feat: add LDAP support and guest user functionality

- Introduced BaseDN configuration for LDAP in the config.
- Enhanced User model to include IsLDAP field.
- Updated database queries to handle LDAP users.
- Implemented GraphQL queries for LDAP browsing and user authentication type.
- Added ACL management for users and groups, including guest user permissions.
- Updated frontend to support LDAP login and guest user login.
- Improved error handling and user feedback in login and ACL management.

backend/internal/db/db.go

@@ -18,6 +18,7 @@ type User struct {
 	Username  string
 	PassHash  string
 	Role      string
+	IsLDAP    bool
 	CreatedAt time.Time
 }
 
@@ -107,12 +108,12 @@ func (d *DB) CreateUser(username, passHash, role string) error {
 // GetUser fetches a single user by username.
 func (d *DB) GetUser(username string) (*User, error) {
 	row := d.sql.QueryRow(
-		`SELECT id, username, pass_hash, role, created_at FROM users WHERE username = ?`,
+		`SELECT id, username, pass_hash, role, is_ldap, created_at FROM users WHERE username = ?`,
 		username,
 	)
 	u := &User{}
 	var createdAt string
-	err := row.Scan(&u.ID, &u.Username, &u.PassHash, &u.Role, &createdAt)
+	err := row.Scan(&u.ID, &u.Username, &u.PassHash, &u.Role, &u.IsLDAP, &createdAt)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, ErrUserNotFound
 	}
@@ -126,7 +127,7 @@ func (d *DB) GetUser(username string) (*User, error) {
 // ListUsers returns all users ordered by id.
 func (d *DB) ListUsers() ([]*User, error) {
 	rows, err := d.sql.Query(
-		`SELECT id, username, role, created_at FROM users ORDER BY id`,
+		`SELECT id, username, role, is_ldap, created_at FROM users ORDER BY id`,
 	)
 	if err != nil {
 		return nil, err
@@ -137,7 +138,7 @@ func (d *DB) ListUsers() ([]*User, error) {
 	for rows.Next() {
 		u := &User{}
 		var createdAt string
-		if err := rows.Scan(&u.ID, &u.Username, &u.Role, &createdAt); err != nil {
+		if err := rows.Scan(&u.ID, &u.Username, &u.Role, &u.IsLDAP, &createdAt); err != nil {
 			return nil, err
 		}
 		u.CreatedAt, _ = time.Parse("2006-01-02 15:04:05", createdAt)
@@ -185,11 +186,14 @@ func (d *DB) UserCount() (int, error) {
 // --- LDAP & Roles ---
 
 // CreateOrUpdateLDAPUser inserts or updates an LDAP user (without password, role='user').
+// Existing accounts with a non-empty pass_hash are never overwritten so that
+// a local admin cannot be accidentally converted to an LDAP-only account.
 func (d *DB) CreateOrUpdateLDAPUser(username string) error {
 	_, err := d.sql.Exec(`
 		INSERT INTO users (username, pass_hash, role, is_ldap) 
 		VALUES (?, '', 'user', 1)
-		ON CONFLICT(username) DO UPDATE SET is_ldap=1;
+		ON CONFLICT(username) DO UPDATE SET is_ldap=1
+		WHERE excluded.pass_hash = '' AND pass_hash = '';
 	`, username)
 	return err
 }
@@ -274,3 +278,89 @@ func (d *DB) GetACLsForPath(path string) ([]ACLEntry, error) {
 	}
 	return entries, nil
 }
+
+// Group represents a group stored in SQLite.
+type Group struct {
+	ID     int64
+	Name   string
+	IsLDAP bool
+}
+
+// ListGroups returns all groups ordered by name.
+func (d *DB) ListGroups() ([]*Group, error) {
+	rows, err := d.sql.Query(`SELECT id, name, is_ldap FROM groups ORDER BY name`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var groups []*Group
+	for rows.Next() {
+		g := &Group{}
+		if err := rows.Scan(&g.ID, &g.Name, &g.IsLDAP); err != nil {
+			return nil, err
+		}
+		groups = append(groups, g)
+	}
+	return groups, rows.Err()
+}
+
+// EnsureGuestUser creates the built-in guest account if it does not already exist.
+func (d *DB) EnsureGuestUser() error {
+	_, err := d.sql.Exec(`
+		INSERT INTO users (username, pass_hash, role) VALUES ('guest', '', 'guest')
+		ON CONFLICT(username) DO NOTHING;
+	`)
+	return err
+}
+
+// CanUserReadPath returns true if the given username has can_read access on the
+// exact path or any of its ancestor folder paths.
+func (d *DB) CanUserReadPath(username, path string) bool {
+	// Build a list of candidate paths: the path itself and each parent segment.
+	candidates := pathAncestors(path)
+	for _, p := range candidates {
+		var n int
+		d.sql.QueryRow(`
+			SELECT COUNT(*) FROM acl
+			JOIN users ON users.id = acl.subject_id AND acl.subject_type = 'user'
+			WHERE users.username = ? AND acl.path = ? AND acl.can_read = 1
+		`, username, p).Scan(&n)
+		if n > 0 {
+			return true
+		}
+	}
+	return false
+}
+
+// CanUserViewPath returns true if the given username has can_view access on the
+// exact path or any of its ancestor folder paths.
+func (d *DB) CanUserViewPath(username, path string) bool {
+	candidates := pathAncestors(path)
+	for _, p := range candidates {
+		var n int
+		d.sql.QueryRow(`
+			SELECT COUNT(*) FROM acl
+			JOIN users ON users.id = acl.subject_id AND acl.subject_type = 'user'
+			WHERE users.username = ? AND acl.path = ? AND acl.can_view = 1
+		`, username, p).Scan(&n)
+		if n > 0 {
+			return true
+		}
+	}
+	return false
+}
+
+// pathAncestors returns the path and all its parent segments.
+// e.g. "a/b/c" → ["a/b/c", "a/b", "a"]
+func pathAncestors(path string) []string {
+	out := []string{path}
+	for {
+		idx := strings.LastIndex(path, "/")
+		if idx < 0 {
+			break
+		}
+		path = path[:idx]
+		out = append(out, path)
+	}
+	return out
+}