fix(auth): make usernames case-insensitive

Username lookups (login, admin seed, LDAP sync) compared case-sensitively
against a stored value with whatever casing it was created with, so
"Admin" and "admin" were treated as different accounts.

Normalizes at every write and read path: UserService.create/update
lowercase the username before persisting, findByUsername lowercases
the lookup input, AuthService.validateUser lowercases before the login
query, AdminSeedService lowercases the configured admin username, and
the LDAP sync loop lowercases the mapped sAMAccountName before using it
for lookup/create/update -- so AD casing differences don't create
duplicate accounts either.

Added a data migration to lowercase any existing mixed-case usernames.
It relies on the User.username unique constraint to fail loudly if two
existing accounts would collide after normalizing, rather than silently
merging them.

Verified locally: logged in with "ADMIN" (uppercase) against the
existing lowercase "admin" account after rebuilding the API image.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/src/user/admin-seed.service.ts

@@ -17,7 +17,9 @@ export class AdminSeedService implements OnApplicationBootstrap {
   ) {}
 
   async onApplicationBootstrap() {
-    const username = this.configService.get<string>('TESSERA_ADMIN_USER');
+    const username = this.configService
+      .get<string>('TESSERA_ADMIN_USER')
+      ?.toLowerCase();
     const email = this.configService.get<string>('TESSERA_ADMIN_EMAIL');
     const password = this.configService.get<string>('TESSERA_ADMIN_PASSWORD');
     const forceChange =

apps/api/src/user/user.service.ts

@@ -9,9 +9,13 @@ export class UserService {
   /**
    * Find user by username. Uses UNSCOPED Prisma (not tenant-scoped)
    * because login must work across all tenants.
+   * Usernames are stored lowercase (case-insensitive login) -- normalize
+   * the lookup input to match regardless of how it was typed.
    */
   async findByUsername(username: string) {
-    return this.prisma.user.findUnique({ where: { username } });
+    return this.prisma.user.findUnique({
+      where: { username: username.toLowerCase() },
+    });
   }
 
   /**
@@ -23,6 +27,7 @@ export class UserService {
 
   /**
    * Create a new user with hashed password.
+   * Username is normalized to lowercase so login is case-insensitive.
    */
   async create(data: {
     username: string;
@@ -38,6 +43,7 @@ export class UserService {
     return this.prisma.user.create({
       data: {
         ...rest,
+        username: rest.username.toLowerCase(),
         passwordHash: password ? await argon2.hash(password) : null,
       },
     });
@@ -61,6 +67,10 @@ export class UserService {
     const { password, ...rest } = data;
     const updateData: any = { ...rest };
 
+    if (updateData.username) {
+      updateData.username = updateData.username.toLowerCase();
+    }
+
     if (password) {
       updateData.passwordHash = await argon2.hash(password);
     }