Fix semantics of group mapping query (#29738)

* test case

* fix query and split out test case

src/metabase/integrations/common.clj

@@ -25,9 +25,11 @@
         user-id            (u/the-id user-or-id)
         current-group-ids  (when (seq mapped-group-ids)
                              (t2/select-fn-set :group_id PermissionsGroupMembership
-                                               :user_id  user-id
-                                               :group_id [:in mapped-group-ids]
-                                               :group_id [:not-in excluded-group-ids]))
+                                               {:where
+                                                [:and
+                                                 [:= :user_id user-id]
+                                                 [:in :group_id mapped-group-ids]
+                                                 [:not-in :group_id excluded-group-ids]]}))
         new-group-ids      (set/intersection (set (map u/the-id new-groups-or-ids))
                                              mapped-group-ids)
         ;; determine what's different between current mapped groups and new mapped groups

test/metabase/integrations/common_test.clj

@@ -107,6 +107,13 @@
         (with-user-in-groups [user []]
           (integrations.common/sync-group-memberships! user #{(perms-group/admin)} #{(perms-group/admin)})
           (is (= #{"All Users" "Administrators"}
+                 (group-memberships user)))))
+
+      (testing "unmapped admin group is ignored even if other groups are added (#29718)"
+        (with-user-in-groups [group {:name (str ::group)}
+                              user  [(perms-group/admin)]]
+          (integrations.common/sync-group-memberships! user #{group} #{group})
+          (is (= #{"All Users" "Administrators" ":metabase.integrations.common-test/group"}
                  (group-memberships user)))))))
 
   (testing "Make sure the delete last admin exception is catched"