restad 0.1.0__py3-none-any.whl

restad/__init__.py

@@ -0,0 +1,5 @@
+"""restAD: a read-only REST interface over the msad Active Directory library."""
+
+from __future__ import annotations
+
+__version__ = "0.1.0"

restad/__main__.py

@@ -0,0 +1,25 @@
+"""Console entry point: run the restAD API with uvicorn.
+
+Usage:
+    restad                 # listen on 127.0.0.1:8000
+    RESTAD_HOST=0.0.0.0 RESTAD_PORT=9000 restad
+
+Host/port are read from RESTAD_HOST / RESTAD_PORT (not the MSAD_* vars, which
+configure the directory connection).
+"""
+
+from __future__ import annotations
+
+import os
+
+
+def main() -> None:
+    import uvicorn
+
+    host = os.environ.get("RESTAD_HOST", "127.0.0.1")
+    port = int(os.environ.get("RESTAD_PORT", "8000"))
+    uvicorn.run("restad.app:app", host=host, port=port, factory=False)
+
+
+if __name__ == "__main__":
+    main()

restad/app.py

@@ -0,0 +1,101 @@
+"""FastAPI application factory and lifespan.
+
+At startup the lifespan resolves the effective :class:`msad.DomainConfig`
+(TOML + ``MSAD_*`` env overrides), opens a single bound LDAP connection and
+stores both on ``app.state``. At shutdown it unbinds the connection.
+
+By default a failure to connect at startup is fatal. Set
+``RESTAD_LAZY_CONNECT=true`` to start anyway (the ``/health`` endpoint still
+works and reports the error; data endpoints return 503 until a connection is
+available).
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+from collections.abc import AsyncIterator
+from contextlib import asynccontextmanager
+
+from fastapi import FastAPI
+from msad import connect
+
+from .config import ConfigError, resolve_domain_config
+from .routers import audit, computers, groups, health, ous, users
+
+logger = logging.getLogger("restad")
+
+_TRUE = {"1", "true", "yes", "on"}
+
+
+def _env_flag(name: str, default: bool = False) -> bool:
+    value = os.environ.get(name)
+    if value is None:
+        return default
+    return value.strip().lower() in _TRUE
+
+
+@asynccontextmanager
+async def lifespan(app: FastAPI) -> AsyncIterator[None]:
+    """Resolve config, open the LDAP connection, and tear it down on exit."""
+    lazy = _env_flag("RESTAD_LAZY_CONNECT")
+
+    config = resolve_domain_config()
+    app.state.config = config
+    app.state.conn = None
+
+    try:
+        app.state.conn = connect(config)
+        auth = "kerberos" if config.uses_kerberos else config.user
+        logger.info("Connected to the directory as %s", auth)
+    except Exception as exc:
+        # MsadConnectionError on bind/connect failure, but also e.g. environment
+        # issues raised deeper in ldap3. In lazy mode we start anyway; otherwise
+        # startup fails loudly.
+        if not lazy:
+            raise
+        logger.warning("Startup connection failed (lazy mode, continuing): %s", exc)
+
+    try:
+        yield
+    finally:
+        conn = app.state.conn
+        if conn is not None:
+            try:
+                conn.unbind()
+            except Exception:  # best-effort teardown
+                logger.debug("unbind on shutdown failed", exc_info=True)
+
+
+def create_app() -> FastAPI:
+    """Build and configure the FastAPI application."""
+    app = FastAPI(
+        title="restAD",
+        version="0.1.0",
+        summary="Read-only REST interface over Active Directory (msad).",
+        description=(
+            "A read-only HTTP API in front of the msad library. All endpoints "
+            "perform LDAP searches only; no write operations are exposed."
+        ),
+        lifespan=lifespan,
+    )
+
+    app.include_router(health.router)
+    app.include_router(users.router)
+    app.include_router(computers.router)
+    app.include_router(groups.router)
+    app.include_router(ous.router)
+    app.include_router(audit.router)
+
+    @app.get("/", tags=["health"], summary="Service metadata")
+    def root() -> dict[str, str]:
+        return {"service": "restAD", "version": "0.1.0", "docs": "/docs"}
+
+    return app
+
+
+# Module-level app for `uvicorn restad.app:app` and ASGI servers.
+app = create_app()
+
+
+__all__ = ["app", "create_app", "lifespan", "ConfigError"]

restad/config.py

@@ -0,0 +1,145 @@
+"""Configuration resolution for restAD.
+
+The effective :class:`msad.DomainConfig` is built in two layers:
+
+1. Optionally load an msad TOML config file (``~/.msad.toml`` by default, or
+   the path in ``MSAD_CONFIG_FILE``) and pick a domain.
+2. Apply ``MSAD_*`` environment-variable overrides on top. Environment values
+   always win, so credentials (and any connection parameter) can be injected
+   at runtime without ever being written to the TOML file.
+
+Supported environment variables
+--------------------------------
+=========================  =================================================
+Variable                   Effect
+=========================  =================================================
+``MSAD_CONFIG_FILE``       Path to the msad TOML file (default ``~/.msad.toml``).
+``MSAD_DOMAIN``            Which ``[domains.<name>]`` section to use.
+``MSAD_HOST``              Override ``host``.
+``MSAD_BASE``              Override ``base`` (search base DN).
+``MSAD_PORT``              Override ``port`` (int).
+``MSAD_USE_SSL``           Override ``use_ssl`` (true/false/1/0/yes/no).
+``MSAD_USER``              Override bind ``user`` (enables user/password bind).
+``MSAD_PASSWORD``          Override bind ``password``.
+``MSAD_QUERY_TIMEOUT``     Override ``query_timeout`` (int seconds).
+=========================  =================================================
+
+If no TOML file exists, the configuration is built entirely from the
+environment: at minimum ``MSAD_HOST`` and ``MSAD_BASE`` must be set.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+from msad import DomainConfig, MsadConfigError, load_config
+
+#: Env var holding the path to the msad TOML config file.
+ENV_CONFIG_FILE = "MSAD_CONFIG_FILE"
+#: Env var selecting which domain section to use.
+ENV_DOMAIN = "MSAD_DOMAIN"
+
+_TRUE = {"1", "true", "yes", "on"}
+_FALSE = {"0", "false", "no", "off"}
+
+
+class ConfigError(RuntimeError):
+    """Raised when the effective configuration cannot be resolved."""
+
+
+def _parse_bool(value: str, name: str) -> bool:
+    lowered = value.strip().lower()
+    if lowered in _TRUE:
+        return True
+    if lowered in _FALSE:
+        return False
+    raise ConfigError(f"{name}: expected a boolean, got {value!r}")
+
+
+def _parse_int(value: str, name: str) -> int:
+    try:
+        return int(value.strip())
+    except ValueError as exc:
+        raise ConfigError(f"{name}: expected an integer, got {value!r}") from exc
+
+
+def _base_from_toml(env: dict[str, str]) -> dict[str, object]:
+    """Load the TOML file (if any) and return the chosen domain as a dict.
+
+    Returns an empty dict when no config file is present, so the configuration
+    can be built purely from environment variables.
+    """
+    config_file = env.get(ENV_CONFIG_FILE)
+    domain = env.get(ENV_DOMAIN)
+
+    path = Path(config_file) if config_file else None
+    # Only attempt to load when a file is explicitly given or the default
+    # exists; otherwise fall back to a pure-env configuration.
+    from msad import DEFAULT_CONFIG_PATH
+
+    if path is None and DEFAULT_CONFIG_PATH.is_file():
+        path = DEFAULT_CONFIG_PATH
+
+    if path is None:
+        return {}
+
+    try:
+        config = load_config(path)
+        domain_config = config.get_domain(domain)
+    except MsadConfigError as exc:
+        raise ConfigError(str(exc)) from exc
+
+    return domain_config.model_dump()
+
+
+def _apply_env_overrides(data: dict[str, object], env: dict[str, str]) -> dict[str, object]:
+    """Overlay ``MSAD_*`` environment overrides onto a config dict."""
+    if (host := env.get("MSAD_HOST")) is not None:
+        data["host"] = host
+    if (base := env.get("MSAD_BASE")) is not None:
+        data["base"] = base
+    if (port := env.get("MSAD_PORT")) is not None:
+        data["port"] = _parse_int(port, "MSAD_PORT")
+    if (use_ssl := env.get("MSAD_USE_SSL")) is not None:
+        data["use_ssl"] = _parse_bool(use_ssl, "MSAD_USE_SSL")
+    if (user := env.get("MSAD_USER")) is not None:
+        data["user"] = user
+    if (password := env.get("MSAD_PASSWORD")) is not None:
+        data["password"] = password
+    if (timeout := env.get("MSAD_QUERY_TIMEOUT")) is not None:
+        data["query_timeout"] = _parse_int(timeout, "MSAD_QUERY_TIMEOUT")
+    return data
+
+
+def resolve_domain_config(env: dict[str, str] | None = None) -> DomainConfig:
+    """Resolve the effective :class:`msad.DomainConfig`.
+
+    Args:
+        env: environment mapping to read from (defaults to ``os.environ``).
+            Injectable for testing.
+
+    Returns:
+        A validated :class:`msad.DomainConfig`.
+
+    Raises:
+        ConfigError: if required fields are missing or values are invalid.
+    """
+    environ = dict(os.environ if env is None else env)
+
+    data = _base_from_toml(environ)
+    data = _apply_env_overrides(data, environ)
+
+    missing = [k for k in ("host", "base") if not data.get(k)]
+    if missing:
+        raise ConfigError(
+            "Missing required configuration: "
+            + ", ".join(missing)
+            + ". Provide them via the msad TOML file or the MSAD_HOST / MSAD_BASE "
+            "environment variables."
+        )
+
+    try:
+        return DomainConfig.model_validate(data)
+    except Exception as exc:  # pydantic ValidationError and friends
+        raise ConfigError(f"Invalid configuration: {exc}") from exc

restad/deps.py

@@ -0,0 +1,50 @@
+"""Shared FastAPI dependencies.
+
+The LDAP connection and resolved configuration are created once during the
+application lifespan (see :mod:`restad.app`) and stored on ``app.state``. These
+dependencies expose them to the route handlers.
+"""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import Depends, HTTPException, Request, status
+from msad import DomainConfig
+from msad.types import LdapConnection
+
+
+def get_config(request: Request) -> DomainConfig:
+    """Return the resolved domain configuration from app state."""
+    config: DomainConfig | None = getattr(request.app.state, "config", None)
+    if config is None:  # pragma: no cover - should not happen after lifespan
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Configuration not initialized.",
+        )
+    return config
+
+
+def get_base(config: Annotated[DomainConfig, Depends(get_config)]) -> str:
+    """Return the configured search base DN."""
+    return config.base
+
+
+def get_connection(request: Request) -> LdapConnection:
+    """Return the shared bound LDAP connection from app state.
+
+    Raises 503 if the connection was never established (e.g. the directory was
+    unreachable at startup and lazy connection is disabled).
+    """
+    conn: LdapConnection | None = getattr(request.app.state, "conn", None)
+    if conn is None:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="LDAP connection is not available.",
+        )
+    return conn
+
+
+ConfigDep = Annotated[DomainConfig, Depends(get_config)]
+BaseDep = Annotated[str, Depends(get_base)]
+ConnDep = Annotated[LdapConnection, Depends(get_connection)]

restad/models.py

@@ -0,0 +1,59 @@
+"""Pydantic response models (wrappers) for the REST API.
+
+LDAP entries are intentionally dynamic: the attributes returned depend on the
+requested attribute list, so each entry is represented as an open mapping
+(``dict[str, Any]``) rather than a rigid model. The wrappers below add a small,
+predictable envelope (counts, the domain queried) around those entries.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from pydantic import BaseModel, Field
+
+#: A single LDAP entry: attribute name -> value(s). Values are whatever ldap3
+#: decoded them to (str, int, datetime, list, ...).
+LdapEntry = dict[str, Any]
+
+
+class HealthResponse(BaseModel):
+    """Result of the LDAP connectivity health check."""
+
+    ok: bool = Field(description="Whether the bind to the directory succeeded.")
+    target: str = Field(description="The server URL, e.g. ldaps://dc:636.")
+    auth: str = Field(description="Authentication method used (kerberos or user '<name>').")
+    error: str | None = Field(default=None, description="Error message when ok is false.")
+
+
+class EntryResponse(BaseModel):
+    """A single LDAP entry (or null when not found)."""
+
+    entry: LdapEntry | None = None
+
+
+class EntriesResponse(BaseModel):
+    """A list of LDAP entries plus a count."""
+
+    count: int = Field(description="Number of entries returned.")
+    entries: list[LdapEntry] = Field(default_factory=list)
+
+
+class BoolResponse(BaseModel):
+    """A tri-state boolean result (null means 'not found')."""
+
+    result: bool | None = None
+
+
+class OsSummaryItem(BaseModel):
+    """One row of the computer-OS summary."""
+
+    operatingSystem: str
+    count: int
+
+
+class OsSummaryResponse(BaseModel):
+    """Computer accounts grouped and counted by operating system."""
+
+    count: int = Field(description="Number of distinct operating systems.")
+    items: list[OsSummaryItem] = Field(default_factory=list)

restad/routers/__init__.py

@@ -0,0 +1 @@
+"""Read-only API routers for restAD."""

restad/routers/audit.py

@@ -0,0 +1,132 @@
+"""Read-only audit endpoints: domain info, policy, privileged groups, topology."""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, HTTPException, Query, status
+from msad import (
+    get_domain_info,
+    get_gpo,
+    get_password_policy,
+    get_password_policy_violations,
+    get_privileged_groups,
+    list_fine_grained_password_policies,
+    list_fsmo_roles,
+    list_gpos,
+    list_sites,
+    list_trusts,
+)
+
+from ..deps import BaseDep, ConnDep
+from ..models import EntriesResponse, EntryResponse
+
+router = APIRouter(prefix="/audit", tags=["audit"])
+
+
+@router.get("/domain", response_model=EntryResponse, summary="Domain object info")
+def domain_info(conn: ConnDep, base: BaseDep) -> EntryResponse:
+    """Read the domain object (security-relevant settings and metadata)."""
+    return EntryResponse(entry=get_domain_info(conn, base))
+
+
+@router.get("/password-policy", response_model=EntryResponse, summary="Default password policy")
+def password_policy(conn: ConnDep, base: BaseDep) -> EntryResponse:
+    """Read the default domain password policy."""
+    return EntryResponse(entry=get_password_policy(conn, base))
+
+
+@router.get(
+    "/password-policy/violations",
+    response_model=EntriesResponse,
+    summary="Password policy violations",
+)
+def password_policy_violations(
+    conn: ConnDep,
+    base: BaseDep,
+    include_never_set: Annotated[
+        bool, Query(description="Also flag users with pwdLastSet=0")
+    ] = True,
+    limit: Annotated[int, Query(ge=0, description="Max entries (0 = no limit)")] = 0,
+) -> EntriesResponse:
+    """Enabled users whose password violates the domain policy."""
+    entries = get_password_policy_violations(
+        conn, base, include_never_set=include_never_set, limit=limit
+    )
+    return EntriesResponse(count=len(entries), entries=entries)
+
+
+@router.get("/privileged-groups", response_model=EntriesResponse, summary="Privileged groups")
+def privileged_groups(
+    conn: ConnDep,
+    base: BaseDep,
+    with_members: Annotated[bool, Query(description="Include each group's members")] = False,
+    nested: Annotated[bool, Query(description="Expand nested membership")] = False,
+) -> EntriesResponse:
+    """Report on well-known privileged groups with member counts."""
+    entries = get_privileged_groups(conn, base, with_members=with_members, nested=nested)
+    return EntriesResponse(count=len(entries), entries=entries)
+
+
+@router.get("/fsmo-roles", response_model=EntriesResponse, summary="FSMO role owners")
+def fsmo_roles(conn: ConnDep, base: BaseDep) -> EntriesResponse:
+    """Report the owner of each of the five FSMO roles."""
+    entries = list_fsmo_roles(conn, base)
+    return EntriesResponse(count=len(entries), entries=entries)
+
+
+@router.get("/trusts", response_model=EntriesResponse, summary="Domain trusts")
+def trusts(
+    conn: ConnDep,
+    base: BaseDep,
+    limit: Annotated[int, Query(ge=0, description="Max entries (0 = no limit)")] = 0,
+) -> EntriesResponse:
+    """List the domain's trust relationships."""
+    entries = list_trusts(conn, base, limit=limit)
+    return EntriesResponse(count=len(entries), entries=entries)
+
+
+@router.get("/sites", response_model=EntriesResponse, summary="AD sites")
+def sites(
+    conn: ConnDep,
+    base: BaseDep,
+    limit: Annotated[int, Query(ge=0, description="Max entries (0 = no limit)")] = 0,
+) -> EntriesResponse:
+    """List the AD sites from the Configuration NC."""
+    entries = list_sites(conn, base, limit=limit)
+    return EntriesResponse(count=len(entries), entries=entries)
+
+
+@router.get("/gpos", response_model=EntriesResponse, summary="Group Policy Objects")
+def gpos(
+    conn: ConnDep,
+    base: BaseDep,
+    limit: Annotated[int, Query(ge=0, description="Max entries (0 = no limit)")] = 0,
+) -> EntriesResponse:
+    """List Group Policy Objects."""
+    entries = list_gpos(conn, base, limit=limit)
+    return EntriesResponse(count=len(entries), entries=entries)
+
+
+@router.get("/gpos/{identifier}", response_model=EntryResponse, summary="Get a single GPO")
+def gpo(conn: ConnDep, base: BaseDep, identifier: str) -> EntryResponse:
+    """Return a single GPO matched by its cn (GUID) or displayName."""
+    entry = get_gpo(conn, base, identifier)
+    if entry is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="GPO not found")
+    return EntryResponse(entry=entry)
+
+
+@router.get(
+    "/fine-grained-password-policies",
+    response_model=EntriesResponse,
+    summary="Fine-grained password policies (PSOs)",
+)
+def fine_grained_password_policies(
+    conn: ConnDep,
+    base: BaseDep,
+    limit: Annotated[int, Query(ge=0, description="Max entries (0 = no limit)")] = 0,
+) -> EntriesResponse:
+    """List fine-grained password policies (PSOs)."""
+    entries = list_fine_grained_password_policies(conn, base, limit=limit)
+    return EntriesResponse(count=len(entries), entries=entries)

restad/routers/computers.py

@@ -0,0 +1,83 @@
+"""Read-only computer endpoints."""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, HTTPException, Query, status
+from msad import (
+    find_computers,
+    find_stale_computers,
+    get_computer,
+    list_domain_controllers,
+    summarize_computer_os,
+)
+
+from ..deps import BaseDep, ConnDep
+from ..models import EntriesResponse, EntryResponse, OsSummaryResponse
+
+router = APIRouter(prefix="/computers", tags=["computers"])
+
+
+@router.get("", response_model=EntriesResponse, summary="Find computers by field")
+def list_computers(
+    conn: ConnDep,
+    base: BaseDep,
+    name: Annotated[str | None, Query(description="cn (computer name); * wildcards ok")] = None,
+    dns: Annotated[str | None, Query(description="dNSHostName (FQDN); * wildcards ok")] = None,
+    os: Annotated[str | None, Query(description="operatingSystem; * wildcards ok")] = None,
+    limit: Annotated[int, Query(ge=0, description="Max entries (0 = no limit)")] = 0,
+) -> EntriesResponse:
+    """Find computers matching one or more fields (all ANDed together)."""
+    entries = find_computers(conn, base, name=name, dns=dns, os=os, limit=limit)
+    return EntriesResponse(count=len(entries), entries=entries)
+
+
+@router.get("/stale", response_model=EntriesResponse, summary="Find stale computers")
+def stale_computers(
+    conn: ConnDep,
+    base: BaseDep,
+    days: Annotated[int, Query(ge=0, description="Staleness threshold in days")] = 90,
+    include_never: Annotated[
+        bool, Query(description="Also include never-logged-on computers")
+    ] = False,
+    limit: Annotated[int, Query(ge=0, description="Max entries (0 = no limit)")] = 0,
+) -> EntriesResponse:
+    """Computers whose last logon is older than ``days`` days."""
+    entries = find_stale_computers(conn, base, days=days, include_never=include_never, limit=limit)
+    return EntriesResponse(count=len(entries), entries=entries)
+
+
+@router.get(
+    "/domain-controllers",
+    response_model=EntriesResponse,
+    summary="List domain controllers",
+)
+def domain_controllers(
+    conn: ConnDep,
+    base: BaseDep,
+    limit: Annotated[int, Query(ge=0, description="Max entries (0 = no limit)")] = 0,
+) -> EntriesResponse:
+    """List the domain controllers (DC computer accounts)."""
+    entries = list_domain_controllers(conn, base, limit=limit)
+    return EntriesResponse(count=len(entries), entries=entries)
+
+
+@router.get("/os-summary", response_model=OsSummaryResponse, summary="Computer OS summary")
+def os_summary(
+    conn: ConnDep,
+    base: BaseDep,
+    limit: Annotated[int, Query(ge=0, description="Max computers to scan (0 = no limit)")] = 0,
+) -> OsSummaryResponse:
+    """Summarize computer accounts grouped by operatingSystem."""
+    items = summarize_computer_os(conn, base, limit=limit)
+    return OsSummaryResponse(count=len(items), items=items)
+
+
+@router.get("/{identifier}", response_model=EntryResponse, summary="Get a single computer")
+def read_computer(conn: ConnDep, base: BaseDep, identifier: str) -> EntryResponse:
+    """Return a single computer matched by sAMAccountName, cn or dNSHostName."""
+    entry = get_computer(conn, base, identifier)
+    if entry is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Computer not found")
+    return EntryResponse(entry=entry)

restad/routers/groups.py

@@ -0,0 +1,75 @@
+"""Read-only group endpoints."""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, HTTPException, Query, status
+from msad import find_groups, get_group, is_member, list_empty_groups
+from msad.exceptions import MsadNotFoundError
+from msad.group import group_members
+
+from ..deps import BaseDep, ConnDep
+from ..models import BoolResponse, EntriesResponse, EntryResponse
+
+router = APIRouter(prefix="/groups", tags=["groups"])
+
+
+@router.get("", response_model=EntriesResponse, summary="Search groups")
+def list_groups(
+    conn: ConnDep,
+    base: BaseDep,
+    q: Annotated[
+        str, Query(description="cn/name/sAMAccountName/displayName; * wildcards ok")
+    ] = "*",
+    limit: Annotated[int, Query(ge=0, description="Max entries (0 = no limit)")] = 0,
+) -> EntriesResponse:
+    """Search groups by cn, name, sAMAccountName or displayName."""
+    entries = find_groups(conn, base, q, limit=limit)
+    return EntriesResponse(count=len(entries), entries=entries)
+
+
+@router.get("/empty", response_model=EntriesResponse, summary="List empty groups")
+def empty_groups(
+    conn: ConnDep,
+    base: BaseDep,
+    limit: Annotated[int, Query(ge=0, description="Max entries (0 = no limit)")] = 0,
+) -> EntriesResponse:
+    """List groups that have no direct members."""
+    entries = list_empty_groups(conn, base, limit=limit)
+    return EntriesResponse(count=len(entries), entries=entries)
+
+
+@router.get("/{identifier}", response_model=EntryResponse, summary="Get a single group")
+def read_group(conn: ConnDep, base: BaseDep, identifier: str) -> EntryResponse:
+    """Return a single group matched by sAMAccountName or cn."""
+    entry = get_group(conn, base, identifier)
+    if entry is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Group not found")
+    return EntryResponse(entry=entry)
+
+
+@router.get("/{identifier}/members", response_model=EntriesResponse, summary="Group members")
+def read_group_members(
+    conn: ConnDep,
+    base: BaseDep,
+    identifier: str,
+    nested: Annotated[bool, Query(description="Expand nested membership")] = False,
+    limit: Annotated[int, Query(ge=0, description="Max entries (0 = no limit)")] = 0,
+) -> EntriesResponse:
+    """Return the members of a group as person objects."""
+    try:
+        entries = group_members(conn, base, identifier, nested=nested, limit=limit)
+    except MsadNotFoundError as exc:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(exc)) from exc
+    return EntriesResponse(count=len(entries), entries=entries)
+
+
+@router.get("/{identifier}/members/{user}", response_model=BoolResponse, summary="Membership check")
+def read_is_member(conn: ConnDep, base: BaseDep, identifier: str, user: str) -> BoolResponse:
+    """Check whether ``user`` is a (possibly nested) member of the group."""
+    try:
+        result = is_member(conn, base, group=identifier, user=user)
+    except MsadNotFoundError as exc:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(exc)) from exc
+    return BoolResponse(result=result)