Share one Keycloak admin client across parallel team syncs

[jontyms]

Problem

In prod, one team's sync intermittently fails while the team syncing alongside it — same credentials, same second — succeeds:

Processing Team: testing
Processing Team: synced
...
keycloak.exceptions.KeycloakPostError: 400: b'{"error":"invalid_grant","error_description":"Invalid user credentials"}'
ValueError: KEYCLOAK group returned empty: testing
...
Adding ethanperezrivera24 to synced
Processing Team Successful: synced

sync_all_teams runs teams in a ThreadPoolExecutor(max_workers=10), and directory_group_members builds a fresh DirectoryClient() → KeycloakAdmin per call. So each run fires N concurrent password grants for the same service account, and Keycloak rejects some of them.

Fix

githubapp/keycloak.py:

• Build one KeycloakAdmin per process (lazily, under a lock) and hand it to every Keycloak() instance.
• Subclass KeycloakOpenIDConnection so refresh_token() is serialised: a thread that waits on the lock re-checks expires_at and skips the refresh if another thread already did it.

python-keycloak already handles refreshing the shared token on expiry, so the only behavioural change is one login session instead of one per team per run.

Verification

• ruff check / ruff format --check clean.
• Scratch test with KeycloakOpenID.token mocked: 10 threads each constructing Keycloak() and forcing a refresh → 1 client instance, 1 password grant (previously 10).

🤖 Generated with Claude Code

https://claude.ai/code/session_01UGRXmBT8HSsodKUkYXRAZK