// Type definitions for ldapauth-fork 4.0
// Project: https://github.com/vesse/node-ldapauth-fork
// Definitions by: Vesa Poikajärvi <https://github.com/vesse>
// TypeScript Version: 2.1

/// <reference types="node"/>

import { EventEmitter } from 'events';
import { ClientOptions, ErrorCallback } from 'ldapjs';
import { ConnectionOptions } from 'tls';

declare namespace LdapAuth {
  type Scope = 'base' | 'one' | 'sub';

  interface Callback {
    (error: Error | string, result?: any): void;
  }

  interface GroupSearchFilterFunction {
    /**
     * Construct a group search filter from user object
     *
     * @param user The user retrieved and authenticated from LDAP
     */
    (user: any): string;
  }

  interface Options extends ClientOptions {
    /**
     * Admin connection DN, e.g. uid=myapp,ou=users,dc=example,dc=org.
     * If not given at all, admin client is not bound. Giving empty
     * string may result in anonymous bind when allowed.
     *
     * Note: Not passed to ldapjs, it would bind automatically
     */
    bindDN?: string;
    /**
     * Password for bindDN
     */
    bindCredentials?: string;
    /**
     * The base DN from which to search for users by username.
     * E.g. ou=users,dc=example,dc=org
     */
    searchBase: string;
    /**
     * LDAP search filter with which to find a user by username, e.g.
     * (uid={{username}}). Use the literal {{username}} to have the
     * given username interpolated in for the LDAP search.
     */
    searchFilter: string;
    /**
     * Scope of the search. Default: 'sub'
     */
    searchScope?: Scope;
    /**
     * Array of attributes to fetch from LDAP server. Default: all
     */
    searchAttributes?: string[];

    /**
     * The base DN from which to search for groups. If defined,
     * also groupSearchFilter must be defined for the search to work.
     */
    groupSearchBase?: string;
    /**
     * LDAP search filter for groups. Place literal {{dn}} in the filter
     * to have it replaced by the property defined with `groupDnProperty`
     * of the found user object. Optionally you can also assign a
     * function instead. The found user is passed to the function and it
     * should return a valid search filter for the group search.
     */
    groupSearchFilter?: string | GroupSearchFilterFunction;
    /**
     * Scope of the search. Default: sub
     */
    groupSearchScope?: Scope;
    /**
     * Array of attributes to fetch from LDAP server. Default: all
     */
    groupSearchAttributes?: string[];

    /**
     * Property of the LDAP user object to use when binding to verify
     * the password. E.g. name, email. Default: dn
     */
    bindProperty?: string;
    /**
     * The property of user object to use in '{{dn}}' interpolation of
     * groupSearchFilter. Default: 'dn'
     */
    groupDnProperty?: string;

    /**
     * Set to true to add property '_raw' containing the original buffers
     * to the returned user object. Useful when you need to handle binary
     * attributes
     */
    includeRaw?: boolean;

    /**
     * If true, then up to 100 credentials at a time will be cached for
     * 5 minutes.
     */
    cache?: boolean;

    /**
     * If true, then intialize TLS using the starttls mechanism.
     */
    starttls?: boolean;
    /**
     * Provides the secure TLS options passed to tls.connect in ldapjs
     */
    tlsOptions?: ConnectionOptions;
  }
}

declare class LdapAuth extends EventEmitter {
  /**
   * @constructor
   * @param opts
   */
  constructor(opts: LdapAuth.Options);

  /**
   * Authenticate against LDAP server with given credentials
   *
   * @param username Username
   * @param password Password
   * @param callback Standard callback
   */
  authenticate(username: string, password: string, callback: LdapAuth.Callback): void;

  /**
   * Unbind both admin and client connections
   *
   * @param callback Error callback
   */
  close(callback?: ErrorCallback): void;
}

export = LdapAuth;