks: AuthzBase['hooks'] & Pick<Hooks, 'ldapadddone' | 'ldapmodifydone' | 'ldapdeletedone'>;
+    /** What the classes above declared, read once this one is constructed */
+    private readonly declaredByBase;
     constructor(server: DM);
+    /** The attribute a group lists its members in */
+    private get memberAttribute();
     /**
      * Whether a modify can change which groups a uid belongs to: it touches
      * the member attribute, or the attribute a uid is resolved by.

package/dist/src/plugins/auth/authzPerRoute.d.ts

@@ -11,6 +11,9 @@ import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 export declare function globToRegex(glob: string): RegExp;
 export default class AuthzPerRoute extends DmPlugin {
+    static optionDefinitions: {
+        authz_per_route: import("../../config/options").ArrayOption;
+    };
     name: string;
     roles: Role[];
     private rules;

package/dist/src/plugins/auth/authzScope.d.ts

@@ -1,19 +1,28 @@
-/**
- * @module plugins/auth/authzScope
- * @author Xavier Guimard <xguimard@linagora.com>
- *
- * Tells a client what the signed-in administrator may actually do, before it
- * offers them a button that will fail.
- *
- * In a local-administration model the scope *is* the interface: a manager
- * administers a few branches of the tree and nothing else, and an application
- * that cannot name those branches leaves them guessing. This endpoint answers
- * both halves — which branches, and which entities can be created in them —
- * by asking the authorization plugin in force, whichever one that is.
- * @group Plugins
- */
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
+export declare const ScopeResponse: import("@sinclair/typebox").TObject<{
+    user: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>;
+    unrestricted: import("@sinclair/typebox").TBoolean;
+    described: import("@sinclair/typebox").TBoolean;
+    source: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>;
+    sources: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    branches: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        dn: import("@sinclair/typebox").TString;
+        read: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        write: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        delete: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        name: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        path: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    }>>;
+    transit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>>;
+    linksAnyDomain: import("@sinclair/typebox").TBoolean;
+    passwordPolicies: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+    entities: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        name: import("@sinclair/typebox").TString;
+        base: import("@sinclair/typebox").TString;
+        create: import("@sinclair/typebox").TBoolean;
+    }>>;
+}>;
 export default class AuthzScope extends DmPlugin {
     name: string;
     roles: Role[];

package/dist/src/plugins/auth/crowdsec.d.ts

@@ -16,6 +16,11 @@
 import type { Express } from 'express';
 import DmPlugin, { Role } from '../../abstract/plugin';
 export default class CrowdSec extends DmPlugin {
+    static optionDefinitions: {
+        crowdsec_url: import("../../config/options").StringOption;
+        crowdsec_api_key: import("../../config/options").StringOption;
+        crowdsec_cache_ttl: import("../../config/options").NumberOption;
+    };
     name: string;
     roles: Role[];
     private apiUrl;

package/dist/src/plugins/auth/fake.d.ts

@@ -10,6 +10,9 @@ import type { Response } from 'express';
 import AuthBase, { type DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 export default class AuthFake extends AuthBase {
+    static optionDefinitions: {
+        auth_fake_user: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
     private readonly user;

package/dist/src/plugins/auth/hmac.d.ts

@@ -2,6 +2,10 @@ import type { Response } from 'express';
 import AuthBase, { type DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 export default class AuthHmac extends AuthBase {
+    static optionDefinitions: {
+        auth_hmac: import("../../config/options").ArrayOption;
+        auth_hmac_window: import("../../config/options").NumberOption;
+    };
     protected knownIdentities(): string[];
     protected identitySource(): string;
     name: string;

package/dist/src/plugins/auth/llng.d.ts

@@ -11,6 +11,10 @@ import AuthBase, { DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 type LlngHandler = typeof import('lemonldap-ng-handler');
 export default class AuthLLNG extends AuthBase {
+    static optionDefinitions: {
+        llng_ini: import("../../config/options").StringOption;
+        llng_username_header: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
     private handler?;

package/dist/src/plugins/auth/openidconnect.d.ts

@@ -4,6 +4,13 @@ import AuthBase, { DmRequest } from '../../lib/auth/base';
 import { type Role } from '../../abstract/plugin';
 import { DM } from '../../bin';
 export default class OpenIDConnect extends AuthBase {
+    static optionDefinitions: {
+        oidc_server: import("../../config/options").StringOption;
+        oidc_username_claim: import("../../config/options").StringOption;
+        oidc_client_id: import("../../config/options").StringOption;
+        oidc_client_secret: import("../../config/options").StringOption;
+        base_url: import("../../config/options").StringOption;
+    };
     name: string;
     configApiKey: string;
     roles: Role[];

package/dist/src/plugins/auth/rateLimit.d.ts

@@ -15,6 +15,10 @@
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 export default class RateLimit extends DmPlugin {
+    static optionDefinitions: {
+        rate_limit_window_ms: import("../../config/options").NumberOption;
+        rate_limit_max: import("../../config/options").NumberOption;
+    };
     name: string;
     roles: Role[];
     private store;

package/dist/src/plugins/auth/token.d.ts

@@ -9,6 +9,9 @@ import type { Response } from 'express';
 import AuthBase, { type DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 export default class AuthToken extends AuthBase {
+    static optionDefinitions: {
+        auth_token: import("../../config/options").ArrayOption;
+    };
     protected knownIdentities(): string[];
     protected identitySource(): string;
     name: string;

package/dist/src/plugins/auth/totp.d.ts

@@ -2,6 +2,11 @@ import type { Response } from 'express';
 import AuthBase, { type DmRequest } from '../../lib/auth/base';
 import type { Role } from '../../abstract/plugin';
 export default class AuthTotp extends AuthBase {
+    static optionDefinitions: {
+        auth_totp: import("../../config/options").ArrayOption;
+        auth_totp_window: import("../../config/options").NumberOption;
+        auth_totp_step: import("../../config/options").NumberOption;
+    };
     protected knownIdentities(): string[];
     protected identitySource(): string;
     name: string;

package/dist/src/plugins/auth/trustedProxy.d.ts

@@ -34,6 +34,10 @@ declare global {
     }
 }
 export default class TrustedProxy extends DmPlugin {
+    static optionDefinitions: {
+        trusted_proxy: import("../../config/options").ArrayOption;
+        trusted_proxy_auth_header: import("../../config/options").StringOption;
+    };
     name: string;
     roles: Role[];
     private trustedNetworks;

package/dist/src/plugins/bcl.d.ts

@@ -20,6 +20,9 @@ import DmPlugin from '../abstract/plugin';
 import type { DM } from '../bin';
 import type { OidcLogoutToken, OidcSessionClaims } from '../hooks';
 export default class Bcl extends DmPlugin {
+    static optionDefinitions: {
+        bcl_retention: import("../config/options").NumberOption;
+    };
     name: string;
     dependencies: {
         storage: string;

package/dist/src/plugins/bcl.options.d.ts

@@ -0,0 +1,8 @@
+/** Back-Channel Logout plugin options. */
+import type { Config } from '../config/args';
+import { type OptionsOf } from '../config/options';
+export declare const bclOptions: {
+    bcl_retention: import("../config/options").NumberOption;
+};
+export type BclOptions = OptionsOf<typeof bclOptions>;
+export declare function bclOptionsOf(config: Config): BclOptions;

package/dist/src/plugins/configApi.d.ts

@@ -10,16 +10,26 @@
  */
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../abstract/plugin';
+interface ConfigApiResponse {
+    apiPrefix: string;
+    ldapBase: string;
+    features: Record<string, unknown>;
+    /** Absent when the version could not be read at start-up */
+    version?: string;
+}
+/** The body of `GET /v1/config`, `version` left out when it is unknown. */
+export declare function configApiResponse(apiPrefix: string, ldapBase: string, features: Record<string, unknown>, version: string | undefined): ConfigApiResponse;
 /**
  * @openapi-component
  * Config:
  *   type: object
  *   description: |
- *     Aggregated server configuration. The top-level fields are always
- *     present; `features` is a dynamic map whose keys are the names of
- *     loaded plugins that declare the `configurable` role.  Each plugin
- *     contributes an arbitrary sub-object — consult the individual plugin
- *     documentation for its exact shape.
+ *     Aggregated server configuration. `apiPrefix`, `ldapBase` and
+ *     `features` are always present; `version` is present unless the server
+ *     could not read it at start-up; `features` is a dynamic map whose keys
+ *     are the names of loaded plugins that declare the `configurable` role.
+ *     Each plugin contributes an arbitrary sub-object — consult the
+ *     individual plugin documentation for its exact shape.
  *   additionalProperties: true
  *   properties:
  *     apiPrefix:
@@ -30,6 +40,13 @@ import DmPlugin, { type Role } from '../abstract/plugin';
  *       type: string
  *       description: The root LDAP suffix used by this server.
  *       example: dc=example,dc=com
+ *     version:
+ *       type: string
+ *       description: |
+ *         The server's version, as its package declares it. A client reads it
+ *         to tell an administrator the server is older than it supports; a
+ *         server that cannot tell its version leaves the field out.
+ *       example: 1.2.1
  *     features:
  *       type: object
  *       description: |
@@ -52,6 +69,7 @@ import DmPlugin, { type Role } from '../abstract/plugin';
  *   example:
  *     apiPrefix: /api
  *     ldapBase: dc=example,dc=com
+ *     version: 1.2.1
  *     features:
  *       ldapGroups:
  *         enabled: true
@@ -73,3 +91,4 @@ export default class ConfigApi extends DmPlugin {
      */
     private collectPluginConfigs;
 }
+export {};

package/dist/src/plugins/demo/helloworld.d.ts

@@ -6,26 +6,15 @@
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
 /**
- * @openapi-component
- * Hello:
- *   type: object
- *   description: Response returned by the hello-world demo endpoint.
- *   properties:
- *     message:
- *       type: string
- *       description: Static greeting string.
- *       example: Hello
- *     hookResults:
- *       type: array
- *       description: |
- *         Results collected from every function registered on the `hello`
- *         hook.  Empty when no hook listeners are installed.
- *       items: {}
- *       example: []
- *   example:
- *     message: Hello
- *     hookResults: []
+ * The answer of the hello-world endpoint.
+ *
+ * Exported because the OpenAPI generator reads it without running the
+ * plugin, as it reads every schema a route declares.
  */
+export declare const HelloResponse: import("@sinclair/typebox").TObject<{
+    message: import("@sinclair/typebox").TString;
+    hookResults: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnknown>;
+}>;
 export default class HelloWorld extends DmPlugin {
     name: string;
     roles: Role[];

package/dist/src/plugins/ldap/accountLifecycle.d.ts

@@ -1,5 +1,22 @@
 import type { Express } from 'express';
 import DmPlugin, { type Role } from '../../abstract/plugin';
+export declare const StatusBody: import("@sinclair/typebox").TObject<{
+    state: import("@sinclair/typebox").TString;
+}>;
+export declare const PasswordBody: import("@sinclair/typebox").TObject<{
+    password: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    forceChange: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+}>;
+export declare const StatusResponse: import("@sinclair/typebox").TObject<{
+    success: import("@sinclair/typebox").TBoolean;
+    state: import("@sinclair/typebox").TString;
+}>;
+export declare const PasswordResponse: import("@sinclair/typebox").TObject<{
+    success: import("@sinclair/typebox").TBoolean;
+    generated: import("@sinclair/typebox").TBoolean;
+    forceChange: import("@sinclair/typebox").TBoolean;
+    password: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+}>;
 /**
  * Draw a password from {@link PASSWORD_ALPHABET} with a uniform distribution.
  *