Fix: Remove disabled users from the lookup server

lib/AppInfo/Application.php

@@ -15,6 +15,7 @@
 use OCA\GlobalSiteSelector\GlobalSiteSelector;
 use OCA\GlobalSiteSelector\Listeners\AddContentSecurityPolicyListener;
 use OCA\GlobalSiteSelector\Listeners\DeletingUser;
+use OCA\GlobalSiteSelector\Listeners\UserChanged;
 use OCA\GlobalSiteSelector\Listeners\UserCreated;
 use OCA\GlobalSiteSelector\Listeners\UserDeleted;
 use OCA\GlobalSiteSelector\Listeners\UserLoggedOut;
@@ -36,6 +37,7 @@
 use OCP\Server;
 use OCP\User\Events\BeforeUserDeletedEvent;
 use OCP\User\Events\BeforeUserLoggedInEvent;
+use OCP\User\Events\UserChangedEvent;
 use OCP\User\Events\UserCreatedEvent;
 use OCP\User\Events\UserDeletedEvent;
 use OCP\User\Events\UserLoggedOutEvent;
@@ -76,6 +78,7 @@ public function register(IRegistrationContext $context): void {
 		);
 
 		// events on slave
+		$context->registerEventListener(UserChangedEvent::class, UserChanged::class);
 		$context->registerEventListener(UserCreatedEvent::class, UserCreated::class);
 		$context->registerEventListener(BeforeUserDeletedEvent::class, DeletingUser::class);
 		$context->registerEventListener(UserDeletedEvent::class, UserDeleted::class);

lib/Listeners/UserChanged.php

@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\GlobalSiteSelector\Listeners;
+
+use OCA\GlobalSiteSelector\GlobalSiteSelector;
+use OCA\GlobalSiteSelector\Slave;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\User\Events\UserChangedEvent;
+
+/**
+ * @template-implements IEventListener<UserChangedEvent>
+ */
+class UserChanged implements IEventListener {
+
+	public function __construct(
+		private GlobalSiteSelector $globalSiteSelector,
+		private Slave $slave,
+	) {
+	}
+
+	/**
+	 * @param Event $event
+	 */
+	public function handle(Event $event): void {
+		if (!$event instanceof UserChangedEvent) {
+			return;
+		}
+
+		/** only used in slave mode */
+		if (!$this->globalSiteSelector->isSlave()) {
+			return;
+		}
+
+		if ($event->getFeature() !== 'enabled') {
+			return;
+		}
+
+		// updateUser() routes enabled→add, disabled→remove
+		$this->slave->updateUser($event->getUser());
+	}
+}

lib/Slave.php

@@ -99,6 +99,11 @@ public function updateUser(IUser $user): void {
 			]
 		);
 
+		if (!$user->isEnabled()) {
+			$this->removeUsers([$user->getCloudId()]);
+			return;
+		}
+
 		$userData = [];
 		$userData[$user->getCloudId()] = $this->slaveService->getAccountData($user);
 		$this->addUsers($userData);
@@ -158,18 +163,31 @@ public function batchUpdate(): void {
 		foreach ($backends as $backend) {
 			$limit = 200;
 			$offset = 0;
-			$usersData = [];
 			do {
-
 				$users = $backend->getUsers('', $limit, $offset);
+
+				$usersToAdd = [];
+				$usersToRemove = [];
 				foreach ($users as $uid) {
 					$user = $this->userManager->get($uid);
-					if ($user !== null) {
-						$usersData[$user->getCloudId()] = $this->slaveService->getAccountData($user);
+					if ($user === null) {
+						continue;
 					}
+					if ($user->isEnabled()) {
+						$usersToAdd[$user->getCloudId()] = $this->slaveService->getAccountData($user);
+					} else {
+						$usersToRemove[] = $user->getCloudId();
+					}
+				}
+
+				if ($usersToAdd !== []) {
+					$this->addUsers($usersToAdd);
 				}
+				if ($usersToRemove !== []) {
+					$this->removeUsers($usersToRemove);   // one DELETE per page, not per user
+				}
+
 				$offset += $limit;
-				$this->addUsers($usersData);
 			} while (count($users) >= $limit);
 		}
 	}

tests/unit/lib/SlaveTest.php

@@ -0,0 +1,85 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\GlobalSiteSelector\Tests\Unit;
+
+use OCA\GlobalSiteSelector\GlobalSiteSelector;
+use OCA\GlobalSiteSelector\Lookup;
+use OCA\GlobalSiteSelector\Service\SlaveService;
+use OCA\GlobalSiteSelector\Slave;
+use OCP\Http\Client\IClient;
+use OCP\Http\Client\IClientService;
+use OCP\IConfig;
+use OCP\IUser;
+use OCP\IUserManager;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+
+class SlaveTest extends TestCase {
+	private $client;
+	private $slaveService;
+	private Slave $slave;
+
+	protected function setUp(): void {
+		parent::setUp();
+
+		$clientService = $this->createMock(IClientService::class);
+		$this->client = $this->createMock(IClient::class);
+		$clientService->method('newClient')->willReturn($this->client);
+
+		$this->slaveService = $this->createMock(SlaveService::class);
+		$lookup = $this->createMock(Lookup::class);
+		$lookup->method('configureClient')->willReturnArgument(0); // pass options through
+
+		$gss = $this->createMock(GlobalSiteSelector::class);
+		$gss->method('isSlave')->willReturn(true);            // checkConfiguration() passes
+		$gss->method('getLookupServerUrl')->willReturn('https://lookup.test');
+		$gss->method('getMode')->willReturn('slave');
+		$gss->method('getJwtKey')->willReturn('secret');
+
+		$this->slave = new Slave(
+			$this->createMock(IUserManager::class),
+			$clientService,
+			$this->slaveService,
+			$lookup,
+			$gss,
+			$this->createMock(LoggerInterface::class),
+			$this->createMock(IConfig::class),
+		);
+	}
+
+	public function testEnabledUserIsPushed(): void {
+		$user = $this->createMock(IUser::class);
+		$user->method('isEnabled')->willReturn(true);
+		$user->method('getCloudId')->willReturn('alice@slave.test');
+		$this->slaveService->method('getAccountData')->willReturn(['id' => 'alice@slave.test']);
+
+		$this->client->expects($this->once())->method('post');
+		$this->client->expects($this->never())->method('delete');
+
+		$this->slave->updateUser($user);
+	}
+
+	public function testDisabledUserIsRemoved(): void {
+		$user = $this->createMock(IUser::class);
+		$user->method('isEnabled')->willReturn(false);
+		$user->method('getCloudId')->willReturn('bob@slave.test');
+
+		$this->client->expects($this->never())->method('post');
+		$this->client->expects($this->once())->method('delete')->with(
+			$this->anything(),
+			$this->callback(function (array $opts): bool {
+				$body = json_decode($opts['body'] ?? '{}', true);
+				return in_array('bob@slave.test', $body['users'] ?? [], true);
+			})
+		);
+
+		$this->slave->updateUser($user);
+	}
+}