Unfortunately, v2 of the mozillians api doesn’t expose the groups a user is in the users method. However, the users method does still have a group parameter.
This means, in order to establish whether a user is in the nda group, we must query https://mozillians.org/api/v2/users/?email=user@example.com&group=nda
If we have a count of 1, then the user with that email is in the nda group, otherwise the user isn’t in the nda group (or we don’t have an api key with high enough privs to see if they are).
If the user is in the nda group, they should be added to the mozillians_nda group in Discourse, if they aren’t they should be removed from it.
Thanks for that, that bug also alerted me to the fact I should learn to read better, because it turns out the API does allow you to query the users endpoint with a particular group.