From ec187737465624c5527025d429eae3923cd53b7a Mon Sep 17 00:00:00 2001
From: David Soria Parra <dsp@users.noreply.github.com>
Date: Fri, 20 Feb 2026 00:55:09 +0000
Subject: [PATCH] fix: stop importing existing GWS users into Pulumi state

The GWS provider validates email types during import, but GWS itself
returns empty types for primary/alias emails. This causes unrecoverable
validation errors on every new user import. Instead, skip managing
existing users entirely and let group memberships be created directly.

Also marks den as existingGWSUser.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 src/config/users.ts |  1 +
 src/google.ts       | 49 ++++++---------------------------------------
 2 files changed, 7 insertions(+), 43 deletions(-)

diff --git a/src/config/users.ts b/src/config/users.ts
index 629e149..4a25191 100644
--- a/src/config/users.ts
+++ b/src/config/users.ts
@@ -358,6 +358,7 @@ export const MEMBERS: readonly Member[] = [
     firstName: 'Den',
     lastName: 'Delimarsky',
     googleEmailPrefix: 'den',
+    existingGWSUser: true,
     memberOf: [
       ROLE_IDS.AUTH_MAINTAINERS,
       ROLE_IDS.CORE_MAINTAINERS,
diff --git a/src/google.ts b/src/google.ts
index a04139e..4c6c299 100644
--- a/src/google.ts
+++ b/src/google.ts
@@ -81,49 +81,12 @@ MEMBERS.forEach((member) => {
   const primaryEmail = `${member.googleEmailPrefix}@modelcontextprotocol.io`;
 
   if (member.existingGWSUser) {
-    // Import existing user into Pulumi state without recreating
-    const user = new gworkspace.User(
-      `gws-user-${member.googleEmailPrefix}`,
-      {
-        primaryEmail,
-        name: { familyName: member.lastName!, givenName: member.firstName! },
-        orgUnitPath: mcpOrgUnit.orgUnitPath,
-      },
-      {
-        import: primaryEmail,
-        dependsOn: [mcpOrgUnit],
-        ignoreChanges: [
-          'recoveryEmail',
-          'recoveryPhone',
-          'password',
-          'hashFunction',
-          'changePasswordAtNextLogin',
-          'orgUnitPath',
-          'archived',
-          'suspended',
-          'isAdmin',
-          'includeInGlobalAddressList',
-          'ipAllowlist',
-          'addresses',
-          'aliases',
-          'customSchemas',
-          'emails',
-          'externalIds',
-          'ims',
-          'keywords',
-          'languages',
-          'locations',
-          'organizations',
-          'phones',
-          'posixAccounts',
-          'relations',
-          'sshPublicKeys',
-          'websites',
-          'name',
-        ],
-      }
-    );
-    provisionedUsersByEmail[primaryEmail] = user;
+    // Existing GWS users are not managed by Pulumi — the GWS provider's import
+    // validation rejects empty email types that GWS itself sets on primary/alias
+    // emails, and there's no way to fix this at the provider level.
+    // Group memberships for these users are created without dependsOn since the
+    // user already exists in GWS.
+    return;
   } else {
     // Create new user with random password
     const password = new random.RandomPassword(`gws-pwd-${member.googleEmailPrefix}`, {