Tiered LDAP groups

membership/members/billing.py

@@ -12,6 +12,7 @@ from django.utils import timezone
 from .directory import reconcile_groups
 from .models import Account, CryptoInvoice, ManagedGroup, Subscription, WebhookEvent
 from . import shkeeper
+from .service_groups import configured_groups
 
 logger = logging.getLogger(__name__)
 
@@ -101,6 +102,9 @@ def apply_groups(account):
         if tier:
             desired.add(tier["group_dn"])
             membership_level = max(membership_level, tier.get("level", 0))
+    # Compute from paid time on this pass, never the cached account level or
+    # Dex claims. Level 0 is selected only when no paid entitlement remains.
+    desired.update(settings.MEMBERSHIP_SERVICE_GROUPS.get(str(membership_level), []))
     managed = set(ManagedGroup.objects.filter(account=account).values_list("dn", flat=True))
     account.ldap_dn = reconcile_groups(account, desired, managed) if managed else account.ldap_dn
     account.last_ldap_sync = now
@@ -122,8 +126,8 @@ def sync_account(account_id, refresh_stripe=True):
     # which old groups to revoke, even after the tier is removed from config.
     with transaction.atomic():
         account = Account.objects.select_for_update().get(pk=account_id)
-        for tier in settings.MEMBERSHIP_TIERS.values():
-            ManagedGroup.objects.get_or_create(account=account, dn=tier["group_dn"])
+        for dn in configured_groups(settings.MEMBERSHIP_TIERS, settings.MEMBERSHIP_SERVICE_GROUPS):
+            ManagedGroup.objects.get_or_create(account=account, dn=dn)
     with transaction.atomic():
         account = Account.objects.select_for_update().get(pk=account_id)
         # Never hold local expiry hostage to an invoice-history API read.