Merge branch 'main' into chore/remove-133-temp-repair

Author: localden

scripts/validate-config.ts

@@ -8,6 +8,7 @@
 import { ROLES, buildRoleLookup } from '../src/config/roles';
 import { REPOSITORY_ACCESS } from '../src/config/repoAccess';
 import { MEMBERS } from '../src/config/users';
+import { resolveGoogleMemberEmail } from '../src/config/utils';
 import type { RoleId } from '../src/config/roleIds';
 
 const roleLookup = buildRoleLookup();
@@ -157,6 +158,30 @@ console.log('Validating Google Workspace user provisioning fields...');
   }
 }
 
+// Validate that external group members are explicitly permitted.
+// allowExternalMembers is an explicit per-role opt-in (see GoogleConfig in
+// roles.ts): if a group's membership resolves to any non-@modelcontextprotocol.io
+// email but the role does not opt in, `pulumi up` would set the group's
+// ALLOW_EXTERNAL_MEMBERS setting to false and Google would silently purge the
+// external members ~1-2 days later (#133 incident). Fail loudly instead.
+console.log('Validating external group members are explicitly permitted...');
+for (const member of MEMBERS) {
+  const memberEmail = resolveGoogleMemberEmail(member);
+  if (!memberEmail || memberEmail.endsWith('@modelcontextprotocol.io')) continue;
+
+  for (const roleId of member.memberOf) {
+    const role = roleLookup.get(roleId);
+    if (!role?.google || role.google.allowExternalMembers === true) continue;
+
+    console.error(
+      `ERROR: Google group "${role.google.group}" has external member "${memberEmail}" ` +
+        `but its role does not permit external members. If this member is intentional, ` +
+        `add allowExternalMembers: true to the '${role.id}' role's google config in src/config/roles.ts`
+    );
+    hasErrors = true;
+  }
+}
+
 // Validate parent role references in roles.ts
 console.log('Validating parent role references in roles.ts...');
 for (const role of ROLES) {

src/config/roles.ts

@@ -28,6 +28,13 @@ export interface GoogleConfig {
   isEmailGroup?: boolean;
   /** If true, members of this role get a Google Workspace user account */
   provisionUser?: boolean;
+  /**
+   * Opt-in for groups that intentionally include non-@modelcontextprotocol.io
+   * members. Defaults to false. Must stay declared on the GroupSettings
+   * resource: the provider resets an omitted field to false on every apply,
+   * after which Google silently purges external members (#133 incident).
+   */
+  allowExternalMembers?: boolean;
 }
 
 /**
@@ -105,7 +112,7 @@ export const ROLES: readonly Role[] = [
     discord: { role: 'maintainers (synced)' },
     // GWS user accounts are opt-in: maintainers add firstName/lastName/googleEmailPrefix
     // to their entry in users.ts via PR to get an @modelcontextprotocol.io account
-    google: { group: 'maintainers', provisionUser: true },
+    google: { group: 'maintainers', provisionUser: true, allowExternalMembers: true },
   },
   {
     id: ROLE_IDS.DOCS_MAINTAINERS,
@@ -136,7 +143,7 @@ export const ROLES: readonly Role[] = [
     description: 'Official registry builders and maintainers',
     github: { team: 'registry-wg', parent: ROLE_IDS.WORKING_GROUPS },
     discord: { role: 'registry maintainers (synced)' },
-    google: { group: 'registry-wg', provisionUser: true },
+    google: { group: 'registry-wg', provisionUser: true, allowExternalMembers: true },
   },
   {
     id: ROLE_IDS.REGISTRY_COLLABORATORS,
@@ -394,7 +401,7 @@ export const ROLES: readonly Role[] = [
   {
     id: ROLE_IDS.ANTITRUST,
     description: 'Antitrust compliance contacts',
-    google: { group: 'antitrust', isEmailGroup: true },
+    google: { group: 'antitrust', isEmailGroup: true, allowExternalMembers: true },
     // Google only
   },
   {
@@ -406,7 +413,7 @@ export const ROLES: readonly Role[] = [
   {
     id: ROLE_IDS.CATCH_ALL,
     description: 'Catch-all email group',
-    google: { group: 'catch-all', isEmailGroup: true },
+    google: { group: 'catch-all', isEmailGroup: true, allowExternalMembers: true },
     // Google only
   },
 ] as const;

src/config/utils.ts

@@ -27,6 +27,19 @@ export interface Member {
   skipGoogleUserProvisioning?: boolean;
 }
 
+/**
+ * Resolve the email a member joins Google groups with.
+ * Prefers the provisioned GWS email over the personal email. This is the
+ * single source of truth for group-membership emails — src/google.ts uses it
+ * to create memberships, and scripts/validate-config.ts uses it to check that
+ * external members only appear in roles that opt into allowExternalMembers.
+ */
+export function resolveGoogleMemberEmail(member: Member): string | undefined {
+  return member.googleEmailPrefix
+    ? `${member.googleEmailPrefix}@modelcontextprotocol.io`
+    : member.email;
+}
+
 /**
  * Sort roles by GitHub parent dependency (topological sort).
  * Ensures parent teams are created before child teams.

src/google.ts

@@ -5,6 +5,7 @@ import * as random from '@pulumi/random';
 import { ROLES, type Role, buildRoleLookup } from './config/roles';
 import { MEMBERS } from './config/users';
 import type { RoleId } from './config/roleIds';
+import { resolveGoogleMemberEmail } from './config/utils';
 
 const roleLookup = buildRoleLookup();
 // Groups keyed by Google group name
@@ -25,6 +26,15 @@ ROLES.forEach((role: Role) => {
     {
       email: groups[role.google.group].email,
 
+      // Permit external (non-workspace) members only on groups whose role
+      // explicitly opts in via allowExternalMembers in config/roles.ts.
+      // Who is actually a member is still governed entirely by config/users.ts;
+      // validate-config enforces that every external member's role opts in.
+      // This field must stay DECLARED: when omitted, the provider defaults it
+      // to false on every `pulumi up`, and Google then silently purges
+      // external-email members ~1-2 days later (#133 incident).
+      allowExternalMembers: role.google.allowExternalMembers ?? false,
+
       // Maximise visibility of group. It's visible in GitHub anyway
       whoCanViewMembership: 'ALL_IN_DOMAIN_CAN_VIEW',
 
@@ -154,12 +164,11 @@ MEMBERS.forEach((member) => {
 // Create group memberships for users
 MEMBERS.forEach((member) => {
   // Prefer the provisioned GWS email over the personal email for group memberships
-  const gwsEmail = member.googleEmailPrefix
-    ? `${member.googleEmailPrefix}@modelcontextprotocol.io`
-    : undefined;
-  const memberEmail = gwsEmail || member.email;
+  const memberEmail = resolveGoogleMemberEmail(member);
   if (!memberEmail) return;
-  const provisionedUser = gwsEmail ? provisionedUsersByEmail[gwsEmail] : undefined;
+  const provisionedUser = member.googleEmailPrefix
+    ? provisionedUsersByEmail[memberEmail]
+    : undefined;
 
   member.memberOf.forEach((roleId: RoleId) => {
     const role = roleLookup.get(roleId);