ldap-rest 2.0.2 → 2.0.4

package/dist/src/lib/entitySchema/validator.d.ts

@@ -1,5 +1,5 @@
-import type { AttributesList, AttributeValue, ModifyRequest } from '../ldapActions';
-import type { Schema } from '../../config/schema';
+import type { AttributesList, AttributeValue, ModifyRequest } from '../ldapActions.js';
+import type { Schema } from '../../config/schema.js';
 export interface EntityValidatorDeps {
     /**
      * Tells whether a DN names an entry. Asked as the server: a reference to
@@ -72,6 +72,27 @@ export declare class EntityValidator {
      * option, the only one a write takes, written as the directory writes it.
      */
     private schemaSpelling;
+    /**
+     * Refuse a fixed attribute a creation carries under an option. The schema
+     * forces its value under the attribute's own name, which leaves a subtype
+     * such as `l;lang-fr` as a second value of an attribute that cannot be
+     * changed. An alias or an OID (`localityName`, `2.5.4.7`) names the same
+     * attribute. A fixed attribute without a default is set at creation, so it
+     * keeps its options.
+     *
+     * @param values entry about to be created
+     * @throws BadRequestError for a fixed attribute with a default under an
+     *   option
+     */
+    private refuseFixedOptions;
+    /**
+     * The schema's definition of the attribute a name holds, through the
+     * schema's own key, an alias or an OID.
+     *
+     * @param field attribute name, option included
+     * @returns the definition, or undefined when the schema does not declare it
+     */
+    private declaredAttribute;
     /**
      * Drop, in place, the keys a creation or an `add` carries with `null` or
      * `undefined` under a name the schema does not declare. A declared

package/dist/src/lib/expressFormatedResponses.d.ts

@@ -1,6 +1,6 @@
 import type { Request, Response } from 'express';
 import type winston from 'winston';
-import { type Refusal } from './errors';
+import { type Refusal } from './errors.js';
 /**
  * Install the logger, or remove it: a test restores the state it found,
  * which before any `DM` is none.

package/dist/src/lib/health.d.ts

@@ -1,5 +1,5 @@
 import type { Express } from 'express';
-import type { MaybePromise } from '../hooks';
+import type { MaybePromise } from '../hooks.js';
 /** What a plugin answers about the resources it depends on */
 export type HealthStatus = 'ok' | 'degraded';
 /** The paths of the two probes, served before authentication */

package/dist/src/lib/hookBus.d.ts

@@ -9,7 +9,7 @@
  *
  * @see docs/plugin-development/hooks.md
  */
-import type { Hooks } from '../hooks';
+import type { Hooks } from '../hooks.js';
 export type HookFn = Function;
 /** A promise, or the value itself */
 type Settled<T> = T extends Promise<infer P> ? P : T;

package/dist/src/lib/ldap/schema.d.ts

@@ -4,8 +4,8 @@
  * write needs.
  */
 import type { SearchOptions, SearchResult } from 'ldapts';
-import type { AttributesList, ModifyRequest } from '../ldapActions';
-import { SchemaIndex } from '../ldapSchema';
+import type { AttributesList, ModifyRequest } from '../ldapActions.js';
+import { SchemaIndex } from '../ldapSchema.js';
 export interface SchemaLogger {
     info(message: string): void;
     warn(message: string): void;

package/dist/src/lib/ldapActions.d.ts

@@ -6,11 +6,11 @@ import type { Request } from 'express';
 import type { SearchResult, SearchOptions } from 'ldapts';
 import type winston from 'winston';
 import pLimit from 'p-limit';
-import { type Config } from '../config/args';
-import { type DM } from '../bin';
-import type { Hooks } from '../hooks';
-import { type ChangeContext } from './changeContext';
-import type { SchemaIndex } from './ldapSchema';
+import { type Config } from '../config/args.js';
+import { type DM } from '../bin/index.js';
+import type { Hooks } from '../hooks.js';
+import { type ChangeContext } from './changeContext.js';
+import type { SchemaIndex } from './ldapSchema.js';
 export type AttributeValue = Buffer | Buffer[] | string[] | string;
 export type AttributesList = Record<string, AttributeValue>;
 export type LdapList = Record<string, AttributesList>;

package/dist/src/lib/mailDomains.d.ts

@@ -6,7 +6,7 @@
  * each naming its domain in an attribute.
  * @group Libraries
  */
-import type { DM } from '../bin';
+import type { DM } from '../bin/index.js';
 /** Where mail domain entries live, and the attribute naming their domain */
 export interface DomainBranch {
     base: string;

package/dist/src/lib/parseConfig.d.ts

@@ -3,7 +3,7 @@
  * Order: default < env < cli
  * @author Xavier Guimard <xguimard@linagora.com>
  */
-import type { Config } from '../config/args';
+import type { Config } from '../config/args.js';
 export type ConfigTemplate = ConfigEntry[];
 export type ArrayKind = 'identifiers' | 'dns' | 'phrases';
 export type ConfigEntry = [

package/dist/src/lib/schemaFile.d.ts

@@ -1,4 +1,4 @@
-import type { Config } from '../bin';
+import type { Config } from '../bin/index.js';
 /** Directory of the schemas shipped with LDAP-Rest, whatever --schemas-path says */
 export declare const shippedSchemasPath: string;
 /** Prefix of an `extends` naming a shipped schema, as `ldap-rest:twake/users.json` */

package/dist/src/lib/staticFiles.d.ts

@@ -3,7 +3,7 @@
  * announce it
  * @module lib/staticFiles
  */
-import type { DM } from '../bin';
+import type { DM } from '../bin/index.js';
 /** A static plugin, as another plugin asks it where it serves a file */
 export interface StaticFiles {
     schemaUrlOf(file: string): string | undefined;

package/dist/src/lib/storage/store.d.ts

@@ -26,7 +26,7 @@
  * @group Libraries
  */
 import type winston from 'winston';
-import type { HealthStatus } from '../health';
+import type { HealthStatus } from '../health.js';
 /** What a backend keeps: a value, and when it stops counting. */
 export interface StoredRecord {
     value: string;

package/dist/src/lib/utils.d.ts

@@ -3,8 +3,8 @@
  * @author Xavier Guimard <xguimard@linagora.com>
  */
 import type { Request, Response, NextFunction, RequestHandler } from 'express';
-import type { Config } from '../bin';
-import type { AttributeValue } from './ldapActions';
+import type { Config } from '../bin/index.js';
+import type { AttributeValue } from './ldapActions.js';
 /**
  * Get a compiled RegExp from cache, or compile and cache it
  * This avoids recompiling the same regex patterns repeatedly
@@ -22,7 +22,7 @@ export declare function getCompiledRegex(pattern: string, flags?: string): RegEx
  * @returns The escaped string safe for use in RegExp
  */
 export declare function escapeRegex(str: string): string;
-export { hookOwner, recordHookOwner, runAsHookOwner } from './hookBus';
+export { hookOwner, recordHookOwner, runAsHookOwner } from './hookBus.js';
 export declare const transformSchemas: (schemas: string | Buffer, config: Config) => string;
 /**
  * Escape special characters in LDAP filter values according to RFC 4515

package/dist/src/logger/winston.d.ts

@@ -1,5 +1,5 @@
 import winston from 'winston';
-import { Config } from '../bin';
+import { Config } from '../bin/index.js';
 declare module 'winston' {
     interface Logger {
         notice: winston.LeveledLogMethod;

package/dist/src/plugins/auth/auth.options.d.ts

@@ -2,81 +2,82 @@
  * Authentication and authorization plugin options, see
  * `docs/plugin-development/options.md`.
  */
-import type { AuthConfig, Config } from '../../config/args';
-import { type OptionsOf } from '../../config/options';
+import type { AuthConfig, Config } from '../../config/args.js';
+import { type OptionsOf } from '../../config/options.js';
 export declare const tokenOptions: {
-    auth_token: import("../../config/options").ArrayOption;
+    auth_token: import("../../config/options.js").ArrayOption;
 };
 export type TokenOptions = OptionsOf<typeof tokenOptions>;
 export declare const fakeOptions: {
-    auth_fake_user: import("../../config/options").StringOption;
+    auth_fake_user: import("../../config/options.js").StringOption;
 };
 export type FakeOptions = OptionsOf<typeof fakeOptions>;
 export declare const totpOptions: {
-    auth_totp: import("../../config/options").ArrayOption;
-    auth_totp_window: import("../../config/options").NumberOption;
-    auth_totp_step: import("../../config/options").NumberOption;
+    auth_totp: import("../../config/options.js").ArrayOption;
+    auth_totp_window: import("../../config/options.js").NumberOption;
+    auth_totp_step: import("../../config/options.js").NumberOption;
 };
 export type TotpOptions = OptionsOf<typeof totpOptions>;
 export declare const hmacOptions: {
-    auth_hmac: import("../../config/options").ArrayOption;
-    auth_hmac_window: import("../../config/options").NumberOption;
+    auth_hmac: import("../../config/options.js").ArrayOption;
+    auth_hmac_window: import("../../config/options.js").NumberOption;
 };
 export type HmacOptions = OptionsOf<typeof hmacOptions>;
 export declare const llngOptions: {
-    llng_ini: import("../../config/options").StringOption;
-    llng_username_header: import("../../config/options").StringOption;
+    llng_ini: import("../../config/options.js").StringOption;
+    llng_username_header: import("../../config/options.js").StringOption;
 };
 export type LlngOptions = OptionsOf<typeof llngOptions>;
 export declare const perRouteOptions: {
-    authz_per_route: import("../../config/options").ArrayOption;
+    authz_per_route: import("../../config/options.js").ArrayOption;
 };
 export type PerRouteOptions = OptionsOf<typeof perRouteOptions>;
 export declare const perBranchOptions: {
-    authz_per_branch_config: import("../../config/options").JsonOption<AuthConfig>;
-    authz_per_branch_cache_ttl: import("../../config/options").NumberOption;
-    ldap_group_member_attribute: import("../../config/options").StringOption;
+    authz_per_branch_config: import("../../config/options.js").JsonOption<AuthConfig>;
+    authz_per_branch_cache_ttl: import("../../config/options.js").NumberOption;
+    ldap_group_member_attribute: import("../../config/options.js").StringOption;
 };
 export type PerBranchOptions = OptionsOf<typeof perBranchOptions>;
 export declare const dynamicOptions: {
-    authz_dynamic_bypass: import("../../config/options").ArrayOption;
-    authz_dynamic_base: import("../../config/options").StringOption;
-    authz_dynamic_cache_ttl: import("../../config/options").NumberOption;
-    authz_dynamic_token_attribute: import("../../config/options").StringOption;
-    authz_dynamic_config_attribute: import("../../config/options").StringOption;
-    authz_dynamic_tenant_attribute: import("../../config/options").StringOption;
-    authz_dynamic_reload_endpoint: import("../../config/options").BooleanOption;
+    authz_dynamic_bypass: import("../../config/options.js").ArrayOption;
+    authz_dynamic_base: import("../../config/options.js").StringOption;
+    authz_dynamic_cache_ttl: import("../../config/options.js").NumberOption;
+    authz_dynamic_token_attribute: import("../../config/options.js").StringOption;
+    authz_dynamic_config_attribute: import("../../config/options.js").StringOption;
+    authz_dynamic_tenant_attribute: import("../../config/options.js").StringOption;
+    authz_dynamic_reload_endpoint: import("../../config/options.js").BooleanOption;
 };
 export type DynamicOptions = OptionsOf<typeof dynamicOptions>;
 export declare const linid1Options: {
-    authz_local_admin_attribute: import("../../config/options").StringOption;
-    authz_global_branch: import("../../config/options").ArrayOption;
-    authz_global_write_branch: import("../../config/options").ArrayOption;
-    authz_global_organization: import("../../config/options").StringOption;
+    authz_local_admin_attribute: import("../../config/options.js").StringOption;
+    authz_global_branch: import("../../config/options.js").ArrayOption;
+    authz_global_write_branch: import("../../config/options.js").ArrayOption;
+    authz_global_organization: import("../../config/options.js").StringOption;
 };
 export type Linid1Options = OptionsOf<typeof linid1Options>;
 export declare const openidconnectOptions: {
-    oidc_server: import("../../config/options").StringOption;
-    oidc_username_claim: import("../../config/options").StringOption;
-    oidc_client_id: import("../../config/options").StringOption;
-    oidc_client_secret: import("../../config/options").StringOption;
-    base_url: import("../../config/options").StringOption;
+    oidc_server: import("../../config/options.js").StringOption;
+    oidc_username_claim: import("../../config/options.js").StringOption;
+    oidc_client_id: import("../../config/options.js").StringOption;
+    oidc_client_secret: import("../../config/options.js").StringOption;
+    base_url: import("../../config/options.js").StringOption;
+    oidc_logout_origins: import("../../config/options.js").ArrayOption;
 };
 export type OpenidconnectOptions = OptionsOf<typeof openidconnectOptions>;
 export declare const rateLimitOptions: {
-    rate_limit_window_ms: import("../../config/options").NumberOption;
-    rate_limit_max: import("../../config/options").NumberOption;
+    rate_limit_window_ms: import("../../config/options.js").NumberOption;
+    rate_limit_max: import("../../config/options.js").NumberOption;
 };
 export type RateLimitOptions = OptionsOf<typeof rateLimitOptions>;
 export declare const crowdsecOptions: {
-    crowdsec_url: import("../../config/options").StringOption;
-    crowdsec_api_key: import("../../config/options").StringOption;
-    crowdsec_cache_ttl: import("../../config/options").NumberOption;
+    crowdsec_url: import("../../config/options.js").StringOption;
+    crowdsec_api_key: import("../../config/options.js").StringOption;
+    crowdsec_cache_ttl: import("../../config/options.js").NumberOption;
 };
 export type CrowdsecOptions = OptionsOf<typeof crowdsecOptions>;
 export declare const trustedProxyOptions: {
-    trusted_proxy: import("../../config/options").ArrayOption;
-    trusted_proxy_auth_header: import("../../config/options").StringOption;
+    trusted_proxy: import("../../config/options.js").ArrayOption;
+    trusted_proxy_auth_header: import("../../config/options.js").StringOption;
 };
 export type TrustedProxyOptions = OptionsOf<typeof trustedProxyOptions>;
 /** The checked values for a caller that holds a Config instead of the plugin */

package/dist/src/plugins/auth/authzDynamic.d.ts

@@ -25,10 +25,10 @@
  * `ou=users,ou=acme`).
  */
 import type { Express, Response } from 'express';
-import { type Role } from '../../abstract/plugin';
-import type { DM } from '../../bin';
-import AuthBase, { type DmRequest } from '../../lib/auth/base';
-import type { Hooks } from '../../hooks';
+import { type Role } from '../../abstract/plugin.js';
+import type { DM } from '../../bin/index.js';
+import AuthBase, { type DmRequest } from '../../lib/auth/base.js';
+import type { Hooks } from '../../hooks.js';
 export interface BranchAcl {
     dn: string;
     read?: boolean;
@@ -52,13 +52,13 @@ export interface AuthzDynamicRequest extends DmRequest {
 }
 export default class AuthzDynamic extends AuthBase {
     static optionDefinitions: {
-        authz_dynamic_bypass: import("../../config/options").ArrayOption;
-        authz_dynamic_base: import("../../config/options").StringOption;
-        authz_dynamic_cache_ttl: import("../../config/options").NumberOption;
-        authz_dynamic_token_attribute: import("../../config/options").StringOption;
-        authz_dynamic_config_attribute: import("../../config/options").StringOption;
-        authz_dynamic_tenant_attribute: import("../../config/options").StringOption;
-        authz_dynamic_reload_endpoint: import("../../config/options").BooleanOption;
+        authz_dynamic_bypass: import("../../config/options.js").ArrayOption;
+        authz_dynamic_base: import("../../config/options.js").StringOption;
+        authz_dynamic_cache_ttl: import("../../config/options.js").NumberOption;
+        authz_dynamic_token_attribute: import("../../config/options.js").StringOption;
+        authz_dynamic_config_attribute: import("../../config/options.js").StringOption;
+        authz_dynamic_tenant_attribute: import("../../config/options.js").StringOption;
+        authz_dynamic_reload_endpoint: import("../../config/options.js").BooleanOption;
     };
     name: string;
     roles: Role[];
@@ -80,6 +80,19 @@ export default class AuthzDynamic extends AuthBase {
      * does not poison the cache — the previous snapshot stays in use.
      */
     reload(): Promise<void>;
+    /**
+     * Read one ACL flag of a token's JSON.
+     *
+     * Only the boolean `true` grants the permission: every string is truthy,
+     * `"false"`, `"no"` and `"0"` included.
+     *
+     * @param value flag as the token's JSON holds it
+     * @param flag flag name, for the warning
+     * @param branch branch the flag applies to
+     * @param tokenDn DN of the token entry
+     * @returns whether the permission is granted
+     */
+    private aclFlag;
     /**
      * Ensure the cache is fresh (blocks if reloading).
      *

package/dist/src/plugins/auth/authzLinid1.d.ts

@@ -6,19 +6,19 @@
  * Grants permissions to users referenced in organization's twakeLocalAdminLink
  * @group Plugins
  */
-import type { DM } from '../../bin';
-import type { BranchPermissions } from '../../config/args';
-import AuthzBase from '../../lib/authz/base';
+import type { DM } from '../../bin/index.js';
+import type { BranchPermissions } from '../../config/args.js';
+import AuthzBase from '../../lib/authz/base.js';
 interface CachedPermissions {
     branches: Map<string, BranchPermissions>;
     timestamp: number;
 }
 export default class AuthzLinid1 extends AuthzBase {
     static optionDefinitions: {
-        authz_local_admin_attribute: import("../../config/options").StringOption;
-        authz_global_branch: import("../../config/options").ArrayOption;
-        authz_global_write_branch: import("../../config/options").ArrayOption;
-        authz_global_organization: import("../../config/options").StringOption;
+        authz_local_admin_attribute: import("../../config/options.js").StringOption;
+        authz_global_branch: import("../../config/options.js").ArrayOption;
+        authz_global_write_branch: import("../../config/options.js").ArrayOption;
+        authz_global_organization: import("../../config/options.js").StringOption;
     };
     name: string;
     permissionsCache: Map<string, CachedPermissions>;

package/dist/src/plugins/auth/authzPerBranch.d.ts

@@ -6,20 +6,20 @@
  * Supports user and group-based permissions with configurable defaults
  * @group Plugins
  */
-import type { DM } from '../../bin';
-import type { Hooks } from '../../hooks';
-import type { AuthConfig, BranchPermissions } from '../../config/args';
-import type { DmRequest } from '../../lib/auth/base';
-import AuthzBase from '../../lib/authz/base';
+import type { DM } from '../../bin/index.js';
+import type { Hooks } from '../../hooks.js';
+import type { AuthConfig, BranchPermissions } from '../../config/args.js';
+import type { DmRequest } from '../../lib/auth/base.js';
+import AuthzBase from '../../lib/authz/base.js';
 interface CachedGroups {
     groups: string[];
     timestamp: number;
 }
 export default class AuthzPerBranch extends AuthzBase {
     static optionDefinitions: {
-        authz_per_branch_config: import("../../config/options").JsonOption<AuthConfig>;
-        authz_per_branch_cache_ttl: import("../../config/options").NumberOption;
-        ldap_group_member_attribute: import("../../config/options").StringOption;
+        authz_per_branch_config: import("../../config/options.js").JsonOption<AuthConfig>;
+        authz_per_branch_cache_ttl: import("../../config/options.js").NumberOption;
+        ldap_group_member_attribute: import("../../config/options.js").StringOption;
     };
     name: string;
     authConfig?: AuthConfig;

package/dist/src/plugins/auth/authzPerRoute.d.ts

@@ -8,11 +8,11 @@
  * @author Xavier Guimard <xguimard@linagora.com>
  */
 import type { Express } from 'express';
-import DmPlugin, { type Role } from '../../abstract/plugin';
+import DmPlugin, { type Role } from '../../abstract/plugin.js';
 export declare function globToRegex(glob: string): RegExp;
 export default class AuthzPerRoute extends DmPlugin {
     static optionDefinitions: {
-        authz_per_route: import("../../config/options").ArrayOption;
+        authz_per_route: import("../../config/options.js").ArrayOption;
     };
     name: string;
     roles: Role[];

package/dist/src/plugins/auth/authzScope.d.ts

@@ -1,5 +1,5 @@
 import type { Express } from 'express';
-import DmPlugin, { type Role } from '../../abstract/plugin';
+import DmPlugin, { type Role } from '../../abstract/plugin.js';
 export declare const ScopeResponse: import("@sinclair/typebox").TObject<{
     user: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>;
     unrestricted: import("@sinclair/typebox").TBoolean;

package/dist/src/plugins/auth/crowdsec.d.ts

@@ -14,12 +14,12 @@
  * @author Xavier Guimard <xguimard@linagora.com>
  */
 import type { Express } from 'express';
-import DmPlugin, { Role } from '../../abstract/plugin';
+import DmPlugin, { Role } from '../../abstract/plugin.js';
 export default class CrowdSec extends DmPlugin {
     static optionDefinitions: {
-        crowdsec_url: import("../../config/options").StringOption;
-        crowdsec_api_key: import("../../config/options").StringOption;
-        crowdsec_cache_ttl: import("../../config/options").NumberOption;
+        crowdsec_url: import("../../config/options.js").StringOption;
+        crowdsec_api_key: import("../../config/options.js").StringOption;
+        crowdsec_cache_ttl: import("../../config/options.js").NumberOption;
     };
     name: string;
     roles: Role[];

package/dist/src/plugins/auth/fake.d.ts

@@ -7,11 +7,11 @@
  * @group Plugins
  */
 import type { Response } from 'express';
-import AuthBase, { type DmRequest } from '../../lib/auth/base';
-import type { Role } from '../../abstract/plugin';
+import AuthBase, { type DmRequest } from '../../lib/auth/base.js';
+import type { Role } from '../../abstract/plugin.js';
 export default class AuthFake extends AuthBase {
     static optionDefinitions: {
-        auth_fake_user: import("../../config/options").StringOption;
+        auth_fake_user: import("../../config/options.js").StringOption;
     };
     name: string;
     roles: Role[];

package/dist/src/plugins/auth/hmac.d.ts

@@ -1,10 +1,10 @@
 import type { Response } from 'express';
-import AuthBase, { type DmRequest } from '../../lib/auth/base';
-import type { Role } from '../../abstract/plugin';
+import AuthBase, { type DmRequest } from '../../lib/auth/base.js';
+import type { Role } from '../../abstract/plugin.js';
 export default class AuthHmac extends AuthBase {
     static optionDefinitions: {
-        auth_hmac: import("../../config/options").ArrayOption;
-        auth_hmac_window: import("../../config/options").NumberOption;
+        auth_hmac: import("../../config/options.js").ArrayOption;
+        auth_hmac_window: import("../../config/options.js").NumberOption;
     };
     protected knownIdentities(): string[];
     protected identitySource(): string;

package/dist/src/plugins/auth/llng.d.ts

@@ -7,13 +7,28 @@
  * This plugin enables authentication and authorization using Lemonldap::NG.
  */
 import type { Express, Response } from 'express';
-import AuthBase, { DmRequest } from '../../lib/auth/base';
-import type { Role } from '../../abstract/plugin';
-type LlngHandler = typeof import('lemonldap-ng-handler');
+import AuthBase, { DmRequest } from '../../lib/auth/base.js';
+import type { Role } from '../../abstract/plugin.js';
+/**
+ * The part of `lemonldap-ng-handler` this plugin uses. The ambient
+ * declaration in src/types/lemonldap-ng-handler.d.ts gives the module the
+ * same shape for the build; this interface is what the published declaration
+ * names, so a consumer without the package still sees it.
+ */
+interface LlngHandler {
+    init(args: {
+        configStorage?: {
+            confFile?: string;
+            [key: string]: unknown;
+        };
+        type?: string;
+    }): Promise<unknown>;
+    run(req: DmRequest, res: Response, next: () => void): void;
+}
 export default class AuthLLNG extends AuthBase {
     static optionDefinitions: {
-        llng_ini: import("../../config/options").StringOption;
-        llng_username_header: import("../../config/options").StringOption;
+        llng_ini: import("../../config/options.js").StringOption;
+        llng_username_header: import("../../config/options.js").StringOption;
     };
     name: string;
     roles: Role[];

package/dist/src/plugins/auth/openidconnect.d.ts

@@ -1,15 +1,16 @@
 import type { Express, Response } from 'express';
 import type { ConfigParams } from 'express-openid-connect';
-import AuthBase, { DmRequest } from '../../lib/auth/base';
-import { type Role } from '../../abstract/plugin';
-import { DM } from '../../bin';
+import AuthBase, { DmRequest } from '../../lib/auth/base.js';
+import { type Role } from '../../abstract/plugin.js';
+import { DM } from '../../bin/index.js';
 export default class OpenIDConnect extends AuthBase {
     static optionDefinitions: {
-        oidc_server: import("../../config/options").StringOption;
-        oidc_username_claim: import("../../config/options").StringOption;
-        oidc_client_id: import("../../config/options").StringOption;
-        oidc_client_secret: import("../../config/options").StringOption;
-        base_url: import("../../config/options").StringOption;
+        oidc_server: import("../../config/options.js").StringOption;
+        oidc_username_claim: import("../../config/options.js").StringOption;
+        oidc_client_id: import("../../config/options.js").StringOption;
+        oidc_client_secret: import("../../config/options.js").StringOption;
+        base_url: import("../../config/options.js").StringOption;
+        oidc_logout_origins: import("../../config/options.js").ArrayOption;
     };
     name: string;
     configApiKey: string;
@@ -78,6 +79,26 @@ export default class OpenIDConnect extends AuthBase {
      * @param app the express application
      */
     api(app: Express): void;
+    /**
+     * Origins a logout may come from: `--base-url`, and the consoles named in
+     * `--oidc-logout-origins` when they are served elsewhere.
+     */
+    private logoutOrigins;
+    /**
+     * Whether a browser reports the request as coming from another site.
+     *
+     * `/logout` is a `GET` a link reaches, so a page on another site can end
+     * the session without a token. The origin is what tells the caller's own
+     * link apart from someone else's. `Sec-Fetch-Site` answers where a browser
+     * sends it; `Origin` and `Referer` cover the others, and name the console
+     * when it is served from another origin. A client sending none of them — a
+     * script, a server — is not a browser navigating from another site, and is
+     * let through.
+     *
+     * @param req incoming request
+     * @returns true when the request comes from another site
+     */
+    private crossSite;
     /**
      * Read the session, then require one.
      *

package/dist/src/plugins/auth/rateLimit.d.ts

@@ -13,11 +13,11 @@
  * @author Xavier Guimard <xguimard@linagora.com>
  */
 import type { Express } from 'express';
-import DmPlugin, { type Role } from '../../abstract/plugin';
+import DmPlugin, { type Role } from '../../abstract/plugin.js';
 export default class RateLimit extends DmPlugin {
     static optionDefinitions: {
-        rate_limit_window_ms: import("../../config/options").NumberOption;
-        rate_limit_max: import("../../config/options").NumberOption;
+        rate_limit_window_ms: import("../../config/options.js").NumberOption;
+        rate_limit_max: import("../../config/options.js").NumberOption;
     };
     name: string;
     roles: Role[];

package/dist/src/plugins/auth/token.d.ts

@@ -6,11 +6,11 @@
  * @group Plugins
  */
 import type { Response } from 'express';
-import AuthBase, { type DmRequest } from '../../lib/auth/base';
-import type { Role } from '../../abstract/plugin';
+import AuthBase, { type DmRequest } from '../../lib/auth/base.js';
+import type { Role } from '../../abstract/plugin.js';
 export default class AuthToken extends AuthBase {
     static optionDefinitions: {
-        auth_token: import("../../config/options").ArrayOption;
+        auth_token: import("../../config/options.js").ArrayOption;
     };
     protected knownIdentities(): string[];
     protected identitySource(): string;

package/dist/src/plugins/auth/totp.d.ts

@@ -1,11 +1,11 @@
 import type { Response } from 'express';
-import AuthBase, { type DmRequest } from '../../lib/auth/base';
-import type { Role } from '../../abstract/plugin';
+import AuthBase, { type DmRequest } from '../../lib/auth/base.js';
+import type { Role } from '../../abstract/plugin.js';
 export default class AuthTotp extends AuthBase {
     static optionDefinitions: {
-        auth_totp: import("../../config/options").ArrayOption;
-        auth_totp_window: import("../../config/options").NumberOption;
-        auth_totp_step: import("../../config/options").NumberOption;
+        auth_totp: import("../../config/options.js").ArrayOption;
+        auth_totp_window: import("../../config/options.js").NumberOption;
+        auth_totp_step: import("../../config/options.js").NumberOption;
     };
     protected knownIdentities(): string[];
     protected identitySource(): string;