Release 1.11.0: end-user catalog, access requests, nested groups

Closes the end-user half of the directory and adds nested LDAP groups.

The directory could describe the lab but could not tell anyone what they had
or how to reach it, and several of the paths meant to do so were silently
returning nothing:

  - GET /api/discovery/me resolved groups from req.user.groups, which does not
    exist (req.user carries memberOf), so it returned only isPublic resources
    for every human caller -- "My Services" was blank for everyone. The same
    read made isDirectoryAdmin() false for real admins.
  - The portal's "Discover More Services" called the admin-gated endpoint and
    swallowed the 403, so it never rendered for non-admins at all.
  - Services reported no address, because /me had reimplemented getMyAccess
    without its parent-walking resolution.

Adds the catalog at /, self-service access requests, and admin access
visibility (per-resource counts, and the reverse "what can this user reach").

Nested groups come in two halves. groupOfNames.member already accepts a group
DN, so nesting needs no schema -- what it needs is resolution, which no
released OpenLDAP performs. The all-in-one image therefore builds slapd from a
pinned master commit for the nestgroup overlay, and the app computes the
closure itself when pointed at a server without it. Both paths are covered.

member-values is deliberately left out of nestgroup-flags: it expands `member`
when reading a group, which destroys the distinction between "listed here" and
"reachable through a nested group" and is not recoverable afterwards.

Full suite green in both resolution modes: 215 passed, 2 skipped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nodejs/views/directory.ejs

@@ -15,6 +15,13 @@
                           <option value="kind">Kind</option>
                           <option value="env">Environment</option>
                         </select>
+                        <div class="input-group input-group-sm shadow-sm" style="width: 230px;">
+                            <span class="input-group-text" title="What can this user reach?"><i class="fa-solid fa-user-shield"></i></span>
+                            <input type="text" id="user-access-uid" class="form-control" placeholder="uid…" list="access-uid-list"
+                                   onkeydown="if(event.key==='Enter'){openUserAccessModal();}">
+                            <datalist id="access-uid-list"></datalist>
+                            <button class="btn btn-outline-secondary" onclick="openUserAccessModal()">Check</button>
+                        </div>
 					    <button class="btn btn-sm btn-primary ms-1 shadow-sm" onclick="openAddModal()">
 					        <i class="fas fa-plus"></i> Add Resource
 					    </button>
@@ -31,6 +38,7 @@
               <tr>
                 <th class="ps-3">Resource</th>
                 <th>IP / Address</th>
+                <th>Access</th>
                 <th>Actions</th>
               </tr>
             </thead>
@@ -52,6 +60,7 @@
                   {{#metadata.ip}}<div><small>IP:</small> {{metadata.ip}}</div>{{/metadata.ip}}
                   {{#metadata.address}}<div><small>URL:</small> {{metadata.address}}</div>{{/metadata.address}}
                 </td>
+                <td>{{{accessHtml}}}</td>
                 <td>
                   <button class="btn btn-sm btn-primary" onclick="openEditModal('{{id}}')" title="Edit">
                     <i class="fa-solid fa-pen"></i>
@@ -135,6 +144,31 @@
       <label class="form-label">Description</label>
       <textarea id="res-description" class="form-control shadow-sm" rows="2"></textarea>
     </div>
+
+    <hr>
+    <h6 class="text-muted">Catalog appearance</h6>
+    <p class="text-muted small">How this resource is presented on the user-facing catalog at <code>/</code>.</p>
+
+    <div class="row mb-3">
+      <div class="col-4">
+        <label class="form-label">Icon</label>
+        <div class="input-group shadow-sm">
+          <span class="input-group-text"><i id="res-icon-preview" class="fa-solid fa-cube"></i></span>
+          <input type="text" id="res-icon" class="form-control font-monospace" placeholder="fa-solid fa-film">
+        </div>
+        <small class="field-help text-muted d-block">
+          A Font Awesome class. Blank falls back to a per-kind default.
+        </small>
+      </div>
+      <div class="col-8">
+        <label class="form-label">Tagline</label>
+        <input type="text" id="res-tagline" class="form-control shadow-sm" maxlength="120"
+               placeholder="One line shown on the catalog card">
+        <small class="field-help text-muted d-block">
+          Card-length blurb. Blank falls back to the Description above.
+        </small>
+      </div>
+    </div>
   `;
 
   var detailsTabHtml = `
@@ -340,7 +374,9 @@
   var allGroups = [];
   var allEdges = [];
   var rawResources = [];
-  
+  // resourceId -> { groups: [{cn, accessLevel, exists, memberCount}], memberCount }
+  var accessSummary = {};
+
   $(document).ready(async function() {
     await loadResources();
     const slug = app.modal.deepLinkSlug('/directory');
@@ -352,12 +388,16 @@
   
   async function loadResources() {
     try {
-      const [resResources, resGroups, resEdges] = await Promise.all([
+      const [resResources, resGroups, resEdges, resAccess] = await Promise.all([
         app.api.get('directory-admin/resources'),
         app.api.get('directory-admin/groups'),
-        app.api.get('directory-admin/edges')
+        app.api.get('directory-admin/edges'),
+        // Access counts are a nicety, not load-bearing: if the LDAP join fails
+        // the table still renders, just without the Access column populated.
+        app.api.get('directory-admin/access-summary').catch(function(){ return {results: {}}; })
       ]);
-      
+
+      accessSummary = (resAccess && resAccess.results) || {};
       resourcesById = {};
       
       for (const r of resResources.results) {
@@ -383,12 +423,75 @@
       }
       
       renderTable();
+
+      // Type-ahead for the "what can this user reach" lookup. Non-blocking: the
+      // input accepts a free-typed uid whether or not the list ever arrives.
+      loadDirectoryUsers().then(function(users) {
+        $('#access-uid-list').html(users.map(function(u) {
+          return '<option value="' + u.uid + '">' + (u.cn || u.uid) + '</option>';
+        }).join(''));
+      }).catch(function(){ /* datalist is a convenience only */ });
     } catch (err) {
       console.error(err);
       app.messages.toast('Failed to load data', 'danger');
     }
   }
-  
+
+  // "Who can reach this?" at a glance. A resource with no linked group is not a
+  // locked-down resource -- it is an unreachable one, and a group whose LDAP
+  // entry has been deleted grants nothing, so both get called out rather than
+  // rendering as a quiet zero.
+  function accessCellHtml(resourceId) {
+    const summary = accessSummary[resourceId];
+    if (!summary || !summary.groups.length) {
+      return '<span class="badge bg-light text-dark border" title="No LDAP group gates this resource">no groups</span>';
+    }
+    const dangling = summary.groups.filter(g => !g.exists);
+    let html = '<span class="badge bg-primary" title="' +
+      summary.groups.map(g => g.cn + ' (' + g.accessLevel + ', ' + g.memberCount + ')').join('&#10;') +
+      '"><i class="fa-solid fa-user-group"></i> ' + summary.memberCount + '</span>';
+    html += ' <small class="text-muted">' + summary.groups.length +
+      ' group' + (summary.groups.length === 1 ? '' : 's') + '</small>';
+    if (dangling.length) {
+      html += ' <span class="badge bg-warning text-dark" title="Linked group missing in LDAP: ' +
+        dangling.map(g => g.cn).join(', ') + '">!</span>';
+    }
+    return html;
+  }
+
+  // Reverse lookup: what can a given user reach? The question an access-control
+  // pane must answer and the directory previously could not -- /api/discovery/me
+  // only ever answered it for the caller themselves.
+  async function openUserAccessModal() {
+    const uid = ($('#user-access-uid').val() || '').trim();
+    if (!uid) return;
+    app.modal.open({ title: 'Access for ' + uid, bodyHtml: '<p class="text-muted">Loading…</p>' });
+    try {
+      const res = await app.api.get('directory-admin/user-access/' + encodeURIComponent(uid));
+      const data = res.results;
+      let html;
+      if (!data.resources.length) {
+        html = '<p class="text-muted">This user is in ' + data.groups.length +
+          ' group(s), none of which gate a directory resource.</p>';
+      } else {
+        html = '<table class="table table-sm"><thead><tr><th>Resource</th><th>Kind</th>' +
+          '<th>Via group</th><th>Level</th></tr></thead><tbody>' +
+          data.resources.map(function(r) {
+            return '<tr><td><a href="/directory/' + encodeURIComponent(r.slug) + '">' + r.name + '</a></td>' +
+              '<td><span class="badge bg-secondary">' + r.kind + '</span></td>' +
+              '<td><code>' + r.groupCn + '</code></td>' +
+              '<td>' + r.accessLevel + '</td></tr>';
+          }).join('') + '</tbody></table>';
+      }
+      app.modal.open({ title: 'Access for ' + data.uid, bodyHtml: html, size: 'lg' });
+    } catch (err) {
+      app.modal.open({
+        title: 'Access for ' + uid,
+        bodyHtml: '<p class="text-danger">' + ((err && err.message) || 'Lookup failed') + '</p>'
+      });
+    }
+  }
+
   function renderTable() {
     const filter = $('#search-filter').val().toLowerCase();
     const sort = $('#sort-by').val();
@@ -440,6 +543,7 @@
             indentHtml += '<i class="fa-solid fa-turn-up fa-rotate-90 text-muted me-2"></i>';
          }
          n.indentHtml = indentHtml;
+         n.accessHtml = accessCellHtml(n.id);
          finalRenderList.push(n);
          if (n.children.length > 0) {
            flatten(n.children, depth + 1);
@@ -515,6 +619,26 @@
     }
   });
 
+  // Per-kind fallbacks, kept in sync with KIND_ICONS in views/landing.ejs so the
+  // preview shows what the catalog will actually render for a blank icon.
+  var KIND_ICON_FALLBACK = {
+    site: 'fa-solid fa-city',
+    host: 'fa-solid fa-server',
+    service: 'fa-solid fa-cube',
+    oauth: 'fa-solid fa-key'
+  };
+
+  function updateIconPreview() {
+    const raw = ($('#res-icon').val() || '').trim();
+    const cls = raw || KIND_ICON_FALLBACK[$('#res-kind').val()] || 'fa-solid fa-cube';
+    // Replace the class wholesale rather than toggling: a typed class is
+    // arbitrary user input and there is no reliable way to remove "whatever was
+    // there before" incrementally.
+    $('#res-icon-preview').attr('class', cls);
+  }
+
+  app.modal.on('input change', '#res-icon, #res-kind', updateIconPreview);
+
   function openAddModal(parentId, parentKind) {
     openResourceModal('Add Resource', null);
     $('#res-id').val('');
@@ -547,6 +671,9 @@
     $('#res-git-repo').val('');
     $('#res-install-path').val('');
     $('#res-systemd').val('');
+    $('#res-icon').val('');
+    $('#res-tagline').val('');
+    updateIconPreview();
     $('#res-is-production').prop('checked', false);
     $('#res-is-external').prop('checked', false);
     $('#res-is-public').prop('checked', false);
@@ -782,6 +909,9 @@
     $('#res-git-repo').val(r.metadata.gitRepo || '');
     $('#res-install-path').val(r.metadata.installPath || '');
     $('#res-systemd').val(r.metadata.systemdService || '');
+    $('#res-icon').val(r.metadata.icon || '');
+    $('#res-tagline').val(r.metadata.tagline || '');
+    updateIconPreview();
     $('#res-is-production').prop('checked', !!r.metadata.isProduction);
     $('#res-is-external').prop('checked', !!r.metadata.isExternalReachable);
     $('#res-is-public').prop('checked', !!r.metadata.isPublic);
@@ -827,6 +957,8 @@
         gitRepo: $('#res-git-repo').val(),
         installPath: $('#res-install-path').val(),
         systemdService: $('#res-systemd').val(),
+        icon: $('#res-icon').val().trim(),
+        tagline: $('#res-tagline').val().trim(),
         isProduction: $('#res-is-production').is(':checked'),
         isExternalReachable: $('#res-is-external').is(':checked'),
         isPublic: $('#res-is-public').is(':checked'),