ldap-rest 2.0.3 → 2.0.5

package/dist/src/browser/ldap-user-editor/api/UserApiClient.d.ts

@@ -1,8 +1,8 @@
 /**
  * LDAP User Editor - API Client
  */
-import type { Config, LdapUser, PointerOption, Schema } from '../types';
-import { CacheManager } from '../cache/CacheManager';
+import type { Config, LdapUser, PointerOption, Schema } from '../types.js';
+import { CacheManager } from '../cache/CacheManager.js';
 export declare class UserApiClient {
     private baseUrl;
     private cache;

package/dist/src/browser/ldap-user-editor/components/MoveUserModal.d.ts

@@ -2,7 +2,7 @@
  * LDAP User Editor - Move User Modal Component
  * Modal dialog for selecting target organization when moving a user
  */
-import type { UserApiClient } from '../api/UserApiClient';
+import type { UserApiClient } from '../api/UserApiClient.js';
 export declare class MoveUserModal {
     private modal;
     private api;

package/dist/src/browser/ldap-user-editor/components/PointerField.d.ts

@@ -1,8 +1,8 @@
 /**
  * LDAP User Editor - Pointer Field Component
  */
-import type { SchemaAttribute } from '../types';
-import type { UserApiClient } from '../api/UserApiClient';
+import type { SchemaAttribute } from '../types.js';
+import type { UserApiClient } from '../api/UserApiClient.js';
 export declare class PointerField {
     private api;
     private attribute;

package/dist/src/browser/ldap-user-editor/components/UserEditor.d.ts

@@ -1,7 +1,7 @@
 /**
  * LDAP User Editor - User Editor Component
  */
-import type { UserApiClient } from '../api/UserApiClient';
+import type { UserApiClient } from '../api/UserApiClient.js';
 export declare class UserEditor {
     private container;
     private api;

package/dist/src/browser/ldap-user-editor/components/UserList.d.ts

@@ -2,7 +2,7 @@
  * LDAP User Editor - User List Component
  * Shows users in a selected organization
  */
-import type { UserApiClient } from '../api/UserApiClient';
+import type { UserApiClient } from '../api/UserApiClient.js';
 export declare class UserList {
     private container;
     private api;

package/dist/src/browser/ldap-user-editor/components/UserTree.d.ts

@@ -2,7 +2,7 @@
  * LDAP User Editor - Organization Tree Component
  * Shows only LDAP organization tree (filters out users/groups)
  */
-import { DisposableComponent } from '../../shared/components/DisposableComponent';
+import { DisposableComponent } from '../../shared/components/DisposableComponent.js';
 export declare class UserTree extends DisposableComponent {
     private container;
     private baseUrl;

package/dist/src/browser/ldap-user-editor/index.d.ts

@@ -2,6 +2,5 @@
  * LDAP User Editor - Browser library
  * @author Xavier Guimard
  */
-import './styles.css';
-export { LdapUserEditor } from './LdapUserEditor';
-export type { EditorOptions, LdapUser, Schema, SchemaAttribute, PointerOption, Config, } from './types';
+export { LdapUserEditor } from './LdapUserEditor.js';
+export type { EditorOptions, LdapUser, Schema, SchemaAttribute, PointerOption, Config, } from './types.js';

package/dist/src/browser/ldap-user-editor/types.d.ts

@@ -1,7 +1,7 @@
 /**
  * LDAP User Editor - Type definitions
  */
-import type { LocalizedText } from '../shared/types';
+import type { LocalizedText } from '../shared/types/index.js';
 export interface EditorOptions {
     containerId: string;
     apiBaseUrl?: string;

package/dist/src/browser/shared/components/Modal.d.ts

@@ -2,7 +2,7 @@
  * Reusable Modal component
  * @module browser/shared/components/Modal
  */
-import { DisposableComponent } from './DisposableComponent';
+import { DisposableComponent } from './DisposableComponent.js';
 export interface ModalOptions {
     id: string;
     title: string;

package/dist/src/browser/shared/index.d.ts

@@ -2,10 +2,10 @@
  * Main export file for shared browser utilities and components
  * @module browser/shared
  */
-export * from './utils/dom';
-export * from './utils/form';
-export * from './utils/schema';
-export * from './utils/totp';
-export { Modal, type ModalOptions } from './components/Modal';
-export { StatusMessage, showStatus, type StatusMessageOptions, } from './components/StatusMessage';
-export * from './types';
+export * from './utils/dom.js';
+export * from './utils/form.js';
+export * from './utils/schema.js';
+export * from './utils/totp.js';
+export { Modal, type ModalOptions } from './components/Modal.js';
+export { StatusMessage, showStatus, type StatusMessageOptions, } from './components/StatusMessage.js';
+export * from './types/index.js';

package/dist/src/browser/shared/utils/form.d.ts

@@ -2,7 +2,7 @@
  * Form utility functions
  * @module browser/shared/utils/form
  */
-import type { SchemaAttribute, PointerOption } from '../types';
+import type { SchemaAttribute, PointerOption } from '../types/index.js';
 /**
  * Get user-friendly field label from field name
  */

package/dist/src/browser/shared/utils/schema.d.ts

@@ -2,7 +2,7 @@
  * Schema utility functions
  * @module browser/shared/utils/schema
  */
-import type { LocalizedText, PointerOption, SchemaAttribute } from '../types';
+import type { LocalizedText, PointerOption, SchemaAttribute } from '../types/index.js';
 /**
  * Load pointer options from API
  */

package/dist/src/config/args.d.ts

@@ -1,6 +1,6 @@
-import type { AttributesList } from '../lib/ldapActions';
-import type { ConfigTemplate } from '../lib/parseConfig';
-export { STATIC_CSP, STATIC_FRAME_OPTIONS } from '../plugins/static.options';
+import type { AttributesList } from '../lib/ldapActions.js';
+import type { ConfigTemplate } from '../lib/parseConfig.js';
+export { STATIC_CSP, STATIC_FRAME_OPTIONS } from '../plugins/static.options.js';
 export interface BranchPermissions {
     read?: boolean;
     write?: boolean;

package/dist/src/config/options.d.ts

@@ -8,8 +8,8 @@
  *
  * See `docs/plugin-development/options.md`.
  */
-import { type ArrayKind, type ConfigEntry, type ConfigTemplate } from '../lib/parseConfig';
-import type { Config } from './args';
+import { type ArrayKind, type ConfigEntry, type ConfigTemplate } from '../lib/parseConfig.js';
+import type { Config } from './args.js';
 export type OptionType = 'string' | 'number' | 'boolean' | 'array' | 'json';
 export interface OptionSpec<T> {
     readonly type: OptionType;

package/dist/src/config/schema.d.ts

@@ -1,4 +1,4 @@
-import type { AttributesList, AttributeValue, ModifyRequest } from '../lib/ldapActions';
+import type { AttributesList, AttributeValue, ModifyRequest } from '../lib/ldapActions.js';
 /**
  * Scalar and container types an entity schema may declare.
  *

package/dist/src/hooks.d.ts

@@ -4,11 +4,11 @@
  */
 import type { Entry, SearchOptions, SearchResult } from 'ldapts';
 import type { Request, Response } from 'express';
-import type { ModifyRequest, AttributesList, AttributeValue, LdapList } from './lib/ldapActions';
-import type { ChangesToNotify } from './plugins/ldap/onChange';
-import type { ChangeContext } from './lib/changeContext';
-import type { BulkResponse, ScimGroup, ScimUser } from './plugins/scim/types';
-import * as utils from './lib/utils';
+import type { ModifyRequest, AttributesList, AttributeValue, LdapList } from './lib/ldapActions.js';
+import type { ChangesToNotify } from './plugins/ldap/onChange.js';
+import type { ChangeContext } from './lib/changeContext.js';
+import type { BulkResponse, ScimGroup, ScimUser } from './plugins/scim/types.js';
+import * as utils from './lib/utils.js';
 export type MaybePromise<T> = Promise<T> | T;
 export type ChainedHook<T> = (arg: T) => MaybePromise<T>;
 /**

package/dist/src/lib/auth/base.d.ts

@@ -1,6 +1,6 @@
 import type { Express, Request, Response } from 'express';
-import DmPlugin from '../../abstract/plugin';
-import type { Config } from '../../config/args';
+import DmPlugin from '../../abstract/plugin.js';
+import type { Config } from '../../config/args.js';
 /**
  * A request as the authentication plugins leave it.
  *

package/dist/src/lib/authz/base.d.ts

@@ -7,12 +7,12 @@
  * @group Libraries
  */
 import type { SearchOptions } from 'ldapts';
-import DmPlugin, { type Role } from '../../abstract/plugin';
-import type { DM } from '../../bin';
-import type { BranchPermissions } from '../../config/args';
-import type { Hooks } from '../../hooks';
-import { type DmRequest } from '../auth/base';
-import type { ModifyRequest } from '../ldapActions';
+import DmPlugin, { type Role } from '../../abstract/plugin.js';
+import type { DM } from '../../bin/index.js';
+import type { BranchPermissions } from '../../config/args.js';
+import type { Hooks } from '../../hooks.js';
+import { type DmRequest } from '../auth/base.js';
+import type { ModifyRequest } from '../ldapActions.js';
 /**
  * The rule of the most specific configured branch holding `target`.
  *

package/dist/src/lib/authz/composition.d.ts

@@ -16,10 +16,10 @@
  * the same ones without `--authz-combine`.
  * @group Libraries
  */
-import type DmPlugin from '../../abstract/plugin';
-import type { DM } from '../../bin';
-import type { Config } from '../../config/args';
-import type { DmRequest } from '../auth/base';
+import type DmPlugin from '../../abstract/plugin.js';
+import type { DM } from '../../bin/index.js';
+import type { Config } from '../../config/args.js';
+import type { DmRequest } from '../auth/base.js';
 /**
  * The hooks an LDAP operation is judged in: refused from, or — for
  * `ldapsearchfilter` — narrowed to what the caller may see. Two plugins on

package/dist/src/lib/entitySchema/validator.d.ts

@@ -1,5 +1,5 @@
-import type { AttributesList, AttributeValue, ModifyRequest } from '../ldapActions';
-import type { Schema } from '../../config/schema';
+import type { AttributesList, AttributeValue, ModifyRequest } from '../ldapActions.js';
+import type { Schema } from '../../config/schema.js';
 export interface EntityValidatorDeps {
     /**
      * Tells whether a DN names an entry. Asked as the server: a reference to
@@ -72,6 +72,27 @@ export declare class EntityValidator {
      * option, the only one a write takes, written as the directory writes it.
      */
     private schemaSpelling;
+    /**
+     * Refuse a fixed attribute a creation carries under an option. The schema
+     * forces its value under the attribute's own name, which leaves a subtype
+     * such as `l;lang-fr` as a second value of an attribute that cannot be
+     * changed. An alias or an OID (`localityName`, `2.5.4.7`) names the same
+     * attribute. A fixed attribute without a default is set at creation, so it
+     * keeps its options.
+     *
+     * @param values entry about to be created
+     * @throws BadRequestError for a fixed attribute with a default under an
+     *   option
+     */
+    private refuseFixedOptions;
+    /**
+     * The schema's definition of the attribute a name holds, through the
+     * schema's own key, an alias or an OID.
+     *
+     * @param field attribute name, option included
+     * @returns the definition, or undefined when the schema does not declare it
+     */
+    private declaredAttribute;
     /**
      * Drop, in place, the keys a creation or an `add` carries with `null` or
      * `undefined` under a name the schema does not declare. A declared

package/dist/src/lib/expressFormatedResponses.d.ts

@@ -1,6 +1,6 @@
 import type { Request, Response } from 'express';
 import type winston from 'winston';
-import { type Refusal } from './errors';
+import { type Refusal } from './errors.js';
 /**
  * Install the logger, or remove it: a test restores the state it found,
  * which before any `DM` is none.

package/dist/src/lib/health.d.ts

@@ -1,5 +1,5 @@
 import type { Express } from 'express';
-import type { MaybePromise } from '../hooks';
+import type { MaybePromise } from '../hooks.js';
 /** What a plugin answers about the resources it depends on */
 export type HealthStatus = 'ok' | 'degraded';
 /** The paths of the two probes, served before authentication */

package/dist/src/lib/hookBus.d.ts

@@ -9,7 +9,7 @@
  *
  * @see docs/plugin-development/hooks.md
  */
-import type { Hooks } from '../hooks';
+import type { Hooks } from '../hooks.js';
 export type HookFn = Function;
 /** A promise, or the value itself */
 type Settled<T> = T extends Promise<infer P> ? P : T;

package/dist/src/lib/ldap/schema.d.ts

@@ -4,8 +4,8 @@
  * write needs.
  */
 import type { SearchOptions, SearchResult } from 'ldapts';
-import type { AttributesList, ModifyRequest } from '../ldapActions';
-import { SchemaIndex } from '../ldapSchema';
+import type { AttributesList, ModifyRequest } from '../ldapActions.js';
+import { SchemaIndex } from '../ldapSchema.js';
 export interface SchemaLogger {
     info(message: string): void;
     warn(message: string): void;

package/dist/src/lib/ldapActions.d.ts

@@ -6,11 +6,11 @@ import type { Request } from 'express';
 import type { SearchResult, SearchOptions } from 'ldapts';
 import type winston from 'winston';
 import pLimit from 'p-limit';
-import { type Config } from '../config/args';
-import { type DM } from '../bin';
-import type { Hooks } from '../hooks';
-import { type ChangeContext } from './changeContext';
-import type { SchemaIndex } from './ldapSchema';
+import { type Config } from '../config/args.js';
+import { type DM } from '../bin/index.js';
+import type { Hooks } from '../hooks.js';
+import { type ChangeContext } from './changeContext.js';
+import type { SchemaIndex } from './ldapSchema.js';
 export type AttributeValue = Buffer | Buffer[] | string[] | string;
 export type AttributesList = Record<string, AttributeValue>;
 export type LdapList = Record<string, AttributesList>;

package/dist/src/lib/mailDomains.d.ts

@@ -6,7 +6,7 @@
  * each naming its domain in an attribute.
  * @group Libraries
  */
-import type { DM } from '../bin';
+import type { DM } from '../bin/index.js';
 /** Where mail domain entries live, and the attribute naming their domain */
 export interface DomainBranch {
     base: string;

package/dist/src/lib/parseConfig.d.ts

@@ -3,7 +3,7 @@
  * Order: default < env < cli
  * @author Xavier Guimard <xguimard@linagora.com>
  */
-import type { Config } from '../config/args';
+import type { Config } from '../config/args.js';
 export type ConfigTemplate = ConfigEntry[];
 export type ArrayKind = 'identifiers' | 'dns' | 'phrases';
 export type ConfigEntry = [

package/dist/src/lib/schemaFile.d.ts

@@ -1,4 +1,4 @@
-import type { Config } from '../bin';
+import type { Config } from '../bin/index.js';
 /** Directory of the schemas shipped with LDAP-Rest, whatever --schemas-path says */
 export declare const shippedSchemasPath: string;
 /** Prefix of an `extends` naming a shipped schema, as `ldap-rest:twake/users.json` */

package/dist/src/lib/staticFiles.d.ts

@@ -3,7 +3,7 @@
  * announce it
  * @module lib/staticFiles
  */
-import type { DM } from '../bin';
+import type { DM } from '../bin/index.js';
 /** A static plugin, as another plugin asks it where it serves a file */
 export interface StaticFiles {
     schemaUrlOf(file: string): string | undefined;

package/dist/src/lib/storage/store.d.ts

@@ -26,7 +26,7 @@
  * @group Libraries
  */
 import type winston from 'winston';
-import type { HealthStatus } from '../health';
+import type { HealthStatus } from '../health.js';
 /** What a backend keeps: a value, and when it stops counting. */
 export interface StoredRecord {
     value: string;

package/dist/src/lib/utils.d.ts

@@ -3,8 +3,8 @@
  * @author Xavier Guimard <xguimard@linagora.com>
  */
 import type { Request, Response, NextFunction, RequestHandler } from 'express';
-import type { Config } from '../bin';
-import type { AttributeValue } from './ldapActions';
+import type { Config } from '../bin/index.js';
+import type { AttributeValue } from './ldapActions.js';
 /**
  * Get a compiled RegExp from cache, or compile and cache it
  * This avoids recompiling the same regex patterns repeatedly
@@ -22,7 +22,7 @@ export declare function getCompiledRegex(pattern: string, flags?: string): RegEx
  * @returns The escaped string safe for use in RegExp
  */
 export declare function escapeRegex(str: string): string;
-export { hookOwner, recordHookOwner, runAsHookOwner } from './hookBus';
+export { hookOwner, recordHookOwner, runAsHookOwner } from './hookBus.js';
 export declare const transformSchemas: (schemas: string | Buffer, config: Config) => string;
 /**
  * Escape special characters in LDAP filter values according to RFC 4515

package/dist/src/logger/winston.d.ts

@@ -1,5 +1,5 @@
 import winston from 'winston';
-import { Config } from '../bin';
+import { Config } from '../bin/index.js';
 declare module 'winston' {
     interface Logger {
         notice: winston.LeveledLogMethod;

package/dist/src/plugins/auth/auth.options.d.ts

@@ -2,82 +2,82 @@
  * Authentication and authorization plugin options, see
  * `docs/plugin-development/options.md`.
  */
-import type { AuthConfig, Config } from '../../config/args';
-import { type OptionsOf } from '../../config/options';
+import type { AuthConfig, Config } from '../../config/args.js';
+import { type OptionsOf } from '../../config/options.js';
 export declare const tokenOptions: {
-    auth_token: import("../../config/options").ArrayOption;
+    auth_token: import("../../config/options.js").ArrayOption;
 };
 export type TokenOptions = OptionsOf<typeof tokenOptions>;
 export declare const fakeOptions: {
-    auth_fake_user: import("../../config/options").StringOption;
+    auth_fake_user: import("../../config/options.js").StringOption;
 };
 export type FakeOptions = OptionsOf<typeof fakeOptions>;
 export declare const totpOptions: {
-    auth_totp: import("../../config/options").ArrayOption;
-    auth_totp_window: import("../../config/options").NumberOption;
-    auth_totp_step: import("../../config/options").NumberOption;
+    auth_totp: import("../../config/options.js").ArrayOption;
+    auth_totp_window: import("../../config/options.js").NumberOption;
+    auth_totp_step: import("../../config/options.js").NumberOption;
 };
 export type TotpOptions = OptionsOf<typeof totpOptions>;
 export declare const hmacOptions: {
-    auth_hmac: import("../../config/options").ArrayOption;
-    auth_hmac_window: import("../../config/options").NumberOption;
+    auth_hmac: import("../../config/options.js").ArrayOption;
+    auth_hmac_window: import("../../config/options.js").NumberOption;
 };
 export type HmacOptions = OptionsOf<typeof hmacOptions>;
 export declare const llngOptions: {
-    llng_ini: import("../../config/options").StringOption;
-    llng_username_header: import("../../config/options").StringOption;
+    llng_ini: import("../../config/options.js").StringOption;
+    llng_username_header: import("../../config/options.js").StringOption;
 };
 export type LlngOptions = OptionsOf<typeof llngOptions>;
 export declare const perRouteOptions: {
-    authz_per_route: import("../../config/options").ArrayOption;
+    authz_per_route: import("../../config/options.js").ArrayOption;
 };
 export type PerRouteOptions = OptionsOf<typeof perRouteOptions>;
 export declare const perBranchOptions: {
-    authz_per_branch_config: import("../../config/options").JsonOption<AuthConfig>;
-    authz_per_branch_cache_ttl: import("../../config/options").NumberOption;
-    ldap_group_member_attribute: import("../../config/options").StringOption;
+    authz_per_branch_config: import("../../config/options.js").JsonOption<AuthConfig>;
+    authz_per_branch_cache_ttl: import("../../config/options.js").NumberOption;
+    ldap_group_member_attribute: import("../../config/options.js").StringOption;
 };
 export type PerBranchOptions = OptionsOf<typeof perBranchOptions>;
 export declare const dynamicOptions: {
-    authz_dynamic_bypass: import("../../config/options").ArrayOption;
-    authz_dynamic_base: import("../../config/options").StringOption;
-    authz_dynamic_cache_ttl: import("../../config/options").NumberOption;
-    authz_dynamic_token_attribute: import("../../config/options").StringOption;
-    authz_dynamic_config_attribute: import("../../config/options").StringOption;
-    authz_dynamic_tenant_attribute: import("../../config/options").StringOption;
-    authz_dynamic_reload_endpoint: import("../../config/options").BooleanOption;
+    authz_dynamic_bypass: import("../../config/options.js").ArrayOption;
+    authz_dynamic_base: import("../../config/options.js").StringOption;
+    authz_dynamic_cache_ttl: import("../../config/options.js").NumberOption;
+    authz_dynamic_token_attribute: import("../../config/options.js").StringOption;
+    authz_dynamic_config_attribute: import("../../config/options.js").StringOption;
+    authz_dynamic_tenant_attribute: import("../../config/options.js").StringOption;
+    authz_dynamic_reload_endpoint: import("../../config/options.js").BooleanOption;
 };
 export type DynamicOptions = OptionsOf<typeof dynamicOptions>;
 export declare const linid1Options: {
-    authz_local_admin_attribute: import("../../config/options").StringOption;
-    authz_global_branch: import("../../config/options").ArrayOption;
-    authz_global_write_branch: import("../../config/options").ArrayOption;
-    authz_global_organization: import("../../config/options").StringOption;
+    authz_local_admin_attribute: import("../../config/options.js").StringOption;
+    authz_global_branch: import("../../config/options.js").ArrayOption;
+    authz_global_write_branch: import("../../config/options.js").ArrayOption;
+    authz_global_organization: import("../../config/options.js").StringOption;
 };
 export type Linid1Options = OptionsOf<typeof linid1Options>;
 export declare const openidconnectOptions: {
-    oidc_server: import("../../config/options").StringOption;
-    oidc_username_claim: import("../../config/options").StringOption;
-    oidc_client_id: import("../../config/options").StringOption;
-    oidc_client_secret: import("../../config/options").StringOption;
-    base_url: import("../../config/options").StringOption;
-    oidc_logout_origins: import("../../config/options").ArrayOption;
+    oidc_server: import("../../config/options.js").StringOption;
+    oidc_username_claim: import("../../config/options.js").StringOption;
+    oidc_client_id: import("../../config/options.js").StringOption;
+    oidc_client_secret: import("../../config/options.js").StringOption;
+    base_url: import("../../config/options.js").StringOption;
+    oidc_logout_origins: import("../../config/options.js").ArrayOption;
 };
 export type OpenidconnectOptions = OptionsOf<typeof openidconnectOptions>;
 export declare const rateLimitOptions: {
-    rate_limit_window_ms: import("../../config/options").NumberOption;
-    rate_limit_max: import("../../config/options").NumberOption;
+    rate_limit_window_ms: import("../../config/options.js").NumberOption;
+    rate_limit_max: import("../../config/options.js").NumberOption;
 };
 export type RateLimitOptions = OptionsOf<typeof rateLimitOptions>;
 export declare const crowdsecOptions: {
-    crowdsec_url: import("../../config/options").StringOption;
-    crowdsec_api_key: import("../../config/options").StringOption;
-    crowdsec_cache_ttl: import("../../config/options").NumberOption;
+    crowdsec_url: import("../../config/options.js").StringOption;
+    crowdsec_api_key: import("../../config/options.js").StringOption;
+    crowdsec_cache_ttl: import("../../config/options.js").NumberOption;
 };
 export type CrowdsecOptions = OptionsOf<typeof crowdsecOptions>;
 export declare const trustedProxyOptions: {
-    trusted_proxy: import("../../config/options").ArrayOption;
-    trusted_proxy_auth_header: import("../../config/options").StringOption;
+    trusted_proxy: import("../../config/options.js").ArrayOption;
+    trusted_proxy_auth_header: import("../../config/options.js").StringOption;
 };
 export type TrustedProxyOptions = OptionsOf<typeof trustedProxyOptions>;
 /** The checked values for a caller that holds a Config instead of the plugin */

package/dist/src/plugins/auth/authzDynamic.d.ts

@@ -25,10 +25,10 @@
  * `ou=users,ou=acme`).
  */
 import type { Express, Response } from 'express';
-import { type Role } from '../../abstract/plugin';
-import type { DM } from '../../bin';
-import AuthBase, { type DmRequest } from '../../lib/auth/base';
-import type { Hooks } from '../../hooks';
+import { type Role } from '../../abstract/plugin.js';
+import type { DM } from '../../bin/index.js';
+import AuthBase, { type DmRequest } from '../../lib/auth/base.js';
+import type { Hooks } from '../../hooks.js';
 export interface BranchAcl {
     dn: string;
     read?: boolean;
@@ -52,13 +52,13 @@ export interface AuthzDynamicRequest extends DmRequest {
 }
 export default class AuthzDynamic extends AuthBase {
     static optionDefinitions: {
-        authz_dynamic_bypass: import("../../config/options").ArrayOption;
-        authz_dynamic_base: import("../../config/options").StringOption;
-        authz_dynamic_cache_ttl: import("../../config/options").NumberOption;
-        authz_dynamic_token_attribute: import("../../config/options").StringOption;
-        authz_dynamic_config_attribute: import("../../config/options").StringOption;
-        authz_dynamic_tenant_attribute: import("../../config/options").StringOption;
-        authz_dynamic_reload_endpoint: import("../../config/options").BooleanOption;
+        authz_dynamic_bypass: import("../../config/options.js").ArrayOption;
+        authz_dynamic_base: import("../../config/options.js").StringOption;
+        authz_dynamic_cache_ttl: import("../../config/options.js").NumberOption;
+        authz_dynamic_token_attribute: import("../../config/options.js").StringOption;
+        authz_dynamic_config_attribute: import("../../config/options.js").StringOption;
+        authz_dynamic_tenant_attribute: import("../../config/options.js").StringOption;
+        authz_dynamic_reload_endpoint: import("../../config/options.js").BooleanOption;
     };
     name: string;
     roles: Role[];
@@ -80,6 +80,19 @@ export default class AuthzDynamic extends AuthBase {
      * does not poison the cache — the previous snapshot stays in use.
      */
     reload(): Promise<void>;
+    /**
+     * Read one ACL flag of a token's JSON.
+     *
+     * Only the boolean `true` grants the permission: every string is truthy,
+     * `"false"`, `"no"` and `"0"` included.
+     *
+     * @param value flag as the token's JSON holds it
+     * @param flag flag name, for the warning
+     * @param branch branch the flag applies to
+     * @param tokenDn DN of the token entry
+     * @returns whether the permission is granted
+     */
+    private aclFlag;
     /**
      * Ensure the cache is fresh (blocks if reloading).
      *

package/dist/src/plugins/auth/authzLinid1.d.ts

@@ -6,19 +6,19 @@
  * Grants permissions to users referenced in organization's twakeLocalAdminLink
  * @group Plugins
  */
-import type { DM } from '../../bin';
-import type { BranchPermissions } from '../../config/args';
-import AuthzBase from '../../lib/authz/base';
+import type { DM } from '../../bin/index.js';
+import type { BranchPermissions } from '../../config/args.js';
+import AuthzBase from '../../lib/authz/base.js';
 interface CachedPermissions {
     branches: Map<string, BranchPermissions>;
     timestamp: number;
 }
 export default class AuthzLinid1 extends AuthzBase {
     static optionDefinitions: {
-        authz_local_admin_attribute: import("../../config/options").StringOption;
-        authz_global_branch: import("../../config/options").ArrayOption;
-        authz_global_write_branch: import("../../config/options").ArrayOption;
-        authz_global_organization: import("../../config/options").StringOption;
+        authz_local_admin_attribute: import("../../config/options.js").StringOption;
+        authz_global_branch: import("../../config/options.js").ArrayOption;
+        authz_global_write_branch: import("../../config/options.js").ArrayOption;
+        authz_global_organization: import("../../config/options.js").StringOption;
     };
     name: string;
     permissionsCache: Map<string, CachedPermissions>;