feat(ldap): add groupFilterDns column for selective import filter

Persists per-tenant AD group/OU DNs to restrict which directory
entries get synced. Empty array (default) preserves current
behavior — import everyone under base DN.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/src/ldap/dto/ldap-config.dto.ts

@@ -1,5 +1,6 @@
 import { PartialType } from '@nestjs/mapped-types';
 import {
+  IsArray,
   IsBoolean,
   IsInt,
   IsNotEmpty,
@@ -40,6 +41,11 @@ export class CreateLdapConfigDto {
   @IsBoolean()
   @IsOptional()
   isActive?: boolean = true;
+
+  @IsArray()
+  @IsString({ each: true })
+  @IsOptional()
+  groupFilterDns?: string[] = [];
 }
 
 /**

apps/api/src/ldap/ldap-config.service.ts

@@ -39,6 +39,7 @@ export class LdapConfigService {
         searchFilter: dto.searchFilter ?? '(objectClass=person)',
         syncIntervalMin: dto.syncIntervalMin ?? 60,
         isActive: dto.isActive ?? true,
+        groupFilterDns: dto.groupFilterDns ?? [],
         fieldMappings: {
           create: [
             {
@@ -79,6 +80,9 @@ export class LdapConfigService {
           syncIntervalMin: dto.syncIntervalMin,
         }),
         ...(dto.isActive !== undefined && { isActive: dto.isActive }),
+        ...(dto.groupFilterDns !== undefined && {
+          groupFilterDns: dto.groupFilterDns,
+        }),
       },
       include: { fieldMappings: true },
     });