From 44117f90b33adae8e93538af76423a0daee7871d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=94=D0=B5=D0=BD=D0=B8=D1=81=20=D0=9A=D1=80=D0=B8=D0=B2?= =?UTF-8?q?=D0=BE=D1=87=D0=B5=D0=BD=D0=BA=D0=BE?= Date: Thu, 23 Jul 2026 09:54:46 +0700 Subject: [PATCH] fix: AD lookup by email/UPN instead of sAMAccountName to prevent wrong requester email --- instruct/handlers.py | 2 +- service_desk/handlers.py | 13 ++++++++----- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/instruct/handlers.py b/instruct/handlers.py index 736dc9b..22a7a53 100644 --- a/instruct/handlers.py +++ b/instruct/handlers.py @@ -112,7 +112,7 @@ async def instruct_router_handler(msg: Message): subject = f"Запрос доступа к Trueconf" description = f"Пользователь {cn} ({user_id}) запросил инструкцию по Trueconf, но не имеет группы 2FA. Требуется выдача доступа." # Ищем email пользователя в AD, как в service_desk - ad_user = await asyncio.to_thread(get_ad_user_sync, login) + ad_user = await asyncio.to_thread(get_ad_user_sync, user_id) requester_email = ad_user.get("mail") if ad_user and ad_user.get("mail") else DEFAULT_REQUESTER ticket_id = await create_ticket_in_sd(requester_email, subject, description, "Кемерово") logger.info(f"SD ticket created for {cn}: #{ticket_id}") diff --git a/service_desk/handlers.py b/service_desk/handlers.py index 997690e..3f77bbe 100644 --- a/service_desk/handlers.py +++ b/service_desk/handlers.py @@ -70,15 +70,18 @@ sd_sessions = {} # ================================================ # БИЗНЕС-ЛОГИКА # ================================================ -def get_ad_user_sync(login: str): +def get_ad_user_sync(user_id: str): + """Ищем по email/UPN (search_by_user_id), НЕ по sAMAccountName. + user_id из TrueConf — обычно email вида 'login@tcs.sibcem.ru'. + Функция сама заменит @tcs.sibcem.ru на @sibcem.ru и найдёт правильную учётку.""" try: - from utils.ad_search import search_by_login - entries = search_by_login(login, ["displayName", "mail", "l", "userAccountControl"]) + from utils.ad_search import search_by_user_id + entries = search_by_user_id(user_id, ["displayName", "mail", "l", "userAccountControl"]) if entries: user = entries[0] uac = user.userAccountControl.value if 'userAccountControl' in user else 0 return { - "name": user.displayName.value if 'displayName' in user else login, + "name": user.displayName.value if 'displayName' in user else user_id, "mail": user.mail.value if 'mail' in user else None, "city": user.l.value if 'l' in user else "Кемерово", "is_disabled": bool(uac & 2) @@ -220,7 +223,7 @@ async def _create_ticket_and_attach_files(user_id, msg_text, session, msg, login """Логика генерации темы, отправки в SD и загрузки всех очередей вложений.""" session["step"] = "creating_ticket" try: - ad_user = await asyncio.to_thread(get_ad_user_sync, login) + ad_user = await asyncio.to_thread(get_ad_user_sync, user_id) sd_workflow_logger.info(f"👤 [AD Lookup] User: {login} -> Found: {ad_user is not None}") sender_email = ad_user.get("mail") if ad_user else DEFAULT_REQUESTER city = ad_user.get("city") if ad_user else "Кемерово"