From d812d9b2b26bcb09b4f8568a5a9a6cefbe25ed2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=94=D0=B5=D0=BD=D0=B8=D1=81=20=D0=9A=D1=80=D0=B8=D0=B2?=
 =?UTF-8?q?=D0=BE=D1=87=D0=B5=D0=BD=D0=BA=D0=BE?= <d.krivochenko@sibcem.ru>
Date: Thu, 23 Jul 2026 10:18:42 +0700
Subject: [PATCH] fix: validate AD email match to prevent wrong requester
 fallback

---
 service_desk/handlers.py | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/service_desk/handlers.py b/service_desk/handlers.py
index 3f77bbe..581f8ef 100644
--- a/service_desk/handlers.py
+++ b/service_desk/handlers.py
@@ -73,19 +73,30 @@ sd_sessions = {}
 def get_ad_user_sync(user_id: str):
     """Ищем по email/UPN (search_by_user_id), НЕ по sAMAccountName.
     user_id из TrueConf — обычно email вида 'login@tcs.sibcem.ru'.
-    Функция сама заменит @tcs.sibcem.ru на @sibcem.ru и найдёт правильную учётку."""
+    Функция сама заменит @tcs.sibcem.ru на @sibcem.ru и найдёт правильную учётку.
+    ВАЖНО: если найденный пользователь не совпадает с запрошенным по email — возвращаем None."""
     try:
         from utils.ad_search import search_by_user_id
         entries = search_by_user_id(user_id, ["displayName", "mail", "l", "userAccountControl"])
-        if entries:
-            user = entries[0]
-            uac = user.userAccountControl.value if 'userAccountControl' in user else 0
-            return {
-                "name": user.displayName.value if 'displayName' in user else user_id,
-                "mail": user.mail.value if 'mail' in user else None,
-                "city": user.l.value if 'l' in user else "Кемерово",
-                "is_disabled": bool(uac & 2)
-            }
+        if not entries:
+            return None
+        user = entries[0]
+        mail = user.mail.value if 'mail' in user else None
+        if not mail:
+            return None
+        # Валидация: извлекаем логин из user_id и из mail, сравниваем
+        req_login = user_id.split("@")[0] if "@" in user_id else user_id
+        mail_login = mail.split("@")[0] if "@" in mail else mail
+        if req_login.lower() != mail_login.lower():
+            logger.info(f"AD user mismatch: requested login={req_login}, found mail={mail} (login={mail_login})")
+            return None
+        uac = user.userAccountControl.value if 'userAccountControl' in user else 0
+        return {
+            "name": user.displayName.value if 'displayName' in user else user_id,
+            "mail": mail,
+            "city": user.l.value if 'l' in user else "Кемерово",
+            "is_disabled": bool(uac & 2)
+        }
     except Exception as e:
         logger.error(f"Ошибка LDAP: {e}")
     return None