patrick
62c4e742ab
CRITICAL: - C-1: LDAP tls_verify Default False → True (MITM-Schutz) - C-2: TOTP-Secret Fernet-verschlüsselt in DB (statt Plaintext) - core/crypto.py: encrypt_value() / decrypt_value() helper - Migration 0026: totp_secret VARCHAR(64→500), ldap tls_verify default=true - _totp_plain() helper mit Legacy-Fallback für bestehende Werte HIGH: - H-1: Kiosk Nonce-Cache asyncio.Lock (Race Condition behoben) - H-2: File-Upload-Limit 10 MB (import_kimai.py + users.py CSV-Import) - H-3: CORS allow_methods/allow_headers explizit eingeschränkt (war *) - H-4: TrustedHostMiddleware aktiviert wenn ALLOWED_HOSTS gesetzt MEDIUM: - M-1: IP-Logging nutzt X-Forwarded-For hinter nginx-Proxy - M-4: Audit-Log für password_changed, totp_enabled, totp_disabled - M-5: CalDAV verify_ssl in Production erzwungen (_effective_verify_ssl) 152/152 Tests grün Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
61 lines
2.4 KiB
Python
61 lines
2.4 KiB
Python
import uuid
|
|
from datetime import datetime
|
|
from typing import TYPE_CHECKING
|
|
|
|
from sqlalchemy import Boolean, DateTime, ForeignKey, Integer, String, Text, func
|
|
from sqlalchemy.dialects.postgresql import UUID
|
|
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
|
|
|
from app.core.database import Base
|
|
|
|
if TYPE_CHECKING:
|
|
from app.models.company import Company
|
|
|
|
|
|
class LdapConfig(Base):
|
|
__tablename__ = "ldap_configs"
|
|
|
|
id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
|
|
company_id: Mapped[uuid.UUID] = mapped_column(
|
|
UUID(as_uuid=True), ForeignKey("companies.id", ondelete="CASCADE"),
|
|
nullable=False, unique=True, index=True
|
|
)
|
|
enabled: Mapped[bool] = mapped_column(Boolean, default=False)
|
|
|
|
# Server
|
|
host: Mapped[str] = mapped_column(String(255), nullable=False)
|
|
port: Mapped[int] = mapped_column(Integer, default=389)
|
|
use_ssl: Mapped[bool] = mapped_column(Boolean, default=False)
|
|
use_tls: Mapped[bool] = mapped_column(Boolean, default=False)
|
|
tls_verify: Mapped[bool] = mapped_column(Boolean, default=True)
|
|
|
|
# Bind credentials
|
|
bind_dn: Mapped[str] = mapped_column(Text, nullable=False)
|
|
bind_password_encrypted: Mapped[str] = mapped_column(Text, nullable=False)
|
|
|
|
# Search
|
|
base_dn: Mapped[str] = mapped_column(Text, nullable=False)
|
|
user_search_filter: Mapped[str] = mapped_column(
|
|
String(512), nullable=False, default="(objectClass=person)"
|
|
)
|
|
|
|
# Attribute mapping
|
|
attr_email: Mapped[str] = mapped_column(String(100), default="mail")
|
|
attr_firstname: Mapped[str] = mapped_column(String(100), default="givenName")
|
|
attr_lastname: Mapped[str] = mapped_column(String(100), default="sn")
|
|
attr_username: Mapped[str] = mapped_column(String(100), default="sAMAccountName")
|
|
attr_department: Mapped[str | None] = mapped_column(String(100))
|
|
attr_personnel_number: Mapped[str | None] = mapped_column(String(100))
|
|
|
|
# Sync state
|
|
last_sync_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
|
|
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
|
|
updated_at: Mapped[datetime] = mapped_column(
|
|
DateTime(timezone=True), server_default=func.now(), onupdate=func.now()
|
|
)
|
|
|
|
company: Mapped["Company"] = relationship("Company", lazy="noload")
|
|
|
|
def __repr__(self) -> str:
|
|
return f"<LdapConfig {self.host} company={self.company_id}>"
|