fix: botfilter for user sync

Author: raederan

docs/tools/user-sync.md

@@ -55,7 +55,9 @@ only core identity plus email.
 
 1. Enumerate MediaWiki accounts, skipping bots and privileged groups
    (`bot`, `sysop`, `bureaucrat`, `interface-admin`) and MediaWiki reserved
-   system usernames.
+   system usernames. Accounts whose username is an exact ORCID iD are exempt
+   from the group filter (so a person's own admin account is synced); other
+   accounts, such as `<orcid>@bot`, are still excluded by their groups.
 2. Enrich ORCID users from `https://pub.orcid.org/v3.0/<id>`: names and email
    always; researcher URLs and affiliations only when their flag is enabled.
 3. Map each account to a proposed `User` item with a deterministic id

pyproject.toml

@@ -86,6 +86,9 @@ workflow = [
 ]
 tutorial = ["osw[dataimport]"]
 all = ["osw[dataimport,DB,UI,S3,wikitext]"]
+examples = [
+    "python-dotenv>=1.2.4",
+]
 
 [build-system]
 requires = ["hatchling"]

src/osw/tools/user_sync/sources.py

@@ -105,7 +105,10 @@ def enumerate_mw_users(
 
     Args:
         site: An object exposing ``api("query", ...)`` (an mwclient Site).
-        excluded_groups: Accounts in any of these groups are skipped (bots, admins).
+        excluded_groups: Accounts in any of these groups are skipped (bots, admins),
+            unless the username is an exact ORCID iD (a person's own account).
+            Bot accounts derived from an ORCID (e.g. ``<orcid>@bot``) are not exact
+            ORCID iDs and stay excluded.
         excluded_usernames: Exact usernames to skip (reserved system accounts).
         include_orcid: If False, skip ORCID-username accounts.
         include_non_orcid: If False, keep only ORCID-username accounts.
@@ -119,7 +122,7 @@ def enumerate_mw_users(
         user = MwUser.from_api(raw)
         if user.name in excluded_names:
             continue
-        if excluded.intersection(user.groups):
+        if not user.is_orcid and excluded.intersection(user.groups):
             continue
         if not include_non_orcid and not user.is_orcid:
             continue

tests/tools/test_user_sync_sources.py

@@ -110,6 +110,19 @@ def test_enumerate_excludes_privileged_groups_and_reserved_names():
     assert [u.name for u in users] == ["0000-0002-6374-9831"]
 
 
+def test_enumerate_keeps_orcid_accounts_despite_excluded_groups():
+    site = FakeSite([
+        _page([
+            {"name": "0000-0001-7620-1245", "groups": ["user", "bot", "sysop"]},
+            {"name": "0000-0001-7620-1245@importer", "groups": ["user", "bot"]},
+            {"name": "SomeBot", "groups": ["user", "bot"]},
+            {"name": "Admin", "groups": ["user", "sysop"]},
+        ])
+    ])
+    users = enumerate_mw_users(site, excluded_groups=("bot", "sysop"))
+    assert [u.name for u in users] == ["0000-0001-7620-1245"]
+
+
 def test_enumerate_mw_only_skips_orcid():
     site = FakeSite([
         _page([