feat: implement LDAP auth fallback in authenticate_user

tests/test_auth_service.py

@@ -67,3 +67,56 @@ def test_authenticate_no_pw_hash_no_ldap(db):
     db.add(user)
     db.commit()
     assert authenticate_user(db, "ldaponly", "any", ldap_enabled=False) is None
+
+
+# --- LDAP auth integration (uses mocked ldap_authenticate) ---
+
+from unittest.mock import patch as mock_patch
+
+
+def test_authenticate_creates_user_on_ldap_success(db):
+    ldap_attrs = {
+        "username": "newldap",
+        "full_name": "New LDAP User",
+        "department": "EFI",
+        "role": "ST",
+        "account_expires": None,
+    }
+    with mock_patch("app.modules.auth.ldap.ldap_authenticate", return_value=ldap_attrs):
+        user = authenticate_user(db, "newldap", "password", ldap_enabled=True)
+    assert user is not None
+    assert user.username == "newldap"
+    assert user.full_name == "New LDAP User"
+    assert user.last_login is not None
+
+
+def test_authenticate_updates_existing_user_on_ldap_success(db):
+    existing = User(username="existing", full_name="Old Name", pw_hash=None)
+    db.add(existing)
+    db.commit()
+    ldap_attrs = {
+        "username": "existing",
+        "full_name": "New Name",
+        "department": "EFI",
+        "role": "PF",
+        "account_expires": None,
+    }
+    with mock_patch("app.modules.auth.ldap.ldap_authenticate", return_value=ldap_attrs):
+        user = authenticate_user(db, "existing", "password", ldap_enabled=True)
+    assert user.full_name == "New Name"
+
+
+def test_authenticate_returns_none_on_ldap_failure(db):
+    with mock_patch("app.modules.auth.ldap.ldap_authenticate", return_value=None):
+        result = authenticate_user(db, "anyone", "wrong", ldap_enabled=True)
+    assert result is None
+
+
+def test_authenticate_blocked_user_not_bypassed_by_ldap(db):
+    blocked = User(username="blocked", full_name="B", pw_hash=None, is_active=False)
+    db.add(blocked)
+    db.commit()
+    ldap_attrs = {"username": "blocked", "full_name": "B", "department": "", "role": "", "account_expires": None}
+    with mock_patch("app.modules.auth.ldap.ldap_authenticate", return_value=ldap_attrs):
+        result = authenticate_user(db, "blocked", "any", ldap_enabled=True)
+    assert result is None