Adding LDAP login

app/models/role.py

@@ -1,4 +1,4 @@
-from sqlalchemy import String
+from sqlalchemy import Boolean, String
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from app.core.database import Base
@@ -11,6 +11,9 @@ class Role(Base):
     id: Mapped[int] = mapped_column(primary_key=True)
     name: Mapped[str] = mapped_column(String(64), unique=True, index=True)
     description: Mapped[str | None] = mapped_column(String(255), default=None)
+    # The role auto-assigned to newly provisioned/registered users. At most one
+    # role is the default; see ``crud.role.set_default``.
+    is_default: Mapped[bool] = mapped_column(Boolean, default=False)
 
     users: Mapped[list["User"]] = relationship(  # noqa: F821
         secondary=user_roles,

app/models/user.py

@@ -6,13 +6,23 @@ from sqlalchemy.orm import Mapped, mapped_column, relationship
 from app.core.database import Base
 from app.models.associations import user_roles
 
+# Where a user's credentials are verified.
+AUTH_SOURCE_LOCAL = "local"
+AUTH_SOURCE_LDAP = "ldap"
+
 
 class User(Base):
     __tablename__ = "users"
 
     id: Mapped[int] = mapped_column(primary_key=True)
     email: Mapped[str] = mapped_column(String(255), unique=True, index=True)
-    hashed_password: Mapped[str] = mapped_column(String(255))
+    # Set for users provisioned from LDAP; how they sign in. Null for local users.
+    username: Mapped[str | None] = mapped_column(
+        String(255), unique=True, index=True, default=None
+    )
+    # Null for LDAP users, who have no local password (verified against LDAP).
+    hashed_password: Mapped[str | None] = mapped_column(String(255), default=None)
+    auth_source: Mapped[str] = mapped_column(String(16), default=AUTH_SOURCE_LOCAL)
     full_name: Mapped[str | None] = mapped_column(String(255), default=None)
     is_active: Mapped[bool] = mapped_column(Boolean, default=True)
     is_superuser: Mapped[bool] = mapped_column(Boolean, default=False)