fix: use lk/handlers.py filter format, add debug script

instruct/handlers.py

@@ -27,7 +27,7 @@ def _get_user_cn(user_id: str) -> str:
     user_id из TrueConf — это обычно email, например 'ds.krivochenko@tcs.sibcem.ru'
     Заменяет tcs.sibcem.ru на sibcem.ru для поиска в AD.
     """
-    from ldap3 import Server, Connection, ALL, SUBTREE
+    from ldap3 import Server, Connection, ALL
     from config.config import AD_SERVER, AD_USER, AD_PASSWORD, AD_BASE
     from ldap3.utils.conv import escape_filter_chars
 
@@ -35,40 +35,33 @@ def _get_user_cn(user_id: str) -> str:
         # Заменяем tcs.sibcem.ru на sibcem.ru
         search_id = user_id.replace("@tcs.sibcem.ru", "@sibcem.ru")
         short_username = search_id.split("@")[0] if "@" in search_id else user_id
-        safe_id = escape_filter_chars(search_id)
-        safe_short = escape_filter_chars(short_username)
 
         logger.info(f"AD lookup: user_id={user_id}, search_id={search_id}, short={short_username}")
 
         server = Server(AD_SERVER, get_info=ALL)
         conn = Connection(server, user=AD_USER, password=AD_PASSWORD, auto_bind=True)
 
-        # Пробуем несколько фильтров + разные базы поиска
-        filters = [
-            f"(mail={safe_id})",
-            f"(userPrincipalName={safe_id})",
-            f"(sAMAccountName={safe_short})",
-        ]
+        # Фильтр как в lk/handlers.py — работает
+        safe_user_id = escape_filter_chars(search_id)
+        search_filter = (
+            f"(&(objectClass=user)(|"
+            f"(mail={safe_user_id})"
+            f"(userPrincipalName={safe_user_id})"
+            f"(userPrincipalName={escape_filter_chars(f'{short_username}@sibcem.ru')}))"
+            f"(sAMAccountName={escape_filter_chars(short_username)})))"
+        )
+        logger.info(f"AD filter: {search_filter}")
 
-        # AD_BASE + корень домена для поиска во всём дереве
-        search_bases = [AD_BASE, "DC=sibcem,DC=ru"]
+        conn.search(AD_BASE, search_filter, attributes=["cn", "sAMAccountName", "mail", "userPrincipalName"])
 
-        for base in search_bases:
-            for filt in filters:
-                conn.search(
-                    search_base=base,
-                    search_filter=f"(&(objectClass=user)({filt}))",
-                    attributes=["cn", "sAMAccountName", "mail", "userPrincipalName"],
-                    search_scope=SUBTREE
-                )
-                if conn.entries:
-                    entry = conn.entries[0]
-                    cn = str(entry.cn)
-                    mail = str(entry.mail) if 'mail' in entry else "N/A"
-                    sam = str(entry.sAMAccountName) if 'sAMAccountName' in entry else "N/A"
-                    upn = str(entry.userPrincipalName) if 'userPrincipalName' in entry else "N/A"
-                    logger.info(f"AD found: cn={cn}, mail={mail}, sam={sam}, upn={upn}, base={base}")
-                    return cn
+        if conn.entries:
+            entry = conn.entries[0]
+            cn = str(entry.cn)
+            mail = str(entry.mail) if 'mail' in entry else "N/A"
+            sam = str(entry.sAMAccountName) if 'sAMAccountName' in entry else "N/A"
+            upn = str(entry.userPrincipalName) if 'userPrincipalName' in entry else "N/A"
+            logger.info(f"AD found: cn={cn}, mail={mail}, sam={sam}, upn={upn}")
+            return cn
 
         logger.warning(f"AD not found for user_id={user_id}, search_id={search_id}, short={short_username}")
     except Exception as e: