1package ldap
 2
 3import (
 4	"context"
 5	"log/slog"
 6	"net/netip"
 7	"time"
 8
 9	"tug/internal/service/refusalcap"
10	"tug/internal/storage"
11)
12
13const (
14	ActionBindRefused = "ldap.bind_refused"
15	bindAuditTimeout  = 5 * time.Second
16)
17
18func (s *Server) auditBind(addr netip.Addr, result, userID string) {
19	if userID == "" {
20		return
21	}
22	ctx, cancel := context.WithTimeout(s.ctx, bindAuditTimeout)
23	defer cancel()
24	switch {
25	case result == bindRejected:
26		s.refusal.Refused(ctx, storage.AppendAuditInput{Actor: "system", Action: ActionBindRefused, Subject: userID, Address: addr})
27	case result == bindAccepted && s.binds.first(userID, addr):
28		s.refusal.Succeeded(ctx, storage.AppendAuditInput{Actor: userID, Action: ActionBind, Subject: userID, Address: addr})
29	}
30}
31
32func refusalsOrOwn(c *refusalcap.Cap, store *storage.Store, logger *slog.Logger) *refusalcap.Cap {
33	if c != nil {
34		return c
35	}
36	return refusalcap.New(store, time.Now, logger)
37}