ldap-rest 2.0.2 → 2.0.4

package/dist/src/plugins/twake/tombstone.d.ts

@@ -1,7 +1,7 @@
 import type { Express, Request } from 'express';
-import DmPlugin, { type Role } from '../../abstract/plugin';
-import type { DM } from '../../bin';
-import type { Hooks } from '../../hooks';
+import DmPlugin, { type Role } from '../../abstract/plugin.js';
+import type { DM } from '../../bin/index.js';
+import type { Hooks } from '../../hooks.js';
 export declare const EraseTombstoneBody: import("@sinclair/typebox").TObject<{
     dn: import("@sinclair/typebox").TString;
     force: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
@@ -11,13 +11,13 @@ export declare const EraseTombstoneResponse: import("@sinclair/typebox").TObject
 }>;
 export default class TwakeTombstone extends DmPlugin {
     static optionDefinitions: {
-        twake_tombstone_dn: import("../../config/options").ArrayOption;
-        twake_tombstone_default_reason: import("../../config/options").StringOption;
-        twake_tombstone_reason_header: import("../../config/options").StringOption;
-        twake_tombstone_reasons: import("../../config/options").ArrayOption;
-        twake_tombstone_clear_attributes: import("../../config/options").ArrayOption;
-        twake_tombstone_erase_min_age: import("../../config/options").NumberOption;
-        twake_tombstone_group_bases: import("../../config/options").ArrayOption;
+        twake_tombstone_dn: import("../../config/options.js").ArrayOption;
+        twake_tombstone_default_reason: import("../../config/options.js").StringOption;
+        twake_tombstone_reason_header: import("../../config/options.js").StringOption;
+        twake_tombstone_reasons: import("../../config/options.js").ArrayOption;
+        twake_tombstone_clear_attributes: import("../../config/options.js").ArrayOption;
+        twake_tombstone_erase_min_age: import("../../config/options.js").NumberOption;
+        twake_tombstone_group_bases: import("../../config/options.js").ArrayOption;
     };
     name: string;
     roles: Role[];

package/dist/src/plugins/twake/twakeGroups.options.d.ts

@@ -1,19 +1,19 @@
 /**
  * Twake groups options, see `docs/plugin-development/options.md`.
  */
-import type { Config } from '../../config/args';
-import { type OptionsOf } from '../../config/options';
+import type { Config } from '../../config/args.js';
+import { type OptionsOf } from '../../config/options.js';
 export declare const twakeGroupsOptions: {
-    twake_group_base: import("../../config/options").StringOption;
-    twake_group_user_base: import("../../config/options").StringOption;
-    twake_group_organization_dn: import("../../config/options").StringOption;
-    twake_group_organization_status_attribute: import("../../config/options").StringOption;
-    twake_group_organization_deleted_value: import("../../config/options").StringOption;
-    twake_group_display_name_attribute: import("../../config/options").StringOption;
-    twake_group_color_attribute: import("../../config/options").StringOption;
-    twake_group_created_at_attribute: import("../../config/options").StringOption;
-    twake_group_max_page_limit: import("../../config/options").NumberOption;
-    twake_group_member_fields: import("../../config/options").JsonOption<{}>;
+    twake_group_base: import("../../config/options.js").StringOption;
+    twake_group_user_base: import("../../config/options.js").StringOption;
+    twake_group_organization_dn: import("../../config/options.js").StringOption;
+    twake_group_organization_status_attribute: import("../../config/options.js").StringOption;
+    twake_group_organization_deleted_value: import("../../config/options.js").StringOption;
+    twake_group_display_name_attribute: import("../../config/options.js").StringOption;
+    twake_group_color_attribute: import("../../config/options.js").StringOption;
+    twake_group_created_at_attribute: import("../../config/options.js").StringOption;
+    twake_group_max_page_limit: import("../../config/options.js").NumberOption;
+    twake_group_member_fields: import("../../config/options.js").JsonOption<{}>;
 };
 export type TwakeGroupsOptions = OptionsOf<typeof twakeGroupsOptions>;
 /** The checked values for a caller that holds a Config instead of the plugin */

package/dist/src/plugins/twake/twakeInstances.options.d.ts

@@ -1,42 +1,42 @@
 /**
  * Twake instances options, see `docs/plugin-development/options.md`.
  */
-import type { Config } from '../../config/args';
-import { type OptionsOf } from '../../config/options';
+import type { Config } from '../../config/args.js';
+import { type OptionsOf } from '../../config/options.js';
 export declare const twakeInstancesOptions: {
-    twake_instance_dn: import("../../config/options").ArrayOption;
-    twake_instance_skip_attribute: import("../../config/options").StringOption;
-    twake_instance_skip_value: import("../../config/options").StringOption;
-    twake_instance_provider: import("../../config/options").StringOption;
-    twake_instance_id: import("../../config/options").StringOption;
-    twake_instance_fqdn_attribute: import("../../config/options").StringOption;
-    twake_instance_sent_attribute: import("../../config/options").StringOption;
-    twake_instance_locale: import("../../config/options").StringOption;
-    twake_instance_timeout: import("../../config/options").NumberOption;
-    twake_instance_cloudery_url: import("../../config/options").StringOption;
-    twake_instance_cloudery_token: import("../../config/options").StringOption;
-    twake_instance_cloudery_offer: import("../../config/options").StringOption;
-    twake_instance_cloudery_domain: import("../../config/options").StringOption;
-    twake_instance_cloudery_organization_offer: import("../../config/options").StringOption;
-    twake_instance_cozy_url: import("../../config/options").StringOption;
-    twake_instance_cozy_user: import("../../config/options").StringOption;
-    twake_instance_cozy_passphrase: import("../../config/options").StringOption;
-    twake_instance_cozy_domain: import("../../config/options").StringOption;
-    twake_instance_cozy_context: import("../../config/options").StringOption;
-    twake_instance_cozy_apps: import("../../config/options").StringOption;
-    twake_instance_cozy_org_id: import("../../config/options").StringOption;
-    twake_instance_cozy_org_domain: import("../../config/options").StringOption;
-    twake_instance_auth_exchange: import("../../config/options").StringOption;
-    twake_instance_b2b_exchange: import("../../config/options").StringOption;
-    twake_instance_user_created_key: import("../../config/options").StringOption;
-    twake_instance_organization_created_key: import("../../config/options").StringOption;
-    twake_instance_workplace_created_key: import("../../config/options").StringOption;
-    twake_instance_queue: import("../../config/options").StringOption;
-    twake_instance_organization_base: import("../../config/options").StringOption;
-    twake_instance_organization_id_attribute: import("../../config/options").StringOption;
-    twake_instance_organization_domain_attribute: import("../../config/options").StringOption;
-    twake_instance_organization_name_attribute: import("../../config/options").StringOption;
-    twake_instance_organization_fqdn_attribute: import("../../config/options").StringOption;
+    twake_instance_dn: import("../../config/options.js").ArrayOption;
+    twake_instance_skip_attribute: import("../../config/options.js").StringOption;
+    twake_instance_skip_value: import("../../config/options.js").StringOption;
+    twake_instance_provider: import("../../config/options.js").StringOption;
+    twake_instance_id: import("../../config/options.js").StringOption;
+    twake_instance_fqdn_attribute: import("../../config/options.js").StringOption;
+    twake_instance_sent_attribute: import("../../config/options.js").StringOption;
+    twake_instance_locale: import("../../config/options.js").StringOption;
+    twake_instance_timeout: import("../../config/options.js").NumberOption;
+    twake_instance_cloudery_url: import("../../config/options.js").StringOption;
+    twake_instance_cloudery_token: import("../../config/options.js").StringOption;
+    twake_instance_cloudery_offer: import("../../config/options.js").StringOption;
+    twake_instance_cloudery_domain: import("../../config/options.js").StringOption;
+    twake_instance_cloudery_organization_offer: import("../../config/options.js").StringOption;
+    twake_instance_cozy_url: import("../../config/options.js").StringOption;
+    twake_instance_cozy_user: import("../../config/options.js").StringOption;
+    twake_instance_cozy_passphrase: import("../../config/options.js").StringOption;
+    twake_instance_cozy_domain: import("../../config/options.js").StringOption;
+    twake_instance_cozy_context: import("../../config/options.js").StringOption;
+    twake_instance_cozy_apps: import("../../config/options.js").StringOption;
+    twake_instance_cozy_org_id: import("../../config/options.js").StringOption;
+    twake_instance_cozy_org_domain: import("../../config/options.js").StringOption;
+    twake_instance_auth_exchange: import("../../config/options.js").StringOption;
+    twake_instance_b2b_exchange: import("../../config/options.js").StringOption;
+    twake_instance_user_created_key: import("../../config/options.js").StringOption;
+    twake_instance_organization_created_key: import("../../config/options.js").StringOption;
+    twake_instance_workplace_created_key: import("../../config/options.js").StringOption;
+    twake_instance_queue: import("../../config/options.js").StringOption;
+    twake_instance_organization_base: import("../../config/options.js").StringOption;
+    twake_instance_organization_id_attribute: import("../../config/options.js").StringOption;
+    twake_instance_organization_domain_attribute: import("../../config/options.js").StringOption;
+    twake_instance_organization_name_attribute: import("../../config/options.js").StringOption;
+    twake_instance_organization_fqdn_attribute: import("../../config/options.js").StringOption;
 };
 export type TwakeInstancesOptions = OptionsOf<typeof twakeInstancesOptions>;
 /** The checked values for a caller that holds a Config instead of the plugin */

package/dist/src/plugins/twake/twakeLifecycle.options.d.ts

@@ -2,19 +2,19 @@
  * Account lifecycle options, shared by the Twake lifecycle plugins. See
  * `docs/plugin-development/options.md`.
  */
-import type { Config } from '../../config/args';
-import { type OptionsOf } from '../../config/options';
+import type { Config } from '../../config/args.js';
+import { type OptionsOf } from '../../config/options.js';
 export declare const twakeLifecycleOptions: {
-    twake_lifecycle_role_attribute: import("../../config/options").StringOption;
-    twake_lifecycle_lock_attribute: import("../../config/options").StringOption;
-    twake_lifecycle_lock_value: import("../../config/options").StringOption;
-    twake_lifecycle_deleted_attribute: import("../../config/options").StringOption;
-    twake_lifecycle_deleted_value: import("../../config/options").StringOption;
-    twake_lifecycle_deleted_at_attribute: import("../../config/options").StringOption;
-    twake_lifecycle_deleted_at_format: import("../../config/options").StringOption;
-    twake_lifecycle_reason_attribute: import("../../config/options").StringOption;
-    twake_lifecycle_rules: import("../../config/options").StringOption;
-    twake_lifecycle_member_attribute: import("../../config/options").StringOption;
+    twake_lifecycle_role_attribute: import("../../config/options.js").StringOption;
+    twake_lifecycle_lock_attribute: import("../../config/options.js").StringOption;
+    twake_lifecycle_lock_value: import("../../config/options.js").StringOption;
+    twake_lifecycle_deleted_attribute: import("../../config/options.js").StringOption;
+    twake_lifecycle_deleted_value: import("../../config/options.js").StringOption;
+    twake_lifecycle_deleted_at_attribute: import("../../config/options.js").StringOption;
+    twake_lifecycle_deleted_at_format: import("../../config/options.js").StringOption;
+    twake_lifecycle_reason_attribute: import("../../config/options.js").StringOption;
+    twake_lifecycle_rules: import("../../config/options.js").StringOption;
+    twake_lifecycle_member_attribute: import("../../config/options.js").StringOption;
 };
 export type TwakeLifecycleOptions = OptionsOf<typeof twakeLifecycleOptions>;
 /** The checked values for a caller that holds a Config instead of the plugin */

package/dist/src/plugins/twake/twakeSpaces.options.d.ts

@@ -1,18 +1,18 @@
 /**
  * Twake spaces options, see `docs/plugin-development/options.md`.
  */
-import type { Config } from '../../config/args';
-import { type OptionsOf } from '../../config/options';
+import type { Config } from '../../config/args.js';
+import { type OptionsOf } from '../../config/options.js';
 export declare const twakeSpacesOptions: {
-    twake_space_base: import("../../config/options").StringOption;
-    twake_space_class: import("../../config/options").ArrayOption;
-    twake_space_display_name_attribute: import("../../config/options").StringOption;
-    twake_space_admin_attribute: import("../../config/options").StringOption;
-    twake_space_editor_attribute: import("../../config/options").StringOption;
-    twake_space_viewer_attribute: import("../../config/options").StringOption;
-    twake_space_user_role_attribute: import("../../config/options").StringOption;
-    twake_space_exchange: import("../../config/options").StringOption;
-    twake_space_sync_queue: import("../../config/options").StringOption;
+    twake_space_base: import("../../config/options.js").StringOption;
+    twake_space_class: import("../../config/options.js").ArrayOption;
+    twake_space_display_name_attribute: import("../../config/options.js").StringOption;
+    twake_space_admin_attribute: import("../../config/options.js").StringOption;
+    twake_space_editor_attribute: import("../../config/options.js").StringOption;
+    twake_space_viewer_attribute: import("../../config/options.js").StringOption;
+    twake_space_user_role_attribute: import("../../config/options.js").StringOption;
+    twake_space_exchange: import("../../config/options.js").StringOption;
+    twake_space_sync_queue: import("../../config/options.js").StringOption;
 };
 export type TwakeSpacesOptions = OptionsOf<typeof twakeSpacesOptions>;
 /** The checked values for a caller that holds a Config instead of the plugin */

package/dist/src/plugins/twake/twakeTombstone.options.d.ts

@@ -1,16 +1,16 @@
 /**
  * Twake tombstone options, see `docs/plugin-development/options.md`.
  */
-import type { Config } from '../../config/args';
-import { type OptionsOf } from '../../config/options';
+import type { Config } from '../../config/args.js';
+import { type OptionsOf } from '../../config/options.js';
 export declare const twakeTombstoneOptions: {
-    twake_tombstone_dn: import("../../config/options").ArrayOption;
-    twake_tombstone_default_reason: import("../../config/options").StringOption;
-    twake_tombstone_reason_header: import("../../config/options").StringOption;
-    twake_tombstone_reasons: import("../../config/options").ArrayOption;
-    twake_tombstone_clear_attributes: import("../../config/options").ArrayOption;
-    twake_tombstone_erase_min_age: import("../../config/options").NumberOption;
-    twake_tombstone_group_bases: import("../../config/options").ArrayOption;
+    twake_tombstone_dn: import("../../config/options.js").ArrayOption;
+    twake_tombstone_default_reason: import("../../config/options.js").StringOption;
+    twake_tombstone_reason_header: import("../../config/options.js").StringOption;
+    twake_tombstone_reasons: import("../../config/options.js").ArrayOption;
+    twake_tombstone_clear_attributes: import("../../config/options.js").ArrayOption;
+    twake_tombstone_erase_min_age: import("../../config/options.js").NumberOption;
+    twake_tombstone_group_bases: import("../../config/options.js").ArrayOption;
 };
 export type TwakeTombstoneOptions = OptionsOf<typeof twakeTombstoneOptions>;
 /** The checked values for a caller that holds a Config instead of the plugin */

package/dist/src/plugins/weblogs.d.ts

@@ -1,5 +1,5 @@
 import type { Express, Request, Response } from 'express';
-import DmPlugin, { type Role } from '../abstract/plugin';
+import DmPlugin, { type Role } from '../abstract/plugin.js';
 declare global {
     namespace Express {
         interface Request {

package/docs/client-development/schemas/README.md

@@ -772,7 +772,12 @@ Attribute values must have the shape of their declared type, see
 
 ### Fixed Attributes
 
-Attributes with `"fixed": true` cannot be modified after creation.
+Attributes with `"fixed": true` cannot be modified after creation. A creation
+that sends one **with a default** under an option (`l;lang-fr`, or an alias
+such as `localityName;lang-fr`) is refused with `400`: the default is written
+under the attribute's own name, and the option would add a second value beside
+it. A fixed attribute without a default is set at creation and keeps its
+options.
 
 ```json
 {

package/docs/development/contracts.md

@@ -45,6 +45,28 @@ The snapshot records what the parser reads. A narrowed `choices` list, a
 raised `min` or a lowered `max` is checked when a plugin reads its options,
 not by the snapshot, and is reviewed by hand, as is a custom error `code`.
 
+## Resolution guard
+
+The published package is `"type": "module"`, so a plugin compiled with
+`moduleResolution: nodenext` resolves the declarations as Node resolves
+JavaScript: every relative specifier needs its `.js` extension. The build
+keeps them in the sources, and the declarations inherit them. TypeScript says
+nothing about a specifier it cannot resolve in `node_modules`: it reports the
+imported type as `any`, so a plugin loses type checking on the plugin API
+without a warning.
+
+`npm run lint` refuses an extensionless relative specifier under `src/` (the
+`import-x/extensions` rule), so the mistake shows up locally. `npm run
+check:declarations` then reads the built declarations for one, and type-checks
+a small `nodenext` consumer against the package entries installed with only the
+runtime dependencies: a type the declarations take from a devDependency is
+missing there too. The consumer checks the library declarations themselves, so
+a bare import they make must resolve even when the consumer names no type from
+it. The build drops the browser sources' side-effect CSS imports from the
+emitted declarations: they say nothing about the JavaScript API, and the
+consumer has no CSS module for them. The check needs a build: run `npm run
+build` first. The `test` workflow runs it after the build.
+
 ## The pull request gate
 
 The `contracts` job of `.github/workflows/contracts.yml` generates the

package/docs/presentations/en.md

@@ -432,7 +432,7 @@ docker run -p 8081:8081 ldap-rest
 ## Create a Custom Plugin
 
 ```typescript
-import DmPlugin from 'ldap-rest/plugin-abstract';
+import DmPlugin from 'ldap-rest/plugin';
 import { Hooks } from 'ldap-rest/hooks';
 
 export default class CustomPlugin extends DmPlugin {

package/docs/presentations/fr.md

@@ -432,7 +432,7 @@ docker run -p 8081:8081 ldap-rest
 ## Créer un plugin personnalisé
 
 ```typescript
-import DmPlugin from 'ldap-rest/plugin-abstract';
+import DmPlugin from 'ldap-rest/plugin';
 import { Hooks } from 'ldap-rest/hooks';
 
 export default class CustomPlugin extends DmPlugin {

package/docs/usage/configuration.md

@@ -375,6 +375,7 @@ Development only, refused with `NODE_ENV=production` — see [Fake Authenticatio
 | `--oidc-client-id`      | `DM_OIDC_CLIENT_ID`      |         | OIDC Client ID                                                                          |
 | `--oidc-client-secret`  | `DM_OIDC_CLIENT_SECRET`  |         | OIDC Client Secret                                                                      |
 | `--oidc-username-claim` | `DM_OIDC_USERNAME_CLAIM` | `sub`   | Claim naming the caller, published as `req.userName` (see [OIDC](plugins/auth/oidc.md)) |
+| `--oidc-logout-origins` | `DM_OIDC_LOGOUT_ORIGINS` | `[]`    | Other origins a console may log out from (see [OIDC](plugins/auth/oidc.md#logout))      |
 | `--base-url`            | `DM_BASE_URL`            |         | Public URL for callbacks                                                                |
 
 #### `core/bcl`

package/docs/usage/plugins/auth/authz-dynamic.md

@@ -122,7 +122,9 @@ description: {
   target DNs are compared RDN by RDN, so case, spacing, escapes, `;`
   separators and attribute-type spellings (`ou`, `2.5.4.11`, `OID.2.5.4.11`)
   do not matter; an escaped comma is part of a value, never a separator.
-- Absent flags default to `false`.
+- Only the JSON boolean `true` grants a permission. An absent flag, or one
+  written as anything else (a string such as `"false"` or `"true"`, a
+  number), is `false`; a non-boolean flag is logged as a warning.
 - `tenant` is optional; if omitted, `req.user` falls back to the value of the
   configured `tenantAttribute` (default `cn`).
 

package/docs/usage/plugins/auth/authz-linid1.md

@@ -58,11 +58,16 @@ belongs to nobody's branch, and no administrator could list or change one.
 - Listings of accounts and groups drop the entries attached to an
   organization outside the caller's branches. A single read of one answers
   `404`.
-- Entries attached to nothing — the organizations, the nomenclature values, a
-  group or an account with no `twakeDepartmentLink` — are readable by every
-  administrator: the organization tree is reference data. Writes to them are
-  judged on their parent. The tree a console draws still starts at the
-  caller's own branches: see [getOrganisationTop Hook](#getorganisationtop-hook).
+- An organization is judged by the branch it sits in. The tree under the top
+  organization carries every branch's name, description and local
+  administrators, so a listing returns the caller's branches, and a direct
+  read of another branch answers `404`. `organizations/top` still answers one
+  of their branches: see [getOrganisationTop Hook](#getorganisationtop-hook).
+- Entries attached to nothing — a nomenclature value, a group or an account
+  with no `twakeDepartmentLink` — are readable by every administrator:
+  reference data. Writes to them are judged on their parent. The transit
+  branch's own entry stays readable too: the console opens its card from the
+  scope banner.
 - A caller named in no `twakeLocalAdminLink` is refused every read (`403`)
   but the top organization's own entry, which `organizations/top` answers.
 

package/docs/usage/plugins/auth/oidc.md

@@ -113,6 +113,17 @@ browser is sent to the provider's `end_session_endpoint` with the id token as
 No `post_logout_redirect_uri` is sent: the caller ends on the provider's own
 logout page, and nothing has to be registered there.
 
+A request a browser reports as coming from another site — `Sec-Fetch-Site`
+other than `same-origin` or `none`, or an `Origin` or `Referer` naming another
+origin — is refused (`403`) and leaves the session alone. `/logout` is a `GET`
+a link reaches and asks for no token, so without that check any page could end
+an administrator's session. A console served from another origin than
+`--base-url` names that origin in `--oidc-logout-origins`
+(`DM_OIDC_LOGOUT_ORIGINS`, comma-separated), and is then the only other origin
+a logout is accepted from. A link from such a console is recognized by its
+`Referer`: a page setting `Referrer-Policy: no-referrer`, or a link marked
+`noreferrer`, sends neither `Referer` nor `Origin`, and its logout is refused.
+
 Ending the cookie alone would not log anyone out: every guarded path goes
 through the provider, which still holds its session and logs the caller back
 in without asking anything.

package/docs/usage/plugins/auth/trusted-proxy.md

@@ -39,7 +39,17 @@ DM_TRUSTED_PROXY_AUTH_HEADER="Auth-User"
 - **IPv4 addresses:** `192.168.1.1`
 - **IPv6 addresses:** `::1`, `fe80::1`
 - **CIDR ranges:** `10.0.0.0/8`, `192.168.0.0/16`, `2001:db8::/32`
-- **IPv4-mapped IPv6:** Automatically handled (e.g., `::ffff:127.0.0.1` matches `127.0.0.1`)
+- **IPv4-mapped IPv6:** accepted in any spelling, e.g. `::ffff:127.0.0.1` or
+  `::ffff:7f00:1` matches `127.0.0.1`. A network written in mapped form is
+  checked as the IPv4 network it is: `::ffff:10.0.0.0/104` is `10.0.0.0/8`.
+- **Zone index:** a peer address carrying an interface, such as
+  `fe80::1%eth0`, is matched on the address alone. A trusted entry carrying
+  one is refused: the same link-local address names another host on another
+  link.
+
+An entry that is neither an address nor an `address/prefix` network (`:::`,
+`10.0.0.0/2.`, `10.0.0.0/24x`) makes the server refuse to start: it would
+otherwise trust a network the administrator never wrote.
 
 ## Auth-User Header
 

package/docs/usage/upgrading.md

@@ -4,6 +4,67 @@ What to check before deploying, newest first. Only releases that need a
 decision or a configuration change appear here; see the
 [CHANGELOG](../../CHANGELOG.md) for everything else.
 
+## From 2.0.3
+
+### An `authzDynamic` flag must be a JSON boolean
+
+**Who is affected:** a deployment loading `core/auth/authzDynamic` whose
+token entries hold a `read`, `write` or `delete` flag in `description` as a
+string or a number (`"true"`, `"yes"`, `1`) instead of the boolean `true`.
+
+That flag grants nothing after the upgrade: the permission is refused on
+the branch, and each reload logs `… not a boolean: permission refused`,
+naming the token entry and the branch. Write the JSON boolean `true` for the
+permissions the token holds. A flag written `"false"`, `"no"` or `"0"`
+refuses too, as it was meant to.
+
+### A malformed trusted proxy stops the server
+
+**Who is affected:** a deployment whose `--trusted-proxy` /
+`DM_TRUSTED_PROXIES` holds something that is neither an address nor an
+`address/prefix` network, such as `10.0.0.0/2.`, `10.0.0.0/24x` or `:::`.
+
+`core/auth/trustedProxy` refuses it at startup (`Invalid trusted proxy
+address "…"`) instead of reading its leading digits and trusting another
+network: `10.0.0.0/2.` was read as `10.0.0.0/2`, a network covering
+`0.0.0.0/2`. An IPv4-mapped address remains accepted. A trusted entry
+carrying a zone index (`fe80::1%eth0`) is refused too: the same link-local
+address names another host on another link. Fix the entry.
+
+## From 2.0.2
+
+### A console on another origin must be trusted for logout
+
+**Who is affected:** a deployment whose console is served from an origin
+other than `--base-url`, for example a front-end calling the API with its own
+`apiBaseUrl`.
+
+`/logout` refuses a request a browser reports as coming from another site.
+List the console's origin in `--oidc-logout-origins` (or
+`DM_OIDC_LOGOUT_ORIGINS`, comma-separated); otherwise its sign-out link
+answers `403` and the session stays. A console served by ldap-rest itself,
+from `--base-url`, needs nothing.
+
+### The organization tree is held to branches
+
+**Who is affected:** a deployment using `core/auth/authzLinid1`, or
+`core/auth/authzPerBranch` with `--authz-filter-attached-entries`.
+
+An administrator no longer reads the organizations of another branch: a
+single read answers `404`, and a subnode listing or a search returns only the
+branches they hold. The tree names every branch, its description and its
+local administrators, which an administrator of one branch has no business
+reading. `organizations/top` still answers one of their branches — or the
+top organization for a caller named in no `twakeLocalAdminLink` — and the
+transit branch's own entry stays readable so that the console can open its
+card from the scope banner. Naming the tree top directly is refused like any
+organization outside their branches.
+
+A console drawing the whole tree from an administrator's session draws their
+branches only. A client that listed the tree to let one administrator choose
+another branch as a destination loses that choice; the write was refused on
+the destination branch anyway.
+
 ## From 1.3.0
 
 ### A plugin with its own `service` member

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-rest",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "Light directory manager",
   "keywords": [
     "Identity-Manager"
@@ -809,6 +809,7 @@
     "check": "npm run check:ts && npm run lint && npm run format:check && npm run check:hooks && npm run check:comments && npm run check:no-client-values && npm run check:api && npm run check:openapi && npm run check:options",
     "check:api": "tsx scripts/api-snapshot.ts --check",
     "check:comments": "sh scripts/check-comments.sh",
+    "check:declarations": "tsx scripts/check-declarations.ts",
     "check:hooks": "tsx scripts/hooks-doc.ts",
     "check:no-client-values": "sh scripts/check-no-client-values.sh",
     "check:openapi": "tsx scripts/check-openapi.ts",
@@ -843,6 +844,7 @@
   },
   "dependencies": {
     "@sinclair/typebox": "^0.34.52",
+    "@types/express": "^5.0.3",
     "body-parser": "^2.2.0",
     "csv-parse": "^7.0.2",
     "express": "^5.1.0",
@@ -862,12 +864,10 @@
     "@rollup/plugin-terser": "^1.0.2",
     "@rollup/plugin-typescript": "^12.1.4",
     "@types/chai": "^5.2.2",
-    "@types/express": "^5.0.3",
     "@types/js-yaml": "^4.0.9",
     "@types/mocha": "^10.0.10",
     "@types/multer": "^2.0.0",
     "@types/node": "^26.6.5",
-    "@types/pg": "^8.23.1",
     "@types/supertest": "^7.2.1",
     "@typescript-eslint/eslint-plugin": "^8.44.0",
     "@typescript-eslint/parser": "^8.44.0",
@@ -895,6 +895,7 @@
   },
   "optionalDependencies": {
     "@linagora/rabbitmq-client": "^0.7.2",
+    "@types/pg": "^8.23.1",
     "express-openid-connect": "^3.4.0",
     "iovalkey": "^0.4.0",
     "lemonldap-ng-handler": "^0.9.6",