feat(admin): add user and group management (Admin Directory API)#403
feat(admin): add user and group management (Admin Directory API)#403dl-alexandre wants to merge 1 commit intosteipete:mainfrom
Conversation
Implements Google Admin SDK Directory API support for Workspace user and group management with domain-wide delegation. New commands: - gog admin users list --domain example.com - gog admin users get user@example.com - gog admin users create user@example.com --given John --family Doe - gog admin users suspend user@example.com - gog admin groups list --domain example.com - gog admin groups members list group@example.com - gog admin groups members add group@example.com user@example.com --role MEMBER - gog admin groups members remove group@example.com user@example.com Closes steipete#340 Note: This is a focused implementation of core user/group management. For full GAM feature parity (PR steipete#179), additional work would be needed for: alerts, licenses, org units, printers, reports, vault, SSO, etc.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 64cd89a5f9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ServiceAdmin: { | ||
| scopes: []string{ | ||
| "https://www.googleapis.com/auth/admin.directory.user", | ||
| "https://www.googleapis.com/auth/admin.directory.group", | ||
| "https://www.googleapis.com/auth/admin.directory.group.member", |
There was a problem hiding this comment.
Adding ServiceAdmin here is incomplete because AuthAddCmd computes scopes via ScopesForManageWithOptions, but scopesForServiceWithOptions has no ServiceAdmin branch and returns errUnknownService. In practice, gog auth add --services admin fails before starting OAuth, so the new admin workflow cannot be authorized through the documented command.
Useful? React with 👍 / 👎.
| }, | ||
| Password: c.Password, | ||
| ChangePasswordAtNextLogin: c.ChangePwd, | ||
| IsAdmin: c.Admin, |
There was a problem hiding this comment.
The create request writes IsAdmin directly from --admin, but admin elevation in Directory API is managed via a separate admin action rather than by setting the user resource field. This makes --admin unreliable (ignored or rejected by the API), so the command can report a successful create while not granting admin privileges as requested.
Useful? React with 👍 / 👎.
| } | ||
| items = append(items, item{ | ||
| Email: u.PrimaryEmail, | ||
| Name: u.Name.FullName, |
There was a problem hiding this comment.
The JSON path dereferences u.Name.FullName without verifying u.Name is non-nil. If the API returns a user entry without the nested name object, this command panics during listing instead of returning partial results.
Useful? React with 👍 / 👎.
1 participant
Summary
Add Google Admin SDK Directory API support for user and group management in Google Workspace.
Resolves #340
Changes
ServiceAdminwith scopes foradmin.directory.user,admin.directory.group, andadmin.directory.group.membergog admin users list --domain example.com- List users in a domaingog admin users get user@example.com- Get user detailsgog admin users create user@example.com --given "John" --family "Doe"- Create new usergog admin users suspend user@example.com- Suspend user accountgog admin groups list --domain example.com- List groups in a domaingog admin groups members list group@example.com- List group membersgog admin groups members add group@example.com user@example.com --role MEMBER- Add membergog admin groups members remove group@example.com user@example.com- Remove memberFeatures
--allflagRequirements
Note on PR #179
This is a focused implementation addressing the core user/group management requirements from #340. It intentionally does NOT cover the full GAM feature parity scope of PR #179, which includes additional APIs like:
Those additional features would require separate PRs to keep review manageable.
Test Plan
go build ./...passesgo test ./...passesgolangci-lint runpasses (1 expected gosec warning for password field)Usage Example