Adding LDAP login

app/crud/role.py

@@ -1,4 +1,5 @@
 from sqlalchemy import select
+from sqlalchemy import update as sa_update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.models.permission import Permission
@@ -14,6 +15,23 @@ async def get_by_name(db: AsyncSession, name: str) -> Role | None:
     return result.scalar_one_or_none()
 
 
+async def get_default(db: AsyncSession) -> Role | None:
+    """The role auto-assigned to new users, or ``None`` if none is marked."""
+    result = await db.execute(select(Role).where(Role.is_default.is_(True)))
+    return result.scalars().first()
+
+
+async def set_default(db: AsyncSession, role: Role) -> Role:
+    """Make ``role`` the sole default, clearing the flag on every other role."""
+    await db.execute(
+        sa_update(Role).where(Role.id != role.id).values(is_default=False)
+    )
+    role.is_default = True
+    await db.commit()
+    await db.refresh(role)
+    return role
+
+
 async def list_roles(db: AsyncSession) -> list[Role]:
     result = await db.execute(select(Role).order_by(Role.id))
     return list(result.scalars().all())
@@ -50,6 +68,16 @@ async def update(db: AsyncSession, role: Role, data: dict) -> Role:
     else:
         data.pop("permission_ids", None)
 
+    # Setting a role default must clear the flag on all others.
+    make_default = data.pop("is_default", None)
+    if make_default:
+        await db.execute(
+            sa_update(Role).where(Role.id != role.id).values(is_default=False)
+        )
+        role.is_default = True
+    elif make_default is False:
+        role.is_default = False
+
     for field, value in data.items():
         if value is not None:
             setattr(role, field, value)

app/crud/user.py

@@ -3,7 +3,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.security import hash_password, verify_password
 from app.models.role import Role
-from app.models.user import User
+from app.models.user import AUTH_SOURCE_LDAP, AUTH_SOURCE_LOCAL, User
 
 
 async def get(db: AsyncSession, user_id: int) -> User | None:
@@ -15,6 +15,11 @@ async def get_by_email(db: AsyncSession, email: str) -> User | None:
     return result.scalar_one_or_none()
 
 
+async def get_by_username(db: AsyncSession, username: str) -> User | None:
+    result = await db.execute(select(User).where(User.username == username))
+    return result.scalar_one_or_none()
+
+
 async def list_users(db: AsyncSession, skip: int = 0, limit: int = 100) -> list[User]:
     result = await db.execute(select(User).order_by(User.id).offset(skip).limit(limit))
     return list(result.scalars().all())
@@ -36,14 +41,18 @@ async def create(
     db: AsyncSession,
     *,
     email: str,
-    password: str,
+    password: str | None = None,
     full_name: str | None = None,
     is_superuser: bool = False,
     role_ids: list[int] | None = None,
+    username: str | None = None,
+    auth_source: str = AUTH_SOURCE_LOCAL,
 ) -> User:
     user = User(
         email=email,
-        hashed_password=hash_password(password),
+        username=username,
+        hashed_password=hash_password(password) if password else None,
+        auth_source=auth_source,
         full_name=full_name,
         is_superuser=is_superuser,
         roles=await _resolve_roles(db, role_ids or []),
@@ -54,6 +63,37 @@ async def create(
     return user
 
 
+async def get_or_create_ldap_user(
+    db: AsyncSession,
+    *,
+    username: str,
+    email: str,
+    full_name: str | None,
+    role_ids: list[int] | None = None,
+) -> User:
+    """Find an LDAP user by username, provisioning a local profile on first login.
+
+    The profile is keyed on the LDAP username; email is synthesized by the
+    caller. Newly provisioned users get ``role_ids`` (the default role).
+    """
+    user = await get_by_username(db, username)
+    if user is not None:
+        # Keep the display name in sync with LDAP on subsequent logins.
+        if full_name and user.full_name != full_name:
+            user.full_name = full_name
+            await db.commit()
+            await db.refresh(user)
+        return user
+    return await create(
+        db,
+        email=email,
+        username=username,
+        full_name=full_name,
+        auth_source=AUTH_SOURCE_LDAP,
+        role_ids=role_ids,
+    )
+
+
 async def update(db: AsyncSession, user: User, data: dict) -> User:
     if "password" in data and data["password"]:
         user.hashed_password = hash_password(data.pop("password"))
@@ -81,6 +121,9 @@ async def delete(db: AsyncSession, user: User) -> None:
 
 async def authenticate(db: AsyncSession, email: str, password: str) -> User | None:
     user = await get_by_email(db, email)
-    if not user or not verify_password(password, user.hashed_password):
+    # LDAP users have no local password and must sign in via LDAP.
+    if not user or not user.hashed_password:
+        return None
+    if not verify_password(password, user.hashed_password):
         return None
     return user