fix(PROJ-23): Privilege Escalation in Tenant-LDAP + Login-Reihenfolge

- BUG-1 (P0): domain_admin kann keine Rollen > auditor in default_role/
  group_mappings setzen — serverseitige Allowlist-Prüfung in
  handleSaveTenantLDAP (user/auditor) und handleAdminSaveTenantLDAP
  (user/auditor/domain_admin)
- WARN-1: Login-Fallback-Reihenfolge korrigiert — tenant_ldap wird
  jetzt VOR globalem ldap_config geprüft (Spec: tenant > global > local)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/api/ldap_tenants.go

@@ -447,6 +447,20 @@ func (s *Server) handleSaveTenantLDAP(w http.ResponseWriter, r *http.Request) {
 	}
 	cfg.TenantID = *sess.TenantID
 
+	// BUG-1 fix: domain_admin may only assign user/auditor roles — prevent privilege escalation
+	// via LDAP default_role or group_mappings even when bypassing the frontend.
+	allowedForTenantAdmin := map[string]bool{"user": true, "auditor": true}
+	if cfg.DefaultRole != "" && !allowedForTenantAdmin[cfg.DefaultRole] {
+		writeError(w, http.StatusForbidden, "role not allowed for tenant LDAP config")
+		return
+	}
+	for _, gm := range cfg.GroupMappings {
+		if !allowedForTenantAdmin[gm.Role] {
+			writeError(w, http.StatusForbidden, "group mapping role not allowed")
+			return
+		}
+	}
+
 	if err := s.tenantLdapStore.Save(r.Context(), cfg, sess.Username); err != nil {
 		writeError(w, http.StatusInternalServerError, "failed to save tenant ldap config")
 		return
@@ -575,6 +589,19 @@ func (s *Server) handleAdminSaveTenantLDAP(w http.ResponseWriter, r *http.Reques
 	}
 	cfg.TenantID = id
 
+	// superadmin may assign up to domain_admin in group mappings — not superadmin itself.
+	allowedForSuperAdmin := map[string]bool{"user": true, "auditor": true, "domain_admin": true}
+	if cfg.DefaultRole != "" && !allowedForSuperAdmin[cfg.DefaultRole] {
+		writeError(w, http.StatusForbidden, "role not allowed for tenant LDAP config")
+		return
+	}
+	for _, gm := range cfg.GroupMappings {
+		if !allowedForSuperAdmin[gm.Role] {
+			writeError(w, http.StatusForbidden, "group mapping role not allowed")
+			return
+		}
+	}
+
 	sess := sessionFromCtx(r.Context())
 	if err := s.tenantLdapStore.Save(r.Context(), cfg, sess.Username); err != nil {
 		writeError(w, http.StatusInternalServerError, "failed to save tenant ldap config")