Use SAML provider display names for synced orgs (#45)

## Summary
- use sanitized SAML auth provider display names in synced org names
instead of configID
- carry provider display names through parsed SAML memberships
- update org sync fixtures for the renamed target orgs

## Test plan
- uv run tests/run.py --local

---------

Co-authored-by: Amp <amp@ampcode.com>

Author: marcleblanc2

src/src_auth_perms_sync/orgs/sync.py

@@ -37,6 +37,7 @@
 
 _ALREADY_MEMBER_TEXT = "user is already a member of the organization"
 _ORGANIZATION_EXISTS_TEXT = "organization name is already taken"
+_ONLY_MEMBER_TEXT = "remove the only member of an organization"
 
 # Re-exported here for callers that think in org-sync terms; the naming
 # rule lives in shared.saml_groups so user compaction can share it.
@@ -424,6 +425,8 @@ def _apply_organization_sync(
             "remove",
             parallelism,
             worker_pool,
+            current_user=sync_state.current_user,
+            targets=sync_state.targets,
         )
     return _OrganizationApplyResult(
         creates=create_counts,
@@ -1272,6 +1275,9 @@ def _apply_user_changes(
     change_kind: organization_types.OrganizationChangeKind,
     parallelism: int,
     worker_pool: ThreadPoolExecutor | None = None,
+    *,
+    current_user: organization_types.OrgMember | None = None,
+    targets: dict[str, organization_types.TargetOrganization] | None = None,
 ) -> shared_types.MutationCounts:
     if not changes:
         return shared_types.MutationCounts()
@@ -1292,6 +1298,8 @@ def apply_change(change: organization_types.OrganizationUserChange) -> None:
                 change,
                 current_states[change.organization_name],
                 change_kind,
+                current_user=current_user,
+                target=targets.get(change.organization_name) if targets is not None else None,
             )
 
         def record_result(
@@ -1353,6 +1361,9 @@ def _apply_user_change(
     change: organization_types.OrganizationUserChange,
     state: organization_types.OrganizationState,
     change_kind: organization_types.OrganizationChangeKind,
+    *,
+    current_user: organization_types.OrgMember | None = None,
+    target: organization_types.TargetOrganization | None = None,
 ) -> None:
     if state.id is None:
         raise RuntimeError(f"organization {change.organization_name!r} has no ID")
@@ -1382,10 +1393,60 @@ def _apply_user_change(
         organization_name=change.organization_name,
         username=change.username,
     ):
-        client.graphql(
-            queries.MUTATION_REMOVE_USER_FROM_ORGANIZATION,
-            {"organization": state.id, "user": change.user_id},
-        )
+        try:
+            client.graphql(
+                queries.MUTATION_REMOVE_USER_FROM_ORGANIZATION,
+                {"organization": state.id, "user": change.user_id},
+            )
+        except src.GraphQLError as exception:
+            if not _should_retry_last_member_removal(
+                exception, change, state, target, current_user
+            ):
+                raise
+            _remove_last_other_member_via_current_user(client, change, state, current_user)
+
+
+def _should_retry_last_member_removal(
+    exception: src.GraphQLError,
+    change: organization_types.OrganizationUserChange,
+    state: organization_types.OrganizationState,
+    target: organization_types.TargetOrganization | None,
+    current_user: organization_types.OrgMember | None,
+) -> bool:
+    return (
+        _ONLY_MEMBER_TEXT in str(exception)
+        and current_user is not None
+        and target is not None
+        and not target.desired_members_by_id
+        and change.user_id != current_user["id"]
+        and len(state.members_by_id) == 1
+        and change.user_id in state.members_by_id
+    )
+
+
+def _remove_last_other_member_via_current_user(
+    client: src.SourcegraphClient,
+    change: organization_types.OrganizationUserChange,
+    state: organization_types.OrganizationState,
+    current_user: organization_types.OrgMember | None,
+) -> None:
+    if current_user is None:
+        raise RuntimeError("current user is required for last-member org cleanup")
+    log.info(
+        "  Sourcegraph forbids removing %s as the only member of org %s; "
+        "temporarily adding current user %s so the stale synced org can be emptied.",
+        change.username,
+        change.organization_name,
+        current_user["username"],
+    )
+    temporary_membership = organization_types.OrganizationUserChange(
+        organization_name=change.organization_name,
+        user_id=current_user["id"],
+        username=current_user["username"],
+    )
+    _apply_user_change(client, temporary_membership, state, "add")
+    _apply_user_change(client, change, state, "remove")
+    _apply_user_change(client, temporary_membership, state, "remove")
 
 
 def _snapshot_from_states(

tests/e2e/case_runner.py

@@ -721,7 +721,10 @@ def _add_user_to_organization(self, variables: dict[str, object]) -> None:
     def _remove_user_from_organization(self, variables: dict[str, object]) -> None:
         organization = self._organization_by_graphql_id(variables["organization"])
         username = self._username_from_user_graphql_id(variables["user"])
-        self._organization_members_by_id[organization["id"]].discard(username)
+        members = self._organization_members_by_id[organization["id"]]
+        if len(members) == 1 and username != self._current_username:
+            raise src.GraphQLError("you can't remove the only member of an organization")
+        members.discard(username)
         self._mutation_count += 1
 
     def _organization_by_graphql_id(self, organization_id_value: object) -> FixtureOrganization:

tests/run.py

@@ -138,7 +138,7 @@
 query TestSamlAuthProviders {
   site {
     authProviders {
-      nodes { serviceType serviceID clientID configID }
+      nodes { serviceType serviceID clientID displayName configID }
     }
   }
 }
@@ -1951,12 +1951,14 @@ def run_seeded_org_sync_check(self, environment: dict[str, str]) -> None:
             for group in groups:
                 members_by_group.setdefault(group, set()).add(username)
         expected_members_by_organization = {
-            organization_name_for_saml_group(provider["configID"], group): usernames
+            organization_name_for_saml_group(provider["displayName"], group): usernames
             for group, usernames in members_by_group.items()
         }
 
         seeded_group = min(members_by_group)
-        seeded_organization = organization_name_for_saml_group(provider["configID"], seeded_group)
+        seeded_organization = organization_name_for_saml_group(
+            provider["displayName"], seeded_group
+        )
         # The sync must REMOVE this member: no SAML group puts them in the org.
         unjustified_member = next(
             username

tests/tests.yaml

@@ -1379,8 +1379,8 @@ cases:
       Scoped org sync converges from the old configID-based org name to
       the display-name-based org name: repo grants are already converged,
       but org sync creates the display-name org, removes the creator's
-      auto-membership, adds the scoped user, and removes that user from
-      the old synced org.
+      auto-membership, adds the scoped user, and empties the old synced
+      org via a temporary current-user membership.
     modes:
       - local
     args:
@@ -1389,7 +1389,7 @@ cases:
         - test_user_09991
       sync_saml_orgs: true
       apply: true
-    expectedMutations: 4
+    expectedMutations: 6
 
   sync-saml-orgs-full-cleanup:
     # scope:
@@ -1401,19 +1401,21 @@ cases:
     #   reads:
     #     users: all
     #     orgMembers: all
-    #   writes: 4 mutations
+    #   writes: 6 mutations
     description: >-
       Standalone full org sync converges synced orgs both ways: creates the
       org a SAML group requires (cleaning up the creator's auto-membership)
       and empties - but never deletes - a synced org whose SAML group
-      disappeared from every user's assertion.
+      disappeared from every user's assertion, using a temporary
+      current-user membership when Sourcegraph rejects removing another
+      user's final org membership.
     modes:
       - local
     args:
       command: sync_saml_orgs
       full: true
       apply: true
-    expectedMutations: 4
+    expectedMutations: 6
 
   sync-saml-orgs-users-scoped:
     # scope: