modelcontextprotocol/access
Watch
1
0
Fork
You've already forked access
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Add Google Workspace user account provisioning (#66)

Browse source 
* Add Google Workspace user account provisioning

* Fix validation: remove stale skipGoogleUserProvisioning from a-akimov, add it for BobDickinson

- a-akimov: had skipGoogleUserProvisioning but is not in a provisionUser role (DOCS_MAINTAINERS)
- BobDickinson: is in REGISTRY_MAINTAINERS (provisionUser role) but missing Google user fields
This commit is contained in:
David Soria Parra 2026-02-19 22:17:25 +00:00 • committed by GitHub
commit 2de77b8684
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 502 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

66
scripts/validate-config.ts
View file

@ -98,6 +98,72 @@ console.log('Validating member ordering in users.ts...');
}
}
// Validate Google Workspace user provisioning fields
console.log('Validating Google Workspace user provisioning fields...');
{
const googleEmailPrefixes = new Map<string, string>();
for (const member of MEMBERS) {
const memberId = member.github || member.email || 'unknown';
// Members with googleEmailPrefix must also have firstName and lastName
if (member.googleEmailPrefix) {
if (!member.firstName) {
console.error(`ERROR: Member "${memberId}" has googleEmailPrefix but is missing firstName`);
hasErrors = true;
}
if (!member.lastName) {
console.error(`ERROR: Member "${memberId}" has googleEmailPrefix but is missing lastName`);
hasErrors = true;
}
// Check uniqueness of googleEmailPrefix
const existing = googleEmailPrefixes.get(member.googleEmailPrefix);
if (existing) {
console.error(
`ERROR: googleEmailPrefix "${member.googleEmailPrefix}" is used by both "${existing}" and "${memberId}"`
);
hasErrors = true;
} else {
googleEmailPrefixes.set(member.googleEmailPrefix, memberId);
}
}
// Members in provisionUser roles without all three fields won't get a GWS account
const inProvisionUserRole = member.memberOf.some((roleId: RoleId) => {
const role = roleLookup.get(roleId);
return role?.google?.provisionUser === true;
});
const hasProvisioningFields = !!(
member.googleEmailPrefix &&
member.firstName &&
member.lastName
);
if (member.skipGoogleUserProvisioning && !inProvisionUserRole) {
console.error(
`ERROR: Member "${memberId}" has skipGoogleUserProvisioning=true but is not in a provisionUser role`
);
hasErrors = true;
}
if (inProvisionUserRole && hasProvisioningFields && member.skipGoogleUserProvisioning) {
console.error(
`ERROR: Member "${memberId}" has provisioning fields and skipGoogleUserProvisioning=true; pick one`
);
hasErrors = true;
}
if (inProvisionUserRole && !hasProvisioningFields && !member.skipGoogleUserProvisioning) {
console.error(
`ERROR: Member "${memberId}" is in a provisionUser role but is missing Google user fields. Add fields or set skipGoogleUserProvisioning: true`
);
hasErrors = true;
}
}
}
// Validate parent role references in roles.ts
console.log('Validating parent role references in roles.ts...');
for (const role of ROLES) {