SSO: re-sync VCS accounts for SSO organization daily

readthedocs/oauth/tasks.py

@@ -6,14 +6,17 @@
 from django.contrib.auth.models import User
 from django.utils.translation import ugettext_lazy as _
 
+from readthedocs.core.permissions import AdminPermission
 from readthedocs.core.utils.tasks import PublicTask, user_id_matches
 from readthedocs.oauth.notifications import (
     AttachWebhookNotification,
     InvalidProjectWebhookNotification,
 )
 from readthedocs.oauth.services.base import SyncServiceError
 from readthedocs.oauth.utils import SERVICE_MAP
+from readthedocs.organizations.models import Organization
 from readthedocs.projects.models import Project
+from readthedocs.sso.models import SSOIntegration
 from readthedocs.worker import app
 
 from .services import registry
@@ -49,6 +52,53 @@ def sync_remote_repositories(user_id):
         )
 
 
+@app.task(queue='web')
+def sync_remote_repositories_organizations(organization_slugs=None):
+    """
+    Re-sync users member of organizations.
+
+    It will trigger one `sync_remote_repositories` task per user.
+
+    :param organization_slugs: list containg organization's slugs to sync. If
+    not passed, all organizations with ALLAUTH SSO enabled will be synced
+
+    :type organization_slugs: list
+    """
+    if organization_slugs:
+        query = Organization.objects.filter(slug__in=organization_slugs)
+        log.info(
+            'Triggering SSO re-sync for organizations. slugs=%s count=%s',
+            organization_slugs,
+            query.count(),
+        )
+    else:
+        log.info(
+            'Triggering SSO re-sync for all organizations. count=%s',
+            query.count(),
+        )
+        query = (
+            SSOIntegration.objects
+            .filter(provider=SSOIntegration.PROVIDER_ALLAUTH)
+            .values_list('organization', flat=True)
+        )
+
+    n_task = -1
+    for organization in query:
+        members = AdminPermission.members(organization)
+        log.info(
+            'Triggering SSO re-sync for organization. organization=%s users=%s',
+            organization.slug,
+            members.count(),
+        )
+        for user in members:
+            n_task += 1
+            sync_remote_repositories.delay(
+                user.pk,
+                # delay the task by 0, 5, 10, 15, ... seconds
+                countdown=n_task * 5,
+            )
+
+
 @app.task(queue='web')
 def attach_webhook(project_pk, user_pk, integration=None):
     """

readthedocs/settings/base.py

@@ -422,6 +422,11 @@ def TEMPLATES(self):
             'schedule': crontab(minute=0, hour=1),
             'options': {'queue': 'web'},
         },
+        'every-day-resync-sso-organization-users': {
+            'task': 'readthedocs.oauth.tasks.sync_remote_repositories_organizations',
+            'schedule': crontab(minute=0, hour=4),
+            'options': {'queue': 'web'},
+        },
         'hourly-archive-builds': {
             'task': 'readthedocs.builds.tasks.archive_builds',
             'schedule': crontab(minute=30),