fix(ui): gate Disable action on User/Computer.Enabled

The drawer Actions section in both users_v2.templ and computers_v2.templ
previously rendered the Disable form whenever the backend was Active
Directory, regardless of the entity's current enabled state. An
already-disabled user kept seeing a "Disable" button that, when
clicked, asked the directory to re-disable an already-disabled account.

Wrap the form in the combined guard (IsAD && Enabled) so the action
only surfaces when it can do something. Comment on the IsAD field
updated to call out the Enabled requirement.

Coverage: new drawer_disable_gating_test.go asserts the IsAD × Enabled
matrix for both User and Computer drawer fragments.

Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>

Author: CybotTM

internal/web/templates/computers_v2.templ

@@ -19,7 +19,7 @@ type ComputerDrawerVM struct {
 	OUName      string // plain-text OU name, e.g. "ou=Computers" (for display)
 	OUPivotHref string // URL-encoded pivot link, e.g. "/computers?ou=ou%3DComputers"
 	CSRFToken   string // current-session CSRF token used by embedded POST forms
-	IsAD        bool   // true when backend is Active Directory — gates the Disable button
+	IsAD        bool   // true when backend is Active Directory — gates the Disable button (which also requires Computer.Enabled)
 }
 
 templ ComputersListV2(computers []ldap.Computer, ouFilter string, ous []string, flashes []Flash, palettePinned []PinnedEntry) {
@@ -325,7 +325,7 @@ templ computerDrawerContentsCtx(vm ComputerDrawerVM, inDrawer bool) {
 	<section class="drawer__section drawer__section--actions">
 		<h3 class="drawer__section-title">Actions</h3>
 		<div class="drawer__actions">
-			if vm.IsAD {
+			if vm.IsAD && vm.Computer.Enabled {
 				<form method="post" action="/computers/bulk?action=disable" data-confirm={ "Disable " + vm.Computer.CN() + "?" }>
 					<input type="hidden" name="csrf_token" value={ vm.CSRFToken }/>
 					<input type="hidden" name="target_dn" value={ vm.Computer.DN() }/>

internal/web/templates/drawer_disable_gating_test.go

@@ -0,0 +1,101 @@
+// internal/web/templates/drawer_disable_gating_test.go
+package templates
+
+import (
+	"bytes"
+	"context"
+	"strings"
+	"testing"
+
+	ldap "github.com/netresearch/simple-ldap-go"
+
+	"github.com/netresearch/ldap-manager/internal/ldap_cache"
+)
+
+// TestUserDrawerDisableGating asserts that the Disable action form is only
+// rendered when both (a) the backend is Active Directory and (b) the user
+// is currently enabled. Bug: the drawer previously emitted the Disable
+// button for an already-disabled user, so the account was told to disable
+// itself again — visually contradictory and operationally useless.
+func TestUserDrawerDisableGating(t *testing.T) {
+	const disableMarker = `action="/users/bulk?action=disable"`
+
+	cases := []struct {
+		name         string
+		isAD         bool
+		enabled      bool
+		wantDisable  bool
+		wantStatusOK string
+	}{
+		{"AD + enabled shows Disable", true, true, true, "Enabled"},
+		{"AD + already disabled hides Disable", true, false, false, "Disabled"},
+		{"OpenLDAP + enabled hides Disable", false, true, false, "Enabled"},
+		{"OpenLDAP + disabled hides Disable", false, false, false, "Disabled"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			vm := UserDrawerVM{
+				User: &ldap_cache.FullLDAPUser{
+					User: ldap.User{Enabled: tc.enabled, SAMAccountName: "bob"},
+				},
+				IsAD: tc.isAD,
+			}
+
+			var buf bytes.Buffer
+			if err := UserDrawerFragment(vm).Render(context.Background(), &buf); err != nil {
+				t.Fatalf("render drawer fragment: %v", err)
+			}
+
+			html := buf.String()
+			hasDisable := strings.Contains(html, disableMarker)
+
+			if hasDisable != tc.wantDisable {
+				t.Errorf("disable form present=%v, want=%v (IsAD=%v, Enabled=%v)",
+					hasDisable, tc.wantDisable, tc.isAD, tc.enabled)
+			}
+			if !strings.Contains(html, tc.wantStatusOK) {
+				t.Errorf("expected drawer to render status %q, missing in output", tc.wantStatusOK)
+			}
+		})
+	}
+}
+
+// TestComputerDrawerDisableGating mirrors TestUserDrawerDisableGating for
+// the computer detail drawer. Same bug symptom (Disable shown on an
+// already-disabled machine account), same fix shape.
+func TestComputerDrawerDisableGating(t *testing.T) {
+	const disableMarker = `action="/computers/bulk?action=disable"`
+
+	cases := []struct {
+		name        string
+		isAD        bool
+		enabled     bool
+		wantDisable bool
+	}{
+		{"AD + enabled shows Disable", true, true, true},
+		{"AD + already disabled hides Disable", true, false, false},
+		{"OpenLDAP + enabled hides Disable", false, true, false},
+		{"OpenLDAP + disabled hides Disable", false, false, false},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			vm := ComputerDrawerVM{
+				Computer: ldap.Computer{Enabled: tc.enabled, SAMAccountName: "pc01$"},
+				IsAD:     tc.isAD,
+			}
+
+			var buf bytes.Buffer
+			if err := ComputerDrawerFragment(vm).Render(context.Background(), &buf); err != nil {
+				t.Fatalf("render drawer fragment: %v", err)
+			}
+
+			hasDisable := strings.Contains(buf.String(), disableMarker)
+			if hasDisable != tc.wantDisable {
+				t.Errorf("disable form present=%v, want=%v (IsAD=%v, Enabled=%v)",
+					hasDisable, tc.wantDisable, tc.isAD, tc.enabled)
+			}
+		})
+	}
+}

internal/web/templates/users_v2.templ

@@ -26,7 +26,7 @@ type UserDrawerVM struct {
 	CSRFToken        string       // current-session CSRF token used by embedded POST forms
 	UnassignedGroups []ldap.Group // groups the user is NOT a member of (datalist for add-to-group)
 	FlashError       string       // set by modify handlers when an LDAP op fails; shown inline
-	IsAD             bool         // true when the backend is Active Directory — gates the Disable button since OpenLDAP has no portable disable mechanism
+	IsAD             bool         // true when the backend is Active Directory — gates the Disable button (which also requires User.Enabled) since OpenLDAP has no portable disable mechanism
 }
 
 templ UsersListV2(users []ldap.User, showDisabled bool, ouFilter string, lastLogon string, memberOfDN, memberOfCN string, ous []string, flashes []Flash, palettePinned []PinnedEntry, adminDNs map[string]struct{}) {
@@ -424,7 +424,7 @@ templ userDrawerContentsCtx(vm UserDrawerVM, inDrawer bool) {
 	<section class="drawer__section drawer__section--actions">
 		<h3 class="drawer__section-title">Actions</h3>
 		<div class="drawer__actions">
-			if vm.IsAD {
+			if vm.IsAD && vm.User.Enabled {
 				<form method="post" action="/users/bulk?action=disable" data-confirm={ "Disable " + vm.User.CN() + "? The account can be re-enabled later." }>
 					<input type="hidden" name="csrf_token" value={ vm.CSRFToken }/>
 					<input type="hidden" name="target_dn" value={ vm.User.DN() }/>