fix(security): resolve Security-009,010,011 — LDAP connection timeout, design-doc correction, security-path test coverage; Security-008 deferred

src/ScadaLink.Security/LdapAuthService.cs

@@ -34,6 +34,12 @@ public class LdapAuthService
         {
             using var connection = new LdapConnection();
 
+            // Bound how long a hung LDAP server can pin a thread-pool thread. The
+            // `ct` passed to Task.Run below only prevents the work item from starting;
+            // it cannot interrupt an in-progress blocking Connect/Bind/Search. This
+            // timeout is the real safeguard (Security-009).
+            ApplyConnectionTimeout(connection);
+
             // LDAPS: TLS negotiated at connection time. StartTLS: connect plaintext,
             // then upgrade the session before any credentials are sent.
             if (_options.LdapTransport == LdapTransport.Ldaps)
@@ -127,6 +133,27 @@ public class LdapAuthService
         }
     }
 
+    /// <summary>
+    /// Applies <see cref="SecurityOptions.LdapConnectionTimeoutMs"/> to both the socket
+    /// connect timeout and the per-operation (bind/search) time limit, so a hung or
+    /// unresponsive LDAP server cannot pin a thread-pool thread indefinitely. The
+    /// <c>CancellationToken</c> handed to the <c>Task.Run</c> wrappers only guards
+    /// work-item scheduling and cannot interrupt an in-progress blocking call.
+    /// </summary>
+    private void ApplyConnectionTimeout(LdapConnection connection)
+    {
+        var timeoutMs = _options.LdapConnectionTimeoutMs;
+        if (timeoutMs <= 0)
+            return;
+
+        connection.ConnectionTimeout = timeoutMs;
+
+        // LdapConstraints.TimeLimit is the server-side operation time limit in ms.
+        var constraints = connection.Constraints;
+        constraints.TimeLimit = timeoutMs;
+        connection.Constraints = constraints;
+    }
+
     /// <summary>
     /// Resolves the user's full DN. When a service account is configured, performs a
     /// search-then-bind lookup. Otherwise falls back to constructing the DN directly.