LDAP / Active Directory Authentication — Implementation Plan

// LDAPConfig configures directory (LDAP/AD) authentication. Disabled by default so the demo
// and every existing deployment are unchanged. When enabled, the login form transparently
// authenticates directory users (JIT-provisioned, provider='ldap') in addition to (mixed) or
// instead of (only) local passwords. The defaults are AD-friendly (objectClass=user,
// mail/sAMAccountName, memberOf); an OpenLDAP rig overrides USER_FILTER/attrs (see docs/LDAP.md).
type LDAPConfig struct {
    Enabled            bool   `env:"LDAP_ENABLED" envDefault:"false"`
    URL                string `env:"LDAP_URL"`                                          // ldap://host:389 or ldaps://host:636
    StartTLS           bool   `env:"LDAP_START_TLS" envDefault:"false"`                // upgrade plain 389 to TLS; mutually exclusive with ldaps
    CAFile             string `env:"LDAP_CA_FILE"`                                     // optional PEM for a private CA
    InsecureSkipVerify bool   `env:"LDAP_INSECURE_SKIP_VERIFY" envDefault:"false"`     // TESTING ONLY; logged loudly
    BindDN             string `env:"LDAP_BIND_DN"`                                     // read-only service account for the search bind
    BindPassword       string `env:"LDAP_BIND_PASSWORD"`
    BaseDN             string `env:"LDAP_BASE_DN"`                                     // e.g. dc=corp,dc=example,dc=id
    UserFilter         string `env:"LDAP_USER_FILTER" envDefault:"(&(objectClass=user)(|(mail=%s)(sAMAccountName=%s)))"` // %s = escaped login
    AttrEmail          string `env:"LDAP_ATTR_EMAIL" envDefault:"mail"`
    AttrName           string `env:"LDAP_ATTR_NAME" envDefault:"displayName"`
    AttrGroups         string `env:"LDAP_ATTR_GROUPS" envDefault:"memberOf"`
    Mode               string `env:"LDAP_MODE" envDefault:"mixed"`                     // mixed | only
}

    LDAP         LDAPConfig

    if err := c.LDAP.validate(); err != nil {
        return err
    }

func (l LDAPConfig) validate() error {
    if !l.Enabled {
        return nil
    }
    if l.URL == "" {
        return fmt.Errorf("config: LDAP_URL is required when LDAP_ENABLED=true")
    }
    if l.BaseDN == "" {
        return fmt.Errorf("config: LDAP_BASE_DN is required when LDAP_ENABLED=true")
    }
    if l.StartTLS && strings.HasPrefix(strings.ToLower(l.URL), "ldaps://") {
        return fmt.Errorf("config: LDAP_START_TLS is mutually exclusive with an ldaps:// LDAP_URL — choose one TLS mode")
    }
    switch l.Mode {
    case "mixed", "only":
    default:
        return fmt.Errorf("config: invalid LDAP_MODE %q (want mixed|only)", l.Mode)
    }
    return nil
}

package adapters

import (
    "context"
    "crypto/tls"
    "crypto/x509"
    "errors"
    "fmt"
    "log/slog"
    "net"
    "net/url"
    "os"
    "strings"
    "sync/atomic"
    "time"

    "github.com/go-ldap/ldap/v3"

    "github.com/Virtue-Digital-Indonesia/obscura/internal/auth/app"
)

const ldapOpTimeout = 8 * time.Second

// LDAPAuthenticator implements app.DirectoryAuthenticator against an LDAP/AD server. It is
// constructed only when LDAP is enabled (nil otherwise). Each Authenticate dials a fresh
// connection (closed on return); the only retained state is the atomic last-bind telemetry
// surfaced by Status() for the admin status card.
type LDAPAuthenticator struct {
    url          string
    startTLS     bool
    tlsConfig    *tls.Config
    bindDN       string
    bindPassword string
    baseDN       string
    userFilter   string
    attrEmail    string
    attrName     string
    attrGroups   string
    mode         string
    logger       *slog.Logger

    lastBindOK   atomic.Bool
    lastBindUnix atomic.Int64 // unix seconds of the last successful service bind; 0 = never
}

// LDAPOptions is the constructor input (mirrors config.LDAPConfig; decoupled so auth/adapters
// does not import platform/config).
type LDAPOptions struct {
    URL, BindDN, BindPassword, BaseDN, UserFilter, AttrEmail, AttrName, AttrGroups, Mode, CAFile string
    StartTLS, InsecureSkipVerify                                                                 bool
}

// NewLDAPAuthenticator builds the authenticator, loading the optional CA file into a pool and
// deriving the TLS ServerName from the URL host.
func NewLDAPAuthenticator(opts LDAPOptions, logger *slog.Logger) (*LDAPAuthenticator, error) {
    tlsCfg := &tls.Config{InsecureSkipVerify: opts.InsecureSkipVerify} //nolint:gosec // opt-in, logged below
    if opts.InsecureSkipVerify && logger != nil {
        logger.Warn("LDAP_INSECURE_SKIP_VERIFY is set — the directory server's TLS certificate is NOT verified; use only for testing")
    }
    if u, err := url.Parse(opts.URL); err == nil && u.Hostname() != "" {
        tlsCfg.ServerName = u.Hostname()
    }
    if opts.CAFile != "" {
        pem, err := os.ReadFile(opts.CAFile)
        if err != nil {
            return nil, fmt.Errorf("ldap: read CA file %q: %w", opts.CAFile, err)
        }
        pool := x509.NewCertPool()
        if !pool.AppendCertsFromPEM(pem) {
            return nil, fmt.Errorf("ldap: CA file %q contained no valid PEM certificates", opts.CAFile)
        }
        tlsCfg.RootCAs = pool
    }
    return &LDAPAuthenticator{
        url: opts.URL, startTLS: opts.StartTLS, tlsConfig: tlsCfg,
        bindDN: opts.BindDN, bindPassword: opts.BindPassword, baseDN: opts.BaseDN,
        userFilter: opts.UserFilter, attrEmail: opts.AttrEmail, attrName: opts.AttrName,
        attrGroups: opts.AttrGroups, mode: opts.Mode, logger: logger,
    }, nil
}

// Mode returns the configured posture (mixed|only).
func (a *LDAPAuthenticator) Mode() string { return a.mode }

// Status returns the read-only health/config summary for GET /admin/ldap/status.
func (a *LDAPAuthenticator) Status() app.DirectoryStatus {
    st := app.DirectoryStatus{Enabled: true, URL: a.url, Mode: a.mode, BaseDN: a.baseDN, LastBindOK: a.lastBindOK.Load()}
    if u := a.lastBindUnix.Load(); u > 0 {
        t := time.Unix(u, 0).UTC()
        st.LastBindAt = &t
    }
    return st
}

// dial opens a connection honoring ldap:// vs ldaps:// and optional StartTLS.
func (a *LDAPAuthenticator) dial() (*ldap.Conn, error) {
    dialer := ldap.DialWithDialer(&net.Dialer{Timeout: ldapOpTimeout})
    if strings.HasPrefix(strings.ToLower(a.url), "ldaps://") {
        return ldap.DialURL(a.url, dialer, ldap.DialWithTLSConfig(a.tlsConfig))
    }
    conn, err := ldap.DialURL(a.url, dialer)
    if err != nil {
        return nil, err
    }
    if a.startTLS {
        if err := conn.StartTLS(a.tlsConfig); err != nil {
            conn.Close()
            return nil, fmt.Errorf("starttls: %w", err)
        }
    }
    return conn, nil
}

// Authenticate performs the service-account search bind, requires exactly one match, binds AS
// the found user with the submitted password, and returns the identity + groups. The login
// input is escaped with ldap.EscapeFilter before templating into USER_FILTER, so filter
// injection is impossible. Every error is returned as-is; the caller maps ALL of them to a
// single generic invalid-credentials error (no enumeration).
func (a *LDAPAuthenticator) Authenticate(ctx context.Context, login, password string) (app.DirectoryIdentity, error) {
    _ = ctx // go-ldap v3 has no ctx-aware ops; per-op deadline is set via SetTimeout below
    if login == "" || password == "" {
        return app.DirectoryIdentity{}, errors.New("ldap: empty login or password")
    }

    conn, err := a.dial()
    if err != nil {
        a.lastBindOK.Store(false)
        return app.DirectoryIdentity{}, fmt.Errorf("ldap: dial: %w", err)
    }
    defer conn.Close()
    conn.SetTimeout(ldapOpTimeout)

    // 1) service-account search bind
    if err := conn.Bind(a.bindDN, a.bindPassword); err != nil {
        a.lastBindOK.Store(false)
        return app.DirectoryIdentity{}, fmt.Errorf("ldap: service bind: %w", err)
    }
    a.lastBindOK.Store(true)
    a.lastBindUnix.Store(time.Now().Unix())

    // 2) escaped search — exactly one result required
    safe := ldap.EscapeFilter(login)
    nverb := strings.Count(a.userFilter, "%s")
    args := make([]any, nverb)
    for i := range args {
        args[i] = safe
    }
    filter := fmt.Sprintf(a.userFilter, args...)
    req := ldap.NewSearchRequest(
        a.baseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
        2, int(ldapOpTimeout.Seconds()), false,
        filter, []string{a.attrEmail, a.attrName, a.attrGroups}, nil,
    )
    res, err := conn.Search(req)
    if err != nil {
        return app.DirectoryIdentity{}, fmt.Errorf("ldap: search: %w", err)
    }
    if len(res.Entries) != 1 {
        return app.DirectoryIdentity{}, fmt.Errorf("ldap: expected exactly 1 result, got %d", len(res.Entries))
    }
    entry := res.Entries[0]

    // 3) bind AS the user (rebind the same conn) with the submitted password
    if err := conn.Bind(entry.DN, password); err != nil {
        return app.DirectoryIdentity{}, fmt.Errorf("ldap: user bind: %w", err)
    }

    // 4) extract attributes; fall back email→login (the search matched it) so JIT always has one
    id := app.DirectoryIdentity{
        DN:          entry.DN,
        Email:       entry.GetAttributeValue(a.attrEmail),
        DisplayName: entry.GetAttributeValue(a.attrName),
        Groups:      entry.GetAttributeValues(a.attrGroups),
    }
    if id.Email == "" {
        id.Email = login
    }
    return id, nil
}

var _ app.DirectoryAuthenticator = (*LDAPAuthenticator)(nil)

git add go/go.mod go/go.sum go/internal/platform/config/config.go go/internal/auth/adapters/ldap.go
git commit -m "feat(auth): LDAP config (fail-closed) + go-ldap authenticator (search+user bind, escaped filter)"

-- +goose Up
-- Denormalized identity-backend marker on users, so the login path decides local-vs-directory
-- in ONE column read (a user is either local or ldap). Existing rows are backfilled from their
-- primary user_identities.idp; new rows are stamped by UpsertUserByIdentity. Default 'local'
-- keeps any identity-less row (there should be none) on the local password path — behavior is
-- unchanged until a user is provisioned via LDAP.
ALTER TABLE users ADD COLUMN provider text NOT NULL DEFAULT 'local';

UPDATE users u
   SET provider = COALESCE(
       (SELECT i.idp FROM user_identities i WHERE i.user_id = u.id ORDER BY i.created_at, i.id LIMIT 1),
       'local');

-- +goose Down
ALTER TABLE users DROP COLUMN provider;

    // Provider is the identity backend that owns this account: "local"/"dev" (password or
    // dev-login), "oidc", or "ldap". A directory ('ldap') account has NO local password and may
    // not change-password. Denormalized from the user's primary user_identities.idp.
    Provider string

package app

import (
    "context"
    "time"
)

// DirectoryIdentity is the identity asserted by a successful directory (LDAP/AD) bind.
type DirectoryIdentity struct {
    DN          string   // the bound user's distinguished name — the stable JIT subject
    Email       string
    DisplayName string
    Groups      []string // raw group DN strings from LDAP_ATTR_GROUPS (memberOf by default)
}

// DirectoryStatus is the read-only health/config summary for GET /admin/ldap/status.
type DirectoryStatus struct {
    Enabled    bool
    URL        string
    Mode       string
    BaseDN     string
    LastBindOK bool
    LastBindAt *time.Time
}

// DirectoryAuthenticator authenticates a login+password against an external directory and
// returns the asserted identity. nil on the Service = directory login disabled.
type DirectoryAuthenticator interface {
    Authenticate(ctx context.Context, login, password string) (DirectoryIdentity, error)
    Status() DirectoryStatus
    Mode() string
}

// AdminChecker reports whether a user holds the wildcard break-glass admin role (directly or
// via a held position). Consulted ONLY in LDAP_MODE=only so an operator can still log in with a
// local password when the directory is down. nil → no break-glass (directory-only for all).
type AdminChecker interface {
    HoldsAdmin(ctx context.Context, userID string) (bool, error)
}

// GroupRoleReconciler applies a directory user's group memberships to their Obscura role grants
// after a successful directory login. Best-effort: a failure is logged and NON-FATAL to the
// login. nil → group→role mapping disabled.
type GroupRoleReconciler interface {
    Reconcile(ctx context.Context, userID string, groupDNs []string) error
}

const userColumns = `id, email, display_name, phone, is_service, created_at, disabled, quota_bytes, provider`

func userColumnsAliased(alias string) string {
    return alias + `.id, ` + alias + `.email, ` + alias + `.display_name, ` + alias + `.phone, ` +
        alias + `.is_service, ` + alias + `.created_at, ` + alias + `.disabled, ` + alias + `.quota_bytes, ` +
        alias + `.provider`
}

func scanUser(u *domain.User) []any {
    return []any{&u.ID, &u.Email, &u.DisplayName, &u.Phone, &u.IsService, &u.CreatedAt, &u.Disabled, &u.QuotaBytes, &u.Provider}
}

            if _, err := ex.Exec(ctx,
                `INSERT INTO users (id, email, display_name, provider) VALUES ($1, $2, $3, $4)`, uid, email, name, idp); err != nil {
                return fmt.Errorf("auth create user: %w", err)
            }

type Service struct {
    repo     Repository
    hasher   Hasher
    totp     TOTP
    verifier TokenVerifier // nil when OIDC is not configured
    now      func() time.Time

    dir        DirectoryAuthenticator // nil when LDAP disabled
    admin      AdminChecker           // nil when no break-glass check wired
    reconciler GroupRoleReconciler    // nil when group→role mapping disabled
    logger     *slog.Logger           // optional; best-effort directory-path logging
}

// SetDirectory attaches the optional directory-login collaborators (LDAP authenticator,
// break-glass admin checker, group→role reconciler) and a logger. Leaving dir nil keeps the
// login path identical to today (local password only). Wired in the composition root after
// rbac/directory exist, following the repo's Set*-collaborator idiom.
func (s *Service) SetDirectory(dir DirectoryAuthenticator, admin AdminChecker, reconciler GroupRoleReconciler, logger *slog.Logger) {
    s.dir = dir
    s.admin = admin
    s.reconciler = reconciler
    s.logger = logger
}

// DirectoryStatus returns the directory-login status (admin status card) and whether a
// directory backend is configured at all.
func (s *Service) DirectoryStatus() (DirectoryStatus, bool) {
    if s.dir == nil {
        return DirectoryStatus{Enabled: false}, false
    }
    return s.dir.Status(), true
}

// LoginWithDirectory authenticates an email+password across the local and directory (LDAP/AD)
// backends per the transparent-same-form policy (see the login-branch contract in the plan).
// When the directory is disabled (s.dir == nil) it reduces EXACTLY to VerifyPassword. Every
// failure returns the same generic invalid-credentials error as local login (no enumeration).
func (s *Service) LoginWithDirectory(ctx context.Context, email, password string) (domain.User, error) {
    invalid := &kernel.Error{Kind: kernel.ErrPermissionDenied, Code: "auth.login.invalid", Message: "invalid email or password"}
    if email == "" || password == "" {
        return domain.User{}, invalid
    }

    existing, _, err := s.repo.UserByEmail(ctx, email)
    known := err == nil
    if err != nil {
        var ke *kernel.Error
        if !(errors.As(err, &ke) && ke.Kind == kernel.ErrNotFound) {
            return domain.User{}, err // a real lookup error, not "absent"
        }
    }

    // Local path: a known non-ldap user, OR the directory being disabled entirely. A failed
    // local verify NEVER falls through to LDAP for a local-provider user.
    if (known && existing.Provider != "ldap") || s.dir == nil {
        if s.dir != nil && s.dir.Mode() == "only" && known {
            isAdmin := false
            if s.admin != nil {
                if ok, aerr := s.admin.HoldsAdmin(ctx, existing.ID); aerr == nil {
                    isAdmin = ok
                }
            }
            if !isAdmin {
                return domain.User{}, invalid // directory-only: local passwords disabled for non-admins
            }
        }
        return s.VerifyPassword(ctx, email, password)
    }

    // Directory path: unknown user, or a known provider='ldap' user.
    id, aerr := s.dir.Authenticate(ctx, email, password)
    if aerr != nil {
        if s.logger != nil {
            s.logger.Warn("directory authenticate failed", "login", email, "err", aerr)
        }
        return domain.User{}, invalid
    }
    subject := id.DN
    if subject == "" {
        subject = strings.ToLower(email)
    }
    user, perr := s.repo.UpsertUserByIdentity(ctx, "ldap", subject, id.Email, id.DisplayName)
    if perr != nil {
        return domain.User{}, perr
    }
    if s.reconciler != nil {
        if rerr := s.reconciler.Reconcile(ctx, user.ID, id.Groups); rerr != nil && s.logger != nil {
            s.logger.Warn("directory group reconcile failed", "user", user.ID, "err", rerr)
        }
    }
    return user, nil
}

    user, err := s.repo.GetUser(ctx, userID)
    if err != nil {
        return err
    }
    if user.Provider == "ldap" {
        return &kernel.Error{Kind: kernel.ErrValidation, Code: "auth.ldap.managed_by_directory", Message: "your password is managed by your directory (LDAP/AD) — change it there"}
    }

    user, err := s.auth.LoginWithDirectory(ctx, body.Email, body.Password)

    // Directory (LDAP/AD) login: build the authenticator when enabled (nil otherwise), a
    // break-glass admin checker, and the group→role reconciler, then attach them to authSvc.
    // LDAP is disabled by default (config fail-closed), so the demo login path is unchanged.
    var directoryAuth authapp.DirectoryAuthenticator
    if cfg.LDAP.Enabled {
        la, lerr := authadapters.NewLDAPAuthenticator(authadapters.LDAPOptions{
            URL: cfg.LDAP.URL, StartTLS: cfg.LDAP.StartTLS, CAFile: cfg.LDAP.CAFile,
            InsecureSkipVerify: cfg.LDAP.InsecureSkipVerify, BindDN: cfg.LDAP.BindDN,
            BindPassword: cfg.LDAP.BindPassword, BaseDN: cfg.LDAP.BaseDN, UserFilter: cfg.LDAP.UserFilter,
            AttrEmail: cfg.LDAP.AttrEmail, AttrName: cfg.LDAP.AttrName, AttrGroups: cfg.LDAP.AttrGroups,
            Mode: cfg.LDAP.Mode,
        }, logger)
        if lerr != nil {
            return fmt.Errorf("ldap authenticator: %w", lerr)
        }
        directoryAuth = la
        logger.Info("LDAP directory login enabled", "url", cfg.LDAP.URL, "mode", cfg.LDAP.Mode, "base_dn", cfg.LDAP.BaseDN)
    }
    ldapGrantStore := authadapters.NewLDAPGrantStore(database)               // T3
    ldapGroupRoleSvc := authapp.NewGroupRoleService(ldapGrantStore, rbacStore) // T3
    authSvc.SetDirectory(directoryAuth, ldapAdminChecker{rbac: rbacStore, dir: dirSvc, clock: utcNow}, ldapGroupRoleSvc, logger)

// ldapAdminChecker answers "does this user hold the wildcard break-glass admin role" for the
// LDAP_MODE=only local-login exception, resolving the SAME way GET /me does: roles bound to the
// user UNION roles bound to any held position; the wildcard role is named "admin".
type ldapAdminChecker struct {
    rbac  *rbacadapters.Store
    dir   *directoryapp.Service
    clock func() time.Time
}

func (c ldapAdminChecker) HoldsAdmin(ctx context.Context, userID string) (bool, error) {
    if byUser, err := c.rbac.RolesForSubjects(ctx, "user", []string{userID}); err == nil {
        for _, rn := range byUser[userID] {
            if rn == "admin" {
                return true, nil
            }
        }
    }
    positions, err := c.dir.PositionsForUser(ctx, userID, c.clock())
    if err != nil || len(positions) == 0 {
        return false, nil
    }
    byPos, err := c.rbac.RolesForSubjects(ctx, "position", positions)
    if err != nil {
        return false, nil
    }
    for _, rns := range byPos {
        for _, rn := range rns {
            if rn == "admin" {
                return true, nil
            }
        }
    }
    return false, nil
}

git add go/migrations/00082_user_provider.sql go/internal/auth/domain/auth.go go/internal/auth/adapters/pg.go go/internal/auth/app/directory.go go/internal/auth/app/service.go go/internal/httpapi/handlers_auth.go
git commit -m "feat(auth): users.provider + LoginWithDirectory orchestration + change-password guard for ldap users"

-- +goose Up
-- Admin-managed AD-group-DN → Obscura-role mapping. role_id references the rbac roles catalogue
-- (roles.id is uuid); ON DELETE CASCADE so deleting a role drops its mappings automatically.
CREATE TABLE ldap_group_roles (
    group_dn   text PRIMARY KEY,
    role_id    uuid NOT NULL REFERENCES roles(id) ON DELETE CASCADE,
    created_at timestamptz NOT NULL DEFAULT now()
);

-- Ledger of role bindings CREATED by directory reconciliation, so they can be revoked when a
-- user leaves a group WITHOUT touching manually-assigned roles (which have no ledger row). One
-- row per (user, role); group_dn records which mapping granted it. Cascades on user/role delete.
CREATE TABLE ldap_role_grants (
    user_id    uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    role_id    uuid NOT NULL REFERENCES roles(id) ON DELETE CASCADE,
    group_dn   text NOT NULL,
    granted_at timestamptz NOT NULL DEFAULT now(),
    PRIMARY KEY (user_id, role_id)
);
CREATE INDEX ldap_role_grants_user ON ldap_role_grants (user_id);

-- +goose Down
DROP TABLE ldap_role_grants;
DROP TABLE ldap_group_roles;

package app

import (
    "context"
    "strings"

    "github.com/Virtue-Digital-Indonesia/obscura/internal/kernel"
)

// subjectKindUser mirrors rbacapp.SubjectUser ("user") — the subject kind for a per-user role
// binding. Duplicated here to avoid the auth context importing rbac's app package.
const subjectKindUser = "user"

// GroupRoleMapping is one AD-group-DN → Obscura-role-id mapping (admin-managed).
type GroupRoleMapping struct {
    GroupDN string
    RoleID  string
}

// RoleGrant is one reconciliation-ledger entry (a role granted to a user for a group).
type RoleGrant struct {
    RoleID  string
    GroupDN string
}

// DirectoryGrantStore persists the group→role mappings and the reconciliation ledger.
type DirectoryGrantStore interface {
    ListMappings(ctx context.Context) ([]GroupRoleMapping, error)
    UpsertMapping(ctx context.Context, groupDN, roleID string) error
    DeleteMapping(ctx context.Context, groupDN string) error
    GrantsForUser(ctx context.Context, userID string) ([]RoleGrant, error)
    InsertGrant(ctx context.Context, userID, roleID, groupDN string) error
    DeleteGrant(ctx context.Context, userID, roleID string) error
}

// RoleBinder is the narrow slice of the rbac write-service this context needs to apply
// directory-derived role grants. The rbac *Store satisfies it (BindRole/UnbindRole/
// RefreshEffectivePerms).
type RoleBinder interface {
    BindRole(ctx context.Context, roleID, subjectKind, subjectID string) error
    UnbindRole(ctx context.Context, roleID, subjectKind, subjectID string) error
    RefreshEffectivePerms(ctx context.Context) error
}

// GroupRoleService owns the admin CRUD over group→role mappings AND reconciles a directory
// user's group memberships into Obscura role bindings on login. It satisfies
// GroupRoleReconciler.
type GroupRoleService struct {
    store  DirectoryGrantStore
    binder RoleBinder
}

// NewGroupRoleService wires the group-role service.
func NewGroupRoleService(store DirectoryGrantStore, binder RoleBinder) *GroupRoleService {
    return &GroupRoleService{store: store, binder: binder}
}

// ListMappings returns the admin-managed group→role mappings.
func (s *GroupRoleService) ListMappings(ctx context.Context) ([]GroupRoleMapping, error) {
    return s.store.ListMappings(ctx)
}

// UpsertMapping validates and stores a group_dn → role_id mapping.
func (s *GroupRoleService) UpsertMapping(ctx context.Context, groupDN, roleID string) error {
    groupDN = strings.TrimSpace(groupDN)
    if groupDN == "" {
        return &kernel.Error{Kind: kernel.ErrValidation, Code: "ldap.mapping.group_required", Message: "group DN is required"}
    }
    if strings.TrimSpace(roleID) == "" {
        return &kernel.Error{Kind: kernel.ErrValidation, Code: "ldap.mapping.role_required", Message: "role id is required"}
    }
    return s.store.UpsertMapping(ctx, groupDN, roleID)
}

// DeleteMapping removes a group→role mapping.
func (s *GroupRoleService) DeleteMapping(ctx context.Context, groupDN string) error {
    if strings.TrimSpace(groupDN) == "" {
        return &kernel.Error{Kind: kernel.ErrValidation, Code: "ldap.mapping.group_required", Message: "group DN is required"}
    }
    return s.store.DeleteMapping(ctx, groupDN)
}

// Reconcile brings a user's directory-derived role grants in line with their current group
// memberships: grant roles for newly-matched groups (recording a ledger row), revoke grants
// whose group is no longer present, NEVER touching manually-assigned roles (no ledger row).
// Group-DN comparison is case-insensitive. Refreshes the effective-perms read model on any
// change. Errors are returned; the caller logs them non-fatally.
func (s *GroupRoleService) Reconcile(ctx context.Context, userID string, groupDNs []string) error {
    mappings, err := s.store.ListMappings(ctx)
    if err != nil {
        return err
    }
    memberOf := make(map[string]bool, len(groupDNs))
    for _, g := range groupDNs {
        memberOf[strings.ToLower(strings.TrimSpace(g))] = true
    }
    // Desired grants: role_id → granting group_dn for every mapping the user matches.
    desired := map[string]string{}
    for _, m := range mappings {
        if memberOf[strings.ToLower(strings.TrimSpace(m.GroupDN))] {
            desired[m.RoleID] = m.GroupDN
        }
    }
    current, err := s.store.GrantsForUser(ctx, userID)
    if err != nil {
        return err
    }
    have := make(map[string]bool, len(current))
    changed := false
    // Revoke ledger grants no longer desired.
    for _, g := range current {
        have[g.RoleID] = true
        if _, keep := desired[g.RoleID]; !keep {
            if err := s.binder.UnbindRole(ctx, g.RoleID, subjectKindUser, userID); err != nil {
                return err
            }
            if err := s.store.DeleteGrant(ctx, userID, g.RoleID); err != nil {
                return err
            }
            changed = true
        }
    }
    // Grant newly-desired roles.
    for roleID, groupDN := range desired {
        if have[roleID] {
            continue
        }
        if err := s.binder.BindRole(ctx, roleID, subjectKindUser, userID); err != nil {
            return err
        }
        if err := s.store.InsertGrant(ctx, userID, roleID, groupDN); err != nil {
            return err
        }
        changed = true
    }
    if changed {
        return s.binder.RefreshEffectivePerms(ctx)
    }
    return nil
}

var _ GroupRoleReconciler = (*GroupRoleService)(nil)

package adapters

import (
    "context"
    "fmt"

    "github.com/Virtue-Digital-Indonesia/obscura/internal/auth/app"
    "github.com/Virtue-Digital-Indonesia/obscura/internal/platform/db"
)

// LDAPGrantStore persists group→role mappings (ldap_group_roles) and the reconciliation ledger
// (ldap_role_grants). Every statement runs through s.db.Exec(ctx) (no own tx), like the other
// auth stores. Implements app.DirectoryGrantStore.
type LDAPGrantStore struct {
    db *db.DB
}

// NewLDAPGrantStore constructs the store.
func NewLDAPGrantStore(d *db.DB) *LDAPGrantStore { return &LDAPGrantStore{db: d} }

// ListMappings returns every group_dn → role_id mapping (ordered).
func (s *LDAPGrantStore) ListMappings(ctx context.Context) ([]app.GroupRoleMapping, error) {
    rows, err := s.db.Exec(ctx).Query(ctx, `SELECT group_dn, role_id FROM ldap_group_roles ORDER BY group_dn`)
    if err != nil {
        return nil, fmt.Errorf("ldap list mappings: %w", err)
    }
    defer rows.Close()
    var out []app.GroupRoleMapping
    for rows.Next() {
        var m app.GroupRoleMapping
        if err := rows.Scan(&m.GroupDN, &m.RoleID); err != nil {
            return nil, fmt.Errorf("ldap scan mapping: %w", err)
        }
        out = append(out, m)
    }
    return out, rows.Err()
}

// UpsertMapping inserts or replaces a group_dn → role_id mapping.
func (s *LDAPGrantStore) UpsertMapping(ctx context.Context, groupDN, roleID string) error {
    if _, err := s.db.Exec(ctx).Exec(ctx,
        `INSERT INTO ldap_group_roles (group_dn, role_id) VALUES ($1, $2)
         ON CONFLICT (group_dn) DO UPDATE SET role_id = EXCLUDED.role_id`, groupDN, roleID); err != nil {
        return fmt.Errorf("ldap upsert mapping: %w", err)
    }
    return nil
}

// DeleteMapping removes a mapping (no-op when absent).
func (s *LDAPGrantStore) DeleteMapping(ctx context.Context, groupDN string) error {
    if _, err := s.db.Exec(ctx).Exec(ctx, `DELETE FROM ldap_group_roles WHERE group_dn = $1`, groupDN); err != nil {
        return fmt.Errorf("ldap delete mapping: %w", err)
    }
    return nil
}

// GrantsForUser returns the user's reconciliation-ledger rows.
func (s *LDAPGrantStore) GrantsForUser(ctx context.Context, userID string) ([]app.RoleGrant, error) {
    rows, err := s.db.Exec(ctx).Query(ctx, `SELECT role_id, group_dn FROM ldap_role_grants WHERE user_id = $1`, userID)
    if err != nil {
        return nil, fmt.Errorf("ldap grants for user: %w", err)
    }
    defer rows.Close()
    var out []app.RoleGrant
    for rows.Next() {
        var g app.RoleGrant
        if err := rows.Scan(&g.RoleID, &g.GroupDN); err != nil {
            return nil, fmt.Errorf("ldap scan grant: %w", err)
        }
        out = append(out, g)
    }
    return out, rows.Err()
}

// InsertGrant records a reconciliation grant (idempotent on (user_id, role_id)).
func (s *LDAPGrantStore) InsertGrant(ctx context.Context, userID, roleID, groupDN string) error {
    if _, err := s.db.Exec(ctx).Exec(ctx,
        `INSERT INTO ldap_role_grants (user_id, role_id, group_dn) VALUES ($1, $2, $3)
         ON CONFLICT (user_id, role_id) DO UPDATE SET group_dn = EXCLUDED.group_dn`, userID, roleID, groupDN); err != nil {
        return fmt.Errorf("ldap insert grant: %w", err)
    }
    return nil
}

// DeleteGrant removes a ledger row.
func (s *LDAPGrantStore) DeleteGrant(ctx context.Context, userID, roleID string) error {
    if _, err := s.db.Exec(ctx).Exec(ctx, `DELETE FROM ldap_role_grants WHERE user_id = $1 AND role_id = $2`, userID, roleID); err != nil {
        return fmt.Errorf("ldap delete grant: %w", err)
    }
    return nil
}

var _ app.DirectoryGrantStore = (*LDAPGrantStore)(nil)

git add go/migrations/00083_ldap_group_roles.sql go/internal/auth/app/ldap.go go/internal/auth/adapters/ldap_grants_pg.go go/cmd/obscura-server/wire.go
git commit -m "feat(auth): LDAP group→role mapping store + login-time reconciler (grant/revoke via rbac bindings)"

package httpapi

import (
    "encoding/json"
    "net/http"
    "time"

    "github.com/Virtue-Digital-Indonesia/obscura/internal/kernel"
)

// ldapStatusView is the JSON for GET /admin/ldap/status.
type ldapStatusView struct {
    Enabled    bool    `json:"enabled"`
    URL        string  `json:"url"`
    Mode       string  `json:"mode"`
    BaseDN     string  `json:"base_dn"`
    LastBindOK bool    `json:"last_bind_ok"`
    LastBindAt *string `json:"last_bind_at"`
}

// GetLDAPStatus returns the directory-login status card. Enabled=false (empty rest) when LDAP
// is not configured for this deployment.
func (s *Server) GetLDAPStatus(w http.ResponseWriter, r *http.Request) {
    st, _ := s.auth.DirectoryStatus()
    view := ldapStatusView{Enabled: st.Enabled, URL: st.URL, Mode: st.Mode, BaseDN: st.BaseDN, LastBindOK: st.LastBindOK}
    if st.LastBindAt != nil {
        iso := st.LastBindAt.Format(time.RFC3339)
        view.LastBindAt = &iso
    }
    writeJSON(w, http.StatusOK, view)
}

// ldapGroupRoleView is one group_dn↔role_id mapping row.
type ldapGroupRoleView struct {
    GroupDN string `json:"group_dn"`
    RoleID  string `json:"role_id"`
}

// ListLDAPGroupRoles returns the admin-managed group→role mappings.
func (s *Server) ListLDAPGroupRoles(w http.ResponseWriter, r *http.Request) {
    ms, err := s.ldapGroupRoles.ListMappings(r.Context())
    if err != nil {
        writeProblem(w, err)
        return
    }
    out := make([]ldapGroupRoleView, 0, len(ms))
    for _, m := range ms {
        out = append(out, ldapGroupRoleView{GroupDN: m.GroupDN, RoleID: m.RoleID})
    }
    writeJSON(w, http.StatusOK, map[string]any{"group_roles": out})
}

// PutLDAPGroupRole upserts one group→role mapping.
func (s *Server) PutLDAPGroupRole(w http.ResponseWriter, r *http.Request) {
    var body struct {
        GroupDN string `json:"group_dn"`
        RoleID  string `json:"role_id"`
    }
    if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
        writeProblem(w, &kernel.Error{Kind: kernel.ErrValidation, Code: "request.invalid_json", Message: "invalid request body"})
        return
    }
    if err := s.ldapGroupRoles.UpsertMapping(r.Context(), body.GroupDN, body.RoleID); err != nil {
        writeProblem(w, err)
        return
    }
    writeJSON(w, http.StatusOK, ldapGroupRoleView{GroupDN: body.GroupDN, RoleID: body.RoleID})
}

// DeleteLDAPGroupRole removes a mapping selected by ?group_dn=.
func (s *Server) DeleteLDAPGroupRole(w http.ResponseWriter, r *http.Request) {
    if err := s.ldapGroupRoles.DeleteMapping(r.Context(), r.URL.Query().Get("group_dn")); err != nil {
        writeProblem(w, err)
        return
    }
    w.WriteHeader(http.StatusNoContent)
}

            // Directory (LDAP/AD) administration: read-only status + group→role mapping CRUD.
            // Same rbac.admin gate as the Roles manager.
            r.With(s.requirePerm("rbac.admin")).Get("/admin/ldap/status", s.GetLDAPStatus)
            r.With(s.requirePerm("rbac.admin")).Get("/admin/ldap/group-roles", s.ListLDAPGroupRoles)
            r.With(s.requirePerm("rbac.admin")).Put("/admin/ldap/group-roles", s.PutLDAPGroupRole)
            r.With(s.requirePerm("rbac.admin")).Delete("/admin/ldap/group-roles", s.DeleteLDAPGroupRole)

        LDAPGroupRoles: ldapGroupRoleSvc,

  /api/v1/admin/ldap/status:
    get:
      operationId: getLdapStatus
      summary: Directory (LDAP/AD) login status
      description: Read-only status of the LDAP directory backend for the admin status card. Requires rbac.admin.
      tags: [admin]
      responses:
        '200':
          description: Directory status (enabled=false when LDAP is not configured).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LdapStatus'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
  /api/v1/admin/ldap/group-roles:
    get:
      operationId: listLdapGroupRoles
      summary: List LDAP group→role mappings
      description: The admin-managed AD-group-DN → Obscura-role mappings. Requires rbac.admin.
      tags: [admin]
      responses:
        '200':
          description: The mappings.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LdapGroupRoleList'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
    put:
      operationId: putLdapGroupRole
      summary: Upsert an LDAP group→role mapping
      description: Insert or replace the role mapped to a group DN. Requires rbac.admin.
      tags: [admin]
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LdapGroupRole'
      responses:
        '200':
          description: The stored mapping.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LdapGroupRole'
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
    delete:
      operationId: deleteLdapGroupRole
      summary: Delete an LDAP group→role mapping
      description: Remove the mapping for the group DN given as the group_dn query parameter. Requires rbac.admin.
      tags: [admin]
      parameters:
        - in: query
          name: group_dn
          required: true
          schema: { type: string }
      responses:
        '204':
          description: Deleted (idempotent).
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'