@@ -43,7 +46,7 @@ export function SettingsMenu() {
{open && (
- {items.map(({ href, label, icon: Icon }) => {
+ {visibleItems.map(({ href, label, icon: Icon }) => {
const active = pathname.startsWith(href);
return (
= { admin: "Администратор", agent: "Агент" };
+
+export function AccountsManager({
+ initialUsers,
+ currentUserId,
+ ldapEnabled,
+}: {
+ initialUsers: UserAccountDTO[];
+ currentUserId: string;
+ ldapEnabled: boolean;
+}) {
+ const [users, setUsers] = useState(initialUsers);
+ const [name, setName] = useState("");
+ const [email, setEmail] = useState("");
+ const [password, setPassword] = useState("");
+ const [role, setRole] = useState
("agent");
+ const [loading, setLoading] = useState(false);
+ const [error, setError] = useState(null);
+
+ const [directory, setDirectory] = useState(null);
+ const [selected, setSelected] = useState>(new Set());
+ const [directoryLoading, setDirectoryLoading] = useState(false);
+ const [directoryError, setDirectoryError] = useState(null);
+
+ async function handleCreate(e: React.FormEvent) {
+ e.preventDefault();
+ setLoading(true);
+ setError(null);
+
+ const res = await fetch("/api/users", {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify({ name, email, password, role }),
+ });
+
+ setLoading(false);
+ if (!res.ok) {
+ const data = await res.json().catch(() => null);
+ setError(data?.error ?? "Не удалось создать аккаунт");
+ return;
+ }
+
+ const { user } = await res.json();
+ setUsers((prev) => [...prev, user].sort((a, b) => a.name.localeCompare(b.name)));
+ setName("");
+ setEmail("");
+ setPassword("");
+ setRole("agent");
+ }
+
+ async function handleRoleChange(id: string, newRole: UserAccountDTO["role"]) {
+ setError(null);
+ const res = await fetch(`/api/users/${id}`, {
+ method: "PATCH",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify({ role: newRole }),
+ });
+ if (!res.ok) {
+ const data = await res.json().catch(() => null);
+ setError(data?.error ?? "Не удалось изменить роль");
+ return;
+ }
+ const { user } = await res.json();
+ setUsers((prev) => prev.map((u) => (u.id === id ? user : u)));
+ }
+
+ async function handleDelete(id: string) {
+ setError(null);
+ const res = await fetch(`/api/users/${id}`, { method: "DELETE" });
+ if (!res.ok) {
+ const data = await res.json().catch(() => null);
+ setError(data?.error ?? "Не удалось удалить аккаунт");
+ return;
+ }
+ setUsers((prev) => prev.filter((u) => u.id !== id));
+ }
+
+ async function loadDirectory() {
+ setDirectoryLoading(true);
+ setDirectoryError(null);
+ const res = await fetch("/api/ldap/directory");
+ setDirectoryLoading(false);
+ if (!res.ok) {
+ const data = await res.json().catch(() => null);
+ setDirectoryError(data?.error ?? "Не удалось получить список из LDAP");
+ return;
+ }
+ const data = await res.json();
+ setDirectory(data.entries);
+ setSelected(new Set());
+ }
+
+ function toggleSelected(email: string) {
+ setSelected((prev) => {
+ const next = new Set(prev);
+ if (next.has(email)) next.delete(email);
+ else next.add(email);
+ return next;
+ });
+ }
+
+ async function handleImport() {
+ if (selected.size === 0) return;
+ setDirectoryLoading(true);
+ setDirectoryError(null);
+
+ const res = await fetch("/api/ldap/directory/import", {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify({ emails: Array.from(selected) }),
+ });
+
+ setDirectoryLoading(false);
+ if (!res.ok) {
+ const data = await res.json().catch(() => null);
+ setDirectoryError(data?.error ?? "Не удалось импортировать");
+ return;
+ }
+
+ const usersRes = await fetch("/api/users");
+ if (usersRes.ok) {
+ const { users: fresh } = await usersRes.json();
+ setUsers(fresh);
+ }
+ setDirectory((prev) => (prev ? prev.filter((e) => !selected.has(e.email)) : prev));
+ setSelected(new Set());
+ }
+
+ return (
+
+
+
+
+
Аккаунты ({users.length})
+
+ {users.map((u) => (
+
+
+
+ {u.authSource === "ldap" ? "LDAP" : "Локальный"}
+
+
handleRoleChange(u.id, e.target.value as UserAccountDTO["role"])}
+ className="rounded-md border border-border bg-surface px-2 py-1 text-sm outline-none focus:border-accent"
+ >
+ {ROLE_LABELS.agent}
+ {ROLE_LABELS.admin}
+
+
handleDelete(u.id)}
+ disabled={u.id === currentUserId}
+ title={u.id === currentUserId ? "Нельзя удалить собственный аккаунт" : "Удалить"}
+ className="btn btn-ghost text-danger disabled:opacity-30"
+ >
+
+
+ ))}
+
+
+
+
+
Импорт из LDAP
+ {!ldapEnabled ? (
+
+ LDAP не подключён — настройте его на странице «LDAP», чтобы импортировать аккаунты из каталога.
+
+ ) : (
+ <>
+
Найдите аккаунты из каталога, которых ещё нет в системе.
+
+
+
+ {directoryError && (
+
{directoryError}
+ )}
+
+ {directory && (
+ <>
+ {directory.length === 0 ? (
+
Новых аккаунтов не найдено — всё уже импортировано.
+ ) : (
+
+ {directory.map((entry) => (
+
+ {entry.name}
+ {entry.email}
+
+ ))}
+
+ )}
+ {directory.length > 0 && (
+
+ Импортировать выбранные ({selected.size})
+
+ )}
+
+ )}
+
+ )}
+
+
+
Аккаунты
+
+ Управление аккаунтами агентов и администраторов — создание вручную и импорт из LDAP.
+
+
+
(null);
+
+ async function handleConnect(e: React.FormEvent) {
+ e.preventDefault();
+ setLoading(true);
+ setError(null);
+
+ const res = await fetch("/api/ldap/config", {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify({
+ host,
+ port: Number(port),
+ useTls,
+ bindDn,
+ bindPassword,
+ baseDn,
+ userFilter,
+ listFilter,
+ defaultRole,
+ }),
+ });
+
+ setLoading(false);
+ if (!res.ok) {
+ const data = await res.json().catch(() => null);
+ setError(data?.error ?? "Не удалось подключить LDAP");
+ return;
+ }
+
+ setStatus({
+ configured: true,
+ enabled: true,
+ host,
+ port: Number(port),
+ useTls,
+ bindDn,
+ baseDn,
+ userFilter,
+ listFilter,
+ defaultRole,
+ verifiedAt: Date.now(),
+ });
+ setBindPassword("");
+ }
+
+ async function handleDisable() {
+ setLoading(true);
+ await fetch("/api/ldap/config", { method: "DELETE" });
+ setLoading(false);
+ setStatus((s) => ({ ...s, enabled: false }));
+ }
+
+ return (
+
+
+ {status.enabled ? (
+ <>
+ Подключено: {status.host}
+
+ ) : (
+ <>
+ LDAP не подключён
+
+ )}
+
+
+
+
+
LDAP
+
+ Подключите каталог LDAP/AD — вход будет сначала пробовать LDAP, а при неудаче откатываться на локальный
+ пароль. Пока LDAP не подключён, локальный вход работает как обычно.
+
+
+
{
+ const config = await db.query.ldapConfig.findFirst();
+ if (!config || !config.enabled) return null;
+
+ return {
+ host: config.host,
+ port: config.port,
+ useTls: config.useTls,
+ bindDn: config.bindDn,
+ bindPassword: decryptCredential(config.bindPasswordEnc),
+ baseDn: config.baseDn,
+ userFilter: config.userFilter,
+ listFilter: config.listFilter,
+ defaultRole: config.defaultRole,
+ };
+}
+
+export async function saveLdapSettings(settings: LdapSettings): Promise {
+ const row = {
+ host: settings.host,
+ port: settings.port,
+ useTls: settings.useTls,
+ bindDn: settings.bindDn,
+ bindPasswordEnc: encryptCredential(settings.bindPassword),
+ baseDn: settings.baseDn,
+ userFilter: settings.userFilter,
+ listFilter: settings.listFilter,
+ defaultRole: settings.defaultRole,
+ enabled: true,
+ verifiedAt: new Date(),
+ };
+
+ const existing = await db.query.ldapConfig.findFirst();
+ if (existing) {
+ await db.update(ldapConfig).set(row).where(eq(ldapConfig.id, existing.id));
+ } else {
+ await db.insert(ldapConfig).values(row);
+ }
+}
+
+export async function disableLdap(): Promise {
+ const existing = await db.query.ldapConfig.findFirst();
+ if (existing) {
+ await db.update(ldapConfig).set({ enabled: false }).where(eq(ldapConfig.id, existing.id));
+ }
+}
+
+export async function getLdapStatus() {
+ const config = await db.query.ldapConfig.findFirst();
+ return {
+ configured: Boolean(config),
+ enabled: Boolean(config?.enabled),
+ host: config?.host ?? null,
+ port: config?.port ?? null,
+ useTls: config?.useTls ?? false,
+ bindDn: config?.bindDn ?? null,
+ baseDn: config?.baseDn ?? null,
+ userFilter: config?.userFilter ?? null,
+ listFilter: config?.listFilter ?? null,
+ defaultRole: config?.defaultRole ?? "agent",
+ verifiedAt: config?.verifiedAt?.getTime() ?? null,
+ };
+}
diff --git a/src/lib/auth/require.ts b/src/lib/auth/require.ts
index dec6b2e..a1048aa 100644
--- a/src/lib/auth/require.ts
+++ b/src/lib/auth/require.ts
@@ -9,3 +9,15 @@ export async function requireSession() {
}
return { session, response: null };
}
+
+/** Same as requireSession, but also requires role === "admin" — for account/LDAP management. */
+export async function requireAdminSession() {
+ const session = await getCurrentSession();
+ if (!session) {
+ return { session: null, response: NextResponse.json({ error: "Unauthorized" }, { status: 401 }) };
+ }
+ if (session.user.role !== "admin") {
+ return { session: null, response: NextResponse.json({ error: "Forbidden" }, { status: 403 }) };
+ }
+ return { session, response: null };
+}
diff --git a/src/lib/auth/users.ts b/src/lib/auth/users.ts
new file mode 100644
index 0000000..f861f2f
--- /dev/null
+++ b/src/lib/auth/users.ts
@@ -0,0 +1,105 @@
+import { eq, ne, and, count } from "drizzle-orm";
+import { db } from "@/lib/db/client";
+import { users } from "@/lib/db/schema";
+import { hashPassword } from "@/lib/auth/password";
+
+export interface UserAccountDTO {
+ id: string;
+ name: string;
+ email: string;
+ role: "admin" | "agent";
+ authSource: "local" | "ldap";
+ createdAt: number;
+}
+
+function toUserDTO(user: typeof users.$inferSelect): UserAccountDTO {
+ return {
+ id: user.id,
+ name: user.name,
+ email: user.email,
+ role: user.role,
+ authSource: user.authSource,
+ createdAt: user.createdAt.getTime(),
+ };
+}
+
+export async function listUsers(): Promise {
+ const rows = await db.query.users.findMany({ orderBy: users.name });
+ return rows.map(toUserDTO);
+}
+
+export async function createLocalUser(params: {
+ name: string;
+ email: string;
+ password: string;
+ role: "admin" | "agent";
+}): Promise {
+ const passwordHash = await hashPassword(params.password);
+ const [user] = await db
+ .insert(users)
+ .values({
+ name: params.name,
+ email: params.email.toLowerCase().trim(),
+ passwordHash,
+ role: params.role,
+ authSource: "local",
+ })
+ .returning();
+ return toUserDTO(user);
+}
+
+async function adminCount(excludingUserId?: string): Promise {
+ const where = excludingUserId
+ ? and(eq(users.role, "admin"), ne(users.id, excludingUserId))
+ : eq(users.role, "admin");
+ const [row] = await db.select({ n: count() }).from(users).where(where);
+ return row?.n ?? 0;
+}
+
+export async function updateUserRole(id: string, role: "admin" | "agent"): Promise {
+ if (role === "agent") {
+ // Demoting the last admin would lock everyone out of admin-only pages.
+ const remainingAdmins = await adminCount(id);
+ const target = await db.query.users.findFirst({ where: eq(users.id, id) });
+ if (target?.role === "admin" && remainingAdmins === 0) {
+ throw new Error("Нельзя понизить последнего администратора");
+ }
+ }
+
+ const [user] = await db.update(users).set({ role }).where(eq(users.id, id)).returning();
+ return toUserDTO(user);
+}
+
+export async function deleteUser(id: string): Promise {
+ const target = await db.query.users.findFirst({ where: eq(users.id, id) });
+ if (target?.role === "admin") {
+ const remainingAdmins = await adminCount(id);
+ if (remainingAdmins === 0) {
+ throw new Error("Нельзя удалить последнего администратора");
+ }
+ }
+ await db.delete(users).where(eq(users.id, id));
+}
+
+/** JIT-provisions a local account for a successful LDAP login — never touched again on subsequent logins. */
+export async function findOrCreateUserFromLdap(params: {
+ email: string;
+ name: string;
+ defaultRole: "admin" | "agent";
+}): Promise {
+ const normalized = params.email.toLowerCase().trim();
+ const existing = await db.query.users.findFirst({ where: eq(users.email, normalized) });
+ if (existing) return existing;
+
+ const [user] = await db
+ .insert(users)
+ .values({
+ name: params.name,
+ email: normalized,
+ passwordHash: null,
+ role: params.defaultRole,
+ authSource: "ldap",
+ })
+ .returning();
+ return user;
+}
diff --git a/src/lib/db/migrations/0005_colorful_gorilla_man.sql b/src/lib/db/migrations/0005_colorful_gorilla_man.sql
new file mode 100644
index 0000000..b5248be
--- /dev/null
+++ b/src/lib/db/migrations/0005_colorful_gorilla_man.sql
@@ -0,0 +1,32 @@
+CREATE TABLE `ldap_config` (
+ `id` text PRIMARY KEY NOT NULL,
+ `host` text NOT NULL,
+ `port` integer DEFAULT 389 NOT NULL,
+ `use_tls` integer DEFAULT false NOT NULL,
+ `bind_dn` text NOT NULL,
+ `bind_password_enc` text NOT NULL,
+ `base_dn` text NOT NULL,
+ `user_filter` text DEFAULT '(mail={{email}})' NOT NULL,
+ `list_filter` text DEFAULT '(objectClass=person)' NOT NULL,
+ `default_role` text DEFAULT 'agent' NOT NULL,
+ `enabled` integer DEFAULT false NOT NULL,
+ `verified_at` integer,
+ `created_at` integer DEFAULT (unixepoch('subsec') * 1000) NOT NULL
+);
+--> statement-breakpoint
+PRAGMA foreign_keys=OFF;--> statement-breakpoint
+CREATE TABLE `__new_users` (
+ `id` text PRIMARY KEY NOT NULL,
+ `email` text NOT NULL,
+ `password_hash` text,
+ `name` text NOT NULL,
+ `role` text DEFAULT 'agent' NOT NULL,
+ `auth_source` text DEFAULT 'local' NOT NULL,
+ `created_at` integer DEFAULT (unixepoch('subsec') * 1000) NOT NULL
+);
+--> statement-breakpoint
+INSERT INTO `__new_users`("id", "email", "password_hash", "name", "role", "created_at") SELECT "id", "email", "password_hash", "name", "role", "created_at" FROM `users`;--> statement-breakpoint
+DROP TABLE `users`;--> statement-breakpoint
+ALTER TABLE `__new_users` RENAME TO `users`;--> statement-breakpoint
+PRAGMA foreign_keys=ON;--> statement-breakpoint
+CREATE UNIQUE INDEX `users_email_unique` ON `users` (`email`);
\ No newline at end of file
diff --git a/src/lib/db/migrations/meta/0005_snapshot.json b/src/lib/db/migrations/meta/0005_snapshot.json
new file mode 100644
index 0000000..eea0610
--- /dev/null
+++ b/src/lib/db/migrations/meta/0005_snapshot.json
@@ -0,0 +1,953 @@
+{
+ "version": "6",
+ "dialect": "sqlite",
+ "id": "980ae196-7c18-498e-87e9-34feba13f92d",
+ "prevId": "c974991b-5c77-4525-a20c-91b3b31a7a70",
+ "tables": {
+ "attachments": {
+ "name": "attachments",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "message_id": {
+ "name": "message_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "filename": {
+ "name": "filename",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "mime_type": {
+ "name": "mime_type",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "size_bytes": {
+ "name": "size_bytes",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "storage_key": {
+ "name": "storage_key",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {
+ "attachments_message_id_messages_id_fk": {
+ "name": "attachments_message_id_messages_id_fk",
+ "tableFrom": "attachments",
+ "tableTo": "messages",
+ "columnsFrom": [
+ "message_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "checkConstraints": {}
+ },
+ "canned_responses": {
+ "name": "canned_responses",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "title": {
+ "name": "title",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "body": {
+ "name": "body",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "checkConstraints": {}
+ },
+ "customers": {
+ "name": "customers",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "display_name": {
+ "name": "display_name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "email": {
+ "name": "email",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false,
+ "autoincrement": false
+ },
+ "telegram_chat_id": {
+ "name": "telegram_chat_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false,
+ "autoincrement": false
+ },
+ "portal_token": {
+ "name": "portal_token",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ }
+ },
+ "indexes": {
+ "customers_telegram_chat_id_unique": {
+ "name": "customers_telegram_chat_id_unique",
+ "columns": [
+ "telegram_chat_id"
+ ],
+ "isUnique": true
+ },
+ "customers_portal_token_unique": {
+ "name": "customers_portal_token_unique",
+ "columns": [
+ "portal_token"
+ ],
+ "isUnique": true
+ }
+ },
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "checkConstraints": {}
+ },
+ "ldap_config": {
+ "name": "ldap_config",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "host": {
+ "name": "host",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "port": {
+ "name": "port",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": 389
+ },
+ "use_tls": {
+ "name": "use_tls",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": false
+ },
+ "bind_dn": {
+ "name": "bind_dn",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "bind_password_enc": {
+ "name": "bind_password_enc",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "base_dn": {
+ "name": "base_dn",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "user_filter": {
+ "name": "user_filter",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "'(mail={{email}})'"
+ },
+ "list_filter": {
+ "name": "list_filter",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "'(objectClass=person)'"
+ },
+ "default_role": {
+ "name": "default_role",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "'agent'"
+ },
+ "enabled": {
+ "name": "enabled",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": false
+ },
+ "verified_at": {
+ "name": "verified_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": false,
+ "autoincrement": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "checkConstraints": {}
+ },
+ "mailbox_config": {
+ "name": "mailbox_config",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "imap_host": {
+ "name": "imap_host",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "imap_port": {
+ "name": "imap_port",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": 993
+ },
+ "smtp_host": {
+ "name": "smtp_host",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "smtp_port": {
+ "name": "smtp_port",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": 587
+ },
+ "user": {
+ "name": "user",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "password_enc": {
+ "name": "password_enc",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "allow_insecure_tls": {
+ "name": "allow_insecure_tls",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": false
+ },
+ "enabled": {
+ "name": "enabled",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": false
+ },
+ "verified_at": {
+ "name": "verified_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": false,
+ "autoincrement": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "checkConstraints": {}
+ },
+ "messages": {
+ "name": "messages",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "ticket_id": {
+ "name": "ticket_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "author_type": {
+ "name": "author_type",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "author_id": {
+ "name": "author_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false,
+ "autoincrement": false
+ },
+ "author_name": {
+ "name": "author_name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "body": {
+ "name": "body",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "direction": {
+ "name": "direction",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "visibility": {
+ "name": "visibility",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "'public'"
+ },
+ "email_message_id": {
+ "name": "email_message_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false,
+ "autoincrement": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {
+ "messages_ticket_id_tickets_id_fk": {
+ "name": "messages_ticket_id_tickets_id_fk",
+ "tableFrom": "messages",
+ "tableTo": "tickets",
+ "columnsFrom": [
+ "ticket_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "checkConstraints": {}
+ },
+ "sessions": {
+ "name": "sessions",
+ "columns": {
+ "token_hash": {
+ "name": "token_hash",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "user_id": {
+ "name": "user_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "expires_at": {
+ "name": "expires_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {
+ "sessions_user_id_users_id_fk": {
+ "name": "sessions_user_id_users_id_fk",
+ "tableFrom": "sessions",
+ "tableTo": "users",
+ "columnsFrom": [
+ "user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "checkConstraints": {}
+ },
+ "tags": {
+ "name": "tags",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "name": {
+ "name": "name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "color": {
+ "name": "color",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "'accent'"
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ }
+ },
+ "indexes": {
+ "tags_name_unique": {
+ "name": "tags_name_unique",
+ "columns": [
+ "name"
+ ],
+ "isUnique": true
+ }
+ },
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "checkConstraints": {}
+ },
+ "telegram_config": {
+ "name": "telegram_config",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "bot_token_enc": {
+ "name": "bot_token_enc",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "bot_username": {
+ "name": "bot_username",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false,
+ "autoincrement": false
+ },
+ "enabled": {
+ "name": "enabled",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": false
+ },
+ "verified_at": {
+ "name": "verified_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": false,
+ "autoincrement": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "checkConstraints": {}
+ },
+ "ticket_tags": {
+ "name": "ticket_tags",
+ "columns": {
+ "ticket_id": {
+ "name": "ticket_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "tag_id": {
+ "name": "tag_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {
+ "ticket_tags_ticket_id_tickets_id_fk": {
+ "name": "ticket_tags_ticket_id_tickets_id_fk",
+ "tableFrom": "ticket_tags",
+ "tableTo": "tickets",
+ "columnsFrom": [
+ "ticket_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ },
+ "ticket_tags_tag_id_tags_id_fk": {
+ "name": "ticket_tags_tag_id_tags_id_fk",
+ "tableFrom": "ticket_tags",
+ "tableTo": "tags",
+ "columnsFrom": [
+ "tag_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {
+ "ticket_tags_ticket_id_tag_id_pk": {
+ "columns": [
+ "ticket_id",
+ "tag_id"
+ ],
+ "name": "ticket_tags_ticket_id_tag_id_pk"
+ }
+ },
+ "uniqueConstraints": {},
+ "checkConstraints": {}
+ },
+ "tickets": {
+ "name": "tickets",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "subject": {
+ "name": "subject",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "status": {
+ "name": "status",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "'new'"
+ },
+ "priority": {
+ "name": "priority",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "'normal'"
+ },
+ "channel": {
+ "name": "channel",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "customer_id": {
+ "name": "customer_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "assignee_id": {
+ "name": "assignee_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false,
+ "autoincrement": false
+ },
+ "last_message_at": {
+ "name": "last_message_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {
+ "tickets_customer_id_customers_id_fk": {
+ "name": "tickets_customer_id_customers_id_fk",
+ "tableFrom": "tickets",
+ "tableTo": "customers",
+ "columnsFrom": [
+ "customer_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ },
+ "tickets_assignee_id_users_id_fk": {
+ "name": "tickets_assignee_id_users_id_fk",
+ "tableFrom": "tickets",
+ "tableTo": "users",
+ "columnsFrom": [
+ "assignee_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "checkConstraints": {}
+ },
+ "users": {
+ "name": "users",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "email": {
+ "name": "email",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "password_hash": {
+ "name": "password_hash",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false,
+ "autoincrement": false
+ },
+ "name": {
+ "name": "name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "role": {
+ "name": "role",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "'agent'"
+ },
+ "auth_source": {
+ "name": "auth_source",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "'local'"
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ }
+ },
+ "indexes": {
+ "users_email_unique": {
+ "name": "users_email_unique",
+ "columns": [
+ "email"
+ ],
+ "isUnique": true
+ }
+ },
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "checkConstraints": {}
+ },
+ "widget_sites": {
+ "name": "widget_sites",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "site_key": {
+ "name": "site_key",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "name": {
+ "name": "name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false
+ },
+ "allowed_origin": {
+ "name": "allowed_origin",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false,
+ "autoincrement": false
+ },
+ "enabled": {
+ "name": "enabled",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": true
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "autoincrement": false,
+ "default": "(unixepoch('subsec') * 1000)"
+ }
+ },
+ "indexes": {
+ "widget_sites_site_key_unique": {
+ "name": "widget_sites_site_key_unique",
+ "columns": [
+ "site_key"
+ ],
+ "isUnique": true
+ }
+ },
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "checkConstraints": {}
+ }
+ },
+ "views": {},
+ "enums": {},
+ "_meta": {
+ "schemas": {},
+ "tables": {},
+ "columns": {}
+ },
+ "internal": {
+ "indexes": {}
+ }
+}
\ No newline at end of file
diff --git a/src/lib/db/migrations/meta/_journal.json b/src/lib/db/migrations/meta/_journal.json
index ac7e9ca..4355c22 100644
--- a/src/lib/db/migrations/meta/_journal.json
+++ b/src/lib/db/migrations/meta/_journal.json
@@ -36,6 +36,13 @@
"when": 1785085538509,
"tag": "0004_familiar_kronos",
"breakpoints": true
+ },
+ {
+ "idx": 5,
+ "version": "6",
+ "when": 1785138258070,
+ "tag": "0005_colorful_gorilla_man",
+ "breakpoints": true
}
]
}
\ No newline at end of file
diff --git a/src/lib/db/schema.ts b/src/lib/db/schema.ts
index 2a2d377..20e205d 100644
--- a/src/lib/db/schema.ts
+++ b/src/lib/db/schema.ts
@@ -20,11 +20,16 @@ const timestamps = {
export const users = sqliteTable("users", {
id: id(),
email: text("email").notNull().unique(),
- passwordHash: text("password_hash").notNull(),
+ // Null for LDAP-provisioned accounts — they have no local password, and
+ // the login route must never pass null into argon2's verify.
+ passwordHash: text("password_hash"),
name: text("name").notNull(),
role: text("role", { enum: ["admin", "agent"] })
.notNull()
.default("agent"),
+ authSource: text("auth_source", { enum: ["local", "ldap"] })
+ .notNull()
+ .default("local"),
createdAt: timestamps.createdAt,
});
@@ -127,6 +132,27 @@ export const mailboxConfig = sqliteTable("mailbox_config", {
createdAt: timestamps.createdAt,
});
+/** Single-row-ish config for LDAP login (one directory per deployment). */
+export const ldapConfig = sqliteTable("ldap_config", {
+ id: id(),
+ host: text("host").notNull(),
+ port: integer("port").notNull().default(389),
+ useTls: integer("use_tls", { mode: "boolean" }).notNull().default(false),
+ bindDn: text("bind_dn").notNull(),
+ bindPasswordEnc: text("bind_password_enc").notNull(),
+ baseDn: text("base_dn").notNull(),
+ // "{{email}}" is substituted with the login email at auth time.
+ userFilter: text("user_filter").notNull().default("(mail={{email}})"),
+ // Broader filter used only by the "browse directory to import" admin UI.
+ listFilter: text("list_filter").notNull().default("(objectClass=person)"),
+ defaultRole: text("default_role", { enum: ["admin", "agent"] })
+ .notNull()
+ .default("agent"),
+ enabled: integer("enabled", { mode: "boolean" }).notNull().default(false),
+ verifiedAt: integer("verified_at", { mode: "timestamp_ms" }),
+ createdAt: timestamps.createdAt,
+});
+
/** A site the chat widget is embedded on. Public, non-secret identifier — labels ticket origin, not a trust boundary. */
export const widgetSites = sqliteTable("widget_sites", {
id: id(),
diff --git a/src/lib/ldap/client.ts b/src/lib/ldap/client.ts
new file mode 100644
index 0000000..2f30512
--- /dev/null
+++ b/src/lib/ldap/client.ts
@@ -0,0 +1,137 @@
+import ldap from "ldapjs";
+import { getLdapSettings } from "@/lib/auth/ldap-config";
+
+export interface LdapUserInfo {
+ dn: string;
+ email: string;
+ name: string;
+}
+
+interface ConnectionSettings {
+ host: string;
+ port: number;
+ useTls: boolean;
+}
+
+function createLdapClient(settings: ConnectionSettings): ldap.Client {
+ const protocol = settings.useTls ? "ldaps" : "ldap";
+ const client = ldap.createClient({
+ url: `${protocol}://${settings.host}:${settings.port}`,
+ timeout: 5_000,
+ connectTimeout: 5_000,
+ });
+ // A socket-level error (e.g. host unreachable) with no listener would
+ // throw and crash the process — swallow it here, every call site already
+ // handles failure via the bind/search callback's error argument.
+ client.on("error", () => {});
+ return client;
+}
+
+function bind(client: ldap.Client, dn: string, password: string): Promise {
+ return new Promise((resolve, reject) => {
+ client.bind(dn, password, (err) => (err ? reject(err) : resolve()));
+ });
+}
+
+function search(
+ client: ldap.Client,
+ baseDn: string,
+ filter: string,
+): Promise<{ dn: string; attributes: Record }[]> {
+ return new Promise((resolve, reject) => {
+ const results: { dn: string; attributes: Record }[] = [];
+ client.search(baseDn, { filter, scope: "sub" }, (err, res) => {
+ if (err) {
+ reject(err);
+ return;
+ }
+ res.on("searchEntry", (entry) => {
+ const attributes: Record = {};
+ for (const attr of entry.pojo.attributes) {
+ attributes[attr.type] = attr.values[0] ?? "";
+ }
+ results.push({ dn: entry.objectName ?? entry.pojo.objectName, attributes });
+ });
+ res.on("error", (searchErr) => reject(searchErr));
+ res.on("end", () => resolve(results));
+ });
+ });
+}
+
+function unbindQuietly(client: ldap.Client): void {
+ client.unbind(() => {});
+}
+
+/** Escapes an untrusted value for safe interpolation into an LDAP search filter (RFC 4515). */
+function escapeFilterValue(value: string): string {
+ return value.replace(/[\\*()\0]/g, (c) => `\\${c.charCodeAt(0).toString(16).padStart(2, "0")}`);
+}
+
+/** Binds with the service account only — used to validate settings before saving. Throws on failure. */
+export async function testLdapBind(settings: ConnectionSettings & { bindDn: string; bindPassword: string }): Promise {
+ const client = createLdapClient(settings);
+ try {
+ await bind(client, settings.bindDn, settings.bindPassword);
+ } finally {
+ unbindQuietly(client);
+ }
+}
+
+/**
+ * Search-then-bind: finds the user by userFilter, then re-binds as their
+ * own DN with the supplied password to actually verify it. Every failure
+ * mode (not configured, disabled, unreachable, no match, wrong password)
+ * normalizes to null — a directory outage must never break local login.
+ */
+export async function authenticateLdapUser(email: string, password: string): Promise {
+ const settings = await getLdapSettings();
+ if (!settings) return null;
+
+ const serviceClient = createLdapClient(settings);
+ try {
+ await bind(serviceClient, settings.bindDn, settings.bindPassword);
+ const filter = settings.userFilter.replace("{{email}}", escapeFilterValue(email));
+ const entries = await search(serviceClient, settings.baseDn, filter);
+
+ const match = entries[0];
+ if (!match) return null;
+
+ const userClient = createLdapClient(settings);
+ try {
+ await bind(userClient, match.dn, password);
+ } finally {
+ unbindQuietly(userClient);
+ }
+
+ return {
+ dn: match.dn,
+ email: match.attributes.mail || email,
+ name: match.attributes.cn || match.attributes.displayName || email,
+ };
+ } catch {
+ return null;
+ } finally {
+ unbindQuietly(serviceClient);
+ }
+}
+
+/** Broad directory browse (listFilter) for the "import accounts from LDAP" admin UI. */
+export async function searchLdapDirectory(): Promise {
+ const settings = await getLdapSettings();
+ if (!settings) return [];
+
+ const client = createLdapClient(settings);
+ try {
+ await bind(client, settings.bindDn, settings.bindPassword);
+ const entries = await search(client, settings.baseDn, settings.listFilter);
+ return entries
+ .filter((e) => e.attributes.mail)
+ .map((e) => ({
+ dn: e.dn,
+ email: e.attributes.mail,
+ name: e.attributes.cn || e.attributes.displayName || e.attributes.mail,
+ }));
+ } finally {
+ unbindQuietly(client);
+ }
+}