Release 1.11.0: end-user catalog, access requests, nested groups

Closes the end-user half of the directory and adds nested LDAP groups.

The directory could describe the lab but could not tell anyone what they had
or how to reach it, and several of the paths meant to do so were silently
returning nothing:

  - GET /api/discovery/me resolved groups from req.user.groups, which does not
    exist (req.user carries memberOf), so it returned only isPublic resources
    for every human caller -- "My Services" was blank for everyone. The same
    read made isDirectoryAdmin() false for real admins.
  - The portal's "Discover More Services" called the admin-gated endpoint and
    swallowed the 403, so it never rendered for non-admins at all.
  - Services reported no address, because /me had reimplemented getMyAccess
    without its parent-walking resolution.

Adds the catalog at /, self-service access requests, and admin access
visibility (per-resource counts, and the reverse "what can this user reach").

Nested groups come in two halves. groupOfNames.member already accepts a group
DN, so nesting needs no schema -- what it needs is resolution, which no
released OpenLDAP performs. The all-in-one image therefore builds slapd from a
pinned master commit for the nestgroup overlay, and the app computes the
closure itself when pointed at a server without it. Both paths are covered.

member-values is deliberately left out of nestgroup-flags: it expands `member`
when reading a group, which destroys the distinction between "listed here" and
"reachable through a nested group" and is not recoverable afterwards.

Full suite green in both resolution modes: 215 passed, 2 skipped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nodejs/routes/discovery.js

@@ -10,9 +10,14 @@
 // jump-host's `data.results || []` silently collapsed to `[]`, so no user could
 // bridge) and absorbs the dead /me handler that used to live in
 // routes/api_discovery.js (mounted after the 404, so unreachable).
+//
+// Group CNs come from utils/user_groups — `req.user` has `memberOf` (DNs) and
+// no `.groups`, so reading `.groups` off it directly yields [] for every human
+// caller. See that file for what that silently broke.
 
 const router = require('express').Router();
 const { Resource, ResourceGroup } = require('../models/resource');
+const { withGroups } = require('../utils/user_groups');
 const {
 	envelope,
 	projectResource,
@@ -20,20 +25,29 @@ const {
 	isDirectoryAdmin,
 } = require('@simpleworkjs/directory-schema');
 
+// Resolve the caller's groups once per request and hand back the projection
+// flag. Every handler needs both, and both are wrong if taken off req.user raw.
+async function callerView(req) {
+	const user = await withGroups(req.user);
+	return { user, fullMetadata: isDirectoryAdmin(user) };
+}
+
 // GET /api/discovery/resources[?kind=&group=&parent=]
 router.get('/resources', async (req, res, next) => {
 	try {
+		const { fullMetadata } = await callerView(req);
 		const resources = await Resource.search(req.query);
-		res.json(envelope(projectResources(resources, { fullMetadata: isDirectoryAdmin(req.user) })));
+		res.json(envelope(projectResources(resources, { fullMetadata })));
 	} catch (err) { next(err); }
 });
 
 // GET /api/discovery/resources/:slug
 router.get('/resources/:slug', async (req, res, next) => {
 	try {
+		const { fullMetadata } = await callerView(req);
 		const resource = await Resource.getBySlug(req.params.slug);
 		// parents/children are edges (no secrets); project only the resource body.
-		const projected = projectResource(resource, { fullMetadata: isDirectoryAdmin(req.user) });
+		const projected = projectResource(resource, { fullMetadata });
 		projected.parents = resource.parents;
 		projected.children = resource.children;
 		res.json(envelope(projected));
@@ -43,9 +57,10 @@ router.get('/resources/:slug', async (req, res, next) => {
 // GET /api/discovery/graph
 router.get('/graph', async (req, res, next) => {
 	try {
+		const { fullMetadata } = await callerView(req);
 		const graph = await Resource.getGraph();
 		res.json(envelope({
-			resources: projectResources(graph.resources, { fullMetadata: isDirectoryAdmin(req.user) }),
+			resources: projectResources(graph.resources, { fullMetadata }),
 			edges: graph.edges,
 		}));
 	} catch (err) { next(err); }
@@ -54,26 +69,28 @@ router.get('/graph', async (req, res, next) => {
 // GET /api/discovery/me
 // Returns the resources the current caller can reach. Machines see only their
 // own resource; humans get the union of their LDAP groups' resources plus
-// anything flagged isPublic. Uses req.user.groups (populated by the auth
-// middleware for session/PAT callers) rather than re-querying LDAP by DN, so it
-// works for every auth transport without assuming a .dn is present.
+// anything flagged isPublic.
 router.get('/me', async (req, res, next) => {
 	try {
+		const { user, fullMetadata } = await callerView(req);
 		let accessible;
 		if (req.user && req.user.isMachine) {
 			accessible = await Resource.list({ where: { id: req.resourceId } });
 		} else {
-			const userGroups = (req.user && req.user.groups) || [];
 			const ids = new Set();
-			if (userGroups.length) {
-				const rgs = await ResourceGroup.list({ where: { groupCn: { in: userGroups } } });
+			if (user.groups.length) {
+				const rgs = await ResourceGroup.list({ where: { groupCn: { in: user.groups } } });
 				for (const rg of rgs) ids.add(rg.resourceId);
 			}
 			const all = await Resource.list();
 			accessible = all.filter(r => ids.has(r.id) || (r.metadata && r.metadata.isPublic));
 		}
-		res.json(envelope(projectResources(accessible, { fullMetadata: isDirectoryAdmin(req.user) })));
+		// resolvedAddress is the whole point of /me ("how do I reach it") and a
+		// service inherits it from its host, so it must be computed here rather
+		// than left to each caller to guess at address || ip.
+		accessible = await Resource.withResolvedAddress(accessible);
+		res.json(envelope(projectResources(accessible, { fullMetadata })));
 	} catch (err) { next(err); }
 });
 
-module.exports = router;
+module.exports = router;