fix(cache): DN-aware immediate-child + OU-parent reconstruction

- addOUChildren: parse DNs and compare RDN components instead of
  string-matching. Fixes false-negative on immediate children whose
  CN contains an escaped comma (e.g. "cn=Last\, First,ou=...").
- immediateOUFromDN: use go-ldap's DN serializer so escaped/multi-
  valued RDNs round-trip correctly instead of manual concat.
- Regression test TestBuildGraph_OUFocus_EscapedCommaChild pins the
  escaped-comma case. Mutation-tested: temporarily reverting the
  DN-parsing check makes the test fail as expected.

Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>

Author: CybotTM

internal/ldap_cache/graph.go

@@ -386,29 +386,11 @@ func immediateOUFromDN(dn string) string {
 	}
 
 	tail := parsed.RDNs[1:]
-
-	var buf strings.Builder
-
-	for i, r := range tail {
-		if i > 0 {
-			buf.WriteString(",")
-		}
-
-		for _, a := range r.Attributes {
-			buf.WriteString(a.Type)
-			buf.WriteString("=")
-			buf.WriteString(a.Value)
-		}
-	}
-
-	out := buf.String()
-
-	// Only return if first RDN is ou=
-	if len(tail) > 0 && strings.EqualFold(tail[0].Attributes[0].Type, "ou") {
-		return out
+	if len(tail[0].Attributes) == 0 || !strings.EqualFold(tail[0].Attributes[0].Type, "ou") {
+		return ""
 	}
 
-	return ""
+	return (&goldap.DN{RDNs: tail}).String()
 }
 
 func labelForOU(dn string) string {
@@ -467,16 +449,29 @@ func addOU(data *GraphData, seen map[string]int, ouDN string, ring int, edge Edg
 }
 
 func (m *Manager) addOUChildren(data *GraphData, seen map[string]int, ouDN string, ring int) {
-	suffix := "," + ouDN
+	ouParsed, err := goldap.ParseDN(ouDN)
+	if err != nil {
+		return
+	}
 
-	for _, u := range m.Users.Get() {
-		if !strings.HasSuffix(u.DN(), suffix) {
-			continue
+	isImmediateChild := func(childDN string) bool {
+		p, err := goldap.ParseDN(childDN)
+		if err != nil || len(p.RDNs) != len(ouParsed.RDNs)+1 {
+			return false
 		}
 
-		rel := strings.TrimSuffix(u.DN(), suffix)
-		if strings.Contains(rel, ",") {
-			continue // not an immediate child
+		for i, rdn := range ouParsed.RDNs {
+			if !rdn.Equal(p.RDNs[i+1]) {
+				return false
+			}
+		}
+
+		return true
+	}
+
+	for _, u := range m.Users.Get() {
+		if !isImmediateChild(u.DN()) {
+			continue
 		}
 
 		if _, dup := seen[u.DN()]; dup {
@@ -489,12 +484,7 @@ func (m *Manager) addOUChildren(data *GraphData, seen map[string]int, ouDN strin
 	}
 
 	for _, c := range m.Computers.Get() {
-		if !strings.HasSuffix(c.DN(), suffix) {
-			continue
-		}
-
-		rel := strings.TrimSuffix(c.DN(), suffix)
-		if strings.Contains(rel, ",") {
+		if !isImmediateChild(c.DN()) {
 			continue
 		}
 

internal/ldap_cache/graph_test.go

@@ -353,6 +353,53 @@ func TestBuildGraph_CycleSafe(t *testing.T) {
 	}
 }
 
+func TestBuildGraph_OUFocus_EscapedCommaChild(t *testing.T) {
+	manager := New(&mockLDAPClient{})
+	// "Last, First" with the comma escaped per RFC 4514.
+	childDN := `cn=Last\, First,ou=Engineering,dc=ex,dc=com`
+	manager.Users.setAll([]ldap.User{
+		newUserWithDN(childDN, "Last, First", "lastf", true, nil),
+	})
+
+	ouDN := "ou=Engineering,dc=ex,dc=com"
+	data, err := manager.BuildGraph(ouDN, 1)
+	if err != nil {
+		t.Fatalf("BuildGraph: %v", err)
+	}
+
+	foundNode := false
+
+	for _, n := range data.Nodes {
+		if n.DN == childDN {
+			foundNode = true
+
+			break
+		}
+	}
+
+	if !foundNode {
+		t.Fatalf("escaped-comma immediate child %q must appear in depth-1 nodes for %q", childDN, ouDN)
+	}
+
+	foundEdge := false
+
+	for _, e := range data.Edges {
+		if e.Source == ouDN && e.Target == childDN {
+			if e.Kind != EdgeContains {
+				t.Errorf("edge kind for escaped-comma child: got %q, want %q", e.Kind, EdgeContains)
+			}
+
+			foundEdge = true
+
+			break
+		}
+	}
+
+	if !foundEdge {
+		t.Errorf("escaped-comma immediate child %q must have contains edge from %q", childDN, ouDN)
+	}
+}
+
 func TestAssignConcentric_EvenDistribution(t *testing.T) {
 	m := graphFixture(t)
 	data, _ := m.BuildGraph("cn=bob,ou=Engineering,dc=ex,dc=com", 1)