From f916271ed9f7756c3a4dfa920e1cb8e18fb68472 Mon Sep 17 00:00:00 2001
From: David Soria Parra <dsp@users.noreply.github.com>
Date: Fri, 20 Feb 2026 00:20:06 +0000
Subject: [PATCH] fix: ignore recoveryEmail and recoveryPhone on imported GWS
 users

These are user-managed fields that shouldn't be touched by IaC.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 src/google.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/google.ts b/src/google.ts
index 0f95d85..74b5713 100644
--- a/src/google.ts
+++ b/src/google.ts
@@ -89,7 +89,7 @@ MEMBERS.forEach((member) => {
         name: { familyName: member.lastName!, givenName: member.firstName! },
         orgUnitPath: mcpOrgUnit.orgUnitPath,
       },
-      { import: primaryEmail, dependsOn: [mcpOrgUnit] }
+      { import: primaryEmail, dependsOn: [mcpOrgUnit], ignoreChanges: ['recoveryEmail', 'recoveryPhone'] }
     );
     provisionedUsersByEmail[primaryEmail] = user;
   } else {