Adding LDAP login

app/api/auth.py

@@ -2,6 +2,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from fastapi.security import OAuth2PasswordRequestForm
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.core.config import settings
 from app.core.database import get_db
 from app.crud import role as role_crud
 from app.crud import token as token_crud
@@ -10,27 +11,34 @@ from app.deps import get_current_user
 from app.models.user import User
 from app.schemas.token import LogoutRequest, Token, TokenRefreshRequest
 from app.schemas.user import RegisterRequest, UserRead
+from app.services import ldap as ldap_service
 from app.services.auth import RefreshError, issue_token_pair, rotate_refresh_token
 
 router = APIRouter()
 
+# Fallback default role name if no role is flagged as default in the DB.
 DEFAULT_USER_ROLE = "user"
 
 
+async def _default_role_ids(db: AsyncSession) -> list[int]:
+    role = await role_crud.get_default(db)
+    if role is None:
+        role = await role_crud.get_by_name(db, DEFAULT_USER_ROLE)
+    return [role.id] if role else []
+
+
 @router.post("/register", response_model=UserRead, status_code=status.HTTP_201_CREATED)
 async def register(payload: RegisterRequest, db: AsyncSession = Depends(get_db)):
     if await user_crud.get_by_email(db, payload.email):
         raise HTTPException(
             status_code=status.HTTP_409_CONFLICT, detail="Email already registered"
         )
-    default_role = await role_crud.get_by_name(db, DEFAULT_USER_ROLE)
-    role_ids = [default_role.id] if default_role else []
     user = await user_crud.create(
         db,
         email=payload.email,
         password=payload.password,
         full_name=payload.full_name,
-        role_ids=role_ids,
+        role_ids=await _default_role_ids(db),
     )
     return user
 
@@ -52,6 +60,27 @@ async def login(
     return Token(access_token=access, refresh_token=refresh)
 
 
+@router.post("/ldap-login", response_model=Token)
+async def ldap_login(
+    form: OAuth2PasswordRequestForm = Depends(),
+    db: AsyncSession = Depends(get_db),
+):
+    """Authenticate against LDAP, provisioning the local profile on first login."""
+    if not settings.ldap_enabled:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="LDAP login is not enabled"
+        )
+    user = await ldap_service.login(db, form.username, form.password)
+    if user is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Incorrect username or password",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    access, refresh = await issue_token_pair(db, user)
+    return Token(access_token=access, refresh_token=refresh)
+
+
 @router.post("/refresh", response_model=Token)
 async def refresh(payload: TokenRefreshRequest, db: AsyncSession = Depends(get_db)):
     try: