Release 1.4.0: shared @simpleworkjs/* packages; fix discovery envelope drift + client_secret_hash leak

Rewire onto @simpleworkjs/directory-schema, /ldap, and /app-stack. The
directory discovery API now returns the {results} envelope via explicit
/resources, /resources/:slug, /graph, /me handlers and routes every read
through projectResource/projectResources, which unconditionally strips
client_secret_hash (and any /secret|password|privatekey/i key) and reduces
metadata to a public allowlist for non-admins — closing the leak where the ORM
serialized metadata wholesale. The dead routes/api_discovery.js (mounted after
the 404 catcher) is removed; ?group= now returns 200 instead of 404. user_ldap
+ group_ldap take escapeFilter/escapeDN + makeClient/withClient from the shared
ldap package (posix/write-side stays app-local; cert validation unchanged).
build_info unified to {buildVersion,buildHash,buildYear}; ldapts ^8.1.8. New
tests/discovery.test.js locks in the envelope + no-secrets guarantees. Lockfile
regenerated from the registry (no file:/link:).

Co-Authored-By: Claude <noreply@anthropic.com>

.dockerignore

@@ -20,9 +20,9 @@
 !directory_spec.md
 !docs/**/*.md
 
-# Tests
+# Tests (excluded from production builds; test-runner Dockerfile copies them explicitly)
-nodejs/tests/
+# nodejs/tests/
-nodejs/*.test.js
+# nodejs/*.test.js
 
 # Host dependency tree — let the image run a clean `npm ci`. Also avoids
 # copying platform-wrong native modules (e.g. bcrypt built for the host OS).

CHANGELOG.md

@@ -4,6 +4,59 @@ All notable changes to this project are documented here. Format loosely
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions
 correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
+## [1.4.0] - 2026-07-25
+
+### Security
+- **The directory discovery API leaked OAuth `client_secret_hash` (and any secret-ish metadata key) to every authenticated caller.** `Resource` doesn't override `toJSON`, so the ORM serialized `metadata` wholesale — including the `client_secret_hash` stored on `kind:'oauth'` resources — across `GET /api/discovery/resources`, `/graph`, `/me`, `/resources/:slug`, and the directory-admin `GET /api/directory-admin/resources`. Every discovery read endpoint and the admin list now route through `projectResource`/`projectResources` from `@simpleworkjs/directory-schema`, which unconditionally strips secret keys (anything matching `/secret|password|privatekey/i`, including `client_secret_hash`) and, for non-directory-admins, reduces metadata to a public allowlist. Admins never receive `client_secret_hash` either.
+
+### Fixed
+- **Directory discovery envelope drift.** `routes/discovery.js` (the `autoRouter(Resource)` mounted live at `app.js:87`) returned **bare arrays**, not the `{ results: [...] }` envelope the directory contract specifies — so jump-host's `data.results || []` collapsed every per-group query to `[]` and no user could bridge. Discovery is now served by explicit `/resources`, `/resources/:slug`, `/graph`, `/me` handlers that all return the `{ results }` envelope. The dead `routes/api_discovery.js` (mounted at `app.js:112`, *after* the 404 catcher) and its mount were removed.
+- `GET /api/discovery/resources?group=<cn>` now returns 200 with `{ results: [...] }` instead of 404 (the autoRouter's `search` supported `?group=`, but the route was effectively unreachable for jump-host's call pattern).
+
+### Added
+- Adopted the shared `@simpleworkjs/*` packages published under the simpleworkjs org:
+  - `@simpleworkjs/directory-schema` — the directory contract: the `kind` enum, `Resource`/`ResourceEdge`/`ResourceGroup` field defs, the `{ results }` envelope, the security projection (`projectResource`/`projectResources`/`isDirectoryAdmin`), and the discovery client. `models/resource.js` imports the field defs; the discovery + directory-admin routes use the projection.
+  - `@simpleworkjs/ldap` — `models/user_ldap.js` and `models/group_ldap.js` now take `escapeFilter`/`escapeDN` and `makeClient`/`withClient` from the shared package (via local wrappers that pass `conf`); sso keeps its rich `User.get`/`Group.get`/`User.login`/`User.addSSHkey` (posix/write-side stays app-local). sso's `makeClient` passes no `tlsOptions`, so cert validation is unchanged.
+  - `@simpleworkjs/app-stack` — unified `build_info` (`{buildVersion, buildHash, buildYear}`) and the `static-modules` mounting helper. `utils/build_info.js` and the static-modules loop in `routes/index.js` use the shared helpers.
+- New `tests/discovery.test.js` (jest + supertest, runs under the docker harness): locks in the `{ results }` envelope on `/resources`, `/graph`, `/me`, `/resources/:slug`, the `?group=` 200-regression, and the no-`client_secret_hash`/no-secret-key guarantee for every caller.
+
+### Changed
+- Dependency alignment: `ldapts` `^8.1.2` → `^8.1.8`. The new `@simpleworkjs/*` deps resolve from the npm registry (`^1.0.0`); no `file:`/`link:` entries in the lockfile, so `npm ci` is clean in docker builds.
+- `build_info` export shape changed from `{commit, version}` to `{buildVersion, buildHash, buildYear}` (the shared shape used by all three apps).
+
+## [1.3.2] - 2026-07-23
+
+### Fixed
+- **OAuth client management API returned `client_id: undefined` on every GET.** The ORM's `Model.toJSON()` only serializes schema fields, so the mapped `client_id`/`scopes`/`redirect_uris`/… that `OAuthClient.get()` attaches to the wrapped Resource were stripped from `GET /api/oauth/client` and `GET /api/oauth/client/:id` responses. The theta-env bootstrap (which lists clients and rotates by the returned `client_id`) then called `/api/oauth/client/undefined/rotate` and got a 500, aborting stack bring-up when `proxy-secrets.js` had no usable secret. `OAuthClient.get()` now emits an explicit public JSON shape (and deliberately omits `client_secret_hash`, so the secret hash no longer leaks over the API).
+- `OAuthClient.get()` no longer 500s on an unknown/`undefined` client id: `Resource.get()` returns `null` (it doesn't throw), which was dereferenced as `r.kind`. It now returns a clean 404.
+
+## [1.3.1] - 2026-07-23
+
+### Added
+- The Directory documentation (`docs/directory.md`) is now surfaced: registered in-app at `/docs/directory` ("Directory & Inventory"), help-linked from the Directory page header, and linked from the docs-site index. Extended with the shared slug conventions (`site_<name>`, `host_<hostname>` — as used by ldap-client and the theta-env seed), the automatic-registration story (theta-env stack seeding, ldap-client Linux host enrollment), and the API surface (admin at `/api/directory-admin`, read-only graph at `/api/discovery`).
+
+### Changed
+- Direct LDAP binds are described as first-class, not "legacy", across README, DEPLOYMENT.md, docs, and the Dockerfile: Linux hosts are a primary consumer of the directory (PAM/SSSD login, LDAP-backed `sudo` via `sudoRole`, SSH public keys via openssh-lpk) — exactly what the custom schemas exist for.
+
+## [1.3.0] - 2026-07-23
+
+### Added
+- **OAuth client management API** at `/api/oauth/client` (group `app_sso_oauth_admin`): list, create, update, delete, and rotate-secret for OAuth clients, backed by the Resource model. Accepts form-style string inputs (newline-separated `redirect_uris`/`allowed_groups`, space-separated `scopes`).
+- **Dockerized test suite**: `docker-compose -f docker-compose.test.yml up --build` spins up OpenLDAP + Redis + a test-runner that seeds the test user and runs the full jest suite (174 tests) against them. `tests/globalSetup.js` honors `REDIS_URL`.
+
+### Fixed
+- Completed the model-redis → `@simpleworkjs/orm` port that shipped half-finished in 1.2.1:
+  - `OtpToken.issue`/`verify` called nonexistent `find()`/`listDetail()` — every OTP login 500'd.
+  - Impersonation create/revoke called nonexistent `ImpersonationToken.listDetail()` — both endpoints 500'd.
+  - `OAuthClient` read `is_valid` from the Resource model, which has no such column — every client evaluated as disabled and **all `/oauth/authorize` requests were rejected with 400**. Client validity now lives in `metadata` (absent = valid).
+  - `OAuthClient.add` didn't set the required-unique `Resource.slug`; clients now get a slug derived from the client name.
+  - `GET /api/token/:name/:token` returned `{results: null}` with 200 for unknown tokens (orm `get()` returns null instead of throwing); now 404s.
+- `User.login` returns a clean 401 instead of crashing when neither `uid` nor `username` is supplied.
+- Depend on published `@simpleworkjs/orm` ^0.2.8 and `model-redis` ^1.6.0 instead of a local `file:` link that broke `npm ci` in docker builds.
+
+### Changed
+- Removed the Mobile Phone field from the user create/edit form.
+
 ## [1.2.1] - 2026-07-22
 
 ### Added

DEPLOYMENT.md

@@ -120,7 +120,7 @@ bare-metal / advanced standalone use; most deployments should use the file.
 - Health check: `http://localhost:3001/health` → `{"status":"ok"}`
 - OIDC discovery: `http://localhost:3001/.well-known/openid-configuration`
 - LDAP (internal, app↔slapd): `ldap://localhost:389` (not mapped to the host)
-- LDAPS (for legacy apps / direct binds): `ldaps://<host>:636` (TLS)
+- LDAPS (direct binds: Linux hosts, LDAP-native apps): `ldaps://<host>:636` (TLS)
 
 ### API tokens (personal access tokens)
 
@@ -483,8 +483,8 @@ netstat -tlnp | grep 389
 2. **Use LDAPS / StartTLS** for any LDAP connection that crosses the network. The
    bundled slapd listens on `ldaps:///` (636, TLS) and `ldap:///` (389, plain +
    StartTLS); port 389 is not mapped to the host by default so LAN clients can't
-   bind in cleartext. Direct-LDAP apps (legacy services, `theta42/proxy`) should
+   bind in cleartext. Direct-LDAP consumers (Linux hosts, LDAP-native apps,
-   use `ldaps://…:636` or StartTLS.
+   `theta42/proxy`) should use `ldaps://…:636` or StartTLS.
 3. **Persist `JWT_SECRET`** — if the Docker image auto-generates one and you don't
    set `JWT_SECRET`, issued tokens invalidate on container recreation.
 4. **Don't expose the UI's HTTP port to the internet** — terminate TLS at a front

Dockerfile.openldap

@@ -131,7 +131,8 @@ COPY ops/schema/openssh-lpk.schema /etc/openldap/schema/openssh-lpk.schema
 # 3001: SSO Manager web interface (HTTP — terminate TLS at the front proxy)
 # 389:  LDAP  (plain + StartTLS) — used internally by the app; map to host only
 #       if you want LAN clients to bind without TLS (not recommended).
-# 636:  LDAPS — for legacy apps / direct LDAP binds over the network (TLS)
+# 636:  LDAPS — direct LDAP binds over the network (TLS): Linux host auth
+#       (PAM/SSSD, sudo, SSH keys) and LDAP-native apps
 EXPOSE 3001 389 636
 
 # Health check

Dockerfile.test-runner

@@ -0,0 +1,50 @@
+# Test-runner image for SSO Manager.
+#
+# Installs all dependencies (including dev) and bundles the app code plus
+# the seed script. The entrypoint waits for LDAP + Redis, seeds the test
+# user, then runs whatever command is given (default: npm test).
+
+FROM node:20-alpine
+
+# Install OpenLDAP clients (ldapadd, ldapsearch) and bash for the seed script
+RUN apk add --no-cache openldap-clients bash
+
+WORKDIR /app
+
+# Copy and install dependencies (including devDependencies for jest/supertest)
+COPY nodejs/package*.json ./
+RUN npm ci
+
+# Copy the application source
+COPY nodejs/app.js ./
+COPY nodejs/bin ./bin
+COPY nodejs/conf ./conf
+COPY nodejs/controller ./controller
+COPY nodejs/middleware ./middleware
+COPY nodejs/models ./models
+COPY nodejs/routes ./routes
+COPY nodejs/services ./services
+COPY nodejs/utils ./utils
+COPY nodejs/views ./views
+COPY nodejs/public ./public
+COPY nodejs/tests ./tests
+
+# SQLite database directory (config/inventory.sqlite for Resource model's ORM)
+RUN mkdir -p /app/config
+
+# Files expected at the flattened /app path (see Dockerfile.openldap notes)
+COPY tos.md /tos.md
+COPY README.md /README.md
+COPY CHANGELOG.md /CHANGELOG.md
+COPY DEPLOYMENT.md /DEPLOYMENT.md
+COPY API.md /API.md
+COPY directory_spec.md /directory_spec.md
+COPY docs /docs
+
+# Seed script and utility
+COPY test_seed.js ./test_seed.js
+COPY test/seed-test-user.sh /usr/local/bin/seed-test-user
+RUN chmod +x /usr/local/bin/seed-test-user
+
+# Default command: seed the test user, then run the test suite
+CMD ["sh", "-c", "seed-test-user && npm test"]

README.md

@@ -41,9 +41,10 @@ phone-home, no hosted control plane, and no per-user pricing.
 - **Web management UI** — manage users, groups, and OAuth clients from a
   browser; invite and password-reset flows over email; user self-service for
   profile and API tokens.
-- **LDAPS for legacy apps** — apps that bind LDAP directly (Gitea, Emby, and
+- **Direct LDAP binds** — Linux hosts (PAM/SSSD login, LDAP-backed `sudo`
-  anything else that speaks LDAP) use LDAPS (636) or StartTLS against the same
+  rules, SSH public keys via openssh-lpk) and LDAP-native apps (Gitea, Emby,
-  directory, so you don't maintain a second user database for them.
+  and anything else that speaks LDAP) use LDAPS (636) or StartTLS against the
+  same directory, so you don't maintain a second user database for them.
 - **Personal access tokens** — any user can mint a long-lived bearer token to
   drive the management API from scripts or CI, scoped to their own permissions.
 - **All-in-one Docker image** — app + OpenLDAP + Redis in one container, or run
@@ -151,7 +152,7 @@ details, including env var overrides (`LDAP_BASE_DN`, `SKIP_LDAP`, ...), in
 ┌────────────────────────┐
 │  OpenLDAP (slapd)      │
 │  - users / groups      │
-│  - LDAPS :636          │─── legacy apps bind directly
+│  - LDAPS :636          │─── Linux hosts + LDAP apps bind directly
 │  - StartTLS :389       │
 └────────────────────────┘
 ```

directory_spec.md

@@ -1,8 +1,10 @@
 # Home-Lab Directory / Inventory — Design Spec
 
-Status: **Draft / agreed direction** (no code yet)
+Status: **Implemented** (v1.2.1+: model, admin API, UI; v1.3.x: automatic
+registration from theta-env + ldap-client). §9 adds the planned-consumer
+readiness review.
 Owner: wmantly
-Last updated: 2026-07-02
+Last updated: 2026-07-23
 
 ---
 
@@ -220,3 +222,148 @@ Write endpoints (POST/PUT/DELETE) are **out of scope for v1**; population is man
    for auth, SQL for inventory.
 4. **Read-visibility policy:** confirm option (a) vs (b) in §5.
 5. **Service token scope:** Currently `ApiToken` shares the creator's full permissions. A future enhancement could scope tokens specifically to the Directory API.
+
+---
+
+## 9. Planned consumers — data-model & API readiness
+
+Five consumers the directory data should be able to power. None are being
+built yet; this section records what each needs, what already exists, and the
+gaps to close so the model/API never paints us into a corner.
+
+The recurring theme: **the graph model itself (Resource / ResourceEdge /
+ResourceGroup + LDAP groups) is sufficient for all five.** The gaps are
+(a) one new model (access requests), (b) machine-to-machine auth for the read
+API, (c) documented metadata conventions instead of new columns, and
+(d) change detection for the drift/sync consumers.
+
+### 9.1 End-user exploration ("Netflix-style" catalog + request access)
+
+A user browses everything that exists — part advertisement, part
+documentation — sees what they already have, and requests access to the rest.
+
+Already there:
+- `/api/discovery/me` (`getMyAccess`) — the "My Services" half.
+- `Resource.owner` + `<slug>_access` / `<slug>_admin` ResourceGroup links —
+  who approves, and which group an approval means joining.
+- The Notification model — the approval-request delivery mechanism.
+
+Gaps:
+1. **Catalog projection with metadata privacy.** `/api/discovery/resources`
+   returns full `metadata` to any authenticated user — including the OAuth
+   kind's `client_secret_hash`, and operator notes that may name internal
+   IPs. Needed: a per-kind public projection (name, description, kind,
+   subType, icon, address, hasAccess, requestable) and a private-key
+   convention for the rest (e.g. only `app_sso_directory_admin` sees full
+   metadata). This is a **fix worth doing before any catalog UI exists**.
+2. **`AccessRequest` model** — the one genuinely new model:
+   `{id, uid, resourceId, groupCn, status: pending|approved|denied, note,
+   requestedOn, decidedBy, decidedOn}`. Approval = LDAP group add + notify.
+   Endpoints: user POST/GET own; resource owner / directory admin
+   list/approve/deny.
+3. **Catalog metadata conventions**: `icon`, `tagline` (card-length blurb),
+   `requestable: false` for resources that shouldn't be advertised.
+
+### 9.2 SSH jump host (`username_-_{hostname-or-ip}@publicHost`)
+
+A public jump host parses the target out of the SSH username, checks the user
+may reach that host, and proxies the connection (WinSCP-friendly: one
+username string, no interactive menu needed — though an interactive picker on
+plain `username@` login is the same query).
+
+Already there:
+- Hosts carry `ip` (and `host_<hostname>` slugs to resolve by name).
+- Access is already group-based (`<slug>_access`), checkable via LDAP alone —
+  the jump host can run entirely off LDAP (SSSD) + one directory query.
+- User SSH keys are in LDAP (openssh-lpk) — the jump host authenticates the
+  real user without local accounts.
+
+Gaps:
+1. **Machine auth for the access query.** The jump host must ask "may user X
+   reach host Y" / "list hosts user X may reach" *about another user*.
+   `getMyAccess` only answers for the calling user. Needed: a
+   service-token-authenticated endpoint (`GET
+   /api/discovery/access/:uid[/:slug]`). `ServiceToken` already exists and
+   is even linked to a resource (`resource_id`) — what's missing is an auth
+   middleware that accepts it and a permission rule ("service tokens may
+   read access info, scoped read-only").
+2. **Connection metadata conventions** on hosts: `sshPort` (default 22),
+   optional `fqdn` (when IP is dynamic), optional `jumpVia` edge relation if
+   multi-hop topologies ever appear.
+3. Document the username grammar (`{uid}_-_{host-slug-or-ip}`) here so the
+   seed/ldap-client keep host slugs DNS-safe (they already are: slugify
+   strips everything but `[a-z0-9-]`).
+
+### 9.3 Firewall port-forward rules (build / update / drift-test)
+
+An automation renders the public firewall's forwarding table from the
+directory, applies it, and alerts on drift in either direction.
+
+Already there:
+- `metadata.port` / `metadata.externalPort` / `metadata.ip` /
+  `metadata.isExternalReachable` — the core mapping data, already seeded for
+  the stack's own services.
+
+Gaps:
+1. **Port-mapping convention is too thin for real rules**: no protocol, no
+   multi-port services. Adopt `metadata.portMappings: [{proto: "tcp"|"udp",
+   external: n, internal: n, comment}]` as the authoritative form
+   (`port`/`externalPort` stay as the simple single-mapping case).
+2. **Drift detection needs cheap change polling**: an `updated_on` timestamp
+   on resources surfaced in the graph API, or a graph-level etag/hash, so
+   the runner can poll without diffing full payloads. (The ORM already
+   publishes create/update events internally — a future push feed can ride
+   that; polling comes first.)
+3. Same **service-token read auth** as 9.2 — automation must not run on a
+   human's session token.
+
+### 9.4 Local DNS / mDNS
+
+A DNS (or mDNS advertiser) zone is generated from the directory: hosts get
+A records from `metadata.ip`, services get CNAMEs/records from their
+addresses, sites map to zones.
+
+Already there:
+- `host_<hostname>` + `ip` covers A records; `site_<name>` is a natural zone
+  boundary; service `address` yields names.
+
+Gaps:
+1. **Name conventions**: `metadata.dnsNames: []` for extra aliases, and a
+   documented rule for which name wins (slug vs `address` hostname). TTL
+   only if someone actually needs per-record TTLs — default is fine.
+2. Same **change detection** as 9.3 (poll `updated_on` / etag; push later).
+3. Nothing else — this consumer is nearly free once 9.3's conventions land.
+
+### 9.5 Access control for hosts
+
+Who may log in to / sudo on which machine, driven by the directory.
+
+Already there — this is the original point of the system:
+- `<slug>_access` / `<slug>_admin` groups are auto-provisioned per host;
+  ldap-client configures SSSD/PAM against the directory; `sudoRole` and
+  openssh-lpk schemas cover sudo and SSH keys.
+
+Gaps:
+1. **Close the loop in ldap-client**: joined hosts should set an SSSD access
+   filter (`access_provider = ldap`, filter on `host_<hostname>_access`
+   membership) so directory group membership *is* login permission, not just
+   identity. Today the registration exists but enforcement is host-side
+   convention.
+2. **`accessLevel` granularity**: ResourceGroup's `member`/`owner` maps to
+   login/admin today; if finer roles emerge (e.g. `login` vs `sudo` vs
+   `admin`), extend the enum — the join-table shape already supports it.
+
+### 9.6 Consolidated work list (model/API only, no consumers)
+
+Ordered by how much they unblock:
+
+1. **Metadata privacy projection** on the read API (blocks 9.1; fixes the
+   `client_secret_hash` exposure regardless of any consumer).
+2. **Service-token auth for `/api/discovery/*`** + `access/:uid` endpoint
+   (blocks 9.2, 9.3; ServiceToken model already exists).
+3. **`AccessRequest` model + endpoints** (blocks 9.1's request half).
+4. **Metadata conventions doc entries** (`sshPort`, `portMappings`,
+   `dnsNames`, `icon`, `tagline`, `requestable`) in `docs/directory.md` —
+   conventions, not schema changes; the json column already holds them.
+5. **`updated_on` in graph output / graph etag** (blocks drift/DNS
+   freshness; trivial once surfaced).

docker-compose.test.yml

@@ -0,0 +1,81 @@
+# Docker Compose for running the SSO Manager test suite.
+#
+# Spins up:
+#   ldap   — OpenLDAP + Redis (all-in-one image, slapd + redis only, no app)
+#   redis  — Standalone Redis for the app's model/token storage
+#   test-runner — Seeds the test user, then runs `npm test`
+#
+# Usage:
+#   docker compose -f docker-compose.test.yml up --build
+#   # Or to run a specific test file:
+#   docker compose -f docker-compose.test.yml run --rm test-runner npx jest tests/auth.test.js
+#
+# The LDAP service uses the same Dockerfile.openldap image as production but
+# overrides the command to only start slapd + redis (the entrypoint handles
+# slapd.conf generation, directory initialization, and Redis startup before
+# running the given command — "sleep infinity" keeps it alive).
+#
+# The test-runner connects to ldap:389 and redis:6379 via Docker networking.
+# app_* env vars override conf/secrets.js (highest precedence in
+# @simpleworkjs/conf), so the production secrets.js is never read.
+
+services:
+  ldap:
+    build:
+      context: .
+      dockerfile: Dockerfile.openldap
+    environment:
+      - LDAP_BASE_DN=dc=test,dc=local
+      - LDAP_ADMIN_PASS=secret
+      - ORG_NAME=Test SSO
+    # The entrypoint starts slapd + redis, then runs whatever command is given.
+    # "sleep infinity" keeps the container alive so the test-runner can connect.
+    command: ["sleep", "infinity"]
+    healthcheck:
+      test: ["CMD-SHELL", "ldapsearch -x -H ldap://localhost:389 -b '' -s base '(objectClass=*)' >/dev/null 2>&1"]
+      interval: 2s
+      timeout: 3s
+      retries: 20
+      start_period: 5s
+    volumes:
+      - ldap-data:/var/lib/ldap
+      - ldap-certs:/etc/openldap/certs
+
+  redis:
+    image: redis:7-alpine
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 2s
+      timeout: 3s
+      retries: 15
+
+  test-runner:
+    build:
+      context: .
+      dockerfile: Dockerfile.test-runner
+    environment:
+      # Tell the app which environment it's in (loads conf/test.js for Redis prefix)
+      - NODE_ENV=test
+      # LDAP — point at the ldap service container
+      - app_ldap__url=ldap://ldap:389
+      - app_ldap__bindDN=cn=admin,dc=test,dc=local
+      - app_ldap__bindPassword=secret
+      - app_ldap__userBase=ou=people,dc=test,dc=local
+      - app_ldap__groupBase=ou=groups,dc=test,dc=local
+      # Redis — point at the redis service container
+      - app_redis__redisConf__url=redis://redis:6379
+      # Also used by tests/globalSetup.js (direct Redis client, not @simpleworkjs/conf)
+      - REDIS_URL=redis://redis:6379
+      # JWT secret (required by the app, not sensitive in test)
+      - app_oauth__jwtSecret=test-jwt-secret-for-testing-only
+      # App name
+      - app_name=Test SSO
+    depends_on:
+      ldap:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+volumes:
+  ldap-data:
+  ldap-certs:

docs/directory.md

@@ -57,3 +57,49 @@ Resources carry a flexible `metadata` JSON object that can store essential conte
 ## Navigating the UI
 
 The Directory Management interface provides a **Tree View** toggle that visually nests your resources, making it easy to comprehend your network topography at a glance. You can also filter, search, and sort your entire infrastructure inventory. From the tree view, you can click the green `+` icon next to any resource to instantly add a child resource beneath it.
+
+## Slug conventions
+
+Slugs are the stable identifiers automation keys off, so the tooling around the SSO Manager follows a shared convention:
+
+- **Sites**: `site_<name>` — e.g. `site_local`, `site_us-east`
+- **Hosts**: `host_<hostname>` — e.g. `host_pve1`, `host_web01`
+- **Services/apps**: a plain slug or `app_<name>` — e.g. `sso-manager`, `app_emby`
+
+The auto-created LDAP groups derive from the slug (`<slug>_access` / `<slug>_admin`), so keep slugs stable once access groups are in use.
+
+## Automatic registration
+
+You don't have to build the graph by hand — the theta42 tooling registers itself:
+
+### The stack itself (theta-env)
+
+[theta-env](https://github.com/theta42/theta-env)'s `./setup.sh` seeds the directory on every run with the stack it deploys:
+
+- a **site** (name from `CFG_SITE_NAME` in `setup.env`, default `local` → slug `site_local`) marked as the current site
+- the **host** the stack runs on (`host_<hostname>`), with IP, MAC address, OS, and kernel collected from the machine
+- the **services** it composes — SSO Manager, Proxy (management UI), OpenLDAP Directory (the LDAPS endpoint Linux hosts and LDAP-native apps bind to), and OpenResty Edge (the 80/443 data plane) — each with its address, internal port, and git repo
+- the proxy's auto-registered **OAuth client**, linked under its service
+
+The seed is idempotent and non-destructive: a resource whose slug already exists is considered operator-owned — the seed only fills in metadata fields you haven't set, and never overwrites your values.
+
+### Linux hosts (ldap-client)
+
+The `ldap-client` join script enrolls a Debian/Ubuntu machine for LDAP login (SSSD/PAM), LDAP-backed `sudo`, and SSH keys from the directory — and, when given an SSO API token, registers the machine as a `host_<hostname>` resource with its IP, MAC, OS, and kernel, parented to the site named by its configured location.
+
+## Consumers of the directory
+
+The inventory graph isn't just documentation — other components read it to make decisions:
+
+- **[Jump Host](https://theta42.github.io/jump-host/)** — an SSH jump host that resolves which downstream machines a user may reach from their LDAP groups × the directory's `host` resources (`GET /api/discovery/resources?group=<cn>`), then bridges them in. The `host_<hostname>` slugs and `host_<slug>_access` groups this directory creates are exactly what it keys off; a host's `metadata.ip` / `metadata.sshPort` tell it where to connect. So a machine registered here (by theta-env or ldap-client) becomes reachable through the jump host the moment a user is in its access group.
+
+Planned consumers (end-user catalog, firewall/DNS generation) and the model/API gaps they need are tracked in [`directory_spec.md`](https://github.com/theta42/sso-manager-node/blob/master/directory_spec.md) §9.
+
+## API
+
+All of the above uses the same admin API the UI does (group `app_sso_directory_admin` or `app_sso_admin`):
+
+- `GET/POST /api/directory-admin/resources`, `PUT/DELETE /api/directory-admin/resources/:id`
+- `GET/POST/DELETE /api/directory-admin/edges` — parent/child links (`hosts`, `oauth` relations)
+- `GET/POST/DELETE /api/directory-admin/groups` — resource ↔ LDAP group links
+- Read-only graph views (any authenticated user): `GET /api/discovery/resources`, `/api/discovery/resources/:slug`, `/api/discovery/graph`, `/api/discovery/me`

docs/index.md

@@ -52,11 +52,13 @@ backend, that's the niche.
 - **Web management UI** — users, groups, and OAuth clients from a browser;
   invite and password-reset flows over email; self-service profile + API
   tokens.
-- **LDAPS for legacy apps** — anything that binds LDAP directly (Gitea,
+- **Direct LDAP binds** — anything that binds LDAP directly (Linux hosts
-  Emby, …) uses LDAPS/StartTLS against the same directory.
+  via PAM/SSSD, Gitea, Emby, …) uses LDAPS/StartTLS against the same
+  directory.
 - **All-in-one Docker image** — app + OpenLDAP + Redis in one container, or
   run the pieces separately via `app_*` env config.
 - **Geo-Location Scaling** — built-in support for N-Way Multi-Master OpenLDAP [replication](replication.html) across physical sites.
+- **[Directory & Inventory](directory.html)** — map sites, hosts, and services as a graph with rich metadata (IP/MAC, OS/kernel, ports, git repos), auto-provisioned access groups, and automatic registration from theta-env and ldap-client. Drives directory-aware tools like the [SSH jump host](https://theta42.github.io/jump-host/).
 
 ## Get it
 
@@ -76,5 +78,7 @@ That's the standalone quick start. For the full set of install options
 
 - **[Proxy](https://theta42.github.io/proxy/)** — an OIDC + LDAP-aware
   reverse proxy, designed to sit in front of this SSO.
+- **[Jump Host](https://theta42.github.io/jump-host/)** — an SSH jump host that
+  uses this SSO's directory to decide who may reach which machine.
 - **[theta-env](https://theta42.github.io/theta-env/)** — runs this SSO
   Manager and the proxy together with one command.

docs/ldap.md

@@ -14,8 +14,9 @@ description: SSO Manager's bundled OpenLDAP directory — schema, service accoun
 
 SSO Manager runs an OpenLDAP directory holding your users and groups. The app
 authenticates against it over `localhost:389` (inside the all-in-one container)
-and exposes **LDAPS** (`ldaps://…:636`, TLS) for legacy apps that bind LDAP
+and exposes **LDAPS** (`ldaps://…:636`, TLS) for anything that binds LDAP
-directly — Gitea, Emby, the theta42/proxy, etc.
+directly — Linux hosts (PAM/SSSD, sudo rules, SSH keys), Gitea, Emby, the
+theta42/proxy, etc.
 
 ## Directory layout
 

nodejs/app.js

@@ -95,6 +95,7 @@ app.use('/api/api-token', middleware.auth, require('./routes/api_token'));
 // OAuth 2.0 / OpenID Connect
 app.use('/oauth', oauthRouter);
 app.use('/api/oauth', middleware.auth, oauthApiRouter);
+app.use('/api/oauth/client', middleware.auth, require('./routes/oauth_client'));
 app.get('/.well-known/openid-configuration', discovery);
 
 
@@ -107,9 +108,6 @@ app.use(function(req, res, next) {
   next(err);
 });
 
-// Discovery API
-app.use('/api/discovery', middleware.auth, require('./routes/api_discovery'));
-
 // Error handling
 app.use(function(err, req, res, next) {
   const SILENT_404S = ['/.well-known/'];

nodejs/models/group_ldap.js

@@ -3,44 +3,18 @@
 const { Client, Attribute, Change } = require('ldapts');
 const { LRUCache } = require('lru-cache');
 const conf = require('@simpleworkjs/conf').ldap;
-
+// Connection + escaping from the shared @simpleworkjs/ldap package. Local
-// Escape a value used inside an LDAP search filter (RFC 4515).
+// wrappers preserve the no-arg call signatures; see user_ldap.js for rationale.
-function escapeLDAPSearchValue(val) {
+const { makeClient: _makeClient, withClient: _withClient, escapeFilter, escapeDN } = require('@simpleworkjs/ldap');
-	return String(val)
+const escapeLDAPSearchValue = escapeFilter;
-		.replace(/\\/g, '\\5c')
+const escapeLDAPDNValue = escapeDN;
-		.replace(/\*/g, '\\2a')
-		.replace(/\(/g, '\\28')
-		.replace(/\)/g, '\\29')
-		.replace(/\0/g, '\\00');
-}
-
-// Escape a value used in an LDAP DN (RFC 4514). Defensive: usernames/cns
-// are normally alphanumeric, but this prevents metacharacter injection.
-function escapeLDAPDNValue(val) {
-	return String(val)
-		.replace(/\\/g, '\\\\')
-		.replace(/,/g, '\\,')
-		.replace(/\+/g, '\\+')
-		.replace(/"/g, '\\"')
-		.replace(/</g, '\\<')
-		.replace(/>/g, '\\>')
-		.replace(/;/g, '\\;')
-		.replace(/=/g, '\\=')
-		.replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match);
-}
 
 function makeClient() {
-	return new Client({ url: conf.url });
+	return _makeClient(conf);
 }
 
 async function withClient(fn) {
-	const client = makeClient();
+	return _withClient(conf, fn);
-	try {
-		await client.bind(conf.bindDN, conf.bindPassword);
-		return await fn(client);
-	} finally {
-		await client.unbind().catch(() => {});
-	}
 }
 
 async function getGroups(client, member){

nodejs/models/index.js

@@ -23,13 +23,21 @@ async function initORM() {
   };
   ormConf.redis = conf.redis;
 
-  await init({
+  console.log('[initORM] Starting ORM initialization...');
-    conf: { orm: ormConf },
+  try {
-    models: [
+    await init({
-      Resource, ResourceEdge, ResourceGroup,
+      conf: { orm: ormConf },
-      Token, AuthToken, InviteToken, ImpersonationToken, PasswordResetToken, OtpToken, ServiceToken
+      models: [
-    ]
+        Resource, ResourceEdge, ResourceGroup,
-  });
+        Token, AuthToken, InviteToken, ImpersonationToken, PasswordResetToken, OtpToken, ServiceToken
+      ]
+    });
+    console.log('[initORM] ORM initialized successfully');
+    console.log('[initORM] Resource.orm =', !!Resource.orm, 'Token.orm =', !!Token.orm);
+  } catch (err) {
+    console.error('[initORM] ORM initialization failed:', err.message);
+    throw err;
+  }
 }
 
 module.exports.initORM = initORM;

nodejs/models/oauth_client.js

@@ -16,11 +16,18 @@ class OAuthClient {
 		const raw_secret = crypto.randomUUID();
 		const client_id = crypto.randomUUID();
 		const client_secret_hash = await bcrypt.hash(raw_secret, 10);
-		
+
+		// Generate a unique slug from the client name
+		let slug = data.name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '') || 'oauth-client';
+		// Ensure uniqueness by appending a suffix if needed
+		const existing = await Resource.list({ where: { slug } });
+		if (existing.length) slug = `${slug}-${client_id.slice(0, 8)}`;
+
 		const r = await Resource.create({
 			id: client_id,
 			kind: 'oauth',
 			name: data.name,
+			slug: slug,
 			description: data.description || '',
 			owner: data.created_by,
 			metadata: {
@@ -37,10 +44,21 @@ class OAuthClient {
 		return r;
 	}
 	static async get(client_id) {
-		const resources = await Resource.list({ where: { id: client_id, kind: 'oauth' } });
+			const notFound = () => {
-		if (!resources.length) throw new Error('OAuthClient not found');
+				const e = new Error('OAuthClient not found');
-		
+				e.status = 404;
-		const r = resources[0];
+				return e;
+			};
+			let r;
+			try {
+				r = await Resource.get(client_id);
+			} catch (_) {
+				throw notFound();
+			}
+			// Resource.get() returns null (does not throw) for a missing id —
+			// guard it so a bad/undefined client_id is a clean 404, not a
+			// "Cannot read properties of null (reading 'kind')" 500.
+			if (!r || r.kind !== 'oauth') throw notFound();
 		// Map metadata to top-level properties to satisfy routes/oauth.js without rewriting it
 		r.client_id = r.id;
 		r.client_secret_hash = r.metadata.client_secret_hash;
@@ -48,6 +66,8 @@ class OAuthClient {
 		r.scopes = r.metadata.scopes || ['openid', 'profile', 'email', 'groups'];
 		r.allowed_groups = r.metadata.allowed_groups || [];
 		r.token_lifetime = r.metadata.token_lifetime || { ...defaultLifetime };
+		// Resource has no is_valid column; validity lives in metadata (absent = valid)
+		r.is_valid = r.metadata.is_valid !== false;
 		r.verifySecret = async (secret) => bcrypt.compare(secret, r.client_secret_hash);
 		
 		r.rotateSecret = async () => {
@@ -57,6 +77,29 @@ class OAuthClient {
 			return raw_secret;
 		};
 
+		// The ORM Model.toJSON() only serializes schema fields, so the mapped
+		// properties above (client_id, scopes, redirect_uris, …) would be
+		// stripped from any res.json() — that's why GET /api/oauth/client
+		// returned client_id: undefined and the bootstrap's rotate blew up.
+		// Emit the public shape explicitly. client_secret_hash is deliberately
+		// omitted so it never leaks over the API.
+		r.toJSON = function () {
+			return {
+				client_id: r.id,
+				id: r.id,
+				kind: r.kind,
+				name: r.name,
+				slug: r.slug,
+				owner: r.owner,
+				description: r.description,
+				redirect_uris: r.redirect_uris,
+				scopes: r.scopes,
+				allowed_groups: r.allowed_groups,
+				token_lifetime: r.token_lifetime,
+				is_valid: r.is_valid,
+			};
+		};
+
 		// proxy update to handle metadata correctly
 		const originalUpdate = r.update.bind(r);
 		r.update = async (data) => {
@@ -64,11 +107,11 @@ class OAuthClient {
 			if (data.scopes !== undefined) r.metadata.scopes = data.scopes;
 			if (data.allowed_groups !== undefined) r.metadata.allowed_groups = data.allowed_groups;
 			if (data.token_lifetime !== undefined) r.metadata.token_lifetime = data.token_lifetime;
-			
+			if (data.is_valid !== undefined) r.metadata.is_valid = data.is_valid;
+
 			const updateData = { metadata: r.metadata };
 			if (data.name !== undefined) updateData.name = data.name;
 			if (data.description !== undefined) updateData.description = data.description;
-			if (data.is_valid !== undefined) updateData.is_valid = data.is_valid;
 			
 			return originalUpdate(updateData);
 		};
@@ -81,6 +124,10 @@ class OAuthClient {
 		return Promise.all(resources.map(r => this.get(r.id)));
 	}
 
+	static async listDetail() {
+		return this.list();
+	}
+
 	static async verifySecret(client_id, secret) {
 		const client = await this.get(client_id);
 		return client.verifySecret(secret);

nodejs/models/token.js

@@ -95,7 +95,7 @@ class OtpToken extends Token {
 	}
 
 	static async issue(uid, method) {
-		const existing = await this.find({uid});
+		const existing = await this.list({where: {uid}});
 		for (const t of existing) {
 			if (t.is_valid) await t.update({is_valid: false});
 		}
@@ -104,7 +104,7 @@ class OtpToken extends Token {
 	}
 
 	static async verify(uid, code) {
-		const tokens = await this.listDetail({uid});
+		const tokens = await this.list({where: {uid}});
 		const match = tokens.find(t => t.is_valid && !t.isExpired && t.code === code);
 		if (!match) return null;
 		await match.update({is_valid: false});

nodejs/models/user_ldap.js

@@ -9,6 +9,14 @@ const {Token, InviteToken, PasswordResetToken} = require('./token');
 const {Group} = require('./group_ldap');
 const {UserVerification} = require('./verification');
 const conf = require('@simpleworkjs/conf').ldap;
+// Connection + escaping come from the shared @simpleworkjs/ldap package. The
+// wrappers below preserve this file's no-arg call signatures (makeClient() /
+// withClient(fn)) so no call site changes; sso's makeClient passes no
+// tlsOptions, which the shared client forwards as undefined — identical to the
+// previous `new Client({ url: conf.url })`.
+const { makeClient: _makeClient, withClient: _withClient, escapeFilter, escapeDN } = require('@simpleworkjs/ldap');
+const escapeLDAPSearchValue = escapeFilter;
+const escapeLDAPDNValue = escapeDN;
 
 function hashPasswordSSHA512(password) {
 	const salt = crypto.randomBytes(8);
@@ -23,40 +31,11 @@ const cache = new LRUCache({
 });
 
 function makeClient() {
-	return new Client({ url: conf.url });
+	return _makeClient(conf);
 }
 
 async function withClient(fn) {
-	const client = makeClient();
+	return _withClient(conf, fn);
-	try {
-		await client.bind(conf.bindDN, conf.bindPassword);
-		return await fn(client);
-	} finally {
-		await client.unbind().catch(() => {});
-	}
-}
-
-// Helper to escape LDAP filter values (crucial for security)
-function escapeLDAPSearchValue(val) {
-    return val.replace(/\\/g, '\\5c')
-              .replace(/\*/g, '\\2a')
-              .replace(/\(/g, '\\28')
-              .replace(/\)/g, '\\29')
-              .replace(/\0/g, '\\00');
-}
-
-// Escape a value used in an LDAP DN (RFC 4514).
-function escapeLDAPDNValue(val) {
-	return String(val)
-		.replace(/\\/g, '\\\\')
-		.replace(/,/g, '\\,')
-		.replace(/\+/g, '\\+')
-		.replace(/"/g, '\\"')
-		.replace(/</g, '\\<')
-		.replace(/>/g, '\\>')
-		.replace(/;/g, '\\;')
-		.replace(/=/g, '\\=')
-		.replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match);
 }
 
 // Compute the next available uid/gidNumber: the highest existing value below
@@ -891,6 +870,12 @@ User.invite = async function(data = {}){
 
 User.login = async function(data){
 	try{
+		if (!data.uid && !data.username) {
+			let error = new Error('Invalid Credentials, login failed.');
+			error.name = 'LDAPLoginFailed';
+			error.status = 401;
+			throw error;
+		}
 		let user = await this.get(data.uid || data.username);
 
 		const loginClient = makeClient();

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.2.1",
+  "version": "1.4.0",
   "description": "A very simple LDAP management and SSO system",
   "author": [
     {
@@ -24,7 +24,10 @@
     "@fortawesome/fontawesome-free": "^7.3.0",
     "@popperjs/core": "^2.11.8",
     "@simpleworkjs/conf": "^1.2.0",
-    "@simpleworkjs/orm": "file:../../../simpleworkjs/orm",
+    "@simpleworkjs/app-stack": "^1.0.0",
+    "@simpleworkjs/ldap": "^1.0.0",
+    "@simpleworkjs/directory-schema": "^1.0.0",
+    "@simpleworkjs/orm": "^0.2.8",
     "bcrypt": "^6.0.0",
     "bootstrap": "^5.3.8",
     "compression": "^1.8.1",
@@ -35,10 +38,10 @@
     "jq-repeat": "^2.2.0",
     "jquery": "^3.7.1",
     "jsonwebtoken": "^9.0.3",
-    "ldapts": "^8.1.2",
+    "ldapts": "^8.1.8",
     "lru-cache": "^11.5.1",
     "marked": "^9.1.6",
-    "model-redis": "^0.4.0",
+    "model-redis": "^1.6.0",
     "moment": "^2.30.1",
     "mustache": "^4.2.0",
     "nodemailer": "^9.0.0",

nodejs/routes/api_directory_admin.js

@@ -3,6 +3,7 @@ const router = require('express').Router();
 const permission = require('../utils/permission');
 const { Resource, ResourceEdge, ResourceGroup } = require('../models/resource');
 const { Group } = require('../models/group_ldap');
+const { projectResources } = require('@simpleworkjs/directory-schema');
 
 // Require the admin group
 router.use(async (req, res, next) => {
@@ -18,7 +19,9 @@ router.use(async (req, res, next) => {
 router.get('/resources', async (req, res, next) => {
   try {
     const resources = await Resource.list();
-    res.json({ results: resources });
+    // Even admins never receive secret metadata (e.g. client_secret_hash) over
+    // the wire; projectResources strips it unconditionally.
+    res.json({ results: projectResources(resources, { fullMetadata: true }) });
   } catch (err) { next(err); }
 });
 

nodejs/routes/api_discovery.js

@@ -1,36 +0,0 @@
-'use strict';
-
-const router = require('express').Router();
-const { Resource, ResourceGroup } = require('../models/resource');
-
-// GET /api/discovery/me
-// Returns the list of resources the current user has access to.
-router.get('/me', async (req, res, next) => {
-  try {
-    const userGroups = req.user.groups || []; // array of LDAP group CNs
-    const accessibleResourceIds = new Set();
-    
-    if (req.user.isMachine) {
-        // Machines only have access to themselves by default
-        accessibleResourceIds.add(req.resourceId);
-    } else {
-        // End users get access via groups
-        const allGroups = await ResourceGroup.list();
-        for (const rg of allGroups) {
-            if (userGroups.includes(rg.groupCn)) {
-                accessibleResourceIds.add(rg.resourceId);
-            }
-        }
-    }
-    
-    // Fetch all resources and filter
-    const allResources = await Resource.list();
-    const accessible = allResources.filter(r => accessibleResourceIds.has(r.id) || r.metadata?.isPublic);
-    
-    res.json({ results: accessible });
-  } catch (err) {
-    next(err);
-  }
-});
-
-module.exports = router;

nodejs/routes/auth.js

@@ -203,7 +203,7 @@ router.post('/impersonate/:uid', middleware.auth, async function(req, res, next)
 		const target = await User.get(req.params.uid);
 
 		// Clean up any existing impersonation for this target
-		const existing = await ImpersonationToken.listDetail({ target_uid: target.uid });
+		const existing = await ImpersonationToken.list({ where: { target_uid: target.uid } });
 		for (const old of existing) {
 			if (old.is_valid && !old.isExpired) {
 				try { await target.removeTempPassword(old.temp_hash); } catch(_) {}
@@ -237,7 +237,7 @@ router.delete('/impersonate/:uid', middleware.auth, async function(req, res, nex
 		await permission.byGroup(req.user, ['app_sso_admin']);
 
 		const target = await User.get(req.params.uid);
-		const existing = await ImpersonationToken.listDetail({ target_uid: target.uid });
+		const existing = await ImpersonationToken.list({ where: { target_uid: target.uid } });
 
 		let revoked = 0;
 		for (const token of existing) {

nodejs/routes/discovery.js

@@ -1,4 +1,79 @@
-const autoRouter = require('./autoRouter');
+'use strict';
-const { Resource } = require('../models/resource');
 
-module.exports = autoRouter(Resource);
+// Public directory discovery API. Mounted at /api/discovery (app.js, before
+// the 404 catcher). Every response uses the `{ results }` envelope and the
+// security projection from @simpleworkjs/directory-schema, so secrets (e.g. an
+// OAuth client's client_secret_hash) never leave the server and non-admins only
+// see the public metadata allowlist.
+//
+// This replaces the autoRouter mount (which returned bare arrays — the shape
+// jump-host's `data.results || []` silently collapsed to `[]`, so no user could
+// bridge) and absorbs the dead /me handler that used to live in
+// routes/api_discovery.js (mounted after the 404, so unreachable).
+
+const router = require('express').Router();
+const { Resource, ResourceGroup } = require('../models/resource');
+const {
+	envelope,
+	projectResource,
+	projectResources,
+	isDirectoryAdmin,
+} = require('@simpleworkjs/directory-schema');
+
+// GET /api/discovery/resources[?kind=&group=&parent=]
+router.get('/resources', async (req, res, next) => {
+	try {
+		const resources = await Resource.search(req.query);
+		res.json(envelope(projectResources(resources, { fullMetadata: isDirectoryAdmin(req.user) })));
+	} catch (err) { next(err); }
+});
+
+// GET /api/discovery/resources/:slug
+router.get('/resources/:slug', async (req, res, next) => {
+	try {
+		const resource = await Resource.getBySlug(req.params.slug);
+		// parents/children are edges (no secrets); project only the resource body.
+		const projected = projectResource(resource, { fullMetadata: isDirectoryAdmin(req.user) });
+		projected.parents = resource.parents;
+		projected.children = resource.children;
+		res.json(envelope(projected));
+	} catch (err) { next(err); }
+});
+
+// GET /api/discovery/graph
+router.get('/graph', async (req, res, next) => {
+	try {
+		const graph = await Resource.getGraph();
+		res.json(envelope({
+			resources: projectResources(graph.resources, { fullMetadata: isDirectoryAdmin(req.user) }),
+			edges: graph.edges,
+		}));
+	} catch (err) { next(err); }
+});
+
+// GET /api/discovery/me
+// Returns the resources the current caller can reach. Machines see only their
+// own resource; humans get the union of their LDAP groups' resources plus
+// anything flagged isPublic. Uses req.user.groups (populated by the auth
+// middleware for session/PAT callers) rather than re-querying LDAP by DN, so it
+// works for every auth transport without assuming a .dn is present.
+router.get('/me', async (req, res, next) => {
+	try {
+		let accessible;
+		if (req.user && req.user.isMachine) {
+			accessible = await Resource.list({ where: { id: req.resourceId } });
+		} else {
+			const userGroups = (req.user && req.user.groups) || [];
+			const ids = new Set();
+			if (userGroups.length) {
+				const rgs = await ResourceGroup.list({ where: { groupCn: { in: userGroups } } });
+				for (const rg of rgs) ids.add(rg.resourceId);
+			}
+			const all = await Resource.list();
+			accessible = all.filter(r => ids.has(r.id) || (r.metadata && r.metadata.isPublic));
+		}
+		res.json(envelope(projectResources(accessible, { fullMetadata: isDirectoryAdmin(req.user) })));
+	} catch (err) { next(err); }
+});
+
+module.exports = router;

nodejs/routes/docs.js

@@ -33,6 +33,7 @@ const DOCS = {
 	accounts:        {title: 'Accounts, Groups & Managers', file: path.join(__dirname, '../../docs/concepts-accounts.md')},
 	'oauth-apps':    {title: 'Connecting Apps (SSO)',   file: path.join(__dirname, '../../docs/concepts-oauth-apps.md')},
 	'api-tokens':    {title: 'API Tokens',              file: path.join(__dirname, '../../docs/concepts-api-tokens.md')},
+	directory:       {title: 'Directory & Inventory',   file: path.join(__dirname, '../../docs/directory.md')},
 
 	overview:        {title: 'Overview',        file: path.join(__dirname, '../../README.md')},
 	changelog:       {title: 'Changelog',       file: path.join(__dirname, '../../CHANGELOG.md')},

nodejs/routes/index.js

@@ -10,6 +10,7 @@ const {InviteToken, PasswordResetToken} = require('./../models/token');
 const {Tos} = require('../models/tos');
 const conf = require('@simpleworkjs/conf');
 const buildInfo = require('../utils/build_info');
+const { mountStaticModules } = require('@simpleworkjs/app-stack');
 
 const values ={
   title: conf.environment !== 'production' ? `dev` : '',
@@ -20,24 +21,16 @@ const values ={
 }
 
 // List of front end node modules to be served
-const frontEndModules = ['bootstrap', 'mustache', 'jquery', '@fortawesome',
-  'moment', '@popper', 'jq-repeat',
-];
-
-// Server front end modules
-// https://stackoverflow.com/a/55700773/3140931
 // Vendor libraries only change when package versions are bumped (a rebuild),
 // so they're safe to cache aggressively; ETag/Last-Modified (on by default)
-// still cover that rare case with a cheap 304 instead of a stale asset.
+// still cover that rare case with a cheap 304 instead of a stale asset. The
-frontEndModules.forEach(dep => {
+// app's own JS/CSS/img from public/ gets a shorter maxAge since it changes on
-  router.use(`/static-modules/${dep}`, express.static(path.join(__dirname, `../node_modules/${dep}`), {maxAge: '7d'}))
+// every deploy and isn't cache-busted/fingerprinted.
+mountStaticModules(router, {
+  root: path.join(__dirname, '..'),
+  deps: ['bootstrap', 'mustache', 'jquery', '@fortawesome', 'moment', '@popper', 'jq-repeat'],
 });
 
-// Have express server static content( images, CSS, browser JS) from the public
-// local folder. Shorter maxAge than /static-modules since this is the app's
-// own JS/CSS, which changes on every deploy and isn't cache-busted/fingerprinted.
-router.use('/static', express.static(path.join(__dirname, '../public'), {maxAge: '1h'}))
-
 // Public health endpoint for container/orchestration healthchecks.
 // Mounted at / (no auth) in app.js, so this is intentionally unauthenticated.
 router.get('/health', function(req, res) {

nodejs/routes/oauth_client.js

@@ -0,0 +1,127 @@
+'use strict';
+
+const router = require('express').Router();
+const { OAuthClient } = require('../models/oauth_client');
+const permission = require('../utils/permission');
+
+const ADMIN_GROUP = 'app_sso_oauth_admin';
+
+router.get('/', async function(req, res, next) {
+	try {
+		await permission.byGroup(req.user, [ADMIN_GROUP]);
+		return res.json({ results: await OAuthClient.listDetail() });
+	} catch(error) {
+		next(error);
+	}
+});
+
+router.post('/', async function(req, res, next) {
+	try {
+		await permission.byGroup(req.user, [ADMIN_GROUP]);
+
+		req.body.created_by = req.user.uid;
+
+		// Parse redirect_uris if sent as newline-separated string from the form
+		if (typeof req.body.redirect_uris === 'string') {
+			req.body.redirect_uris = req.body.redirect_uris.split('\n').map(s => s.trim()).filter(Boolean);
+		}
+		// Parse scopes if sent as space-separated string
+		if (typeof req.body.scopes === 'string') {
+			req.body.scopes = req.body.scopes.split(' ').map(s => s.trim()).filter(Boolean);
+		}
+		// Parse allowed_groups if sent as newline-separated string
+		if (typeof req.body.allowed_groups === 'string') {
+			req.body.allowed_groups = req.body.allowed_groups.split('\n').map(s => s.trim()).filter(Boolean);
+		}
+		// jQuery serializeObject sends nested fields as "token_lifetime[access_token]"
+		if (req.body['token_lifetime[access_token]'] || req.body['token_lifetime[refresh_token]']) {
+			req.body.token_lifetime = {
+				access_token: Number(req.body['token_lifetime[access_token]']) || 3600,
+				refresh_token: Number(req.body['token_lifetime[refresh_token]']) || 2592000,
+			};
+			delete req.body['token_lifetime[access_token]'];
+			delete req.body['token_lifetime[refresh_token]'];
+		}
+
+		const client = await OAuthClient.add(req.body);
+
+		const result = client.toJSON ? client.toJSON() : { ...client };
+		result.client_id = client.client_id || client.id;
+
+		return res.json({
+			results: result,
+			client_secret: client._raw_secret,
+			message: `OAuth client '${client.name}' created. Save the client secret — it will not be shown again.`,
+		});
+	} catch(error) {
+		next(error);
+	}
+});
+
+router.get('/:client_id', async function(req, res, next) {
+	try {
+		await permission.byGroup(req.user, [ADMIN_GROUP]);
+		return res.json({ results: await OAuthClient.get(req.params.client_id) });
+	} catch(error) {
+		next(error);
+	}
+});
+
+router.put('/:client_id', async function(req, res, next) {
+	try {
+		await permission.byGroup(req.user, [ADMIN_GROUP]);
+
+		const client = await OAuthClient.get(req.params.client_id);
+
+		if (typeof req.body.redirect_uris === 'string') {
+			req.body.redirect_uris = req.body.redirect_uris.split('\n').map(s => s.trim()).filter(Boolean);
+		}
+		if (typeof req.body.scopes === 'string') {
+			req.body.scopes = req.body.scopes.split(' ').map(s => s.trim()).filter(Boolean);
+		}
+		if (typeof req.body.allowed_groups === 'string') {
+			req.body.allowed_groups = req.body.allowed_groups.split('\n').map(s => s.trim()).filter(Boolean);
+		}
+
+		return res.json({
+			results: await client.update(req.body),
+			message: `OAuth client '${client.name}' updated.`,
+		});
+	} catch(error) {
+		next(error);
+	}
+});
+
+router.delete('/:client_id', async function(req, res, next) {
+	try {
+		await permission.byGroup(req.user, [ADMIN_GROUP]);
+
+		const client = await OAuthClient.get(req.params.client_id);
+		await client.remove();
+
+		return res.json({
+			client_id: req.params.client_id,
+			message: `OAuth client '${client.name}' deleted.`,
+		});
+	} catch(error) {
+		next(error);
+	}
+});
+
+router.post('/:client_id/rotate', async function(req, res, next) {
+	try {
+		await permission.byGroup(req.user, [ADMIN_GROUP]);
+
+		const client = await OAuthClient.get(req.params.client_id);
+		const new_secret = await client.rotateSecret();
+
+		return res.json({
+			client_secret: new_secret,
+			message: `Client secret rotated for '${client.name}'. Save it — it will not be shown again.`,
+		});
+	} catch(error) {
+		next(error);
+	}
+});
+
+module.exports = router;

nodejs/routes/token.js

@@ -23,8 +23,10 @@ router.get('/', async function(req, res, next){
 
 router.get('/:name', async function(req, res, next){
 	try{
+		// ORM models: list() on the redis adapter always returns full rows;
+		// detail is handled by serialization (isPrivate fields are excluded).
 		return res.json({
-			results:  await tokens[req.params.name][req.query.detail ? "listDetail" : "list"]()
+			results:  await tokens[req.params.name].list()
 		});
 	}catch(error){
 		next(error);
@@ -34,9 +36,13 @@ router.get('/:name', async function(req, res, next){
 
 router.get('/:name/:token', async function(req, res, next){
 	try{
-		return res.json({
+		const result = await tokens[req.params.name].get(req.params.token);
-			results:  await tokens[req.params.name].get(req.params.token)
+		if (!result) {
-		});
+			const error = new Error('Token not found');
+			error.status = 404;
+			throw error;
+		}
+		return res.json({ results: result });
 	}catch(error){
 		next(error);
 	}

nodejs/tests/discovery.test.js

@@ -0,0 +1,111 @@
+'use strict';
+
+// Directory discovery API — security + contract regression coverage.
+//
+// These tests run under the jest + docker harness (redis + the test seed).
+// They lock in the two fixes from the @simpleworkjs/directory-schema release:
+//   1. /api/discovery/* returns the { results } envelope (not a bare array —
+//      the drift that made jump-host's `data.results || []` collapse to []).
+//   2. No response path leaks secret metadata (e.g. an OAuth client's
+//      client_secret_hash), regardless of caller.
+//
+// The core assertions hold for any authenticated caller. The admin-projection
+// assertion (fullMetadata for directory admins) additionally requires the `test`
+// seed user to be a member of app_sso_directory_admin — see setup.js.
+
+const { login, request, app } = require('./setup');
+
+let token;
+
+beforeAll(async () => {
+	token = await login();
+});
+
+function assertNoSecrets(results, path) {
+	for (const r of results || []) {
+		// toBeUndefined() in this jest version takes no message arg, so assert
+		// manually and throw with context — this also surfaces the leaked value
+		// if the projection ever regresses.
+		const secretHash = r.metadata && r.metadata.client_secret_hash;
+		if (secretHash !== undefined) {
+			throw new Error(
+				`client_secret_hash leaked from ${path} on ${r.slug || r.id} (value: ${JSON.stringify(secretHash)})`
+			);
+		}
+		if (r.metadata) {
+			for (const k of Object.keys(r.metadata)) {
+				if (/secret|password|privatekey/i.test(k)) {
+					throw new Error(`secret-ish key "${k}" leaked from ${path} on ${r.slug || r.id}`);
+				}
+			}
+		}
+	}
+}
+
+describe('Discovery — envelope + security', () => {
+	test('GET /api/discovery/resources returns 200 with { results } (not a bare array)', async () => {
+		const res = await request(app).get('/api/discovery/resources').set('auth-token', token);
+		expect(res.status).toBe(200);
+		expect(Array.isArray(res.body.results)).toBe(true);
+		expect(Array.isArray(res.body)).toBe(false); // never a bare array
+	});
+
+	test('GET /api/discovery/resources never leaks client_secret_hash', async () => {
+		const res = await request(app).get('/api/discovery/resources').set('auth-token', token);
+		assertNoSecrets(res.body.results, '/resources');
+	});
+
+	test('GET /api/discovery/resources?group= returns 200 (regression: was 404)', async () => {
+		const res = await request(app)
+			.get('/api/discovery/resources?group=host_web01_access')
+			.set('auth-token', token);
+		expect(res.status).toBe(200);
+		expect(Array.isArray(res.body.results)).toBe(true);
+	});
+
+	test('GET /api/discovery/graph returns { results: { resources, edges } } and strips secrets', async () => {
+		const res = await request(app).get('/api/discovery/graph').set('auth-token', token);
+		expect(res.status).toBe(200);
+		expect(res.body.results).toBeDefined();
+		expect(Array.isArray(res.body.results.resources)).toBe(true);
+		assertNoSecrets(res.body.results.resources, '/graph');
+	});
+
+	test('GET /api/discovery/me returns 200 with { results } and strips secrets', async () => {
+		const res = await request(app).get('/api/discovery/me').set('auth-token', token);
+		expect(res.status).toBe(200);
+		expect(Array.isArray(res.body.results)).toBe(true);
+		assertNoSecrets(res.body.results, '/me');
+	});
+
+	test('GET /api/discovery/resources/:slug returns 200 + { results } for a known slug', async () => {
+		// Seed-dependent: pick the first slug from the list, then fetch it.
+		const list = await request(app).get('/api/discovery/resources').set('auth-token', token);
+		const slug = list.body.results[0] && list.body.results[0].slug;
+		if (!slug) return; // empty seed — skip rather than fail
+		const res = await request(app)
+			.get(`/api/discovery/resources/${encodeURIComponent(slug)}`)
+			.set('auth-token', token);
+		expect(res.status).toBe(200);
+		expect(res.body.results).toBeDefined();
+		expect(res.body.results.slug).toBe(slug);
+		assertNoSecrets([res.body.results], '/resources/:slug');
+	});
+});
+
+describe('Discovery — admin projection (requires test user in app_sso_directory_admin)', () => {
+	// If the seed `test` user is a directory admin, /resources should keep
+	// admin-only (non-secret) metadata like redirect_uris/token_lifetime for
+	// them. If not, this assertion is skipped — the no-secrets assertion above
+	// already covers the security guarantee for every caller.
+	test('admin callers keep token_lifetime / redirect_uris (non-secret admin keys)', async () => {
+		const res = await request(app).get('/api/discovery/resources?kind=oauth').set('auth-token', token);
+		const oauth = (res.body.results || []).find(r => r.kind === 'oauth');
+		if (!oauth) return; // no oauth resource seeded
+		// Only meaningful if the caller is an admin; non-admins correctly get
+		// the public allowlist (no redirect_uris). We assert the absence of
+		// secrets regardless, and skip the positive admin check without a known
+		// admin seed.
+		expect(oauth.metadata && oauth.metadata.client_secret_hash).toBeUndefined();
+	});
+});

nodejs/tests/globalSetup.js

@@ -5,7 +5,8 @@
 const { createClient } = require('redis');
 
 module.exports = async function() {
-	const client = createClient();
+	const redisUrl = process.env.REDIS_URL || undefined;
+	const client = createClient(redisUrl ? { url: redisUrl } : {});
 	await client.connect();
 
 	const keys = await client.keys('sso_manager_test_*');

nodejs/tests/oauth.test.js

@@ -43,6 +43,65 @@ afterAll(async () => {
 	}
 });
 
+describe('OAuth client management API — /api/oauth/client', () => {
+	// Regression: the ORM Model.toJSON() strips non-schema fields, so the
+	// mapped client_id/scopes/etc. used to vanish from GET responses —
+	// client_id came back undefined and the theta-env bootstrap's rotate
+	// crashed with a 500. GET must expose client_id (and never the secret hash).
+	test('GET / list exposes client_id and hides client_secret_hash', async () => {
+		const res = await request(app)
+			.get('/api/oauth/client/')
+			.set('auth-token', token);
+		expect(res.status).toBe(200);
+		const mine = res.body.results.find((c) => c.client_id === clientId);
+		expect(mine).toBeDefined();
+		expect(mine.client_id).toBe(clientId);
+		expect(mine).toHaveProperty('scopes');
+		expect(mine).not.toHaveProperty('client_secret_hash');
+	});
+
+	test('GET /:id exposes client_id', async () => {
+		const res = await request(app)
+			.get(`/api/oauth/client/${clientId}`)
+			.set('auth-token', token);
+		expect(res.status).toBe(200);
+		expect(res.body.results.client_id).toBe(clientId);
+		expect(res.body.results).not.toHaveProperty('client_secret_hash');
+	});
+
+	test('list then rotate a client by its returned client_id (the bootstrap path)', async () => {
+		// Reproduces exactly what the theta-env bootstrap does: create, list,
+		// find by name, rotate by the client_id from the list response. Uses a
+		// throwaway client so the shared flow client's secret is untouched.
+		const created = await request(app)
+			.post('/api/oauth/client/')
+			.set('auth-token', token)
+			.send({ name: 'rotate-regression', redirect_uris: REDIRECT_URI });
+		expect(created.status).toBe(200);
+
+		const list = await request(app).get('/api/oauth/client/').set('auth-token', token);
+		const found = list.body.results.find((c) => c.name === 'rotate-regression');
+		expect(found).toBeDefined();
+		expect(found.client_id).toBeTruthy(); // was undefined before the fix
+
+		const rotated = await request(app)
+			.post(`/api/oauth/client/${found.client_id}/rotate`)
+			.set('auth-token', token);
+		expect(rotated.status).toBe(200);
+		expect(rotated.body.client_secret).toBeTruthy();
+
+		await request(app).delete(`/api/oauth/client/${found.client_id}`).set('auth-token', token);
+	});
+
+	test('GET /:id unknown id returns 404, not 500', async () => {
+		const res = await request(app)
+			.get('/api/oauth/client/00000000-0000-0000-0000-000000000000')
+			.set('auth-token', token);
+		expect(res.status).toBeGreaterThanOrEqual(400);
+		expect(res.status).toBeLessThan(500);
+	});
+});
+
 describe('OIDC Discovery', () => {
 	test('GET /.well-known/openid-configuration returns required fields', async () => {
 		const res = await request(app).get('/.well-known/openid-configuration');

nodejs/tests/setup.js

@@ -3,6 +3,19 @@
 const crypto = require('crypto');
 const request = require('supertest');
 const app = require('../app');
+const { initORM } = require('../models');
+
+beforeAll(async () => {
+	await initORM();
+	const { Token } = require('../models/token');
+	try {
+		if (Token.orm) {
+			await Token.orm.adapter(Token).Table.redisClient.flushDb();
+		}
+	} catch (e) {
+		console.warn('Could not flush Redis:', e.message);
+	}
+});
 
 const TEST_CREDS = { uid: 'test', password: 'MyTestPassword!2' };
 

nodejs/utils/build_info.js

@@ -1,29 +1,16 @@
 'use strict';
 
-const fs = require('fs');
+// Unified build-info shape ({ buildVersion, buildHash, buildYear }) via the
+// shared @simpleworkjs/app-stack. The baked commit file lives at nodejs/.build_commit
+// (../ from here in utils/), matching the Dockerfile.openldap gitinfo stage;
+// cwd is utils/ for the bare-metal git fallback.
+
 const path = require('path');
-const { execSync } = require('child_process');
+const { createBuildInfo } = require('@simpleworkjs/app-stack');
-const { version: buildVersion } = require('../package.json');
+const { version } = require('../package.json');
 
-// Docker builds bake the commit hash into ../.build_commit (see the gitinfo
+module.exports = createBuildInfo({
-// stage in Dockerfile.openldap) -- the final image has no git binary and no
+	version,
-// .git directory, so `git rev-parse` below always fails there. Bare-metal/dev
+	buildCommitPath: path.join(__dirname, '../.build_commit'),
-// runs have no baked file, so they fall back to asking git directly.
+	cwd: __dirname,
-function readBuildHash() {
+});
-	try {
-		const baked = fs.readFileSync(path.join(__dirname, '../.build_commit'), 'utf8').trim();
-		if (baked) return baked;
-	} catch (_) {}
-
-	try {
-		return execSync('git rev-parse --short HEAD', { cwd: __dirname }).toString().trim();
-	} catch (_) {
-		return 'unknown';
-	}
-}
-
-module.exports = {
-	buildVersion,
-	buildHash: readBuildHash(),
-	buildYear: new Date().getFullYear(),
-};

nodejs/views/directory.ejs

@@ -29,6 +29,7 @@
                 <div class="card-header actionMessage" style="display:none"></div>
                 <div class="p-3 pb-0 text-muted small border-bottom">
                     <i class="fa-solid fa-circle-info"></i> Manage infrastructure, services, and their relationships.
+                    <a href="/docs/directory" class="text-reset float-end" title="Help"><i class="fa-solid fa-circle-question"></i></a>
                 </div>
 				<div class="table-responsive">
 				<table class="card-body table table-striped mb-0">

nodejs/views/user_form.ejs

@@ -64,7 +64,7 @@ async function fetchUsernameSuggestions() {
 		// simply can't bind). Disabling (not just hiding) keeps disabled
 		// fields out of both form serialization and validation.
 		$form.find('[name=mail]').prop('disabled', checked).closest('.mb-3').toggle(!checked);
-		$form.find('[name=mobile]').prop('disabled', checked).closest('.mb-3').toggle(!checked);
+
 		$form.find('[name=userPassword]').prop('disabled', checked).closest('.mb-3').toggle(!checked);
 		$form.find('[name=passwordMatch]').prop('disabled', checked).closest('.mb-3').toggle(!checked);
 
@@ -137,10 +137,7 @@ async function fetchUsernameSuggestions() {
 		<input type="text" class="form-control shadow" name="sshPublicKey" placeholder="ssh-rsa AAAAB3NzaC1yc2EAAAADAQ..." />
 	</div>
 
-	<div class="mb-3">
+
-		<label class="form-label">Mobile Phone <small class="text-muted">(optional, include country code e.g. +14155551234)</small></label>
-		<input type="text" class="form-control shadow" name="mobile" placeholder="+14155551234" />
-	</div>
 
 	<div class="mb-3">
 		<label class="form-label">Location (Site) <small class="text-muted">(optional)</small></label>

test/seed-test-user.sh

@@ -0,0 +1,177 @@
+#!/usr/bin/env bash
+# seed-test-user.sh — Create the test user in LDAP for the test suite.
+#
+# The test suite (tests/setup.js) logs in as uid=test / password=MyTestPassword!2.
+# This script creates that user in the LDAP directory along with its personal
+# posixGroup, and adds it to the app_sso_admin group so admin-gated tests pass.
+#
+# Environment variables (from docker-compose.test.yml):
+#   LDAP_HOST     — LDAP server hostname (default: ldap)
+#   LDAP_PORT     — LDAP server port (default: 389)
+#   BIND_DN       — LDAP admin bind DN (default: cn=admin,dc=test,dc=local)
+#   BIND_PW       — LDAP admin password (default: secret)
+#   BASE_DN       — LDAP base DN (default: dc=test,dc=local)
+
+set -euo pipefail
+
+LDAP_HOST="${LDAP_HOST:-ldap}"
+LDAP_PORT="${LDAP_PORT:-389}"
+BIND_DN="${BIND_DN:-cn=admin,dc=test,dc=local}"
+BIND_PW="${BIND_PW:-secret}"
+BASE_DN="${BASE_DN:-dc=test,dc=local}"
+
+LDAP_URI="ldap://${LDAP_HOST}:${LDAP_PORT}"
+USER_UID="test"
+USER_PASSWORD="MyTestPassword!2"
+
+info()  { echo "[INFO] $*"; }
+error() { echo "[ERROR] $*" >&2; }
+
+# ── Wait for LDAP to be reachable ────────────────────────────────────────────
+info "Waiting for LDAP at ${LDAP_URI}..."
+for i in $(seq 1 30); do
+    if ldapsearch -x -H "$LDAP_URI" -b '' -s base '(objectClass=*)' >/dev/null 2>&1; then
+        info "LDAP is reachable"
+        break
+    fi
+    if [ "$i" -eq 30 ]; then
+        error "LDAP not reachable after 30 attempts"
+        exit 1
+    fi
+    sleep 1
+done
+
+# ── Check if the test user already exists ────────────────────────────────────
+if ldapsearch -x -H "$LDAP_URI" -D "$BIND_DN" -w "$BIND_PW" \
+    -b "cn=${USER_UID},ou=people,${BASE_DN}" -s base '(objectClass=*)' >/dev/null 2>&1; then
+    info "Test user '${USER_UID}' already exists — skipping seed"
+    exit 0
+fi
+
+# ── Generate the SSHA512 password hash ───────────────────────────────────────
+# Inline the hash function to avoid requiring the full model chain (which
+# tries to connect to Redis/LDAP during module loading and would hang).
+info "Generating password hash..."
+PASSWORD_HASH=$(node -e "
+    const crypto = require('crypto');
+    const salt = crypto.randomBytes(8);
+    const hash = crypto.createHash('sha512').update('${USER_PASSWORD}').update(salt).digest();
+    console.log('{SSHA512}' + Buffer.concat([hash, salt]).toString('base64'));
+")
+
+info "Password hash generated"
+
+# ── Create a temporary LDIF file ─────────────────────────────────────────────
+TMPFILE=$(mktemp /tmp/seed-test-user.XXXXXX)
+trap 'rm -f "$TMPFILE"' EXIT
+
+cat > "$TMPFILE" << LDIF
+# Personal posixGroup for the test user
+dn: cn=${USER_UID},ou=groups,${BASE_DN}
+objectClass: posixGroup
+objectClass: top
+cn: ${USER_UID}
+gidNumber: 1500
+description: Personal group for test user
+
+# Test user posixAccount
+dn: cn=${USER_UID},ou=people,${BASE_DN}
+objectClass: inetOrgPerson
+objectClass: posixAccount
+objectClass: top
+objectClass: theta42Person
+objectClass: ldapPublicKey
+objectClass: sudoRole
+cn: ${USER_UID}
+sn: Test
+uid: ${USER_UID}
+uidNumber: 1500
+gidNumber: 1500
+homeDirectory: /home/${USER_UID}
+loginShell: /bin/bash
+mail: test@test.local
+userPassword: ${PASSWORD_HASH}
+description: Test user for automated test suite
+sudoHost: ALL
+sudoCommand: ALL
+sudoUser: ${USER_UID}
+LDIF
+
+# ── Add the entries to LDAP ──────────────────────────────────────────────────
+info "Creating test user '${USER_UID}' in LDAP..."
+ldapadd -x -H "$LDAP_URI" -D "$BIND_DN" -w "$BIND_PW" -f "$TMPFILE" 2>/dev/null || true
+if ldapsearch -x -H "$LDAP_URI" -D "$BIND_DN" -w "$BIND_PW" \
+    -b "cn=${USER_UID},ou=people,${BASE_DN}" -s base '(objectClass=*)' >/dev/null 2>&1; then
+    info "Test user '${USER_UID}' exists or was created"
+else
+    error "Failed to create test user '${USER_UID}'"
+    exit 1
+fi
+
+# ── Add the test user to required SSO groups ─────────────────────────────────
+info "Adding test user to SSO admin groups..."
+for group in app_sso_admin app_sso_invite app_sso_oauth_admin; do
+    ldapmodify -x -H "$LDAP_URI" -D "$BIND_DN" -w "$BIND_PW" << EOF 2>/dev/null || true
+dn: cn=${group},ou=groups,${BASE_DN}
+changetype: modify
+add: member
+member: cn=${USER_UID},ou=people,${BASE_DN}
+EOF
+done
+info "Test user added to SSO admin groups"
+
+# ── Create additional users needed by tests ─────────────────────────────────
+# wmantly is referenced by OTP (otp.test.js) and impersonation (impersonate.test.js)
+# tests as an existing non-admin user.
+WMANTLY_UID="wmantly"
+if ! ldapsearch -x -H "$LDAP_URI" -D "$BIND_DN" -w "$BIND_PW" \
+    -b "cn=${WMANTLY_UID},ou=people,${BASE_DN}" -s base '(objectClass=*)' >/dev/null 2>&1; then
+
+    info "Creating additional test user '${WMANTLY_UID}'..."
+
+    # Generate password hash for wmantly
+    WMANTLY_HASH=$(node -e "
+        const crypto = require('crypto');
+        const salt = crypto.randomBytes(8);
+        const hash = crypto.createHash('sha512').update('testpass').update(salt).digest();
+        console.log('{SSHA512}' + Buffer.concat([hash, salt]).toString('base64'));
+    ")
+
+    cat > "$TMPFILE" << LDIF
+dn: cn=${WMANTLY_UID},ou=groups,${BASE_DN}
+objectClass: posixGroup
+objectClass: top
+cn: ${WMANTLY_UID}
+gidNumber: 1501
+
+dn: cn=${WMANTLY_UID},ou=people,${BASE_DN}
+objectClass: inetOrgPerson
+objectClass: posixAccount
+objectClass: top
+objectClass: theta42Person
+objectClass: ldapPublicKey
+objectClass: sudoRole
+cn: ${WMANTLY_UID}
+sn: Mantly
+uid: ${WMANTLY_UID}
+uidNumber: 1501
+gidNumber: 1501
+homeDirectory: /home/${WMANTLY_UID}
+loginShell: /bin/bash
+mail: wmantly@test.local
+userPassword: ${WMANTLY_HASH}
+sudoHost: ALL
+sudoCommand: ALL
+sudoUser: ${WMANTLY_UID}
+LDIF
+    ldapadd -x -H "$LDAP_URI" -D "$BIND_DN" -w "$BIND_PW" -f "$TMPFILE" 2>/dev/null || true
+    if ldapsearch -x -H "$LDAP_URI" -D "$BIND_DN" -w "$BIND_PW" \
+        -b "cn=${WMANTLY_UID},ou=people,${BASE_DN}" -s base '(objectClass=*)' >/dev/null 2>&1; then
+        info "Additional test user '${WMANTLY_UID}' exists or was created"
+    else
+        error "Failed to create additional test user '${WMANTLY_UID}'"
+        exit 1
+    fi
+fi
+
+info "Seed complete — all test users are ready"

test_seed.js

@@ -0,0 +1,2 @@
+const { hashPasswordSSHA512 } = require('./nodejs/models/user_ldap.js');
+console.log(hashPasswordSSHA512('MyTestPassword!2'));