Pseudocode of how we might implement group permission syncing in DoC GitLab for iBUG

gitlab_ibug_hook.py

users  # all the users in the universe
ibug_group  # let's pretend this it the group that is iBUG
ibug_users  # list of users that are in iBUG


def on_user_add(group, new_user):
	group.add_user(new_user)
	if group == ibug_group
		sync_user_permissions(ibug_group)


def on_user_del(group, leaving_user):
	group.rm_user(leaving_user)
	if group == ibug_group
		sync_group_permissions(ibug_group)  # group is ibug


def on_repo_add(creator, namespace, repo):
    namespace.add_repo(creator, repo) # add the repo as normal regardless
    if namespace.is_user_ns()
        # only care if the repo is added under an individual user
        # as opposed to a group (permissions are handled for us there
        # already by GitLab)
        if creator is in ibug_users:
            # great! An iBUG user is making a personal repo. 
            # Lets sync the permissions for them.
            update_permissions_on_repo_for_group(repo, ibug_group)


def update_permissions_on_repo_for_group(repo, group):
    for user in group:
        repo.add_user_with_permissions(user, 'readonly')


def sync_group_permissions(group):
    for user in group:
        for repo in user.repos:
            update_permissions_on_repo_for_group(repo, group)