fix: make auth source group sync correctly handle team removal (#37161)

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

services/auth/source/source_group_sync.go

@@ -6,6 +6,7 @@ package source
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"gitea.dev/models/organization"
 	user_model "gitea.dev/models/user"
@@ -45,21 +46,38 @@ func SyncGroupsToTeamsCached(ctx context.Context, user *user_model.User, sourceU
 	return nil
 }
 
-func resolveMappedMemberships(sourceUserGroups container.Set[string], sourceGroupTeamMapping map[string]map[string][]string) (map[string][]string, map[string][]string) {
-	membershipsToAdd := map[string][]string{}
-	membershipsToRemove := map[string][]string{}
-	for group, memberships := range sourceGroupTeamMapping {
+func resolveMappedMemberships(sourceUserGroups container.Set[string], groupOrgTeamsMapping map[string]map[string][]string) (membershipsToAdd, membershipsToRemove map[string][]string) {
+	membershipsToAdd, membershipsToRemove = map[string][]string{}, map[string][]string{}
+	for group, orgTeams := range groupOrgTeamsMapping {
 		isUserInGroup := sourceUserGroups.Contains(group)
 		if isUserInGroup {
-			for org, teams := range memberships {
-				membershipsToAdd[org] = append(membershipsToAdd[org], teams...)
+			for org, teams := range orgTeams {
+				for _, teamName := range teams {
+					membershipsToAdd[org] = append(membershipsToAdd[org], strings.ToLower(teamName))
+				}
 			}
 		} else {
-			for org, teams := range memberships {
-				membershipsToRemove[org] = append(membershipsToRemove[org], teams...)
+			for org, teams := range orgTeams {
+				for _, teamName := range teams {
+					membershipsToRemove[org] = append(membershipsToRemove[org], strings.ToLower(teamName))
+				}
 			}
 		}
 	}
+
+	// If another group grants the same team (to add), don't remove it
+	for org, removeTeams := range membershipsToRemove {
+		removeTeamSet := container.SetOf(removeTeams...)
+		removedCount := removeTeamSet.RemoveFromSlice(membershipsToAdd[org])
+		if removedCount > 0 {
+			removeTeams = removeTeamSet.Values()
+			membershipsToRemove[org] = removeTeams
+			if len(removeTeams) == 0 {
+				delete(membershipsToRemove, org)
+			}
+		}
+	}
+
 	return membershipsToAdd, membershipsToRemove
 }
 
@@ -106,6 +124,10 @@ func syncGroupsToTeamsCached(ctx context.Context, user *user_model.User, orgTeam
 				}
 			} else if action == syncRemove && isMember {
 				if err := org_service.RemoveTeamMember(ctx, team, user); err != nil {
+					if organization.IsErrLastOrgOwner(err) {
+						log.Warn("group sync: Skipping removal of last owner in org %s for user %s: %v", org.Name, user.Name, err)
+						continue
+					}
 					log.Error("group sync: Could not remove user from team: %v", err)
 					return err
 				}