modelcontextprotocol/access
Watch
1
0
Fork
You've already forked access
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: provision GWS accounts for implicit maintainers (SDK teams, WGs)

Browse source 
GWS user accounts were only created for members whose direct roles had
google.provisionUser (lead/core maintainers, moderators, maintainers,
registry-wg). SDK maintainers and working-group members who opted in by
adding firstName/lastName/googleEmailPrefix (e.g. #148, #150, #152)
silently got no account.

- Move provisionUser from GoogleConfig to the Role level, and add it to
  the implicit-maintainer containers (sdk-maintainers, working-groups)
  plus the standalone maintainer roles (docs, inspector, mcpb,
  reference-servers, use-mcp, server-identity-wg, wg/ig facilitators).
- Eligibility now walks github.parent chains (hasProvisionUserRole),
  matching GitHub team-nesting semantics, so e.g. python-sdk members
  qualify via sdk-maintainers.
- validate-config now errors when a googleEmailPrefix would be a silent
  no-op (no eligible role and not an existing GWS user), so opt-in PRs
  like #150 fail CI instead of quietly doing nothing.

Newly provisioned on next apply: marcelo@, alexhancock@, liad@.
ochafik is now eligible but already has an account (existingGWSUser).
This commit is contained in:
David Soria Parra 2026-07-27 10:17:46 +01:00
commit 8eb21f43ff
No known key found for this signature in database
1 changed files with 81 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/test-config.ts
View file

@ -8,6 +8,7 @@
import { ROLES, buildRoleLookup, getRolesForPlatform } from '../src/config/roles';
import { ROLE_IDS, isValidRoleId } from '../src/config/roleIds';
import { MEMBERS } from '../src/config/users';
import { hasProvisionUserRole } from '../src/config/utils';
let passed = 0;
let failed = 0;
@ -84,7 +85,7 @@ test('TYPESCRIPT_SDK_AUTH role exists (GitHub-only)', () => {
// Test Google Workspace user provisioning
test('Roles with provisionUser exist', () => {
const provisionRoles = ROLES.filter((r) => r.google?.provisionUser);
const provisionRoles = ROLES.filter((r) => r.provisionUser);
return provisionRoles.length > 0;
});
@ -100,9 +101,8 @@ test('googleEmailPrefix values are unique', () => {
});
test('skipGoogleUserProvisioning is only used in provisionUser roles and without fields', () => {
const provisionRoleIds = new Set(ROLES.filter((r) => r.google?.provisionUser).map((r) => r.id));
return MEMBERS.every((member) => {
const inProvisionRole = member.memberOf.some((id) => provisionRoleIds.has(id));
const inProvisionRole = hasProvisionUserRole(member.memberOf, roleLookup);
if (!inProvisionRole) return !member.skipGoogleUserProvisioning;
const hasProvisioningFields = !!(
@ -116,10 +116,7 @@ test('skipGoogleUserProvisioning is only used in provisionUser roles and without
test('Some members in provisionUser roles have Google user fields', () => {
const membersInProvisionRoles = MEMBERS.filter((m) =>
m.memberOf.some((id) => {
const role = roleLookup.get(id);
return role?.google?.provisionUser === true;
})
hasProvisionUserRole(m.memberOf, roleLookup)
);
const provisioned = membersInProvisionRoles.filter(
(m) => m.firstName && m.lastName && m.googleEmailPrefix