0289b61df4- Add catch-all email group with admin-adam@modelcontextprotocol.io - Add onlyOnPlatforms configuration to restrict groups to specific platforms - Set antitrust and catch-all groups to Google only - Groups default to all platforms when onlyOnPlatforms is not specified
63 lines
2.2 KiB
TypeScript
63 lines
2.2 KiB
TypeScript
import * as gworkspace from '@pulumi/googleworkspace';
|
|
import { GROUPS } from './config/groups';
|
|
import type { Group } from './config/utils';
|
|
import { MEMBERS } from './config/users';
|
|
|
|
const groups: Record<string, gworkspace.Group> = {};
|
|
|
|
GROUPS.forEach((group: Group) => {
|
|
// Skip groups that don't include google in their platforms
|
|
if (group.onlyOnPlatforms && !group.onlyOnPlatforms.includes('google')) return;
|
|
|
|
groups[group.name] = new gworkspace.Group(group.name, {
|
|
email: `${group.name}@modelcontextprotocol.io`,
|
|
name: group.name,
|
|
description: group.description + ' \n(Managed by github.com/modelcontextprotocol/access)',
|
|
});
|
|
|
|
new gworkspace.GroupSettings(group.name, {
|
|
email: groups[group.name].email,
|
|
|
|
// Maximise visibility of group. It's visible in GitHub anyway
|
|
whoCanViewMembership: 'ALL_IN_DOMAIN_CAN_VIEW',
|
|
|
|
// This specifies who can add/remove members. We want this to only be via this IaC.
|
|
whoCanModerateMembers: 'NONE',
|
|
whoCanLeaveGroup: 'NONE_CAN_LEAVE',
|
|
whoCanJoin: 'INVITED_CAN_JOIN',
|
|
|
|
// Email groups allow anyone (including externals) to post
|
|
// Non-email groups are not intended as mailing lists, so use the most restrictive settings
|
|
// whoCanViewGroup is badly named, but actually means 'Permissions to view group messages'. See https://developers.google.com/workspace/admin/groups-settings/v1/reference/groups
|
|
...(group.isEmailGroup ? {
|
|
whoCanPostMessage: 'ANYONE_CAN_POST',
|
|
whoCanContactOwner: 'ALL_OWNERS_CAN_CONTACT',
|
|
whoCanViewGroup: 'ALL_MEMBERS_CAN_VIEW',
|
|
} : {
|
|
whoCanPostMessage: 'ALL_OWNERS_CAN_POST',
|
|
whoCanContactOwner: 'ALL_OWNERS_CAN_CONTACT',
|
|
whoCanViewGroup: 'ALL_OWNERS_CAN_VIEW',
|
|
}),
|
|
|
|
});
|
|
|
|
group.memberOf?.forEach((parentGroupKey) => {
|
|
new gworkspace.GroupMember(`${group.name}-in-${parentGroupKey}`, {
|
|
groupId: groups[parentGroupKey].id,
|
|
email: groups[group.name].email,
|
|
role: 'MEMBER',
|
|
});
|
|
});
|
|
});
|
|
|
|
MEMBERS.forEach((member) => {
|
|
if (!member.email) return;
|
|
|
|
member.memberOf.forEach((teamKey) => {
|
|
new gworkspace.GroupMember(`${member.email}-${teamKey}`, {
|
|
groupId: groups[teamKey].id,
|
|
email: member.email!,
|
|
role: 'MEMBER',
|
|
});
|
|
});
|
|
});
|