modelcontextprotocol/access
Watch
1
0
Fork
You've already forked access
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: create OrgUnit resource before provisioning GWS users

Browse source 
The orgUnitPath '/Model Context Protocol' was hardcoded but the OU
didn't exist in Pulumi state, causing INVALID_OU_ID errors for all
user creates/updates. Create it as a Pulumi resource and wire up
dependsOn so users are provisioned after the OU exists.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
David Soria Parra 2026-02-19 23:41:53 +00:00
commit 9fe97a1d2a
1 changed files with 21 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

31
src/google.ts
View file

@ -48,6 +48,13 @@ ROLES.forEach((role: Role) => {
});
});
// Create the organizational unit for MCP users
const mcpOrgUnit = new gworkspace.OrgUnit('mcp-org-unit', {
name: 'Model Context Protocol',
parentOrgUnitPath: '/',
description: 'Organizational unit for MCP team members (Managed by github.com/modelcontextprotocol/access)',
});
// Provision Google Workspace user accounts for members in roles with provisionUser
const provisionedUsersByEmail: Record<string, gworkspace.User> = {};
const newUserPasswords: Record<string, pulumi.Output<string>> = {};
@ -76,9 +83,9 @@ MEMBERS.forEach((member) => {
{
primaryEmail,
name: { familyName: member.lastName!, givenName: member.firstName! },
orgUnitPath: '/Model Context Protocol',
orgUnitPath: mcpOrgUnit.orgUnitPath,
},
{ import: primaryEmail }
{ import: primaryEmail, dependsOn: [mcpOrgUnit] }
);
provisionedUsersByEmail[primaryEmail] = user;
} else {
@ -91,14 +98,18 @@ MEMBERS.forEach((member) => {
crypto.createHash('sha1').update(plaintext).digest('hex')
);
const user = new gworkspace.User(`gws-user-${member.googleEmailPrefix}`, {
primaryEmail,
name: { familyName: member.lastName!, givenName: member.firstName! },
password: hashedPassword,
hashFunction: 'SHA-1',
changePasswordAtNextLogin: true,
orgUnitPath: '/Model Context Protocol',
});
const user = new gworkspace.User(
`gws-user-${member.googleEmailPrefix}`,
{
primaryEmail,
name: { familyName: member.lastName!, givenName: member.firstName! },
password: hashedPassword,
hashFunction: 'SHA-1',
changePasswordAtNextLogin: true,
orgUnitPath: mcpOrgUnit.orgUnitPath,
},
{ dependsOn: [mcpOrgUnit] }
);
provisionedUsersByEmail[primaryEmail] = user;
// Track password for export so an admin can retrieve it