modelcontextprotocol/access
Watch
1
0
Fork
You've already forked access
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Suppress googleworkspace permadiffs in preview output

Browse source 
- GroupSettings: ignoreChanges on isArchived (upstream
  hashicorp/terraform-provider-googleworkspace#398)
- OrgUnit: drop the stale import option; it was only needed for the
  initial adopt and now triggers a re-compare on every preview
This commit is contained in:
Paul Carleton 2026-04-30 13:07:33 +01:00 • committed by Den Delimarsky
commit 9d584ea6cf
1 changed files with 31 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

52
src/google.ts
View file

@ -20,32 +20,36 @@ ROLES.forEach((role: Role) => {
description: role.description + ' \n(Managed by github.com/modelcontextprotocol/access)', description: role.description + ' \n(Managed by github.com/modelcontextprotocol/access)',
}); });
new gworkspace.GroupSettings(role.google.group, { new gworkspace.GroupSettings(
email: groups[role.google.group].email, role.google.group,
{
email: groups[role.google.group].email,
// Maximise visibility of group. It's visible in GitHub anyway // Maximise visibility of group. It's visible in GitHub anyway
whoCanViewMembership: 'ALL_IN_DOMAIN_CAN_VIEW', whoCanViewMembership: 'ALL_IN_DOMAIN_CAN_VIEW',
// This specifies who can add/remove members. We want this to only be via this IaC. // This specifies who can add/remove members. We want this to only be via this IaC.
whoCanModerateMembers: 'NONE', whoCanModerateMembers: 'NONE',
whoCanLeaveGroup: 'NONE_CAN_LEAVE', whoCanLeaveGroup: 'NONE_CAN_LEAVE',
whoCanJoin: 'INVITED_CAN_JOIN', whoCanJoin: 'INVITED_CAN_JOIN',
// Email groups allow anyone (including externals) to post // Email groups allow anyone (including externals) to post
// Non-email groups are not intended as mailing lists, so use the most restrictive settings // Non-email groups are not intended as mailing lists, so use the most restrictive settings
// whoCanViewGroup is badly named, but actually means 'Permissions to view group messages'. See https://developers.google.com/workspace/admin/groups-settings/v1/reference/groups // whoCanViewGroup is badly named, but actually means 'Permissions to view group messages'. See https://developers.google.com/workspace/admin/groups-settings/v1/reference/groups
...(role.google.isEmailGroup ...(role.google.isEmailGroup
? { ? {
whoCanPostMessage: 'ANYONE_CAN_POST', whoCanPostMessage: 'ANYONE_CAN_POST',
whoCanContactOwner: 'ALL_OWNERS_CAN_CONTACT', whoCanContactOwner: 'ALL_OWNERS_CAN_CONTACT',
whoCanViewGroup: 'ALL_MEMBERS_CAN_VIEW', whoCanViewGroup: 'ALL_MEMBERS_CAN_VIEW',
} }
: { : {
whoCanPostMessage: 'ALL_OWNERS_CAN_POST', whoCanPostMessage: 'ALL_OWNERS_CAN_POST',
whoCanContactOwner: 'ALL_OWNERS_CAN_CONTACT', whoCanContactOwner: 'ALL_OWNERS_CAN_CONTACT',
whoCanViewGroup: 'ALL_OWNERS_CAN_VIEW', whoCanViewGroup: 'ALL_OWNERS_CAN_VIEW',
}), }),
}); },
{ ignoreChanges: ['isArchived'] }
);
}); });
// Create the organizational unit for MCP users // Create the organizational unit for MCP users
@ -56,7 +60,7 @@ const mcpOrgUnit = new gworkspace.OrgUnit(
description: 'Model Context Protocol', description: 'Model Context Protocol',
parentOrgUnitPath: '/', parentOrgUnitPath: '/',
}, },
{ import: 'id:03ph8a2z0nc6rsr', ignoreChanges: ['description'] } { ignoreChanges: ['description'] }
); );
// Provision Google Workspace user accounts for members in roles with provisionUser // Provision Google Workspace user accounts for members in roles with provisionUser