add cli for expiring members

ceo/cli/members.py

@@ -187,3 +187,18 @@ def delete(username):
     click.confirm(f"Are you sure you want to delete {username}?", abort=True)
     resp = http_delete(f'/api/members/{username}')
     handle_stream_response(resp, DeleteMemberTransaction.operations)
+
+
+@members.command(short_help="Check for and mark expired members")
+@click.option('--dry-run', is_flag=True, default=False)
+def expire(dry_run):
+    resp = http_post(f'/api/members/expire?dry_run={dry_run and "yes" or "no"}')
+    result = handle_sync_response(resp)
+
+    if len(result) > 0:
+        if dry_run:
+            click.echo("The following members will be marked as expired:")
+        else:
+            click.echo("The following members has been marked as expired:")
+        for usernmae in result:
+            click.echo(f" * {username}")

ceod/model/LDAPService.py

@@ -259,7 +259,7 @@ class LDAPService:
             query.append(f'term={last_term}')
             query.append(f'nonMemberTerm={last_term}')
 
-        query = '(!(|(' + ')('.join(query) + ')))'
+        query = '(!(|(shadowExpire=1)(' + ')('.join(query) + ')))'
 
         conn = self._get_ldap_conn()
         conn.search(