Patched code sample

def bool_from_string(s):
    """Helper function to mimic OpenStack's string-to-boolean conversion."""
    if isinstance(s, bool):
        return s
    if not isinstance(s, str):
        s = str(s)
    val = s.strip().lower()
    if val in ('true', 't', 'yes', 'y', '1'):
        return True
    if val in ('false', 'f', 'no', 'n', '0'):
        return False
    # For this example, non-empty but unrecognized strings are truthy,
    # mimicking Python's general behavior which caused the vulnerability.
    # A real implementation might be stricter.
    return len(val) > 0

def _get_user_enabled_status_vulnerable(ldap_user, user_enabled_invert=False):
    """Represents the vulnerable logic."""
    enabled_val = ldap_user.get('enabled', 'TRUE')

    if user_enabled_invert:
        # This path correctly converts to bool before inverting
        return not bool_from_string(enabled_val)
    else:
        # VULNERABILITY: Returns the raw string "FALSE", which is truthy
        return enabled_val

def _get_user_enabled_status_fixed(ldap_user, user_enabled_invert=False):
    """Represents the fixed logic."""
    enabled_val = ldap_user.get('enabled', 'TRUE')

    # FIX: The string value from LDAP is *always* converted to a boolean first.
    is_enabled = bool_from_string(enabled_val)

    # The inversion logic is then applied to the boolean result.
    if user_enabled_invert:
        return not is_enabled
    else:
        return is_enabled