Active Directory and eDirectory Vendor Tools

from typing import Dict, List, Optional, Tuple

def fetch_ad_changes(
    server_uri: str,
    bind_dn: str,
    password: str,
    base_dn: str,
    filter: str,
    attributes: Optional[List[str]] = None,
    continuation_token: Optional[bytes] = None,
    include_security: bool = False,
    parents_first: bool = True,
) -> Dict[str, object]:
    """
    Perform an incremental Active Directory sync using the server's vendor-specific delta sync extension.

    Returns a mapping with:
    - 'entries': list of records shaped as {'dn': str, 'attributes': dict, 'change_type': 'add'|'modify'|'delete'}
    - 'token': opaque bytes continuation token (or None when no further pages exist)
    """

def rotate_ad_password(
    server_uri: str,
    caller_dn: str,
    caller_password: str,
    target_dn: str,
    new_password: str,
    current_password: Optional[str] = None,
) -> bool:
    """
    Change an Active Directory user's password through the vendor-specific password change extension.
    Supports both administrative resets and self-service changes when the current password is supplied.
    """

def set_edirectory_universal_password(
    server_uri: str,
    admin_dn: str,
    admin_password: str,
    user_dn: str,
    new_password: str,
) -> bool:
    """
    Set a user's universal password using the eDirectory-specific extension.
    """

def bulk_add_edirectory_group_members(
    server_uri: str,
    admin_dn: str,
    admin_password: str,
    members: List[str],
    groups: List[str],
    fix_inconsistencies: bool = True,
    transactional: bool = True,
) -> Dict[str, object]:
    """
    Add multiple members to multiple groups through the eDirectory bulk membership extension.
    Returns a mapping shaped as {'groups': {group_dn: {'added': [members], 'skipped': [members]}}, 'fixed_inconsistencies': bool}.
    """