access/scripts/test-config.ts
David Soria Parra f960494174
Add Discord role sync with role-centric architecture (#22)
* Add Discord role sync with role-centric architecture

This refactors the access management to use a role-centric model where
each role explicitly defines which platforms it exists on (GitHub,
Discord, Google).

Key changes:
- Add Discord role sync via Pulumi Dynamic Provider
- Replace groups.ts with roleIds.ts + roles.ts for type-safe role definitions
- Use ROLE_IDS constants to prevent typos in memberOf references
- Each role has platform-specific config (github/discord/google keys)
- Discord-only roles (e.g., administrators) and GitHub-only roles
  (e.g., typescript-sdk-auth) are now explicitly modeled
- Add PR preview workflow to show Pulumi changes before merge
- Add test-config.ts for config structure validation
- Fix typo: docs-maintaners -> docs-maintainers

Discord roles will match existing server roles:
- administrators, lead maintainers, core maintainers
- sdk maintainers, working groups, interest groups
- etc.

Requires new GitHub secrets:
- DISCORD_BOT_TOKEN
- DISCORD_GUILD_ID

* Fix GitHub team ordering and make Discord integration optional

- Add topological sort for GitHub teams to ensure parent teams are
  created before child teams, fixing the registry-wg parentTeamId issue
- Make Discord integration optional by using config.get() instead of
  config.require(), allowing CI preview to succeed without Discord secrets
- Add sortRolesByGitHubDependency() utility function in config/utils.ts

Claude-Generated-By: Claude Code (cli/claude-opus-4-5=20%)
Claude-Steers: 2
Claude-Permission-Prompts: 1
Claude-Escapes: 0

* Reconcile Discord roles for listed users

Replace per-role-membership approach with per-user role sync that:
- Adds missing roles users should have
- Removes managed roles users shouldn't have
- Only touches roles defined in config (won't affect admin roles, etc.)

Users not in config remain untouched.

Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 4
Claude-Permission-Prompts: 1
Claude-Escapes: 0

* Fix descriptions to match existing resources

* Cache Pulumi plugins and fix GITHUB_TOKEN for pulumi install

* Remove accidentally committed state backup

* Use github.token for pulumi install

* Fix formatting

Fix deploy: add pulumi login before config set

Fix deploy: set PULUMI_CONFIG_PASSPHRASE_FILE for config commands

Import existing docs-maintainers team (remove after deploy)

Remove docs-maintainers import workaround

Add docs-maintainers cleanup to state cleanup

Add pulumi refresh before up to sync state with reality

Rename Discord roles to add (synced) suffix

Cleanup Makefile and add lead-maintainers GitHub team
2026-01-13 23:35:18 +00:00

87 lines
3 KiB
TypeScript

#!/usr/bin/env npx ts-node
/**
* Tests the configuration structure without needing Pulumi credentials.
* Run with: npx ts-node scripts/test-config.ts
*/
import { ROLES, buildRoleLookup, getRolesForPlatform } from '../src/config/roles';
import { ROLE_IDS, isValidRoleId } from '../src/config/roleIds';
import { MEMBERS } from '../src/config/users';
let passed = 0;
let failed = 0;
function test(name: string, fn: () => boolean) {
try {
if (fn()) {
console.log(`✓ ${name}`);
passed++;
} else {
console.log(`✗ ${name}`);
failed++;
}
} catch (e) {
console.log(`✗ ${name}: ${e}`);
failed++;
}
}
console.log('Testing role configuration...\n');
// Test ROLE_IDS
test('ROLE_IDS has entries', () => Object.keys(ROLE_IDS).length > 0);
test('All ROLE_IDS values are valid', () =>
Object.values(ROLE_IDS).every((id) => isValidRoleId(id)));
// Test ROLES
test('ROLES array is not empty', () => ROLES.length > 0);
test('All roles have id and description', () => ROLES.every((r) => r.id && r.description));
test('All role IDs are unique', () => {
const ids = ROLES.map((r) => r.id);
return ids.length === new Set(ids).size;
});
// Test platform configs
const githubRoles = getRolesForPlatform('github');
const discordRoles = getRolesForPlatform('discord');
const googleRoles = getRolesForPlatform('google');
test('Has GitHub roles', () => githubRoles.length > 0);
test('Has Discord roles', () => discordRoles.length > 0);
test('Has Google roles', () => googleRoles.length > 0);
test('GitHub roles have team names', () => githubRoles.every((r) => r.github?.team));
test('Discord roles have role names', () => discordRoles.every((r) => r.discord?.role));
test('Google roles have group names', () => googleRoles.every((r) => r.google?.group));
// Test parent relationships
const roleLookup = buildRoleLookup();
test('All GitHub parent references are valid', () =>
githubRoles.every((r) => {
if (!r.github?.parent) return true;
const parent = roleLookup.get(r.github.parent);
return parent && parent.github;
}));
// Test members
test('MEMBERS array is not empty', () => MEMBERS.length > 0);
test('All members have at least one identifier', () =>
MEMBERS.every((m) => m.github || m.email || m.discord));
test('All member role references are valid', () =>
MEMBERS.every((m) => m.memberOf.every((id) => roleLookup.has(id))));
// Test specific roles exist
test('CORE_MAINTAINERS role exists', () => !!roleLookup.get(ROLE_IDS.CORE_MAINTAINERS));
test('ADMINISTRATORS role exists (Discord-only)', () => {
const role = roleLookup.get(ROLE_IDS.ADMINISTRATORS);
return role !== undefined && role.discord !== undefined && role.github === undefined;
});
test('TYPESCRIPT_SDK_AUTH role exists (GitHub-only)', () => {
const role = roleLookup.get(ROLE_IDS.TYPESCRIPT_SDK_AUTH);
return role !== undefined && role.github !== undefined && role.discord === undefined;
});
// Summary
console.log(`\n${passed} passed, ${failed} failed`);
process.exit(failed > 0 ? 1 : 0);