Adding LDAP support

app/services/auth.py

@@ -1,8 +1,12 @@
-"""Token issuance / rotation shared by the JSON API and the HTMX UI."""
+"""Auth orchestration shared by the JSON API and the HTMX UI.
+
+Covers credential verification (LDAP + local) and token issuance / rotation.
+"""
 
 import jwt
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.core.config import settings
 from app.core.security import (
     REFRESH_TOKEN_TYPE,
     create_access_token,
@@ -10,7 +14,35 @@ from app.core.security import (
     decode_token,
 )
 from app.crud import token as token_crud
+from app.crud import user as user_crud
 from app.models.user import User
+from app.services import ldap as ldap_service
+
+
+async def authenticate(db: AsyncSession, username: str, password: str) -> User | None:
+    """Verify credentials and return the matching active user, or ``None``.
+
+    When LDAP is enabled the directory is tried first; on a successful bind the
+    local user row is provisioned/refreshed. Local database authentication is
+    always attempted as a fallback, so pre-existing accounts (e.g. the seeded
+    superuser) keep working alongside LDAP.
+    """
+    if settings.ldap_enabled:
+        ldap_user = await ldap_service.authenticate_ldap(username, password)
+        if ldap_user is not None:
+            user = await user_crud.upsert_ldap_user(
+                db,
+                email=ldap_user.email,
+                full_name=ldap_user.full_name,
+                default_role_names=settings.ldap_default_roles,
+            )
+            return user if user.is_active else None
+
+    # Local password auth (the only path when LDAP is disabled).
+    user = await user_crud.authenticate(db, username, password)
+    if user is not None and not user.is_active:
+        return None
+    return user
 
 
 async def issue_token_pair(db: AsyncSession, user: User) -> tuple[str, str]: