feat(ldap): add groupFilterDns column for selective import filter

Persists per-tenant AD group/OU DNs to restrict which directory
entries get synced. Empty array (default) preserves current
behavior — import everyone under base DN.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/prisma/migrations/20260707090000_add_ldap_group_filter/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "LdapConfig" ADD COLUMN IF NOT EXISTS "groupFilterDns" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[];

apps/api/prisma/schema.prisma

@@ -69,6 +69,7 @@ model LdapConfig {
   searchFilter    String             @default("(objectClass=person)")
   syncIntervalMin Int                @default(60)
   isActive        Boolean            @default(true)
+  groupFilterDns  String[]           @default([])
   lastSyncAt      DateTime?
   createdAt       DateTime           @default(now())
   updatedAt       DateTime           @updatedAt

apps/api/src/ldap/dto/ldap-config.dto.ts

@@ -1,5 +1,6 @@
 import { PartialType } from '@nestjs/mapped-types';
 import {
+  IsArray,
   IsBoolean,
   IsInt,
   IsNotEmpty,
@@ -40,6 +41,11 @@ export class CreateLdapConfigDto {
   @IsBoolean()
   @IsOptional()
   isActive?: boolean = true;
+
+  @IsArray()
+  @IsString({ each: true })
+  @IsOptional()
+  groupFilterDns?: string[] = [];
 }
 
 /**

apps/api/src/ldap/ldap-config.service.ts

@@ -39,6 +39,7 @@ export class LdapConfigService {
         searchFilter: dto.searchFilter ?? '(objectClass=person)',
         syncIntervalMin: dto.syncIntervalMin ?? 60,
         isActive: dto.isActive ?? true,
+        groupFilterDns: dto.groupFilterDns ?? [],
         fieldMappings: {
           create: [
             {
@@ -79,6 +80,9 @@ export class LdapConfigService {
           syncIntervalMin: dto.syncIntervalMin,
         }),
         ...(dto.isActive !== undefined && { isActive: dto.isActive }),
+        ...(dto.groupFilterDns !== undefined && {
+          groupFilterDns: dto.groupFilterDns,
+        }),
       },
       include: { fieldMappings: true },
     });