feat(auth): LdapBindMode.User options and validation

2026-10-01 00:47:04 -04:00
parent 9ac6ed51d3
commit 711e8beb2b
4 changed files with 125 additions and 3 deletions
@@ -116,4 +116,38 @@ public class LdapOptionsValidatorTests
        Assert.False(new LdapOptionsValidator()
            .Validate(null, Opts() with { Enabled = false, FallbackServers = new[] { ":::" } })
            .Failed);
+
+    private static LdapOptions UserOpts() => Opts() with
+    {
+        BindMode = LdapBindMode.User,
+        UserBindTemplate = "{0}@corp.test",
+        ServiceAccountDn = "",
+        ServiceAccountPassword = "",
+    };
+
+    [Fact]
+    public void Defaults_KeepServiceAccountMode()
+    {
+        var o = new LdapOptions();
+        Assert.Equal(LdapBindMode.ServiceAccount, o.BindMode);
+        Assert.Equal("", o.UserBindTemplate);
+        Assert.True(o.AcceptDomainQualifiedNames);
+    }
+
+    [Fact]
+    public void Validator_UserMode_DoesNotRequireServiceAccount() =>
+        Assert.True(new LdapOptionsValidator().Validate(null, UserOpts()).Succeeded);
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("jdoe@corp.test")]
+    [InlineData("{0}{0}@corp.test")]
+    public void Validator_UserMode_RequiresExactlyOnePlaceholder(string template)
+    {
+        var result = new LdapOptionsValidator().Validate(null, UserOpts() with { UserBindTemplate = template });
+
+        Assert.True(result.Failed);
+        Assert.Contains(nameof(LdapOptions.UserBindTemplate), result.FailureMessage, StringComparison.Ordinal);
+    }
 }