feat(ui): bulk + single disable (AD-gated), adminCount-based Privileged

Three wins from the simple-ldap-go v1.12.0 bump:

1. adminCount-based Privileged detection

   adminUserDNs no longer maintains a hardcoded English CN allowlist
   ("admins", "domain admins", …). It now reads the AD-native
   User.AdminCount field set by simple-ldap-go v1.12 from the
   adminCount=1 attribute AD applies via adminSDHolder to every
   protected-group member (Domain Admins, Enterprise Admins,
   Administrators, Account Operators, Backup Operators, Server
   Operators, Print Operators, Replicator, Schema Admins, Key Admins,
   Enterprise Key Admins, Read-Only Domain Controllers, Domain
   Controllers). Benefits:

   - Catches localised AD directories (Domänen-Admins etc.) the CN
     list used to miss.
   - No transitive walk needed — AD already bakes the flag in.
   - Limitation documented inline on the function: adminCount is
     sticky (AD doesn't clear it when a user leaves a protected
     group), so a true value means "is OR was privileged", not a
     perfect real-time check.

2. Bulk disable for users and computers

   Replaces the 501 stubs on /users/bulk?action=disable and
   /computers/bulk?action=disable with real AD UAC writes. Backed
   by simple-ldap-go v1.12 DisableUserContext / DisableComputerContext
   which flip the ACCOUNTDISABLE bit (0x2) via read-modify-write,
   preserving every other UAC flag on the entry.

   - bulkDisableUsers / bulkDisableComputers dispatch through a shared
     bulkUACDisable helper (kind, redirectTo, op func) — same shape
     as bulkDeleteByDN, same flash semantics.
   - finaliseBulkDisable emits "Disabled N ..." success /
     "Failed to disable any of N ..." error /
     "Disabled N / M ..." partial flashes. Cache + template cache
     refreshed on any success, like bulk delete.

3. AD-gating everywhere

   Handler side (bulk_handlers.go): each disable dispatch checks
   a.ldapConfig.IsActiveDirectory. Non-AD deployments still hit the
   bulkNotImplemented path with the same 501 + message they used
   to; the contract doesn't regress.

   Template side (users_v2.templ + computers_v2.templ): the Disable
   button only renders when vm.IsAD is true. New IsAD field on both
   UserDrawerVM and ComputerDrawerVM, populated in their build*VM
   functions from a.ldapConfig.IsActiveDirectory.

Tests:

- Unit: TestBulkHandler_Users_DisableDispatchesOnAD and the computers
  equivalent exercise the AD gate by flipping
  app.ldapConfig.IsActiveDirectory=true and asserting NOT 501, NOT 400.
  The pre-existing non-AD stub tests renamed to ..._StubbedOnNonAD
  with docstrings that explain the gate behaviour.
- Existing bulk_handlers_test.go + full e2e suite remain green
  (71.5 s).

Dep: github.com/netresearch/simple-ldap-go v1.11.0 → v1.12.0.

Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>

Author: CybotTM

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/gofiber/storage/bbolt/v2 v2.1.4
 	github.com/gofiber/storage/memory/v2 v2.1.2
 	github.com/joho/godotenv v1.5.1
-	github.com/netresearch/simple-ldap-go v1.11.0
+	github.com/netresearch/simple-ldap-go v1.12.0
 	github.com/playwright-community/playwright-go v0.5700.1
 	github.com/rs/zerolog v1.35.0
 	github.com/stretchr/testify v1.11.1

go.sum

@@ -412,6 +412,8 @@ github.com/natefinch/atomic v1.0.1 h1:ZPYKxkqQOx3KZ+RsbnP/YsgvxWQPGxjC0oBt2AhwV0
 github.com/natefinch/atomic v1.0.1/go.mod h1:N/D/ELrljoqDyT3rZrsUmtsuzvHkeB/wWjHV22AZRbM=
 github.com/netresearch/simple-ldap-go v1.11.0 h1:MoI/3TdYNlVR8R3jUdVHKP2Ez6lFLSB5TRFaX1Ai02M=
 github.com/netresearch/simple-ldap-go v1.11.0/go.mod h1:TgUTDRc9SFd0MpBnzdGoM9A/XX5eAhErHdquURlZ0lo=
+github.com/netresearch/simple-ldap-go v1.12.0 h1:6OmPlACaM9KgT/PhDQ1d3rF0KA8TPTJyL1GE18RgrpI=
+github.com/netresearch/simple-ldap-go v1.12.0/go.mod h1:TgUTDRc9SFd0MpBnzdGoM9A/XX5eAhErHdquURlZ0lo=
 github.com/nishanths/exhaustive v0.12.0 h1:vIY9sALmw6T/yxiASewa4TQcFsVYZQQRUQJhKRf3Swg=
 github.com/nishanths/exhaustive v0.12.0/go.mod h1:mEZ95wPIZW+x8kC4TgC+9YCUgiST7ecevsVDTgc2obs=
 github.com/nishanths/predeclared v0.2.2 h1:V2EPdZPliZymNAn79T8RkNApBjMmVKh5XRpLm/w98Vk=

internal/web/bulk_handlers.go

@@ -44,10 +44,14 @@ func (a *App) handleBulkUsers(c *fiber.Ctx) error {
 	case "delete":
 		return a.bulkDeleteUsers(c)
 	case "disable":
-		// sAMAccountName enable/disable on OpenLDAP (inetOrgPerson) has no
-		// portable bit to flip — userAccountControl is AD-specific. Rather
-		// than silently muddle the description attribute we stub here.
-		return bulkNotImplemented(c, "disable users", "")
+		if !a.ldapConfig.IsActiveDirectory {
+			// OpenLDAP inetOrgPerson has no portable enable/disable
+			// attribute. Return 501 with the same message the template
+			// used to render so the contract is unchanged for non-AD.
+			return bulkNotImplemented(c, "disable users", "")
+		}
+
+		return a.bulkDisableUsers(c)
 	default:
 		return c.Status(fiber.StatusBadRequest).SendString("unknown bulk action")
 	}
@@ -83,8 +87,14 @@ func (a *App) handleBulkComputers(c *fiber.Ctx) error {
 	action := c.Query("action")
 	switch action {
 	case "disable":
-		// Same reasoning as users "disable" — no portable write op.
-		return bulkNotImplemented(c, "disable computers", "")
+		if !a.ldapConfig.IsActiveDirectory {
+			// Non-AD: no userAccountControl to flip. Keep the 501
+			// contract in place so non-AD deployments see a clear
+			// message rather than a silent no-op.
+			return bulkNotImplemented(c, "disable computers", "")
+		}
+
+		return a.bulkDisableComputers(c)
 	case "delete":
 		return a.bulkDeleteComputers(c)
 	default:
@@ -306,6 +316,94 @@ func (a *App) bulkDeleteByDN(c *fiber.Ctx, kind, redirectTo string) error {
 	return c.Redirect(redirectTo, fiber.StatusSeeOther)
 }
 
+// bulkDisableUsers flips the ACCOUNTDISABLE bit (0x2) on each user DN
+// in target_dn[] via simple-ldap-go v1.12's DisableUserContext. AD
+// only — the caller in handleBulkUsers gates this on
+// a.ldapConfig.IsActiveDirectory so non-AD deployments never reach here.
+func (a *App) bulkDisableUsers(c *fiber.Ctx) error {
+	return a.bulkUACDisable(c, "user", "/users", func(client *ldap.LDAP, dn string) error {
+		return client.DisableUserContext(c.UserContext(), dn)
+	})
+}
+
+// bulkDisableComputers mirrors bulkDisableUsers for computer entries.
+// AD-only, same gating in handleBulkComputers.
+func (a *App) bulkDisableComputers(c *fiber.Ctx) error {
+	return a.bulkUACDisable(c, "computer", "/computers", func(client *ldap.LDAP, dn string) error {
+		return client.DisableComputerContext(c.UserContext(), dn)
+	})
+}
+
+// bulkUACDisable is the shared body for bulkDisableUsers /
+// bulkDisableComputers: open a per-user LDAP binding, run the given
+// per-DN disable op, count successes, flash "Disabled N / M <kind>s".
+// Pattern matches bulkDeleteByDN — different op, same batching.
+func (a *App) bulkUACDisable(c *fiber.Ctx, kind, redirectTo string, op func(*ldap.LDAP, string) error) error {
+	targets := collectTargetDNs(c)
+	if len(targets) == 0 {
+		return c.Redirect(redirectTo, fiber.StatusSeeOther)
+	}
+
+	client, err := a.getUserLDAP(c)
+	if err != nil {
+		return handle500(c, err)
+	}
+	defer func() { _ = client.Close() }()
+
+	disabled := 0
+	var firstErr error
+
+	for _, dn := range targets {
+		if err := op(client, dn); err != nil {
+			if firstErr == nil {
+				firstErr = err
+			}
+
+			log.Warn().Err(err).Str("dn", dn).Str("kind", kind).Msg("bulk disable failed")
+
+			continue
+		}
+
+		disabled++
+	}
+
+	a.finaliseBulkDisable(c, kind, disabled, len(targets), firstErr)
+
+	return c.Redirect(redirectTo, fiber.StatusSeeOther)
+}
+
+// finaliseBulkDisable is the disable analogue of finaliseBulkDelete:
+// refresh caches on any success, log the summary, flash the result.
+func (a *App) finaliseBulkDisable(c *fiber.Ctx, kind string, disabled, total int, firstErr error) {
+	if disabled > 0 {
+		a.invalidateTemplateCacheOnModification()
+
+		if a.ldapCache != nil {
+			a.ldapCache.Refresh()
+		}
+	}
+
+	log.Info().
+		Int("targeted", total).
+		Int("disabled", disabled).
+		Str("kind", kind).
+		Msg("bulk disable complete")
+
+	switch disabled {
+	case total:
+		a.setFlash(c, templates.SuccessFlash(
+			fmt.Sprintf("Disabled %d %s%s.", disabled, kind, pluralSuffix(disabled))))
+	case 0:
+		a.setFlash(c, templates.ErrorFlash(
+			fmt.Sprintf("Failed to disable any of %d %s%s: %s",
+				total, kind, pluralSuffix(total), humaniseLDAPError(firstErr))))
+	default:
+		a.setFlash(c, templates.ErrorFlash(
+			fmt.Sprintf("Disabled %d / %d %s%s (%s)",
+				disabled, total, kind, pluralSuffix(total), humaniseLDAPError(firstErr))))
+	}
+}
+
 // finaliseBulkDelete is the shared post-loop cleanup for all three
 // bulk-delete handlers: invalidate the template + LDAP caches if any
 // delete succeeded, and drop a "Deleted N / M <kind>s" flash on the

internal/web/bulk_handlers_test.go

@@ -190,9 +190,13 @@ func TestBulkHandler_Computers_DeleteDispatches(t *testing.T) {
 	}
 }
 
-// TestBulkHandler_Computers_DisableStubbed verifies the disable action on
-// /computers/bulk is explicitly not yet implemented.
-func TestBulkHandler_Computers_DisableStubbed(t *testing.T) {
+// TestBulkHandler_Computers_DisableStubbedOnNonAD verifies the disable
+// action on /computers/bulk returns 501 on non-AD directories (where
+// userAccountControl doesn't exist). The default test config has
+// IsActiveDirectory=false, so the handler's AD gate falls through to
+// bulkNotImplemented. AD deployments dispatch to bulkDisableComputers
+// instead — covered by the AD-gated test below.
+func TestBulkHandler_Computers_DisableStubbedOnNonAD(t *testing.T) {
 	app, store := setupFullTestApp(t)
 
 	cookies := createAuthSession(t, app, store)
@@ -218,9 +222,10 @@ func TestBulkHandler_Computers_DisableStubbed(t *testing.T) {
 	}
 }
 
-// TestBulkHandler_Users_DisableStubbed verifies the disable action on
-// /users/bulk is explicitly not yet implemented for inetOrgPerson.
-func TestBulkHandler_Users_DisableStubbed(t *testing.T) {
+// TestBulkHandler_Users_DisableStubbedOnNonAD verifies disable on
+// /users/bulk still returns 501 when IsActiveDirectory is false
+// (the default test harness). The AD path is tested separately.
+func TestBulkHandler_Users_DisableStubbedOnNonAD(t *testing.T) {
 	app, store := setupFullTestApp(t)
 
 	cookies := createAuthSession(t, app, store)
@@ -246,6 +251,75 @@ func TestBulkHandler_Users_DisableStubbed(t *testing.T) {
 	}
 }
 
+// TestBulkHandler_Users_DisableDispatchesOnAD verifies the AD gate:
+// when IsActiveDirectory is true, /users/bulk?action=disable should
+// NOT return 501 — it should reach the bulkDisableUsers path (where
+// getUserLDAP fails against the mock server and bubbles a redirect).
+// The regression this guards: a future refactor that drops the gate
+// would make AD deployments see a spurious 501 even though the code
+// is ready for them.
+func TestBulkHandler_Users_DisableDispatchesOnAD(t *testing.T) {
+	app, store := setupFullTestApp(t)
+	app.ldapConfig.IsActiveDirectory = true
+
+	cookies := createAuthSession(t, app, store)
+
+	form := url.Values{"target_dn": {"cn=u1,dc=test"}}
+	req := httptest.NewRequest(http.MethodPost,
+		"/users/bulk?action=disable",
+		strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	resp, err := app.fiber.Test(req)
+	if err != nil {
+		t.Fatalf("users/bulk POST: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode == http.StatusNotImplemented {
+		t.Fatalf("expected dispatch to bulkDisableUsers on AD (not 501 stub); got 501")
+	}
+	if resp.StatusCode == http.StatusBadRequest {
+		t.Fatalf("unexpected 400 for well-formed disable on AD: %d", resp.StatusCode)
+	}
+}
+
+// TestBulkHandler_Computers_DisableDispatchesOnAD mirrors the users
+// AD-gate test for computers.
+func TestBulkHandler_Computers_DisableDispatchesOnAD(t *testing.T) {
+	app, store := setupFullTestApp(t)
+	app.ldapConfig.IsActiveDirectory = true
+
+	cookies := createAuthSession(t, app, store)
+
+	form := url.Values{"target_dn": {"cn=pc1,dc=test"}}
+	req := httptest.NewRequest(http.MethodPost,
+		"/computers/bulk?action=disable",
+		strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	resp, err := app.fiber.Test(req)
+	if err != nil {
+		t.Fatalf("computers/bulk POST: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode == http.StatusNotImplemented {
+		t.Fatalf("expected dispatch to bulkDisableComputers on AD (not 501); got 501")
+	}
+	if resp.StatusCode == http.StatusBadRequest {
+		t.Fatalf("unexpected 400 for well-formed disable on AD: %d", resp.StatusCode)
+	}
+}
+
 // TestBulkHandler_Groups_AddMembersMissingUser verifies the add-members
 // action requires user_dn.
 func TestBulkHandler_Groups_AddMembersMissingUser(t *testing.T) {

internal/web/computers_v2_handler.go

@@ -48,6 +48,7 @@ func (a *App) buildComputerDrawerVM(computerDN, viewerDN string) (templates.Comp
 		Pinned:      pinned,
 		OUName:      ouName,
 		OUPivotHref: buildComputerOUPivotHref(ouName),
+		IsAD:        a.ldapConfig.IsActiveDirectory,
 	}, true
 }
 

internal/web/templates/computers_v2.templ

@@ -19,6 +19,7 @@ type ComputerDrawerVM struct {
 	OUName      string // plain-text OU name, e.g. "ou=Computers" (for display)
 	OUPivotHref string // URL-encoded pivot link, e.g. "/computers?ou=ou%3DComputers"
 	CSRFToken   string // current-session CSRF token used by embedded POST forms
+	IsAD        bool   // true when backend is Active Directory — gates the Disable button
 }
 
 templ ComputersListV2(computers []ldap.Computer, ouFilter string, ous []string, flashes []Flash, palettePinned []PinnedEntry) {
@@ -324,11 +325,13 @@ templ computerDrawerContentsCtx(vm ComputerDrawerVM, inDrawer bool) {
 	<section class="drawer__section drawer__section--actions">
 		<h3 class="drawer__section-title">Actions</h3>
 		<div class="drawer__actions">
-			<form method="post" action="/computers/bulk?action=disable" data-confirm={ "Disable " + vm.Computer.CN() + "?" }>
-				<input type="hidden" name="csrf_token" value={ vm.CSRFToken }/>
-				<input type="hidden" name="target_dn" value={ vm.Computer.DN() }/>
-				<button type="submit" class="drawer__action drawer__action--warn">Disable</button>
-			</form>
+			if vm.IsAD {
+				<form method="post" action="/computers/bulk?action=disable" data-confirm={ "Disable " + vm.Computer.CN() + "?" }>
+					<input type="hidden" name="csrf_token" value={ vm.CSRFToken }/>
+					<input type="hidden" name="target_dn" value={ vm.Computer.DN() }/>
+					<button type="submit" class="drawer__action drawer__action--warn">Disable</button>
+				</form>
+			}
 			<form method="post" action="/computers/bulk?action=delete" data-confirm={ "Delete " + vm.Computer.CN() + "? This cannot be undone." }>
 				<input type="hidden" name="csrf_token" value={ vm.CSRFToken }/>
 				<input type="hidden" name="target_dn" value={ vm.Computer.DN() }/>

internal/web/templates/users_v2.templ

@@ -26,6 +26,7 @@ type UserDrawerVM struct {
 	CSRFToken        string       // current-session CSRF token used by embedded POST forms
 	UnassignedGroups []ldap.Group // groups the user is NOT a member of (datalist for add-to-group)
 	FlashError       string       // set by modify handlers when an LDAP op fails; shown inline
+	IsAD             bool         // true when the backend is Active Directory — gates the Disable button since OpenLDAP has no portable disable mechanism
 }
 
 templ UsersListV2(users []ldap.User, showDisabled bool, ouFilter string, lastLogon string, memberOfDN, memberOfCN string, ous []string, flashes []Flash, palettePinned []PinnedEntry, adminDNs map[string]struct{}) {
@@ -423,11 +424,13 @@ templ userDrawerContentsCtx(vm UserDrawerVM, inDrawer bool) {
 	<section class="drawer__section drawer__section--actions">
 		<h3 class="drawer__section-title">Actions</h3>
 		<div class="drawer__actions">
-			<form method="post" action="/users/bulk?action=disable" data-confirm={ "Disable " + vm.User.CN() + "? The account can be re-enabled later." }>
-				<input type="hidden" name="csrf_token" value={ vm.CSRFToken }/>
-				<input type="hidden" name="target_dn" value={ vm.User.DN() }/>
-				<button type="submit" class="drawer__action drawer__action--warn">Disable</button>
-			</form>
+			if vm.IsAD {
+				<form method="post" action="/users/bulk?action=disable" data-confirm={ "Disable " + vm.User.CN() + "? The account can be re-enabled later." }>
+					<input type="hidden" name="csrf_token" value={ vm.CSRFToken }/>
+					<input type="hidden" name="target_dn" value={ vm.User.DN() }/>
+					<button type="submit" class="drawer__action drawer__action--warn">Disable</button>
+				</form>
+			}
 			<form method="post" action="/users/bulk?action=delete" data-confirm={ "Delete " + vm.User.CN() + "? This cannot be undone." }>
 				<input type="hidden" name="csrf_token" value={ vm.CSRFToken }/>
 				<input type="hidden" name="target_dn" value={ vm.User.DN() }/>

internal/web/users_v2_handler.go

@@ -49,6 +49,7 @@ func (a *App) buildUserDrawerVM(userDN, viewerDN string) (templates.UserDrawerVM
 		OUName:           ouFilter,
 		OUPivotHref:      buildOUPivotHref(ouFilter),
 		UnassignedGroups: unassigned,
+		IsAD:             a.ldapConfig.IsActiveDirectory,
 	}, true
 }
 
@@ -116,33 +117,43 @@ func (a *App) handleUsersV2(c *fiber.Ctx) error {
 	return page.Render(c.UserContext(), c.Response().BodyWriter())
 }
 
-// adminUserDNs collects the DNs of users that are members of a group
-// whose CN matches a short "privileged" name list (admins, domain
-// admins, enterprise admins — case-insensitive). Returns a set so the
-// list template's check stays O(1) per row. A nil cache yields nil.
+// adminUserDNs collects the DNs of users flagged as privileged by AD's
+// `adminCount=1` attribute (surfaced as `User.AdminCount` in
+// simple-ldap-go v1.12+).
+//
+// Why adminCount and not a CN allowlist:
+//
+//	AD sets adminCount=1 via adminSDHolder on every member of its
+//	protected groups (Domain Admins, Enterprise Admins,
+//	Administrators, Account Operators, Backup Operators, Server
+//	Operators, Print Operators, Replicator, Schema Admins, Key
+//	Admins, Enterprise Key Admins, Read-Only Domain Controllers,
+//	Domain Controllers). This catches every AD-recognised privileged
+//	user without us hard-coding English CNs (which would miss
+//	localised directories like "Domänen-Admins") and without walking
+//	nested group membership.
+//
+// Limitations:
+//
+//	The attribute is STICKY: AD does not clear adminCount when a
+//	user leaves a protected group. A true value therefore means
+//	"is or was privileged" — still a strong UI signal but not a
+//	perfect real-time membership check. For non-AD directories
+//	(OpenLDAP) the attribute is never set, so the shield never
+//	renders. That matches the read-only nature of those deployments.
+//
+// Returns a set so the list template's per-row check stays O(1).
+// A nil cache yields nil.
 func adminUserDNs(cache *ldap_cache.Manager) map[string]struct{} {
 	if cache == nil {
 		return nil
 	}
 
-	privilegedNames := map[string]struct{}{
-		"admins":            {},
-		"domain admins":     {},
-		"enterprise admins": {},
-		"administrators":    {},
-		"schema admins":     {},
-	}
-
 	out := make(map[string]struct{})
 
-	for _, g := range cache.FindGroups() {
-		cn := strings.ToLower(g.CN())
-		if _, ok := privilegedNames[cn]; !ok {
-			continue
-		}
-
-		for _, memberDN := range g.Members {
-			out[memberDN] = struct{}{}
+	for _, u := range cache.FindUsers(true /* include disabled — privileged flag applies regardless */) {
+		if u.AdminCount {
+			out[u.DN()] = struct{}{}
 		}
 	}