Restore from Gitea ZIP snapshot (12.08.2026) after full instance reinstall

Git history was lost when the previous Gitea instance was wiped and
reinstalled due to an unresolved corruption bug — this commit is the
last known-good file content, exported before the reinstall. Prior
commit history is not recoverable through this path.

src/lib/auth/ldap-config.ts

@@ -0,0 +1,81 @@
+import { eq } from "drizzle-orm";
+import { db } from "@/lib/db/client";
+import { ldapConfig } from "@/lib/db/schema";
+import { encryptCredential, decryptCredential } from "@/lib/crypto/credentials";
+
+export interface LdapSettings {
+  host: string;
+  port: number;
+  useTls: boolean;
+  bindDn: string;
+  bindPassword: string;
+  baseDn: string;
+  userFilter: string;
+  listFilter: string;
+  defaultRole: "admin" | "agent";
+}
+
+/** Settings for actually connecting — null if never configured or disabled. */
+export async function getLdapSettings(): Promise<LdapSettings | null> {
+  const config = await db.query.ldapConfig.findFirst();
+  if (!config || !config.enabled) return null;
+
+  return {
+    host: config.host,
+    port: config.port,
+    useTls: config.useTls,
+    bindDn: config.bindDn,
+    bindPassword: decryptCredential(config.bindPasswordEnc),
+    baseDn: config.baseDn,
+    userFilter: config.userFilter,
+    listFilter: config.listFilter,
+    defaultRole: config.defaultRole,
+  };
+}
+
+export async function saveLdapSettings(settings: LdapSettings): Promise<void> {
+  const row = {
+    host: settings.host,
+    port: settings.port,
+    useTls: settings.useTls,
+    bindDn: settings.bindDn,
+    bindPasswordEnc: encryptCredential(settings.bindPassword),
+    baseDn: settings.baseDn,
+    userFilter: settings.userFilter,
+    listFilter: settings.listFilter,
+    defaultRole: settings.defaultRole,
+    enabled: true,
+    verifiedAt: new Date(),
+  };
+
+  const existing = await db.query.ldapConfig.findFirst();
+  if (existing) {
+    await db.update(ldapConfig).set(row).where(eq(ldapConfig.id, existing.id));
+  } else {
+    await db.insert(ldapConfig).values(row);
+  }
+}
+
+export async function disableLdap(): Promise<void> {
+  const existing = await db.query.ldapConfig.findFirst();
+  if (existing) {
+    await db.update(ldapConfig).set({ enabled: false }).where(eq(ldapConfig.id, existing.id));
+  }
+}
+
+export async function getLdapStatus() {
+  const config = await db.query.ldapConfig.findFirst();
+  return {
+    configured: Boolean(config),
+    enabled: Boolean(config?.enabled),
+    host: config?.host ?? null,
+    port: config?.port ?? null,
+    useTls: config?.useTls ?? false,
+    bindDn: config?.bindDn ?? null,
+    baseDn: config?.baseDn ?? null,
+    userFilter: config?.userFilter ?? null,
+    listFilter: config?.listFilter ?? null,
+    defaultRole: config?.defaultRole ?? "agent",
+    verifiedAt: config?.verifiedAt?.getTime() ?? null,
+  };
+}