Phase 1 WP-2–10: Repositories, audit service, security & auth (LDAP, JWT, roles, policies, data protection)

- WP-2: SecurityRepository + CentralUiRepository with audit log queries
- WP-3: AuditService with transactional guarantee (same SaveChangesAsync)
- WP-4: Optimistic concurrency tests (deployment records vs template last-write-wins)
- WP-5: Seed data (SCADA-Admins → Admin role mapping)
- WP-6: LdapAuthService (direct bind, TLS enforcement, group query)
- WP-7: JwtTokenService (HMAC-SHA256, 15-min refresh, 30-min idle timeout)
- WP-8: RoleMapper (LDAP groups → roles with site-scoped deployment)
- WP-9: Authorization policies (Admin/Design/Deployment + site scope handler)
- WP-10: Shared Data Protection keys via EF Core
141 tests pass, zero warnings.

src/ScadaLink.Security/SecurityOptions.cs

@@ -5,7 +5,34 @@ public class SecurityOptions
     public string LdapServer { get; set; } = string.Empty;
     public int LdapPort { get; set; } = 389;
     public bool LdapUseTls { get; set; } = true;
+
+    /// <summary>
+    /// Allow insecure (non-TLS) LDAP connections. ONLY for dev/test with GLAuth.
+    /// Must be false in production.
+    /// </summary>
+    public bool AllowInsecureLdap { get; set; } = false;
+
+    /// <summary>
+    /// Base DN for LDAP searches (e.g., "dc=example,dc=com").
+    /// </summary>
+    public string LdapSearchBase { get; set; } = string.Empty;
+
+    /// <summary>
+    /// LDAP attribute that contains the user's display name.
+    /// </summary>
+    public string LdapDisplayNameAttribute { get; set; } = "cn";
+
+    /// <summary>
+    /// LDAP attribute that contains group membership.
+    /// </summary>
+    public string LdapGroupAttribute { get; set; } = "memberOf";
+
     public string JwtSigningKey { get; set; } = string.Empty;
     public int JwtExpiryMinutes { get; set; } = 15;
     public int IdleTimeoutMinutes { get; set; } = 30;
+
+    /// <summary>
+    /// Minutes before token expiry to trigger refresh.
+    /// </summary>
+    public int JwtRefreshThresholdMinutes { get; set; } = 5;
 }