fixes and new options

src/auth/ldap.rs

@@ -1,5 +1,5 @@
 use chrono::Utc;
-use tracing::{debug, info};
+use tracing::{debug, info, warn};
 
 use crate::{queries, state::SharedState};
 
@@ -172,12 +172,20 @@ pub async fn authenticate(
 }
 
 fn directory_nickname(display_name: &str, email: &str, username: &str) -> String {
-    let words: Vec<&str> = display_name.split_whitespace().filter(|v| !v.is_empty()).collect();
+    let words: Vec<&str> = display_name
+        .split_whitespace()
+        .filter(|v| !v.is_empty())
+        .collect();
     let candidate = if words.len() >= 2 {
         let first = words[0].chars().next().unwrap_or('u');
         format!("{}.{}", first, words[words.len() - 1])
     } else {
-        email.split('@').next().filter(|v| !v.is_empty()).unwrap_or(username).to_owned()
+        email
+            .split('@')
+            .next()
+            .filter(|v| !v.is_empty())
+            .unwrap_or(username)
+            .to_owned()
     };
     candidate.to_lowercase()
 }
@@ -241,6 +249,10 @@ pub(super) async fn login(
         })?
         .ok_or_else(|| AuthError::unauthorized("Invalid organization login or password."))?;
     let user = provision_ldap_user(state, identity).await?;
+    if user.is_active == 0 {
+        warn!(user_id = user.id, "LDAP login rejected: inactive account");
+        return Err(AuthError::forbidden("This account is inactive."));
+    }
     let session = create_session(state, &user).await?;
     info!(user_id = user.id, nickname = %user.nickname, "LDAP login successful");
     Ok(session)