refactor: migrate LDAP sync to an actor (#1651)

Co-authored-by: Kyle Mendell <kmendell@ofkm.us>

backend/internal/service/e2etest_service.go

@@ -43,12 +43,18 @@ import (
 	"github.com/pocket-id/pocket-id/backend/resources"
 )
 
+// LdapSyncer runs a full LDAP synchronization
+// It's an interface so this package doesn't import the ldapsync package, which imports this one in its tests
+type LdapSyncer interface {
+	SyncAll(ctx context.Context, dbConfig *appconfig.AppConfigModel) error
+}
+
 type TestService struct {
 	db               *gorm.DB
 	actors           *local.Host
 	jwtService       *JwtService
 	appConfigService *appconfig.AppConfigService
-	ldapService      *LdapService
+	ldapSyncer       LdapSyncer
 	fileStorage      storage.FileStorage
 	externalIdPKey   jwk.Key
 }
@@ -63,13 +69,13 @@ const (
 	e2eEmailVerificationToken          = "2FZFSoupBdHyqIL65bWTsgCgHIhxlXup"
 )
 
-func NewTestService(db *gorm.DB, actors *local.Host, appConfigService *appconfig.AppConfigService, jwtService *JwtService, ldapService *LdapService, fileStorage storage.FileStorage) (*TestService, error) {
+func NewTestService(db *gorm.DB, actors *local.Host, appConfigService *appconfig.AppConfigService, jwtService *JwtService, ldapSyncer LdapSyncer, fileStorage storage.FileStorage) (*TestService, error) {
 	s := &TestService{
 		db:               db,
 		actors:           actors,
 		appConfigService: appConfigService,
 		jwtService:       jwtService,
-		ldapService:      ldapService,
+		ldapSyncer:       ldapSyncer,
 		fileStorage:      fileStorage,
 	}
 	err := s.initExternalIdP()
@@ -751,7 +757,7 @@ func (s *TestService) SyncLdap(ctx context.Context) error {
 	if err != nil {
 		return fmt.Errorf("error loading app configuration: %w", err)
 	}
-	return s.ldapService.SyncAll(ctx, dbConfig)
+	return s.ldapSyncer.SyncAll(ctx, dbConfig)
 }
 
 // SetLdapTestConfig updates the LDAP configuration used by the end-to-end test server

backend/internal/service/ldap_service.go

@@ -1,736 +0,0 @@
-package service
-
-import (
-	"bytes"
-	"context"
-	"crypto/tls"
-	"encoding/base64"
-	"fmt"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/url"
-	"path"
-	"strings"
-	"time"
-	"unicode/utf8"
-
-	"github.com/go-ldap/ldap/v3"
-	"github.com/google/uuid"
-	"github.com/pocket-id/pocket-id/backend/internal/appconfig"
-	"github.com/pocket-id/pocket-id/backend/internal/storage"
-	"github.com/pocket-id/pocket-id/backend/internal/utils"
-	"golang.org/x/text/unicode/norm"
-	"gorm.io/gorm"
-
-	"github.com/pocket-id/pocket-id/backend/internal/apperror"
-	"github.com/pocket-id/pocket-id/backend/internal/dto"
-	"github.com/pocket-id/pocket-id/backend/internal/model"
-)
-
-type LdapService struct {
-	db            *gorm.DB
-	httpClient    *http.Client
-	userService   *UserService
-	groupService  *UserGroupService
-	fileStorage   storage.FileStorage
-	clientFactory func(dbConfig *appconfig.AppConfigModel) (ldapClient, error)
-}
-
-type savePicture struct {
-	userID   string
-	username string
-	picture  string
-}
-
-type ldapDesiredUser struct {
-	ldapID  string
-	input   dto.UserCreateDto
-	picture string
-}
-
-type ldapDesiredGroup struct {
-	ldapID          string
-	input           dto.UserGroupCreateDto
-	memberUsernames []string
-}
-
-type ldapDesiredState struct {
-	users    []ldapDesiredUser
-	userIDs  map[string]struct{}
-	groups   []ldapDesiredGroup
-	groupIDs map[string]struct{}
-}
-
-type ldapClient interface {
-	Search(searchRequest *ldap.SearchRequest) (*ldap.SearchResult, error)
-	Bind(username, password string) error
-	Close() error
-}
-
-func NewLdapService(db *gorm.DB, httpClient *http.Client, userService *UserService, groupService *UserGroupService, fileStorage storage.FileStorage) *LdapService {
-	service := &LdapService{
-		db:           db,
-		httpClient:   httpClient,
-		userService:  userService,
-		groupService: groupService,
-		fileStorage:  fileStorage,
-	}
-
-	service.clientFactory = service.createClient
-	return service
-}
-
-func (s *LdapService) createClient(dbConfig *appconfig.AppConfigModel) (ldapClient, error) {
-	if !dbConfig.LdapEnabled.IsTrue() {
-		return nil, apperror.LdapDisabled()
-	}
-
-	// Setup LDAP connection
-	client, err := ldap.DialURL(dbConfig.LdapUrl.String(), ldap.DialWithTLSConfig(&tls.Config{
-		InsecureSkipVerify: dbConfig.LdapSkipCertVerify.IsTrue(), //nolint:gosec
-	}))
-	if err != nil {
-		return nil, fmt.Errorf("failed to connect to LDAP: %w", err)
-	}
-
-	// Bind as service account
-	err = client.Bind(dbConfig.LdapBindDn.String(), dbConfig.LdapBindPassword.String())
-	if err != nil {
-		return nil, fmt.Errorf("failed to bind to LDAP: %w", err)
-	}
-	return client, nil
-}
-
-// SyncAll synchronizes LDAP using the provided application configuration
-func (s *LdapService) SyncAll(ctx context.Context, dbConfig *appconfig.AppConfigModel) error {
-	// Setup LDAP connection
-	client, err := s.clientFactory(dbConfig)
-	if err != nil {
-		return fmt.Errorf("failed to create LDAP client: %w", err)
-	}
-	defer client.Close()
-
-	// First, we fetch all users and group from LDAP, which is our "desired state"
-	desiredState, err := s.fetchDesiredState(ctx, client, dbConfig)
-	if err != nil {
-		return fmt.Errorf("failed to fetch LDAP state: %w", err)
-	}
-
-	// Start a transaction
-	tx := s.db.WithContext(ctx).Begin()
-	if tx.Error != nil {
-		return fmt.Errorf("failed to begin database transaction: %w", tx.Error)
-	}
-	defer tx.Rollback()
-
-	// Reconcile users
-	savePictures, deleteFiles, err := s.reconcileUsers(ctx, tx, desiredState.users, desiredState.userIDs, dbConfig)
-	if err != nil {
-		return fmt.Errorf("failed to sync users: %w", err)
-	}
-
-	// Reconcile groups
-	err = s.reconcileGroups(ctx, tx, desiredState.groups, desiredState.groupIDs, dbConfig)
-	if err != nil {
-		return fmt.Errorf("failed to sync groups: %w", err)
-	}
-
-	// Commit the changes
-	err = tx.Commit().Error
-	if err != nil {
-		return fmt.Errorf("failed to commit changes to database: %w", err)
-	}
-
-	// Now that we've committed the transaction, we can perform operations on the storage layer
-	// First, save all new pictures
-	for _, sp := range savePictures {
-		err = s.saveProfilePicture(ctx, sp.userID, sp.picture)
-		if err != nil {
-			// This is not a fatal error
-			slog.Warn("Error saving profile picture for LDAP user", slog.String("username", sp.username), slog.Any("error", err))
-		}
-	}
-
-	// Delete all old files
-	for _, path := range deleteFiles {
-		err = s.fileStorage.Delete(ctx, path)
-		if err != nil {
-			// This is not a fatal error
-			slog.Error("Failed to delete file after LDAP sync", slog.String("path", path), slog.Any("error", err))
-		}
-	}
-
-	return nil
-}
-
-func (s *LdapService) fetchDesiredState(ctx context.Context, client ldapClient, dbConfig *appconfig.AppConfigModel) (ldapDesiredState, error) {
-	// Fetch users first so we can use their DNs when resolving group members
-	users, userIDs, usernamesByDN, err := s.fetchUsersFromLDAP(ctx, client, dbConfig)
-	if err != nil {
-		return ldapDesiredState{}, err
-	}
-
-	// Then fetch groups to complete the desired LDAP state snapshot
-	groups, groupIDs, err := s.fetchGroupsFromLDAP(ctx, client, usernamesByDN, dbConfig)
-	if err != nil {
-		return ldapDesiredState{}, err
-	}
-
-	// Apply user admin flags from the desired group membership snapshot.
-	// This intentionally uses the configured group member attribute rather than
-	// relying on a user-side reverse-membership attribute such as memberOf.
-	s.applyAdminGroupMembership(users, groups, dbConfig)
-
-	return ldapDesiredState{
-		users:    users,
-		userIDs:  userIDs,
-		groups:   groups,
-		groupIDs: groupIDs,
-	}, nil
-}
-
-func (s *LdapService) applyAdminGroupMembership(desiredUsers []ldapDesiredUser, desiredGroups []ldapDesiredGroup, dbConfig *appconfig.AppConfigModel) {
-	if dbConfig.LdapAdminGroupName == "" {
-		return
-	}
-
-	adminUsernames := make(map[string]struct{})
-	for _, group := range desiredGroups {
-		if group.input.Name != string(dbConfig.LdapAdminGroupName) {
-			continue
-		}
-
-		for _, username := range group.memberUsernames {
-			adminUsernames[username] = struct{}{}
-		}
-	}
-
-	for i := range desiredUsers {
-		_, isAdmin := adminUsernames[desiredUsers[i].input.Username]
-		desiredUsers[i].input.IsAdmin = desiredUsers[i].input.IsAdmin || isAdmin
-	}
-}
-
-func (s *LdapService) fetchGroupsFromLDAP(ctx context.Context, client ldapClient, usernamesByDN map[string]string, dbConfig *appconfig.AppConfigModel) (desiredGroups []ldapDesiredGroup, ldapGroupIDs map[string]struct{}, err error) {
-	// Query LDAP for all groups we want to manage
-	searchAttrs := []string{
-		dbConfig.LdapAttributeGroupName.String(),
-		dbConfig.LdapAttributeGroupUniqueIdentifier.String(),
-		dbConfig.LdapAttributeGroupMember.String(),
-	}
-
-	searchReq := ldap.NewSearchRequest(
-		dbConfig.LdapBase.String(),
-		ldap.ScopeWholeSubtree,
-		0, 0, 0, false,
-		dbConfig.LdapUserGroupSearchFilter.String(),
-		searchAttrs,
-		[]ldap.Control{},
-	)
-	result, err := client.Search(searchReq)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to query LDAP groups: %w", err)
-	}
-
-	// Build the in-memory desired state for groups
-	ldapGroupIDs = make(map[string]struct{}, len(result.Entries))
-	desiredGroups = make([]ldapDesiredGroup, 0, len(result.Entries))
-
-	for _, value := range result.Entries {
-		ldapID := convertLdapIdToString(value.GetAttributeValue(dbConfig.LdapAttributeGroupUniqueIdentifier.String()))
-
-		// Skip groups without a valid LDAP ID
-		if ldapID == "" {
-			slog.Warn("Skipping LDAP group without a valid unique identifier", slog.String("attribute", dbConfig.LdapAttributeGroupUniqueIdentifier.String()))
-			continue
-		}
-
-		ldapGroupIDs[ldapID] = struct{}{}
-
-		// Get group members and add to the correct Group
-		groupMembers := value.GetAttributeValues(dbConfig.LdapAttributeGroupMember.String())
-		memberUsernames := make([]string, 0, len(groupMembers))
-		for _, member := range groupMembers {
-			username := s.resolveGroupMemberUsername(ctx, client, member, usernamesByDN, dbConfig.LdapAttributeUserUsername.String())
-			if username == "" {
-				continue
-			}
-
-			memberUsernames = append(memberUsernames, username)
-		}
-
-		syncGroup := dto.UserGroupCreateDto{
-			Name:         value.GetAttributeValue(dbConfig.LdapAttributeGroupName.String()),
-			FriendlyName: value.GetAttributeValue(dbConfig.LdapAttributeGroupName.String()),
-			LdapID:       ldapID,
-		}
-		dto.Normalize(&syncGroup)
-
-		err = syncGroup.Validate()
-		if err != nil {
-			slog.WarnContext(ctx, "LDAP user group object is not valid", slog.Any("error", err))
-			continue
-		}
-
-		desiredGroups = append(desiredGroups, ldapDesiredGroup{
-			ldapID:          ldapID,
-			input:           syncGroup,
-			memberUsernames: memberUsernames,
-		})
-	}
-
-	return desiredGroups, ldapGroupIDs, nil
-}
-
-func (s *LdapService) fetchUsersFromLDAP(ctx context.Context, client ldapClient, dbConfig *appconfig.AppConfigModel) (desiredUsers []ldapDesiredUser, ldapUserIDs map[string]struct{}, usernamesByDN map[string]string, err error) {
-	// Query LDAP for all users we want to manage
-	searchAttrs := []string{
-		"sn",
-		"cn",
-		dbConfig.LdapAttributeUserUniqueIdentifier.String(),
-		dbConfig.LdapAttributeUserUsername.String(),
-		dbConfig.LdapAttributeUserEmail.String(),
-		dbConfig.LdapAttributeUserFirstName.String(),
-		dbConfig.LdapAttributeUserLastName.String(),
-		dbConfig.LdapAttributeUserProfilePicture.String(),
-		dbConfig.LdapAttributeUserDisplayName.String(),
-	}
-
-	// Filters must start and finish with ()!
-	searchReq := ldap.NewSearchRequest(
-		dbConfig.LdapBase.String(),
-		ldap.ScopeWholeSubtree,
-		0, 0, 0, false,
-		dbConfig.LdapUserSearchFilter.String(),
-		searchAttrs,
-		[]ldap.Control{},
-	)
-
-	result, err := client.Search(searchReq)
-	if err != nil {
-		return nil, nil, nil, fmt.Errorf("failed to query LDAP users: %w", err)
-	}
-
-	// Build the in-memory desired state for users and a DN lookup for group membership resolution
-	ldapUserIDs = make(map[string]struct{}, len(result.Entries))
-	usernamesByDN = make(map[string]string, len(result.Entries))
-	desiredUsers = make([]ldapDesiredUser, 0, len(result.Entries))
-
-	for _, value := range result.Entries {
-		username := norm.NFC.String(value.GetAttributeValue(dbConfig.LdapAttributeUserUsername.String()))
-		if normalizedDN := normalizeLDAPDN(value.DN); normalizedDN != "" && username != "" {
-			usernamesByDN[normalizedDN] = username
-		}
-
-		ldapID := convertLdapIdToString(value.GetAttributeValue(dbConfig.LdapAttributeUserUniqueIdentifier.String()))
-
-		// Skip users without a valid LDAP ID
-		if ldapID == "" {
-			slog.Warn("Skipping LDAP user without a valid unique identifier", slog.String("attribute", dbConfig.LdapAttributeUserUniqueIdentifier.String()))
-			continue
-		}
-
-		ldapUserIDs[ldapID] = struct{}{}
-
-		newUser := dto.UserCreateDto{
-			Username:      value.GetAttributeValue(dbConfig.LdapAttributeUserUsername.String()),
-			Email:         utils.PtrOrNil(value.GetAttributeValue(dbConfig.LdapAttributeUserEmail.String())),
-			EmailVerified: true,
-			FirstName:     value.GetAttributeValue(dbConfig.LdapAttributeUserFirstName.String()),
-			LastName:      value.GetAttributeValue(dbConfig.LdapAttributeUserLastName.String()),
-			DisplayName:   value.GetAttributeValue(dbConfig.LdapAttributeUserDisplayName.String()),
-			// Admin status is computed after groups are loaded so it can use the
-			// configured group member attribute instead of a hard-coded memberOf.
-			IsAdmin: false,
-			LdapID:  ldapID,
-		}
-
-		if newUser.DisplayName == "" {
-			newUser.DisplayName = strings.TrimSpace(newUser.FirstName + " " + newUser.LastName)
-		}
-
-		dto.Normalize(&newUser)
-
-		err = newUser.Validate()
-		if err != nil {
-			slog.WarnContext(ctx, "LDAP user object is not valid", slog.Any("error", err))
-			continue
-		}
-
-		desiredUsers = append(desiredUsers, ldapDesiredUser{
-			ldapID:  ldapID,
-			input:   newUser,
-			picture: value.GetAttributeValue(dbConfig.LdapAttributeUserProfilePicture.String()),
-		})
-	}
-
-	return desiredUsers, ldapUserIDs, usernamesByDN, nil
-}
-
-func (s *LdapService) resolveGroupMemberUsername(ctx context.Context, client ldapClient, member string, usernamesByDN map[string]string, usernameAttr string) string {
-	// First try the DN cache we built while loading users
-	username, exists := usernamesByDN[normalizeLDAPDN(member)]
-	if exists && username != "" {
-		return username
-	}
-
-	// Then try to extract the username directly from the DN
-	username = getDNProperty(usernameAttr, member)
-	if username != "" {
-		return norm.NFC.String(username)
-	}
-
-	// posixGroup (and similar) stores bare usernames in memberUid, not DNs. Treat any value
-	// that is not a valid DN as the username directly — see https://github.com/pocket-id/pocket-id/issues/1408
-	_, err := ldap.ParseDN(member)
-	if err != nil {
-		return norm.NFC.String(member)
-	}
-
-	// As a fallback, query LDAP for the referenced entry
-	userSearchReq := ldap.NewSearchRequest(
-		member,
-		ldap.ScopeBaseObject,
-		0, 0, 0, false,
-		"(objectClass=*)",
-		[]string{usernameAttr},
-		[]ldap.Control{},
-	)
-
-	userResult, err := client.Search(userSearchReq)
-	if err != nil || len(userResult.Entries) == 0 {
-		slog.WarnContext(ctx, "Could not resolve group member DN", slog.String("member", member), slog.Any("error", err))
-		return ""
-	}
-
-	username = userResult.Entries[0].GetAttributeValue(usernameAttr)
-	if username == "" {
-		slog.WarnContext(ctx, "Could not extract username from group member DN", slog.String("member", member))
-		return ""
-	}
-
-	return norm.NFC.String(username)
-}
-
-func (s *LdapService) reconcileGroups(ctx context.Context, tx *gorm.DB, desiredGroups []ldapDesiredGroup, ldapGroupIDs map[string]struct{}, dbConfig *appconfig.AppConfigModel) error {
-	// Load the current LDAP-managed state from the database
-	ldapGroupsInDB, ldapGroupsByID, err := s.loadLDAPGroupsInDB(ctx, tx)
-	if err != nil {
-		return fmt.Errorf("failed to fetch groups from database: %w", err)
-	}
-
-	_, _, ldapUsersByUsername, err := s.loadLDAPUsersInDB(ctx, tx)
-	if err != nil {
-		return fmt.Errorf("failed to fetch users from database: %w", err)
-	}
-
-	// Apply creates and updates to match the desired LDAP group state
-	for _, desiredGroup := range desiredGroups {
-		memberUserIDs := make([]string, 0, len(desiredGroup.memberUsernames))
-		for _, username := range desiredGroup.memberUsernames {
-			databaseUser, exists := ldapUsersByUsername[username]
-			if !exists {
-				// The user collides with a non-LDAP user or was skipped during user sync, so we ignore it
-				continue
-			}
-
-			memberUserIDs = append(memberUserIDs, databaseUser.ID)
-		}
-
-		databaseGroup := ldapGroupsByID[desiredGroup.ldapID]
-		if databaseGroup.ID == "" {
-			newGroup, err := s.groupService.createInternal(ctx, desiredGroup.input, tx)
-			if err != nil {
-				return fmt.Errorf("failed to create group '%s': %w", desiredGroup.input.Name, err)
-			}
-			ldapGroupsByID[desiredGroup.ldapID] = newGroup
-
-			_, err = s.groupService.updateUsersInternal(ctx, newGroup.ID, memberUserIDs, tx)
-			if err != nil {
-				return fmt.Errorf("failed to sync users for group '%s': %w", desiredGroup.input.Name, err)
-			}
-			continue
-		}
-
-		_, err = s.groupService.updateInternal(ctx, databaseGroup.ID, desiredGroup.input, true, tx, dbConfig)
-		if err != nil {
-			return fmt.Errorf("failed to update group '%s': %w", desiredGroup.input.Name, err)
-		}
-
-		_, err = s.groupService.updateUsersInternal(ctx, databaseGroup.ID, memberUserIDs, tx)
-		if err != nil {
-			return fmt.Errorf("failed to sync users for group '%s': %w", desiredGroup.input.Name, err)
-		}
-	}
-
-	// Delete groups that are no longer present in LDAP
-	for _, group := range ldapGroupsInDB {
-		if group.LdapID == nil {
-			continue
-		}
-
-		if _, exists := ldapGroupIDs[*group.LdapID]; exists {
-			continue
-		}
-
-		err = tx.
-			WithContext(ctx).
-			Delete(&model.UserGroup{}, "ldap_id = ?", *group.LdapID).
-			Error
-		if err != nil {
-			return fmt.Errorf("failed to delete group '%s': %w", group.Name, err)
-		}
-
-		slog.Info("Deleted group", slog.String("group", group.Name))
-	}
-
-	return nil
-}
-
-//nolint:gocognit
-func (s *LdapService) reconcileUsers(ctx context.Context, tx *gorm.DB, desiredUsers []ldapDesiredUser, ldapUserIDs map[string]struct{}, dbConfig *appconfig.AppConfigModel) (savePictures []savePicture, deleteFiles []string, err error) {
-	// Load the current LDAP-managed state from the database
-	ldapUsersInDB, ldapUsersByID, _, err := s.loadLDAPUsersInDB(ctx, tx)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to fetch users from database: %w", err)
-	}
-
-	// Apply creates and updates to match the desired LDAP user state
-	savePictures = make([]savePicture, 0, len(desiredUsers))
-
-	for _, desiredUser := range desiredUsers {
-		databaseUser := ldapUsersByID[desiredUser.ldapID]
-
-		// If a user is found (even if disabled), enable them since they're now back in LDAP.
-		if databaseUser.ID != "" && databaseUser.Disabled {
-			err = tx.
-				WithContext(ctx).
-				Model(&model.User{}).
-				Where("id = ?", databaseUser.ID).
-				Update("disabled", false).
-				Error
-			if err != nil {
-				return nil, nil, fmt.Errorf("failed to enable user %s: %w", databaseUser.Username, err)
-			}
-
-			databaseUser.Disabled = false
-			ldapUsersByID[desiredUser.ldapID] = databaseUser
-		}
-
-		userID := databaseUser.ID
-		if databaseUser.ID == "" {
-			createdUser, err := s.userService.createUserInternal(ctx, desiredUser.input, true, tx, dbConfig)
-			if apperror.IsCode(err, apperror.CodeAlreadyInUse) {
-				slog.Warn("Skipping creating LDAP user", slog.String("username", desiredUser.input.Username), slog.Any("error", err))
-				continue
-			} else if err != nil {
-				return nil, nil, fmt.Errorf("error creating user '%s': %w", desiredUser.input.Username, err)
-			}
-
-			userID = createdUser.ID
-			ldapUsersByID[desiredUser.ldapID] = createdUser
-		} else {
-			_, err = s.userService.updateUserInternal(ctx, databaseUser.ID, desiredUser.input, false, true, tx, dbConfig)
-			if apperror.IsCode(err, apperror.CodeAlreadyInUse) {
-				slog.Warn("Skipping updating LDAP user", slog.String("username", desiredUser.input.Username), slog.Any("error", err))
-				continue
-			} else if err != nil {
-				return nil, nil, fmt.Errorf("error updating user '%s': %w", desiredUser.input.Username, err)
-			}
-		}
-
-		if desiredUser.picture != "" {
-			savePictures = append(savePictures, savePicture{
-				userID:   userID,
-				username: desiredUser.input.Username,
-				picture:  desiredUser.picture,
-			})
-		}
-	}
-
-	// Disable or delete users that are no longer present in LDAP
-	deleteFiles = make([]string, 0, len(ldapUsersInDB))
-	for _, user := range ldapUsersInDB {
-		if user.LdapID == nil {
-			continue
-		}
-
-		if _, exists := ldapUserIDs[*user.LdapID]; exists {
-			continue
-		}
-
-		if dbConfig.LdapSoftDeleteUsers.IsTrue() {
-			err = s.userService.disableUserInternal(ctx, tx, user.ID)
-			if err != nil {
-				return nil, nil, fmt.Errorf("failed to disable user %s: %w", user.Username, err)
-			}
-
-			slog.Info("Disabled user", slog.String("username", user.Username))
-			continue
-		}
-
-		err = s.userService.deleteUserInternal(ctx, tx, user.ID, true, dbConfig)
-		if err != nil {
-			if apperror.IsCode(err, apperror.CodeLdapUserUpdate) {
-				return nil, nil, fmt.Errorf("failed to delete user %s: LDAP user must be disabled before deletion", user.Username)
-			}
-			return nil, nil, fmt.Errorf("failed to delete user %s: %w", user.Username, err)
-		}
-
-		slog.Info("Deleted user", slog.String("username", user.Username))
-		deleteFiles = append(deleteFiles, path.Join("profile-pictures", user.ID+".png"))
-	}
-
-	return savePictures, deleteFiles, nil
-}
-
-func (s *LdapService) loadLDAPUsersInDB(ctx context.Context, tx *gorm.DB) (users []model.User, byLdapID map[string]model.User, byUsername map[string]model.User, err error) {
-	// Load all LDAP-managed users and index them by LDAP ID and by username
-	err = tx.
-		WithContext(ctx).
-		Select("id, username, ldap_id, disabled").
-		Where("ldap_id IS NOT NULL").
-		Find(&users).
-		Error
-	if err != nil {
-		return nil, nil, nil, err
-	}
-
-	byLdapID = make(map[string]model.User, len(users))
-	byUsername = make(map[string]model.User, len(users))
-	for _, user := range users {
-		byLdapID[*user.LdapID] = user
-		byUsername[user.Username] = user
-	}
-
-	return users, byLdapID, byUsername, nil
-}
-
-func (s *LdapService) loadLDAPGroupsInDB(ctx context.Context, tx *gorm.DB) ([]model.UserGroup, map[string]model.UserGroup, error) {
-	var groups []model.UserGroup
-
-	// Load all LDAP-managed groups and index them by LDAP ID
-	err := tx.
-		WithContext(ctx).
-		Select("id, name, ldap_id").
-		Where("ldap_id IS NOT NULL").
-		Find(&groups).
-		Error
-	if err != nil {
-		return nil, nil, err
-	}
-
-	groupsByID := make(map[string]model.UserGroup, len(groups))
-	for _, group := range groups {
-		groupsByID[*group.LdapID] = group
-	}
-
-	return groups, groupsByID, nil
-}
-
-func (s *LdapService) saveProfilePicture(parentCtx context.Context, userId string, pictureString string) error {
-	var reader io.ReadSeeker
-
-	// Accept either a URL, a base64-encoded payload, or raw binary data
-	_, err := url.ParseRequestURI(pictureString)
-	if err == nil {
-		ctx, cancel := context.WithTimeout(parentCtx, 15*time.Second)
-		defer cancel()
-
-		var req *http.Request
-		req, err = http.NewRequestWithContext(ctx, http.MethodGet, pictureString, nil)
-		if err != nil {
-			return fmt.Errorf("failed to create request: %w", err)
-		}
-
-		var res *http.Response
-		res, err = s.httpClient.Do(req)
-		if err != nil {
-			return fmt.Errorf("failed to download profile picture: %w", err)
-		}
-		defer res.Body.Close()
-
-		data, err := io.ReadAll(res.Body)
-		if err != nil {
-			return fmt.Errorf("failed to read profile picture: %w", err)
-		}
-
-		reader = bytes.NewReader(data)
-	} else if decodedPhoto, err := base64.StdEncoding.DecodeString(pictureString); err == nil {
-		// If the photo is a base64 encoded string, decode it
-		reader = bytes.NewReader(decodedPhoto)
-	} else {
-		// If the photo is a string, we assume that it's a binary string
-		reader = bytes.NewReader([]byte(pictureString))
-	}
-
-	// Update the profile picture
-	err = s.userService.UpdateProfilePicture(parentCtx, userId, reader)
-	if err != nil {
-		return fmt.Errorf("failed to update profile picture: %w", err)
-	}
-
-	return nil
-}
-
-// normalizeLDAPDN returns a canonical lowercase form of a DN for use as a map key.
-// Different LDAP servers may format the same DN with varying attribute type casing (e.g. "CN=" vs "cn=") or extra whitespace (e.g. "dc=example, dc=com").
-// Without normalization, cache lookups in usernamesByDN would miss when a member attribute value uses a different format than the DN returned in the search entry
-//
-// ldap.ParseDN is used instead of simple lowercasing because it correctly handles multi-valued RDNs (joined with "+") and strips inter-component whitespace.
-// If parsing fails for any reason, we fall back to a simple lowercase+trim.
-func normalizeLDAPDN(dn string) string {
-	parsed, err := ldap.ParseDN(dn)
-	if err != nil {
-		return strings.ToLower(strings.TrimSpace(dn))
-	}
-
-	// Reconstruct the DN in a canonical form: lowercase type=lowercase value, with RDN components separated by "," and multi-value attributes by "+"
-	parts := make([]string, 0, len(parsed.RDNs))
-	for _, rdn := range parsed.RDNs {
-		attrs := make([]string, 0, len(rdn.Attributes))
-		for _, attr := range rdn.Attributes {
-			attrs = append(attrs, strings.ToLower(attr.Type)+"="+strings.ToLower(attr.Value))
-		}
-		parts = append(parts, strings.Join(attrs, "+"))
-	}
-
-	return strings.Join(parts, ",")
-}
-
-// getDNProperty returns the value of a property from a LDAP identifier
-// See: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ldap/distinguished-names
-func getDNProperty(property string, str string) string {
-	// Example format is "CN=username,ou=people,dc=example,dc=com"
-	// First we split at the comma
-	property = strings.ToLower(property)
-	l := len(property) + 1
-	for v := range strings.SplitSeq(str, ",") {
-		v = strings.TrimSpace(v)
-		if len(v) > l && strings.ToLower(v)[0:l] == property+"=" {
-			return v[l:]
-		}
-	}
-
-	// CN not found, return an empty string
-	return ""
-}
-
-// convertLdapIdToString converts LDAP IDs to valid UTF-8 strings.
-// LDAP servers may return binary UUIDs (16 bytes) or other non-UTF-8 data.
-func convertLdapIdToString(ldapId string) string {
-	if utf8.ValidString(ldapId) {
-		return norm.NFC.String(ldapId)
-	}
-
-	// Try to parse as binary UUID (16 bytes)
-	if len(ldapId) == 16 {
-		if parsedUUID, err := uuid.FromBytes([]byte(ldapId)); err == nil {
-			return parsedUUID.String()
-		}
-	}
-
-	// As a last resort, encode as base64 to make it UTF-8 safe
-	return base64.StdEncoding.EncodeToString([]byte(ldapId))
-}

backend/internal/service/ldap_service_test.go

@@ -1,563 +0,0 @@
-package service
-
-import (
-	"net/http"
-	"testing"
-
-	"github.com/go-ldap/ldap/v3"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gorm.io/gorm"
-
-	"github.com/pocket-id/pocket-id/backend/internal/appconfig"
-	"github.com/pocket-id/pocket-id/backend/internal/apperror"
-	"github.com/pocket-id/pocket-id/backend/internal/model"
-	"github.com/pocket-id/pocket-id/backend/internal/storage"
-	testutils "github.com/pocket-id/pocket-id/backend/internal/utils/testing"
-)
-
-type fakeLDAPClient struct {
-	searchFn func(searchRequest *ldap.SearchRequest) (*ldap.SearchResult, error)
-}
-
-func TestCreateLDAPClientRejectsDisabledConfiguration(t *testing.T) {
-	service := NewLdapService(nil, nil, nil, nil, nil)
-
-	_, err := service.createClient(&appconfig.AppConfigModel{LdapEnabled: "false"})
-
-	require.True(t, apperror.IsCode(err, apperror.CodeLdapDisabled))
-}
-
-func (c *fakeLDAPClient) Search(searchRequest *ldap.SearchRequest) (*ldap.SearchResult, error) {
-	if c.searchFn == nil {
-		return nil, nil
-	}
-
-	return c.searchFn(searchRequest)
-}
-
-func (c *fakeLDAPClient) Bind(_, _ string) error {
-	return nil
-}
-
-func (c *fakeLDAPClient) Close() error {
-	return nil
-}
-
-func TestLdapServiceSyncAllReconcilesUsersAndGroups(t *testing.T) {
-	service, db := newTestLdapService(t, newFakeLDAPClient(
-		ldapSearchResult(
-			ldapEntry("uid=alice,ou=people,dc=example,dc=com", map[string][]string{
-				"entryUUID":   {"u-alice"},
-				"uid":         {"alice"},
-				"mail":        {"alice@example.com"},
-				"givenName":   {"Alice"},
-				"sn":          {"Jones"},
-				"displayName": {""},
-			}),
-			ldapEntry("uid=bob,ou=people,dc=example,dc=com", map[string][]string{
-				"entryUUID":   {"u-bob"},
-				"uid":         {"bob"},
-				"mail":        {"bob@example.com"},
-				"givenName":   {"Bob"},
-				"sn":          {"Brown"},
-				"displayName": {""},
-			}),
-		),
-		ldapSearchResult(
-			ldapEntry("cn=admins,ou=groups,dc=example,dc=com", map[string][]string{
-				"entryUUID": {"g-admins"},
-				"cn":        {"admins"},
-				"member":    {"uid=alice,ou=people,dc=example,dc=com"},
-			}),
-			ldapEntry("cn=team,ou=groups,dc=example,dc=com", map[string][]string{
-				"entryUUID": {"g-team"},
-				"cn":        {"team"},
-				"member": {
-					"UID=Alice, OU=People, DC=example, DC=com",
-					"uid=bob, ou=people, dc=example, dc=com",
-				},
-			}),
-		),
-	))
-
-	aliceLdapID := "u-alice"
-	missingLdapID := "u-missing"
-	teamLdapID := "g-team"
-	oldGroupLdapID := "g-old"
-
-	require.NoError(t, db.Create(&model.User{
-		Username:      "alice-old",
-		Email:         new("alice-old@example.com"),
-		EmailVerified: true,
-		FirstName:     "Old",
-		LastName:      "Name",
-		DisplayName:   "Old Name",
-		LdapID:        &aliceLdapID,
-		Disabled:      true,
-	}).Error)
-
-	require.NoError(t, db.Create(&model.User{
-		Username:      "missing",
-		Email:         new("missing@example.com"),
-		EmailVerified: true,
-		FirstName:     "Missing",
-		LastName:      "User",
-		DisplayName:   "Missing User",
-		LdapID:        &missingLdapID,
-	}).Error)
-
-	require.NoError(t, db.Create(&model.UserGroup{
-		Name:         "team-old",
-		FriendlyName: "team-old",
-		LdapID:       &teamLdapID,
-	}).Error)
-
-	require.NoError(t, db.Create(&model.UserGroup{
-		Name:         "old-group",
-		FriendlyName: "old-group",
-		LdapID:       &oldGroupLdapID,
-	}).Error)
-
-	err := service.SyncAll(t.Context(), defaultTestLDAPAppConfig())
-	require.NoError(t, err)
-
-	var alice model.User
-	require.NoError(t, db.First(&alice, "ldap_id = ?", aliceLdapID).Error)
-	assert.Equal(t, "alice", alice.Username)
-	assert.Equal(t, new("alice@example.com"), alice.Email)
-	assert.Equal(t, "Alice", alice.FirstName)
-	assert.Equal(t, "Jones", alice.LastName)
-	assert.Equal(t, "Alice Jones", alice.DisplayName)
-	assert.True(t, alice.IsAdmin)
-	assert.False(t, alice.Disabled)
-
-	var bob model.User
-	require.NoError(t, db.First(&bob, "ldap_id = ?", "u-bob").Error)
-	assert.Equal(t, "bob", bob.Username)
-	assert.Equal(t, "Bob Brown", bob.DisplayName)
-
-	var missing model.User
-	require.NoError(t, db.First(&missing, "ldap_id = ?", missingLdapID).Error)
-	assert.True(t, missing.Disabled)
-
-	var oldGroupCount int64
-	require.NoError(t, db.Model(&model.UserGroup{}).Where("ldap_id = ?", oldGroupLdapID).Count(&oldGroupCount).Error)
-	assert.Zero(t, oldGroupCount)
-
-	var team model.UserGroup
-	require.NoError(t, db.Preload("Users").First(&team, "ldap_id = ?", teamLdapID).Error)
-	assert.Equal(t, "team", team.Name)
-	assert.Equal(t, "team", team.FriendlyName)
-	assert.ElementsMatch(t, []string{"alice", "bob"}, usernames(team.Users))
-}
-
-// Regression: posixGroup uses memberUid (bare uid values), not member DNs — issue #1408.
-func TestLdapServiceSyncAllMapsPosixGroupMemberUid(t *testing.T) {
-	appCfg := defaultTestLDAPAppConfig()
-	appCfg.LdapUserGroupSearchFilter = "(objectClass=posixGroup)"
-	appCfg.LdapAttributeGroupMember = "memberUid"
-
-	service, db := newTestLdapServiceWithAppConfig(t, appCfg, newFakeLDAPClient(
-		ldapSearchResult(
-			ldapEntry("uid=alice,ou=users,dc=example,dc=com", map[string][]string{
-				"entryUUID":   {"u-alice"},
-				"uid":         {"alice"},
-				"mail":        {"alice@example.com"},
-				"givenName":   {"Alice"},
-				"sn":          {"Jones"},
-				"displayName": {""},
-			}),
-			ldapEntry("uid=bob,ou=users,dc=example,dc=com", map[string][]string{
-				"entryUUID":   {"u-bob"},
-				"uid":         {"bob"},
-				"mail":        {"bob@example.com"},
-				"givenName":   {"Bob"},
-				"sn":          {"Brown"},
-				"displayName": {""},
-			}),
-		),
-		ldapSearchResult(
-			ldapEntry("cn=users,ou=groups,dc=example,dc=com", map[string][]string{
-				"entryUUID": {"g-users"},
-				"cn":        {"users"},
-				"memberUid": {"alice", "bob", "unknown"},
-			}),
-		),
-	))
-
-	err := service.SyncAll(t.Context(), appCfg)
-	require.NoError(t, err)
-
-	var group model.UserGroup
-	require.NoError(t, db.Preload("Users").First(&group, "ldap_id = ?", "g-users").Error)
-	assert.Equal(t, "users", group.Name)
-	assert.ElementsMatch(t, []string{"alice", "bob"}, usernames(group.Users))
-}
-
-func TestLdapServiceSyncAllHandlesDuplicateLDAPIDsInSingleRun(t *testing.T) {
-	service, db := newTestLdapService(t, newFakeLDAPClient(
-		ldapSearchResult(
-			ldapEntry("uid=alice,ou=people,dc=example,dc=com", map[string][]string{
-				"entryUUID":   {"u-dup"},
-				"uid":         {"alice"},
-				"mail":        {"alice@example.com"},
-				"givenName":   {"Alice"},
-				"sn":          {"Doe"},
-				"displayName": {"Alice Doe"},
-			}),
-			ldapEntry("uid=alice,ou=people,dc=example,dc=com", map[string][]string{
-				"entryUUID":   {"u-dup"},
-				"uid":         {"alice"},
-				"mail":        {"alice@example.com"},
-				"givenName":   {"Alicia"},
-				"sn":          {"Doe"},
-				"displayName": {"Alicia Doe"},
-			}),
-		),
-		ldapSearchResult(
-			ldapEntry("cn=team,ou=groups,dc=example,dc=com", map[string][]string{
-				"entryUUID": {"g-dup"},
-				"cn":        {"team"},
-				"member":    {"uid=alice,ou=people,dc=example,dc=com"},
-			}),
-			ldapEntry("cn=team,ou=groups,dc=example,dc=com", map[string][]string{
-				"entryUUID": {"g-dup"},
-				"cn":        {"team-renamed"},
-				"member":    {"uid=alice,ou=people,dc=example,dc=com"},
-			}),
-		),
-	))
-
-	err := service.SyncAll(t.Context(), defaultTestLDAPAppConfig())
-	require.NoError(t, err)
-
-	var users []model.User
-	require.NoError(t, db.Find(&users, "ldap_id = ?", "u-dup").Error)
-	require.Len(t, users, 1)
-	assert.Equal(t, "alice", users[0].Username)
-	assert.Equal(t, "Alicia", users[0].FirstName)
-	assert.Equal(t, "Alicia Doe", users[0].DisplayName)
-
-	var groups []model.UserGroup
-	require.NoError(t, db.Preload("Users").Find(&groups, "ldap_id = ?", "g-dup").Error)
-	require.Len(t, groups, 1)
-	assert.Equal(t, "team-renamed", groups[0].Name)
-	assert.Equal(t, "team-renamed", groups[0].FriendlyName)
-	assert.ElementsMatch(t, []string{"alice"}, usernames(groups[0].Users))
-}
-
-func TestLdapServiceSyncAllSetsAdminFromGroupMembership(t *testing.T) {
-	tests := []struct {
-		name        string
-		appConfig   *appconfig.AppConfigModel
-		groupEntry  *ldap.Entry
-		groupName   string
-		groupLookup string
-	}{
-		{
-			name:      "memberOf missing on user",
-			appConfig: defaultTestLDAPAppConfig(),
-			groupEntry: ldapEntry("cn=admins,ou=groups,dc=example,dc=com", map[string][]string{
-				"entryUUID": {"g-admins"},
-				"cn":        {"admins"},
-				"member":    {"uid=testadmin,ou=people,dc=example,dc=com"},
-			}),
-			groupName:   "admins",
-			groupLookup: "g-admins",
-		},
-		{
-			name: "configured group name attribute differs from DN RDN",
-			appConfig: func() *appconfig.AppConfigModel {
-				cfg := defaultTestLDAPAppConfig()
-				cfg.LdapAttributeGroupName = "displayName"
-				cfg.LdapAdminGroupName = "pocketid.admin"
-				return cfg
-			}(),
-			groupEntry: ldapEntry("cn=admins,ou=groups,dc=example,dc=com", map[string][]string{
-				"entryUUID":   {"g-display-admins"},
-				"cn":          {"admins"},
-				"displayName": {"pocketid.admin"},
-				"member":      {"uid=testadmin,ou=people,dc=example,dc=com"},
-			}),
-			groupName:   "pocketid.admin",
-			groupLookup: "g-display-admins",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			service, db := newTestLdapServiceWithAppConfig(t, tt.appConfig, newFakeLDAPClient(
-				ldapSearchResult(
-					ldapEntry("uid=testadmin,ou=people,dc=example,dc=com", map[string][]string{
-						"entryUUID":   {"u-testadmin"},
-						"uid":         {"testadmin"},
-						"mail":        {"testadmin@example.com"},
-						"givenName":   {"Test"},
-						"sn":          {"Admin"},
-						"displayName": {""},
-					}),
-				),
-				ldapSearchResult(tt.groupEntry),
-			))
-
-			err := service.SyncAll(t.Context(), tt.appConfig)
-			require.NoError(t, err)
-
-			var user model.User
-			require.NoError(t, db.First(&user, "ldap_id = ?", "u-testadmin").Error)
-			assert.True(t, user.IsAdmin)
-
-			var group model.UserGroup
-			require.NoError(t, db.Preload("Users").First(&group, "ldap_id = ?", tt.groupLookup).Error)
-			assert.Equal(t, tt.groupName, group.Name)
-			assert.ElementsMatch(t, []string{"testadmin"}, usernames(group.Users))
-		})
-	}
-}
-
-func newTestLdapService(t *testing.T, client ldapClient) (*LdapService, *gorm.DB) {
-	t.Helper()
-
-	return newTestLdapServiceWithAppConfig(t, defaultTestLDAPAppConfig(), client)
-}
-
-func newTestLdapServiceWithAppConfig(t *testing.T, appConfigModel *appconfig.AppConfigModel, client ldapClient) (*LdapService, *gorm.DB) {
-	t.Helper()
-
-	db := testutils.NewDatabaseForTest(t)
-
-	fileStorage, err := storage.NewDatabaseStorage(db)
-	require.NoError(t, err)
-
-	groupService := NewUserGroupService(db, nil)
-	userService := NewUserService(
-		db,
-		nil,
-		nil,
-		NewCustomClaimService(db),
-		NewAppImagesService(map[string]string{}, fileStorage),
-		nil,
-		fileStorage,
-	)
-
-	service := NewLdapService(db, &http.Client{}, userService, groupService, fileStorage)
-	service.clientFactory = func(dbConfig *appconfig.AppConfigModel) (ldapClient, error) {
-		return client, nil
-	}
-
-	return service, db
-}
-
-func defaultTestLDAPAppConfig() *appconfig.AppConfigModel {
-	return &appconfig.AppConfigModel{
-		RequireUserEmail:                   "false",
-		LdapEnabled:                        "true",
-		LdapBase:                           "dc=example,dc=com",
-		LdapUserSearchFilter:               "(objectClass=person)",
-		LdapUserGroupSearchFilter:          "(objectClass=groupOfNames)",
-		LdapAttributeUserUniqueIdentifier:  "entryUUID",
-		LdapAttributeUserUsername:          "uid",
-		LdapAttributeUserEmail:             "mail",
-		LdapAttributeUserFirstName:         "givenName",
-		LdapAttributeUserLastName:          "sn",
-		LdapAttributeUserDisplayName:       "displayName",
-		LdapAttributeUserProfilePicture:    "jpegPhoto",
-		LdapAttributeGroupMember:           "member",
-		LdapAttributeGroupUniqueIdentifier: "entryUUID",
-		LdapAttributeGroupName:             "cn",
-		LdapAdminGroupName:                 "admins",
-		LdapSoftDeleteUsers:                "true",
-	}
-}
-
-func newFakeLDAPClient(userResult, groupResult *ldap.SearchResult) ldapClient {
-	return &fakeLDAPClient{
-		searchFn: func(searchRequest *ldap.SearchRequest) (*ldap.SearchResult, error) {
-			switch searchRequest.Filter {
-			case "(objectClass=person)":
-				return userResult, nil
-			case "(objectClass=groupOfNames)", "(objectClass=posixGroup)":
-				return groupResult, nil
-			default:
-				return &ldap.SearchResult{}, nil
-			}
-		},
-	}
-}
-
-func ldapSearchResult(entries ...*ldap.Entry) *ldap.SearchResult {
-	return &ldap.SearchResult{Entries: entries}
-}
-
-func ldapEntry(dn string, attrs map[string][]string) *ldap.Entry {
-	entry := &ldap.Entry{
-		DN:         dn,
-		Attributes: make([]*ldap.EntryAttribute, 0, len(attrs)),
-	}
-
-	for name, values := range attrs {
-		entry.Attributes = append(entry.Attributes, &ldap.EntryAttribute{
-			Name:   name,
-			Values: values,
-		})
-	}
-
-	return entry
-}
-
-func usernames(users []model.User) []string {
-	result := make([]string, 0, len(users))
-	for _, user := range users {
-		result = append(result, user.Username)
-	}
-
-	return result
-}
-
-func TestGetDNProperty(t *testing.T) {
-	tests := []struct {
-		name           string
-		property       string
-		dn             string
-		expectedResult string
-	}{
-		{
-			name:           "simple case",
-			property:       "cn",
-			dn:             "cn=username,ou=people,dc=example,dc=com",
-			expectedResult: "username",
-		},
-		{
-			name:           "property not found",
-			property:       "uid",
-			dn:             "cn=username,ou=people,dc=example,dc=com",
-			expectedResult: "",
-		},
-		{
-			name:           "mixed case property",
-			property:       "CN",
-			dn:             "cn=username,ou=people,dc=example,dc=com",
-			expectedResult: "username",
-		},
-		{
-			name:           "mixed case DN",
-			property:       "cn",
-			dn:             "CN=username,OU=people,DC=example,DC=com",
-			expectedResult: "username",
-		},
-		{
-			name:           "spaces in DN",
-			property:       "cn",
-			dn:             "cn=username, ou=people, dc=example, dc=com",
-			expectedResult: "username",
-		},
-		{
-			name:           "value with special characters",
-			property:       "cn",
-			dn:             "cn=user.name+123,ou=people,dc=example,dc=com",
-			expectedResult: "user.name+123",
-		},
-		{
-			name:           "empty DN",
-			property:       "cn",
-			dn:             "",
-			expectedResult: "",
-		},
-		{
-			name:           "empty property",
-			property:       "",
-			dn:             "cn=username,ou=people,dc=example,dc=com",
-			expectedResult: "",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := getDNProperty(tt.property, tt.dn)
-			assert.Equalf(t, tt.expectedResult, result, "getDNProperty(%q, %q)", tt.property, tt.dn)
-		})
-	}
-}
-
-func TestNormalizeLDAPDN(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    string
-		expected string
-	}{
-		{
-			name:     "already normalized",
-			input:    "cn=alice,dc=example,dc=com",
-			expected: "cn=alice,dc=example,dc=com",
-		},
-		{
-			name:     "uppercase attribute types",
-			input:    "CN=Alice,DC=example,DC=com",
-			expected: "cn=alice,dc=example,dc=com",
-		},
-		{
-			name:     "spaces after commas",
-			input:    "cn=alice, dc=example, dc=com",
-			expected: "cn=alice,dc=example,dc=com",
-		},
-		{
-			name:     "uppercase types and spaces",
-			input:    "CN=Alice, DC=example, DC=com",
-			expected: "cn=alice,dc=example,dc=com",
-		},
-		{
-			name:     "multi-valued RDN",
-			input:    "cn=alice+uid=a123,dc=example,dc=com",
-			expected: "cn=alice+uid=a123,dc=example,dc=com",
-		},
-		{
-			name:     "invalid DN falls back to lowercase+trim",
-			input:    "  NOT A VALID DN  ",
-			expected: "not a valid dn",
-		},
-		{
-			name:     "empty string",
-			input:    "",
-			expected: "",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := normalizeLDAPDN(tt.input)
-			assert.Equalf(t, tt.expected, result, "normalizeLDAPDN(%q)", tt.input)
-		})
-	}
-}
-
-func TestConvertLdapIdToString(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    string
-		expected string
-	}{
-		{
-			name:     "valid UTF-8 string",
-			input:    "simple-utf8-id",
-			expected: "simple-utf8-id",
-		},
-		{
-			name:     "binary UUID (16 bytes)",
-			input:    string([]byte{0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf1}),
-			expected: "12345678-9abc-def0-1234-56789abcdef1",
-		},
-		{
-			name:     "non-UTF8, non-UUID returns base64",
-			input:    string([]byte{0xff, 0xfe, 0xfd, 0xfc}),
-			expected: "//79/A==",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := convertLdapIdToString(tt.input)
-			assert.Equal(t, tt.expected, got)
-		})
-	}
-}

backend/internal/service/user_group_service.go

@@ -110,11 +110,13 @@ func (s *UserGroupService) Delete(ctx context.Context, cfg *appconfig.AppConfigM
 }
 
 func (s *UserGroupService) Create(ctx context.Context, input dto.UserGroupCreateDto) (group model.UserGroup, err error) {
-	return s.createInternal(ctx, input, s.db)
+	return s.CreateInternal(ctx, input, s.db)
 }
 
-func (s *UserGroupService) createInternal(ctx context.Context, input dto.UserGroupCreateDto, tx *gorm.DB) (group model.UserGroup, err error) {
-	group = model.UserGroup{
+// CreateInternal creates a user group within an existing transaction
+// It's exported for the LDAP sync, which reconciles users and groups in a single transaction of its own
+func (s *UserGroupService) CreateInternal(ctx context.Context, input dto.UserGroupCreateDto, tx *gorm.DB) (model.UserGroup, error) {
+	group := model.UserGroup{
 		FriendlyName: input.FriendlyName,
 		Name:         input.Name,
 	}
@@ -123,7 +125,7 @@ func (s *UserGroupService) createInternal(ctx context.Context, input dto.UserGro
 		group.LdapID = &input.LdapID
 	}
 
-	err = tx.
+	err := tx.
 		WithContext(ctx).
 		Preload("Users").
 		Create(&group).
@@ -160,6 +162,12 @@ func (s *UserGroupService) Update(ctx context.Context, cfg *appconfig.AppConfigM
 	return group, nil
 }
 
+// UpdateInternal updates a user group within an existing transaction
+// It's exported for the LDAP sync, which reconciles users and groups in a single transaction of its own
+func (s *UserGroupService) UpdateInternal(ctx context.Context, cfg *appconfig.AppConfigModel, id string, input dto.UserGroupCreateDto, isLdapSync bool, tx *gorm.DB) (model.UserGroup, error) {
+	return s.updateInternal(ctx, id, input, isLdapSync, tx, cfg)
+}
+
 func (s *UserGroupService) updateInternal(ctx context.Context, id string, input dto.UserGroupCreateDto, isLdapSync bool, tx *gorm.DB, cfg *appconfig.AppConfigModel) (group model.UserGroup, err error) {
 	group, err = s.getInternal(ctx, id, tx)
 	if err != nil {
@@ -201,7 +209,7 @@ func (s *UserGroupService) UpdateUsers(ctx context.Context, id string, userIds [
 		tx.Rollback()
 	}()
 
-	group, err = s.updateUsersInternal(ctx, id, userIds, tx)
+	group, err = s.UpdateUsersInternal(ctx, id, userIds, tx)
 	if err != nil {
 		return model.UserGroup{}, err
 	}
@@ -214,8 +222,10 @@ func (s *UserGroupService) UpdateUsers(ctx context.Context, id string, userIds [
 	return group, nil
 }
 
-func (s *UserGroupService) updateUsersInternal(ctx context.Context, id string, userIds []string, tx *gorm.DB) (group model.UserGroup, err error) {
-	group, err = s.getInternal(ctx, id, tx)
+// UpdateUsersInternal replaces the members of a user group within an existing transaction
+// It's exported for the LDAP sync, which reconciles users and groups in a single transaction of its own
+func (s *UserGroupService) UpdateUsersInternal(ctx context.Context, id string, userIds []string, tx *gorm.DB) (model.UserGroup, error) {
+	group, err := s.getInternal(ctx, id, tx)
 	if err != nil {
 		return model.UserGroup{}, err
 	}

backend/internal/service/user_service.go

@@ -196,7 +196,7 @@ func (s *UserService) UpdateProfilePicture(ctx context.Context, userID string, f
 
 func (s *UserService) DeleteUser(ctx context.Context, dbConfig *appconfig.AppConfigModel, userID string, allowLdapDelete bool) error {
 	err := s.db.Transaction(func(tx *gorm.DB) error {
-		return s.deleteUserInternal(ctx, tx, userID, allowLdapDelete, dbConfig)
+		return s.DeleteUserInternal(ctx, dbConfig, tx, userID, allowLdapDelete)
 	})
 	if err != nil {
 		return fmt.Errorf("failed to delete user '%s': %w", userID, err)
@@ -212,7 +212,10 @@ func (s *UserService) DeleteUser(ctx context.Context, dbConfig *appconfig.AppCon
 	return nil
 }
 
-func (s *UserService) deleteUserInternal(ctx context.Context, tx *gorm.DB, userID string, allowLdapDelete bool, cfg *appconfig.AppConfigModel) error {
+// DeleteUserInternal deletes a user within an existing transaction
+// It's exported for the LDAP sync, which deletes users that are no longer in the directory
+// Note that the caller is responsible for removing the user's profile picture from the storage layer, which must happen outside of the transaction
+func (s *UserService) DeleteUserInternal(ctx context.Context, cfg *appconfig.AppConfigModel, tx *gorm.DB, userID string, allowLdapDelete bool) error {
 	var user model.User
 	err := tx.
 		WithContext(ctx).
@@ -439,7 +442,7 @@ func (s *UserService) UpdateUser(ctx context.Context, cfg *appconfig.AppConfigMo
 		tx.Rollback()
 	}()
 
-	user, err := s.updateUserInternal(ctx, userID, updatedUser, updateOwnUser, isLdapSync, tx, cfg)
+	user, err := s.UpdateUserInternal(ctx, cfg, userID, updatedUser, updateOwnUser, isLdapSync, tx)
 	if err != nil {
 		return model.User{}, err
 	}
@@ -452,7 +455,9 @@ func (s *UserService) UpdateUser(ctx context.Context, cfg *appconfig.AppConfigMo
 	return user, nil
 }
 
-func (s *UserService) updateUserInternal(ctx context.Context, userID string, updatedUser dto.UserCreateDto, updateOwnUser bool, isLdapSync bool, tx *gorm.DB, cfg *appconfig.AppConfigModel) (model.User, error) {
+// UpdateUserInternal updates a user within an existing transaction
+// It's exported for the LDAP sync, which reconciles users and groups in a single transaction of its own
+func (s *UserService) UpdateUserInternal(ctx context.Context, cfg *appconfig.AppConfigModel, userID string, updatedUser dto.UserCreateDto, updateOwnUser bool, isLdapSync bool, tx *gorm.DB) (model.User, error) {
 	if cfg.RequireUserEmail.IsTrue() && updatedUser.Email == nil {
 		return model.User{}, apperror.MissingField("email")
 	}
@@ -643,7 +648,9 @@ func (s *UserService) ResetProfilePicture(ctx context.Context, userID string) er
 	return nil
 }
 
-func (s *UserService) disableUserInternal(ctx context.Context, tx *gorm.DB, userID string) error {
+// DisableUserInternal disables a user within an existing transaction
+// It's exported for the LDAP sync, which soft-deletes users that are no longer in the directory
+func (s *UserService) DisableUserInternal(ctx context.Context, tx *gorm.DB, userID string) error {
 	err := tx.
 		WithContext(ctx).
 		Model(&model.User{}).