Add Discord role sync with role-centric architecture (#22)
* Add Discord role sync with role-centric architecture This refactors the access management to use a role-centric model where each role explicitly defines which platforms it exists on (GitHub, Discord, Google). Key changes: - Add Discord role sync via Pulumi Dynamic Provider - Replace groups.ts with roleIds.ts + roles.ts for type-safe role definitions - Use ROLE_IDS constants to prevent typos in memberOf references - Each role has platform-specific config (github/discord/google keys) - Discord-only roles (e.g., administrators) and GitHub-only roles (e.g., typescript-sdk-auth) are now explicitly modeled - Add PR preview workflow to show Pulumi changes before merge - Add test-config.ts for config structure validation - Fix typo: docs-maintaners -> docs-maintainers Discord roles will match existing server roles: - administrators, lead maintainers, core maintainers - sdk maintainers, working groups, interest groups - etc. Requires new GitHub secrets: - DISCORD_BOT_TOKEN - DISCORD_GUILD_ID * Fix GitHub team ordering and make Discord integration optional - Add topological sort for GitHub teams to ensure parent teams are created before child teams, fixing the registry-wg parentTeamId issue - Make Discord integration optional by using config.get() instead of config.require(), allowing CI preview to succeed without Discord secrets - Add sortRolesByGitHubDependency() utility function in config/utils.ts Claude-Generated-By: Claude Code (cli/claude-opus-4-5=20%) Claude-Steers: 2 Claude-Permission-Prompts: 1 Claude-Escapes: 0 * Reconcile Discord roles for listed users Replace per-role-membership approach with per-user role sync that: - Adds missing roles users should have - Removes managed roles users shouldn't have - Only touches roles defined in config (won't affect admin roles, etc.) Users not in config remain untouched. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 4 Claude-Permission-Prompts: 1 Claude-Escapes: 0 * Fix descriptions to match existing resources * Cache Pulumi plugins and fix GITHUB_TOKEN for pulumi install * Remove accidentally committed state backup * Use github.token for pulumi install * Fix formatting Fix deploy: add pulumi login before config set Fix deploy: set PULUMI_CONFIG_PASSPHRASE_FILE for config commands Import existing docs-maintainers team (remove after deploy) Remove docs-maintainers import workaround Add docs-maintainers cleanup to state cleanup Add pulumi refresh before up to sync state with reality Rename Discord roles to add (synced) suffix Cleanup Makefile and add lead-maintainers GitHub team
This commit is contained in:
David Soria Parra
David Soria Parra
parent
f0336a9991
commit
f960494174
1 changed files with 1354 additions and 414 deletions
316
src/config/roles.ts
Normal file
316
src/config/roles.ts
Normal file
|
|
@ -0,0 +1,316 @@
|
|||
import { ROLE_IDS, type RoleId } from './roleIds';
|
||||
|
||||
/**
|
||||
* GitHub team configuration
|
||||
*/
|
||||
export interface GitHubConfig {
|
||||
/** Team name (usually matches role ID) */
|
||||
team: string;
|
||||
/** Parent team role ID */
|
||||
parent?: RoleId;
|
||||
}
|
||||
|
||||
/**
|
||||
* Discord role configuration
|
||||
*/
|
||||
export interface DiscordConfig {
|
||||
/** Display name in Discord (can have spaces) */
|
||||
role: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Google Workspace group configuration
|
||||
*/
|
||||
export interface GoogleConfig {
|
||||
/** Group name (used as prefix for @modelcontextprotocol.io email) */
|
||||
group: string;
|
||||
/** If true, accepts emails from anyone including external users */
|
||||
isEmailGroup?: boolean;
|
||||
}
|
||||
|
||||
/**
|
||||
* Role definition with platform-specific configurations.
|
||||
* A role only exists on platforms where it has a config key.
|
||||
*/
|
||||
export interface Role {
|
||||
id: RoleId;
|
||||
description: string;
|
||||
github?: GitHubConfig;
|
||||
discord?: DiscordConfig;
|
||||
google?: GoogleConfig;
|
||||
}
|
||||
|
||||
/**
|
||||
* All roles in the MCP organization.
|
||||
* Each role specifies which platforms it exists on via presence of config keys.
|
||||
*/
|
||||
export const ROLES: readonly Role[] = [
|
||||
// ===================
|
||||
// Organization Structure
|
||||
// ===================
|
||||
{
|
||||
id: ROLE_IDS.STEERING_COMMITTEE,
|
||||
description: 'MCP Steering Committee',
|
||||
github: { team: 'steering-committee' },
|
||||
// No discord - this is a GitHub-only organizational container
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.ADMINISTRATORS,
|
||||
description: 'Discord server administrators',
|
||||
discord: { role: 'administrators (synced)' },
|
||||
// Discord only - no GitHub equivalent
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.LEAD_MAINTAINERS,
|
||||
description: 'Lead core maintainers',
|
||||
github: { team: 'lead-maintainers', parent: ROLE_IDS.STEERING_COMMITTEE },
|
||||
discord: { role: 'lead maintainers (synced)' },
|
||||
// Discord only for now - could add GitHub if needed
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.CORE_MAINTAINERS,
|
||||
description: 'Core maintainers',
|
||||
github: { team: 'core-maintainers', parent: ROLE_IDS.STEERING_COMMITTEE },
|
||||
discord: { role: 'core maintainers (synced)' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.MODERATORS,
|
||||
description: 'Community moderators',
|
||||
github: { team: 'moderators', parent: ROLE_IDS.STEERING_COMMITTEE },
|
||||
discord: { role: 'community moderators (synced)' },
|
||||
},
|
||||
|
||||
// ===================
|
||||
// Maintainer Groups
|
||||
// ===================
|
||||
{
|
||||
id: ROLE_IDS.MAINTAINERS,
|
||||
description: 'General maintainers',
|
||||
discord: { role: 'maintainers (synced)' },
|
||||
// Discord only - general maintainer role
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.DOCS_MAINTAINERS,
|
||||
description: 'MCP docs maintainers',
|
||||
github: { team: 'docs-maintainers', parent: ROLE_IDS.STEERING_COMMITTEE },
|
||||
// No discord role for docs maintainers
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.INSPECTOR_MAINTAINERS,
|
||||
description: 'MCP Inspector maintainers',
|
||||
github: { team: 'inspector-maintainers', parent: ROLE_IDS.STEERING_COMMITTEE },
|
||||
discord: { role: 'inspector maintainers (synced)' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.MCPB_MAINTAINERS,
|
||||
description: 'MCPB (Model Context Protocol Bundle) maintainers',
|
||||
github: { team: 'mcpb-maintainers', parent: ROLE_IDS.STEERING_COMMITTEE },
|
||||
// No discord role
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.REFERENCE_SERVERS_MAINTAINERS,
|
||||
description: 'Reference servers maintainers',
|
||||
discord: { role: 'reference servers maintainers (synced)' },
|
||||
// Discord only for now
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.REGISTRY_MAINTAINERS,
|
||||
description: 'Official registry builders and maintainers',
|
||||
github: { team: 'registry-wg', parent: ROLE_IDS.WORKING_GROUPS },
|
||||
discord: { role: 'registry maintainers (synced)' },
|
||||
google: { group: 'registry-wg' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.USE_MCP_MAINTAINERS,
|
||||
description: 'use-mcp maintainers',
|
||||
discord: { role: 'use-mcp maintainers (synced)' },
|
||||
// Discord only
|
||||
},
|
||||
|
||||
// ===================
|
||||
// SDK Maintainers
|
||||
// ===================
|
||||
{
|
||||
id: ROLE_IDS.SDK_MAINTAINERS,
|
||||
description: 'Authors and maintainers of official MCP SDKs',
|
||||
github: { team: 'sdk-maintainers', parent: ROLE_IDS.STEERING_COMMITTEE },
|
||||
discord: { role: 'sdk maintainers (synced)' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.CSHARP_SDK,
|
||||
description: 'Official C# SDK maintainers',
|
||||
github: { team: 'csharp-sdk', parent: ROLE_IDS.SDK_MAINTAINERS },
|
||||
discord: { role: 'c# sdk maintainers (synced)' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.GO_SDK,
|
||||
description: 'The Go SDK Team',
|
||||
github: { team: 'go-sdk', parent: ROLE_IDS.SDK_MAINTAINERS },
|
||||
discord: { role: 'go sdk maintainers (synced)' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.JAVA_SDK,
|
||||
description: 'Official Java SDK maintainers',
|
||||
github: { team: 'java-sdk', parent: ROLE_IDS.SDK_MAINTAINERS },
|
||||
discord: { role: 'java sdk maintainers (synced)' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.KOTLIN_SDK,
|
||||
description: 'Official Kotlin SDK maintainers',
|
||||
github: { team: 'kotlin-sdk', parent: ROLE_IDS.SDK_MAINTAINERS },
|
||||
discord: { role: 'kotlin sdk maintainers (synced)' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.PHP_SDK,
|
||||
description: 'Official PHP SDK maintainers',
|
||||
github: { team: 'php-sdk', parent: ROLE_IDS.SDK_MAINTAINERS },
|
||||
discord: { role: 'php sdk maintainers (synced)' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.PYTHON_SDK,
|
||||
description: 'Official Python SDK maintainers',
|
||||
github: { team: 'python-sdk', parent: ROLE_IDS.SDK_MAINTAINERS },
|
||||
discord: { role: 'python sdk maintainers (synced)' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.PYTHON_SDK_AUTH,
|
||||
description: 'Python SDK auth code owners',
|
||||
github: { team: 'python-sdk-auth', parent: ROLE_IDS.PYTHON_SDK },
|
||||
// GitHub only - for CODEOWNERS
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.RUBY_SDK,
|
||||
description: 'Official Ruby SDK maintainers',
|
||||
github: { team: 'ruby-sdk', parent: ROLE_IDS.SDK_MAINTAINERS },
|
||||
discord: { role: 'ruby sdk maintainers (synced)' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.RUST_SDK,
|
||||
description: 'Official Rust SDK maintainers',
|
||||
github: { team: 'rust-sdk', parent: ROLE_IDS.SDK_MAINTAINERS },
|
||||
discord: { role: 'rust sdk maintainers (synced)' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.SWIFT_SDK,
|
||||
description: 'Official Swift SDK maintainers',
|
||||
github: { team: 'swift-sdk', parent: ROLE_IDS.SDK_MAINTAINERS },
|
||||
discord: { role: 'swift sdk maintainers (synced)' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.TYPESCRIPT_SDK,
|
||||
description: 'Official TypeScript SDK',
|
||||
github: { team: 'typescript-sdk', parent: ROLE_IDS.SDK_MAINTAINERS },
|
||||
discord: { role: 'typescript sdk maintainers (synced)' },
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.TYPESCRIPT_SDK_AUTH,
|
||||
description: 'Code owners for auth in Typescript SDK',
|
||||
github: { team: 'typescript-sdk-auth', parent: ROLE_IDS.TYPESCRIPT_SDK },
|
||||
// GitHub only - for CODEOWNERS
|
||||
},
|
||||
|
||||
// ===================
|
||||
// Working Groups
|
||||
// ===================
|
||||
{
|
||||
id: ROLE_IDS.WORKING_GROUPS,
|
||||
description: 'MCP Working Groups',
|
||||
github: { team: 'working-groups', parent: ROLE_IDS.STEERING_COMMITTEE },
|
||||
// No discord - organizational container
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.AUTH_WG,
|
||||
description: 'Authentication Working Group',
|
||||
github: { team: 'auth-wg', parent: ROLE_IDS.WORKING_GROUPS },
|
||||
// See AUTH_IG for Discord role
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.SECURITY_WG,
|
||||
description: 'Security Working Group',
|
||||
github: { team: 'security-wg', parent: ROLE_IDS.WORKING_GROUPS },
|
||||
// See interest group for Discord role
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.SERVER_IDENTITY_WG,
|
||||
description: 'Server Identity Working Group',
|
||||
discord: { role: 'server identity working group (synced)' },
|
||||
// Discord only for now
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.TRANSPORT_WG,
|
||||
description: 'Transport Working Group',
|
||||
github: { team: 'transport-wg', parent: ROLE_IDS.WORKING_GROUPS },
|
||||
discord: { role: 'transports working group (synced)' },
|
||||
},
|
||||
|
||||
// ===================
|
||||
// Interest Groups
|
||||
// ===================
|
||||
{
|
||||
id: ROLE_IDS.INTEREST_GROUPS,
|
||||
description: 'Interest Groups',
|
||||
github: { team: 'interest-groups', parent: ROLE_IDS.STEERING_COMMITTEE },
|
||||
// No discord - organizational container
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.AGENTS_IG,
|
||||
description: 'Agents Interest Group',
|
||||
discord: { role: 'agents interest group (synced)' },
|
||||
// Discord only
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.AUTH_IG,
|
||||
description: 'Auth Interest Group',
|
||||
discord: { role: 'auth interest group (synced)' },
|
||||
// Discord only - separate from AUTH_WG which is GitHub
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.CLIENT_IMPLEMENTOR_IG,
|
||||
description: 'Client Implementor Interest Group',
|
||||
discord: { role: 'client implementor interest group (synced)' },
|
||||
// Discord only
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.FINANCIAL_SERVICES_IG,
|
||||
description: 'Financial Services Interest Group',
|
||||
github: { team: 'ig-financial-services', parent: ROLE_IDS.INTEREST_GROUPS },
|
||||
discord: { role: 'financial services interest group (synced)' },
|
||||
},
|
||||
|
||||
// ===================
|
||||
// Email Groups (Google only)
|
||||
// ===================
|
||||
{
|
||||
id: ROLE_IDS.ANTITRUST,
|
||||
description: 'Antitrust compliance contacts',
|
||||
google: { group: 'antitrust', isEmailGroup: true },
|
||||
// Google only
|
||||
},
|
||||
{
|
||||
id: ROLE_IDS.CATCH_ALL,
|
||||
description: 'Catch-all email group',
|
||||
google: { group: 'catch-all', isEmailGroup: true },
|
||||
// Google only
|
||||
},
|
||||
] as const;
|
||||
|
||||
/**
|
||||
* Get a role by ID
|
||||
*/
|
||||
export function getRole(id: RoleId): Role | undefined {
|
||||
return ROLES.find((r) => r.id === id);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all roles that exist on a specific platform
|
||||
*/
|
||||
export function getRolesForPlatform(platform: 'github' | 'discord' | 'google'): Role[] {
|
||||
return ROLES.filter((r) => r[platform] !== undefined);
|
||||
}
|
||||
|
||||
/**
|
||||
* Build a lookup map of roles by ID
|
||||
*/
|
||||
export function buildRoleLookup(): Map<RoleId, Role> {
|
||||
return new Map(ROLES.map((r) => [r.id, r]));
|
||||
}
|
||||
Loading…
Reference in a new issue