schalli/tessera-ctl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 14 Wiki Activity

docs(260729-d3k): complete LDAP multi-base-DN quick task

Browse Source
This commit is contained in:
Schalli
2026-07-29 09:40:29 +02:00
parent 96be7e168b
commit 97465a6f25
3 changed files with 320 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/STATE.md
+6 -4
View File
@@ -5,8 +5,8 @@ milestone_name: Ausschreibungs-Radar
current_phase: 14
current_phase_name: rss-email-alert-ingestion-module-rollout
status: executing
stopped_at: Completed 260728-lih quick task (LDAP sync selective + auto-sync default off)
last_updated: "2026-07-28T13:43:32.444Z"
stopped_at: Completed 260729-d3k quick task (LDAP multi-base-DN + base-DN-as-scope)
last_updated: "2026-07-29T07:39:42.771Z"
last_activity: 2026-07-23
last_activity_desc: Completed 14-02-PLAN.md (RSS ingestion slice)
progress:
@@ -224,6 +224,7 @@ Recent decisions affecting current work:
- [Phase ?]: CoverageBanner's denylist block is independent of the onlyDoe coverage-note condition — component renders when either block has content, not gated behind the DOE-only check
- [Phase ?]: 14-05: tenderRadar i18n namespace added; Bundesland/CPV filter option values stay canonical German for backend compatibility, only labels translated; portal display slugs left untranslated as proper nouns
- [Phase ?]: [260728-lih]: DELIBERATE back-compat break — empty groupFilterDns now means 'sync nothing' (was 'import everyone under baseDn'); early-return guard in syncUsersForTenant runs before search/deactivation so an empty selection never mass-deactivates existing LDAP users
- [Phase ?]: [260729-d3k]: syncUsersForTenant no-op guard re-keyed from empty groupFilterDns to empty parsed base-DN list — Base-DN(s) are now the sync scope, groupFilterDns is an optional extra restriction (ou= = extra bases, group DN = memberOf constraint)
### Pending Todos
@@ -253,6 +254,7 @@ None yet.
| 260714-lex | LDAP: Per-User Exclude/Denylist-Filter (Service-Accounts vom Sync ausschliessen) — live verifiziert: deaktiviert 4 Accounts, 2 echte User aktiv | 2026-07-14 | 9d1323f | (direct) |
| 13 | Normalizer-Gap Phase 13 schliessen: NetServer/Cosinex-Bag-Dispatch (TenderNormalizerService) | 2026-07-23 | 9881005 | — |
| 260728-lih | LDAP: Sync strikt selektiv (leere Auswahl = No-Op statt Voll-Import) + Auto-Sync-Default aus (syncIntervalMin 60→0) | 2026-07-28 | c54e424,57bc7f9,63a07ab | [260728-lih-ldap-sync-selektiv-und-auto-sync-default](.planning/quick/260728-lih-ldap-sync-selektiv-und-auto-sync-default/) |
| 260729-d3k | LDAP: Multi-Base-DN und Base-DN als Sync-Scope (statt leerer Gruppenfilter = No-Op) | 2026-07-29 | 5cbd530,96be7e1 | [260729-d3k-ldap-multi-base-dn-und-base-dn-als-scope](.planning/quick/260729-d3k-ldap-multi-base-dn-und-base-dn-als-scope/) |
## Deferred Items
@@ -264,7 +266,7 @@ Items acknowledged and carried forward from previous milestone close:
## Session Continuity
Last session: 2026-07-28T13:43:32.416Z
Stopped at: Completed 260728-lih quick task (LDAP sync selective + auto-sync default off)
Last session: 2026-07-29T07:39:14.866Z
Stopped at: Completed 260729-d3k quick task (LDAP multi-base-DN + base-DN-as-scope)
Resume file: None
Last activity: 2026-07-14 - Built LDAP per-user exclude/denylist filter (9d1323f), migration applied on live DB, verified via Playwright: sync deactivated 4 excluded service accounts (administrator/krbtgt/guest/dns-ldap), 2 real LDAP users stay active, 0 wrongly created