From 3c057f863d28f514d82d370ccda5fa2c7f71efc8 Mon Sep 17 00:00:00 2001
From: Schalli <kschaller@ctl.de>
Date: Tue, 7 Jul 2026 09:34:27 +0200
Subject: [PATCH] feat(ldap): add groupFilterDns column for selective import
 filter
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Persists per-tenant AD group/OU DNs to restrict which directory
entries get synced. Empty array (default) preserves current
behavior — import everyone under base DN.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../20260707090000_add_ldap_group_filter/migration.sql      | 2 ++
 apps/api/prisma/schema.prisma                               | 1 +
 apps/api/src/ldap/dto/ldap-config.dto.ts                    | 6 ++++++
 apps/api/src/ldap/ldap-config.service.ts                    | 4 ++++
 4 files changed, 13 insertions(+)
 create mode 100644 apps/api/prisma/migrations/20260707090000_add_ldap_group_filter/migration.sql

diff --git a/apps/api/prisma/migrations/20260707090000_add_ldap_group_filter/migration.sql b/apps/api/prisma/migrations/20260707090000_add_ldap_group_filter/migration.sql
new file mode 100644
index 0000000..d66bdeb
--- /dev/null
+++ b/apps/api/prisma/migrations/20260707090000_add_ldap_group_filter/migration.sql
@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "LdapConfig" ADD COLUMN IF NOT EXISTS "groupFilterDns" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[];
diff --git a/apps/api/prisma/schema.prisma b/apps/api/prisma/schema.prisma
index ffee08b..7f2fabc 100644
--- a/apps/api/prisma/schema.prisma
+++ b/apps/api/prisma/schema.prisma
@@ -69,6 +69,7 @@ model LdapConfig {
   searchFilter    String             @default("(objectClass=person)")
   syncIntervalMin Int                @default(60)
   isActive        Boolean            @default(true)
+  groupFilterDns  String[]           @default([])
   lastSyncAt      DateTime?
   createdAt       DateTime           @default(now())
   updatedAt       DateTime           @updatedAt
diff --git a/apps/api/src/ldap/dto/ldap-config.dto.ts b/apps/api/src/ldap/dto/ldap-config.dto.ts
index c3d7a8a..e8d3892 100644
--- a/apps/api/src/ldap/dto/ldap-config.dto.ts
+++ b/apps/api/src/ldap/dto/ldap-config.dto.ts
@@ -1,5 +1,6 @@
 import { PartialType } from '@nestjs/mapped-types';
 import {
+  IsArray,
   IsBoolean,
   IsInt,
   IsNotEmpty,
@@ -40,6 +41,11 @@ export class CreateLdapConfigDto {
   @IsBoolean()
   @IsOptional()
   isActive?: boolean = true;
+
+  @IsArray()
+  @IsString({ each: true })
+  @IsOptional()
+  groupFilterDns?: string[] = [];
 }
 
 /**
diff --git a/apps/api/src/ldap/ldap-config.service.ts b/apps/api/src/ldap/ldap-config.service.ts
index aa617e2..034d151 100644
--- a/apps/api/src/ldap/ldap-config.service.ts
+++ b/apps/api/src/ldap/ldap-config.service.ts
@@ -39,6 +39,7 @@ export class LdapConfigService {
         searchFilter: dto.searchFilter ?? '(objectClass=person)',
         syncIntervalMin: dto.syncIntervalMin ?? 60,
         isActive: dto.isActive ?? true,
+        groupFilterDns: dto.groupFilterDns ?? [],
         fieldMappings: {
           create: [
             {
@@ -79,6 +80,9 @@ export class LdapConfigService {
           syncIntervalMin: dto.syncIntervalMin,
         }),
         ...(dto.isActive !== undefined && { isActive: dto.isActive }),
+        ...(dto.groupFilterDns !== undefined && {
+          groupFilterDns: dto.groupFilterDns,
+        }),
       },
       include: { fieldMappings: true },
     });