79 lines
6.5 KiB
Markdown
79 lines
6.5 KiB
Markdown
---
|
|
phase: quick-260728-lih
|
|
verified: 2026-07-28T15:46:00Z
|
|
status: passed
|
|
score: 6/6 must-haves verified
|
|
behavior_unverified: 0
|
|
overrides_applied: 0
|
|
---
|
|
|
|
# Quick Task 260728-lih: LDAP Sync Selektiv + Auto-Sync Default — Verification Report
|
|
|
|
**Task Goal:** LDAP-Sync selektiv & Auto-Sync-off-by-default — (1) syncIntervalMin Prisma-Default 60→0 + Migration + Frontend-Default (isActive bleibt default true), (2) collectSearchEntries leere groupFilterDns ⇒ leeres Ergebnis, (3) KRITISCH syncUsersForTenant Early-Return bei leerer Auswahl = KEINE Suche + KEINE Deaktivierung, (4) i18n de+en umformuliert, (5) Tests angepasst + No-Op-Test.
|
|
**Verified:** 2026-07-28T15:46:00Z
|
|
**Status:** passed
|
|
**Re-verification:** No — initial verification
|
|
|
|
## Goal Achievement
|
|
|
|
### Observable Truths
|
|
|
|
| # | Truth | Status | Evidence |
|
|
|---|-------|--------|----------|
|
|
| 1 | New LdapConfig rows default to `syncIntervalMin=0`; `isActive` still defaults `true` | ✓ VERIFIED | `apps/api/prisma/schema.prisma:70-71` — `syncIntervalMin Int @default(0)` / `isActive Boolean @default(true)` (read directly from file) |
|
|
| 2 | Migration only changes the column DEFAULT, no data rewrite; applied to local DB | ✓ VERIFIED | `apps/api/prisma/migrations/20260728134010_ldap_sync_interval_default_off/migration.sql` contains exactly `ALTER TABLE "LdapConfig" ALTER COLUMN "syncIntervalMin" SET DEFAULT 0;` (2 lines, no UPDATE). Live check: `docker exec tessera-ctl-db-1 psql ... SELECT column_default ...` returned `0`. |
|
|
| 3 | `collectSearchEntries()` returns `[]` on empty/undefined `groupFilterDns`, no search | ✓ VERIFIED | `ldap.service.ts:702-704`: `if (!config.groupFilterDns \|\| config.groupFilterDns.length === 0) { return []; }` — precedes any `client.search()` call in the method |
|
|
| 4 | `syncUsersForTenant()` early-returns BEFORE the deactivation loop (and before any search/bind) on empty selection — the critical safety guard | ✓ VERIFIED | `ldap.service.ts:544-546`: guard `if (!config.groupFilterDns \|\| config.groupFilterDns.length === 0) { return result; }` sits immediately after `result` construction (line 530), before `new Client(...)` (line 548) and far before the deactivation loop (line 642) |
|
|
| 5 | Scheduler (`ldap-sync.scheduler.ts`) and `auth.service.ts` are unchanged | ✓ VERIFIED | `git diff c54e424^ HEAD --stat -- apps/api/src/ldap/ldap-sync.scheduler.ts apps/api/src/auth/auth.service.ts` produced empty output. Scheduler line ~36 still `if (config.syncIntervalMin <= 0) continue;`. `auth.service.ts` line ~55 still `if (!config \|\| !config.isActive) return null;` |
|
|
| 6 | A no-op test exists proving empty selection = no search, no deactivation; i18n de+en reworded | ✓ VERIFIED | `ldap.service.spec.ts:121-168` new describe block asserts `result === {created:0,updated:0,deactivated:0,errors:[]}`, `mockSearch`/`mockBind`/`userService.create`/`prisma.user.update`/`prisma.ldapConfig.update` all not called, with an existing LDAP user pre-loaded in the mock. `de.json`/`en.json` `groupFilter.description`+`emptyMeansAll` read back exactly as specified in the plan. |
|
|
|
|
**Score:** 6/6 truths verified (0 present-but-behavior-unverified)
|
|
|
|
### Required Artifacts
|
|
|
|
| Artifact | Expected | Status | Details |
|
|
|----------|----------|--------|---------|
|
|
| `apps/api/prisma/schema.prisma` | `syncIntervalMin Int @default(0)`, `isActive` unchanged | ✓ VERIFIED | Confirmed lines 70-71 |
|
|
| `apps/api/prisma/migrations/20260728134010_ldap_sync_interval_default_off/migration.sql` | SET DEFAULT only, applied | ✓ VERIFIED | File exists, content matches exactly; live `column_default` = 0 |
|
|
| `apps/api/src/ldap/ldap.service.ts` | `collectSearchEntries` returns `[]`; `syncUsersForTenant` early-return before deactivation | ✓ VERIFIED | Both edits present and correctly ordered |
|
|
| `apps/api/src/ldap/ldap.service.spec.ts` | Exclude-list tests use non-empty selection + new no-op test | ✓ VERIFIED | `baseConfig.groupFilterDns = ['ou=people,dc=example,dc=com']` (line 40); new no-op describe block (lines 121-168) |
|
|
| `apps/web/src/app/(portal)/admin/ldap/page.tsx` | `formData` default `syncIntervalMin: 0` | ✓ VERIFIED | Line 87: `syncIntervalMin: 0,` |
|
|
| `apps/web/src/messages/de.json` + `en.json` | groupFilter copy reworded | ✓ VERIFIED | Both files' `admin.ldap.groupFilter.description`/`emptyMeansAll` read back verbatim as specified in plan |
|
|
|
|
### Key Link Verification
|
|
|
|
| From | To | Via | Status | Details |
|
|
|------|-----|-----|--------|---------|
|
|
| `syncUsersForTenant` early-return guard | deactivation loop (~line 642) | guard placement | ✓ WIRED | Guard at line 544 returns before line 548 (`new Client`), long before line 642 (deactivation query) — physically impossible to reach deactivation on empty selection |
|
|
| `schema.prisma @default(0)` | live DB column default | Prisma migrate | ✓ WIRED | Live psql query confirms `column_default = 0` |
|
|
| `isActive @default(true)` | `auth.service.ts:55` login gate | unchanged code path | ✓ WIRED | Both the default and the gate code are unchanged and still consistent |
|
|
|
|
### Behavioral Spot-Checks
|
|
|
|
| Behavior | Command | Result | Status |
|
|
|----------|---------|--------|--------|
|
|
| ldap.service test suite green (updated exclude tests + new no-op test) | `cd apps/api && pnpm vitest run src/ldap/ldap.service.spec.ts` | 16/16 passed | ✓ PASS |
|
|
| API typecheck clean | `cd apps/api && pnpm exec tsc --noEmit` | no errors | ✓ PASS |
|
|
| Live migration applied | `docker exec tessera-ctl-db-1 psql ... column_default` | `0` | ✓ PASS |
|
|
|
|
### Anti-Patterns Found
|
|
|
|
None. Scanned all 7 modified/created files for `TBD|FIXME|XXX|TODO|HACK|PLACEHOLDER` — zero matches.
|
|
|
|
### Requirements Coverage
|
|
|
|
Quick task — no formal REQUIREMENTS.md entries beyond the task's own `must_haves`, all of which are verified above.
|
|
|
|
### Human Verification Required
|
|
|
|
None. All must-haves are code-level, statically verifiable, and were confirmed by direct file reads, a live DB query, and a passing automated test run — no UI/visual/runtime judgment call remains.
|
|
|
|
### Gaps Summary
|
|
|
|
No gaps. All 6 derived truths, all 6 required artifacts, and all 3 key links verified directly against the live codebase and running local DB (not just SUMMARY.md claims). The critical safety property — early-return before the deactivation loop — was confirmed by reading the exact line ordering in `ldap.service.ts`, and further confirmed behaviorally by running the new no-op unit test (which asserts zero deactivation calls). The three commits referenced in SUMMARY.md (`c54e424`, `57bc7f9`, `63a07ab`) all exist and touch exactly the files claimed.
|
|
|
|
---
|
|
|
|
_Verified: 2026-07-28T15:46:00Z_
|
|
_Verifier: Claude (gsd-verifier)_
|