feat(ldap): allow testing connection before saving a config

"Verbindung testen" only appeared after a config was already saved,
so a fresh/never-configured tenant had no way to validate connection
details at all. Now the button is always visible; POST /ldap/test-connection
accepts optional ad-hoc serverUrl/bindDn/bindPassword and falls back
field-by-field to the saved config for anything omitted (bindPassword
in particular, since the form never re-sends the masked saved password).

Verified locally: tested with typed-but-unsaved values (base DN left
blank, nothing saved) and got a real connection attempt/error back,
not a 404 "no config" response.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/src/ldap/dto/ldap-config.dto.ts

@@ -53,6 +53,25 @@ export class CreateLdapConfigDto {
  */
 export class UpdateLdapConfigDto extends PartialType(CreateLdapConfigDto) {}
 
+/**
+ * DTO for testing a connection with ad-hoc (not-yet-saved) values, so an
+ * admin can validate server/bindDn/bindPassword before persisting a config.
+ * When omitted, the controller falls back to the tenant's saved config.
+ */
+export class TestConnectionDto {
+  @IsUrl({ protocols: ['ldap', 'ldaps'], require_tld: false })
+  @IsOptional()
+  serverUrl?: string;
+
+  @IsString()
+  @IsOptional()
+  bindDn?: string;
+
+  @IsString()
+  @IsOptional()
+  bindPassword?: string;
+}
+
 /**
  * DTO for creating a field mapping entry (D-17).
  */

apps/api/src/ldap/ldap.controller.ts

@@ -15,6 +15,7 @@ import { Roles } from '../auth/decorators/roles.decorator';
 import {
   CreateFieldMappingDto,
   CreateLdapConfigDto,
+  TestConnectionDto,
   UpdateLdapConfigDto,
 } from './dto/ldap-config.dto';
 import { LdapConfigService } from './ldap-config.service';
@@ -108,27 +109,35 @@ export class LdapController {
   }
 
   /**
-   * POST /ldap/test-connection - Test LDAP connection with current config.
-   * Returns success/failure with error message.
+   * POST /ldap/test-connection - Test an LDAP connection.
+   *
+   * Accepts optional ad-hoc serverUrl/bindDn/bindPassword so an admin can
+   * validate connection details before ever saving a config. Any field left
+   * out (e.g. bindPassword, which the form never re-sends once masked)
+   * falls back to the tenant's saved config. If no config is saved yet and
+   * the body doesn't supply all three fields, there is nothing to test.
    */
   @Post('test-connection')
   @Roles(Role.ADMIN, Role.SUPER_ADMIN)
-  async testConnection(@Req() req: any) {
+  async testConnection(@Req() req: any, @Body() dto: TestConnectionDto) {
     const tenantId = req.tenantId;
     if (!tenantId) {
       throw new BadRequestException('No tenant context');
     }
 
     const config = await this.ldapConfigService.getConfig(tenantId);
-    if (!config) {
-      throw new NotFoundException('No LDAP config found for this tenant');
+
+    const serverUrl = dto.serverUrl || config?.serverUrl;
+    const bindDn = dto.bindDn || config?.bindDn;
+    const bindPassword = dto.bindPassword || config?.bindPassword;
+
+    if (!serverUrl || !bindDn || !bindPassword) {
+      throw new BadRequestException(
+        'serverUrl, bindDn, and bindPassword are required (either provided directly or from a saved config)',
+      );
     }
 
-    return this.ldapService.testConnection({
-      serverUrl: config.serverUrl,
-      bindDn: config.bindDn,
-      bindPassword: config.bindPassword,
-    });
+    return this.ldapService.testConnection({ serverUrl, bindDn, bindPassword });
   }
 
   /**