modelcontextprotocol/access
Watch
1
0
Fork
You've already forked access
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Suppress googleworkspace permadiffs in preview output

Browse source 
- GroupSettings: ignoreChanges on isArchived (upstream
  hashicorp/terraform-provider-googleworkspace#398)
- OrgUnit: drop the stale import option; it was only needed for the
  initial adopt and now triggers a re-compare on every preview
This commit is contained in:
Paul Carleton 2026-04-30 13:07:33 +01:00 • committed by Den Delimarsky
commit 9d584ea6cf
1 changed files with 31 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

52
src/google.ts
View file

@ -20,32 +20,36 @@ ROLES.forEach((role: Role) => {
description: role.description + ' \n(Managed by github.com/modelcontextprotocol/access)',
});
new gworkspace.GroupSettings(role.google.group, {
email: groups[role.google.group].email,
new gworkspace.GroupSettings(
role.google.group,
{
email: groups[role.google.group].email,
// Maximise visibility of group. It's visible in GitHub anyway
whoCanViewMembership: 'ALL_IN_DOMAIN_CAN_VIEW',
// Maximise visibility of group. It's visible in GitHub anyway
whoCanViewMembership: 'ALL_IN_DOMAIN_CAN_VIEW',
// This specifies who can add/remove members. We want this to only be via this IaC.
whoCanModerateMembers: 'NONE',
whoCanLeaveGroup: 'NONE_CAN_LEAVE',
whoCanJoin: 'INVITED_CAN_JOIN',
// This specifies who can add/remove members. We want this to only be via this IaC.
whoCanModerateMembers: 'NONE',
whoCanLeaveGroup: 'NONE_CAN_LEAVE',
whoCanJoin: 'INVITED_CAN_JOIN',
// Email groups allow anyone (including externals) to post
// Non-email groups are not intended as mailing lists, so use the most restrictive settings
// whoCanViewGroup is badly named, but actually means 'Permissions to view group messages'. See https://developers.google.com/workspace/admin/groups-settings/v1/reference/groups
...(role.google.isEmailGroup
? {
whoCanPostMessage: 'ANYONE_CAN_POST',
whoCanContactOwner: 'ALL_OWNERS_CAN_CONTACT',
whoCanViewGroup: 'ALL_MEMBERS_CAN_VIEW',
}
: {
whoCanPostMessage: 'ALL_OWNERS_CAN_POST',
whoCanContactOwner: 'ALL_OWNERS_CAN_CONTACT',
whoCanViewGroup: 'ALL_OWNERS_CAN_VIEW',
}),
});
// Email groups allow anyone (including externals) to post
// Non-email groups are not intended as mailing lists, so use the most restrictive settings
// whoCanViewGroup is badly named, but actually means 'Permissions to view group messages'. See https://developers.google.com/workspace/admin/groups-settings/v1/reference/groups
...(role.google.isEmailGroup
? {
whoCanPostMessage: 'ANYONE_CAN_POST',
whoCanContactOwner: 'ALL_OWNERS_CAN_CONTACT',
whoCanViewGroup: 'ALL_MEMBERS_CAN_VIEW',
}
: {
whoCanPostMessage: 'ALL_OWNERS_CAN_POST',
whoCanContactOwner: 'ALL_OWNERS_CAN_CONTACT',
whoCanViewGroup: 'ALL_OWNERS_CAN_VIEW',
}),
},
{ ignoreChanges: ['isArchived'] }
);
});
// Create the organizational unit for MCP users
@ -56,7 +60,7 @@ const mcpOrgUnit = new gworkspace.OrgUnit(
description: 'Model Context Protocol',
parentOrgUnitPath: '/',
},
{ import: 'id:03ph8a2z0nc6rsr', ignoreChanges: ['description'] }
{ ignoreChanges: ['description'] }
);
// Provision Google Workspace user accounts for members in roles with provisionUser