Adding LDAP login

app/web/admin.py

@@ -360,6 +360,33 @@ async def update_role(
     )
 
 
+@router.post("/roles/{role_id}/default", response_class=HTMLResponse)
+async def make_default_role(
+    request: Request,
+    role_id: int,
+    db: AsyncSession = Depends(get_db),
+    actor: User = Depends(web_require("roles:write")),
+):
+    role = await role_crud.get(db, role_id)
+    if role is None:
+        raise HTTPException(status_code=404, detail="Role not found")
+    await role_crud.set_default(db, role)
+    await audit_crud.log(
+        db,
+        actor=actor,
+        action="update",
+        resource_type="Role",
+        resource_id=role_id,
+        description=f"Set role {role.name} (#{role_id}) as the default role",
+    )
+    # Re-render the whole table so every row's default badge refreshes.
+    return templates.TemplateResponse(
+        request,
+        "admin/_roles_table.html",
+        {"roles": await role_crud.list_roles(db), **(await _role_perm_ctx(db))},
+    )
+
+
 @router.delete("/roles/{role_id}")
 async def delete_role(
     role_id: int,

app/web/pages.py

@@ -1,4 +1,4 @@
-from fastapi import APIRouter, Depends, Form, Request, status
+from fastapi import APIRouter, Depends, Form, HTTPException, Request, status
 from fastapi.responses import HTMLResponse, RedirectResponse, Response
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -7,6 +7,7 @@ from app.core.database import get_db
 from app.crud import user as user_crud
 from app.deps import get_current_web_user
 from app.models.user import User
+from app.services import ldap as ldap_service
 from app.services.auth import issue_token_pair
 from app.web.templates import templates
 
@@ -35,7 +36,9 @@ async def dashboard(
 
 @router.get("/login", response_class=HTMLResponse)
 async def login_page(request: Request):
-    return templates.TemplateResponse(request, "login.html", {})
+    return templates.TemplateResponse(
+        request, "login.html", {"ldap_enabled": settings.ldap_enabled}
+    )
 
 
 @router.post("/login")
@@ -51,7 +54,38 @@ async def login_submit(
         return templates.TemplateResponse(
             request,
             "login.html",
-            {"error": "Incorrect email or password", "email": email},
+            {
+                "error": "Incorrect email or password",
+                "email": email,
+                "ldap_enabled": settings.ldap_enabled,
+            },
+            status_code=status.HTTP_401_UNAUTHORIZED,
+        )
+    access, _ = await issue_token_pair(db, user)
+    response = RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER)
+    _set_auth_cookie(response, access)
+    return response
+
+
+@router.post("/login/ldap")
+async def login_ldap_submit(
+    request: Request,
+    username: str = Form(...),
+    password: str = Form(...),
+    db: AsyncSession = Depends(get_db),
+):
+    if not settings.ldap_enabled:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND)
+    user = await ldap_service.login(db, username, password)
+    if user is None:
+        return templates.TemplateResponse(
+            request,
+            "login.html",
+            {
+                "error": "LDAP sign-in failed",
+                "username": username,
+                "ldap_enabled": True,
+            },
             status_code=status.HTTP_401_UNAUTHORIZED,
         )
     access, _ = await issue_token_pair(db, user)