Adding LDAP login

app/crud/user.py

@@ -3,7 +3,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.security import hash_password, verify_password
 from app.models.role import Role
-from app.models.user import User
+from app.models.user import AUTH_SOURCE_LDAP, AUTH_SOURCE_LOCAL, User
 
 
 async def get(db: AsyncSession, user_id: int) -> User | None:
@@ -15,6 +15,11 @@ async def get_by_email(db: AsyncSession, email: str) -> User | None:
     return result.scalar_one_or_none()
 
 
+async def get_by_username(db: AsyncSession, username: str) -> User | None:
+    result = await db.execute(select(User).where(User.username == username))
+    return result.scalar_one_or_none()
+
+
 async def list_users(db: AsyncSession, skip: int = 0, limit: int = 100) -> list[User]:
     result = await db.execute(select(User).order_by(User.id).offset(skip).limit(limit))
     return list(result.scalars().all())
@@ -36,14 +41,18 @@ async def create(
     db: AsyncSession,
     *,
     email: str,
-    password: str,
+    password: str | None = None,
     full_name: str | None = None,
     is_superuser: bool = False,
     role_ids: list[int] | None = None,
+    username: str | None = None,
+    auth_source: str = AUTH_SOURCE_LOCAL,
 ) -> User:
     user = User(
         email=email,
-        hashed_password=hash_password(password),
+        username=username,
+        hashed_password=hash_password(password) if password else None,
+        auth_source=auth_source,
         full_name=full_name,
         is_superuser=is_superuser,
         roles=await _resolve_roles(db, role_ids or []),
@@ -54,6 +63,37 @@ async def create(
     return user
 
 
+async def get_or_create_ldap_user(
+    db: AsyncSession,
+    *,
+    username: str,
+    email: str,
+    full_name: str | None,
+    role_ids: list[int] | None = None,
+) -> User:
+    """Find an LDAP user by username, provisioning a local profile on first login.
+
+    The profile is keyed on the LDAP username; email is synthesized by the
+    caller. Newly provisioned users get ``role_ids`` (the default role).
+    """
+    user = await get_by_username(db, username)
+    if user is not None:
+        # Keep the display name in sync with LDAP on subsequent logins.
+        if full_name and user.full_name != full_name:
+            user.full_name = full_name
+            await db.commit()
+            await db.refresh(user)
+        return user
+    return await create(
+        db,
+        email=email,
+        username=username,
+        full_name=full_name,
+        auth_source=AUTH_SOURCE_LDAP,
+        role_ids=role_ids,
+    )
+
+
 async def update(db: AsyncSession, user: User, data: dict) -> User:
     if "password" in data and data["password"]:
         user.hashed_password = hash_password(data.pop("password"))
@@ -81,6 +121,9 @@ async def delete(db: AsyncSession, user: User) -> None:
 
 async def authenticate(db: AsyncSession, email: str, password: str) -> User | None:
     user = await get_by_email(db, email)
-    if not user or not verify_password(password, user.hashed_password):
+    # LDAP users have no local password and must sign in via LDAP.
+    if not user or not user.hashed_password:
+        return None
+    if not verify_password(password, user.hashed_password):
         return None
     return user