From 520ccc7bd8d572d915b3cbcf301009ac72b5f67b Mon Sep 17 00:00:00 2001
From: David Soria Parra <dsp@users.noreply.github.com>
Date: Fri, 20 Feb 2026 00:22:17 +0000
Subject: [PATCH] fix: ignoreChanges on all user-managed fields for GWS users

After creation/import we only care that the user exists and is in the
right groups. All profile settings (name, recovery info, password,
org unit, etc.) are left to users and admins to manage directly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 src/google.ts | 67 +++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 65 insertions(+), 2 deletions(-)

diff --git a/src/google.ts b/src/google.ts
index 74b5713..a04139e 100644
--- a/src/google.ts
+++ b/src/google.ts
@@ -89,7 +89,39 @@ MEMBERS.forEach((member) => {
         name: { familyName: member.lastName!, givenName: member.firstName! },
         orgUnitPath: mcpOrgUnit.orgUnitPath,
       },
-      { import: primaryEmail, dependsOn: [mcpOrgUnit], ignoreChanges: ['recoveryEmail', 'recoveryPhone'] }
+      {
+        import: primaryEmail,
+        dependsOn: [mcpOrgUnit],
+        ignoreChanges: [
+          'recoveryEmail',
+          'recoveryPhone',
+          'password',
+          'hashFunction',
+          'changePasswordAtNextLogin',
+          'orgUnitPath',
+          'archived',
+          'suspended',
+          'isAdmin',
+          'includeInGlobalAddressList',
+          'ipAllowlist',
+          'addresses',
+          'aliases',
+          'customSchemas',
+          'emails',
+          'externalIds',
+          'ims',
+          'keywords',
+          'languages',
+          'locations',
+          'organizations',
+          'phones',
+          'posixAccounts',
+          'relations',
+          'sshPublicKeys',
+          'websites',
+          'name',
+        ],
+      }
     );
     provisionedUsersByEmail[primaryEmail] = user;
   } else {
@@ -112,7 +144,38 @@ MEMBERS.forEach((member) => {
         changePasswordAtNextLogin: true,
         orgUnitPath: mcpOrgUnit.orgUnitPath,
       },
-      { dependsOn: [mcpOrgUnit] }
+      {
+        dependsOn: [mcpOrgUnit],
+        ignoreChanges: [
+          'recoveryEmail',
+          'recoveryPhone',
+          'password',
+          'hashFunction',
+          'changePasswordAtNextLogin',
+          'orgUnitPath',
+          'archived',
+          'suspended',
+          'isAdmin',
+          'includeInGlobalAddressList',
+          'ipAllowlist',
+          'addresses',
+          'aliases',
+          'customSchemas',
+          'emails',
+          'externalIds',
+          'ims',
+          'keywords',
+          'languages',
+          'locations',
+          'organizations',
+          'phones',
+          'posixAccounts',
+          'relations',
+          'sshPublicKeys',
+          'websites',
+          'name',
+        ],
+      }
     );
     provisionedUsersByEmail[primaryEmail] = user;