Skip to content

Add service-account auth and Workspace Events subscriptions - #213

Merged
omriariav merged 5 commits into
mainfrom
codex/v1-43-0-fullstack
Aug 4, 2026
Merged

Add service-account auth and Workspace Events subscriptions#213
omriariav merged 5 commits into
mainfrom
codex/v1-43-0-fullstack

Conversation

@omriariav

@omriariav omriariav commented Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Summary

v1.43.0: explicit service-account authentication and a gws events command group for the Workspace Events API.

Service-account authentication

  • New auth_mode config (GWS_AUTH_MODE): oauth (default, unchanged), service-account-dwd, service-account-app, with service_account_key_file and impersonate_user settings. Validation is fail-closed and mutually exclusive with actionable errors; key material is never persisted, printed, or echoed.
  • DWD mode impersonates a named Workspace user (JWT subject) and follows the same service-based scope resolution as OAuth logins.
  • Chat app mode (admin-approved) never pre-mints credentials and is isolated to Workspace Events subscriptions on individual Chat spaces — every other service client is rejected with a clear app-mode error.
  • gws auth login fails fast in service-account modes; gws auth status reports the configured mode.

Workspace Events (gws events)

  • subscriptions list | get | create | update | renew | delete | reactivate plus events decode (Pub/Sub CloudEvent from stdin: push envelope or bare message, base64 payload decoding, ce-source = subscription, ce-subject = target).
  • GA-only boundary: Chat space/user events incl. spaceReadState/threadReadState, baseline Drive file (google.workspace.drive.file.v3.added et al.) + permission events, and Meet conference/participant/recording/transcript/smartNote events. Rejected with explanatory errors: customer-wide Chat targets, Drive comment/reply/approval/access-proposal families, chat.app.all.* scopes (all Developer Preview), Chat availability events, and output-only batch events.
  • Least-privilege scopes per subscription class and auth mode (drive.metadata for Drive, meetings.space.readonly/created for Meet, per-class Chat readonly scopes). App-mode read/delete ops use chat.bot; mutations Get the existing subscription first and mint only the matching granular chat.app.*.readonly scopes.
  • Pub/Sub topic validated as projects/PROJECT/topics/TOPIC and must already exist — never created or modified. List requires an event_types filter (rejected locally otherwise).

Docs & skills

  • README auth-mode + events sections; new skills/events (SKILL.md, references/commands.md) and updated skills/auth + setup guide; plugins/gws mirrors synchronized (version-stripped SKILL.md, agents/openai.yaml); skills-test inventory extended.
  • v1.43.0 metadata: Makefile, both plugin manifests, CLAUDE.md.

Validation

  • go test -count=1 ./... — all packages pass
  • go vet ./... — clean
  • make build — embeds Version=1.43.0 (verified via ./bin/gws version)
  • make release-check — all checks passed on a clean tree

🤖 Generated with Claude Code

omriariav and others added 4 commits August 4, 2026 13:41
@omriariav @claude
Add service-account auth modes: DWD impersonation and Chat app auth
7e13454 
- auth_mode config (oauth default | service-account-dwd | service-account-app)
  with fail-closed, mutually exclusive mode validation and actionable errors
- Service-account JWT token sources; DWD sets the impersonated subject,
  key material is never printed or persisted
- App mode never pre-mints credentials and rejects all regular service
  clients (events-only surface); DWD follows user scope resolution
- New 'events' service scope set for OAuth logins
- Unit tests for every invalid mode combination, token-source error paths
  (incl. no key material in errors), and app-mode client isolation

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@omriariav @claude
Add gws events command group for Workspace Events subscriptions
fd173d8 
- events subscriptions list/get/create/update/renew/delete/reactivate
  plus events decode (Pub/Sub CloudEvent from stdin)
- GA-only boundary: Chat space/user events incl. read-state, baseline
  Drive file (v3.added et al.) + permission events, Meet conference/
  participant/recording/transcript/smartNote; Preview families rejected
  with explanatory errors (customer targets, Drive comment/reply/
  approval/access-proposal, chat.app.all.*, batch events output-only)
- Least-privilege scopes per subscription class and auth mode; app-mode
  mutations derive exact granular chat.app scopes from the existing
  subscription (chat.bot Get first); list requires an event_types filter
- Pub/Sub topic validated (projects/P/topics/T), never provisioned
- CloudEvent decode: ce-source = subscription, ce-subject = target,
  base64 payload decoding, push envelope or bare message
- auth login fails fast in service-account modes; auth status reports
  the configured service-account mode
- Deterministic unit + httptest mock-server tests for validation,
  scopes, request shapes, lifecycle flows, and decoding

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@omriariav @claude
Document v1.43.0 service-account auth and Workspace Events
42198d9 
- README: service-account auth configuration (auth_mode table, env
  examples, key-safety notes) and Events command reference section
- CLAUDE.md: events command row and auth mode note
- New skills/events skill: SKILL.md + references/commands.md covering
  lifecycle commands, GA targets/event types, Preview exclusions,
  existing-topic constraint, auth modes/scopes, and decode I/O
- skills/auth: service-account modes section + setup-guide additions
  (DWD domain-admin authorization, app admin-approval boundary, no
  auth login in SA modes, events service in scoped login)
- plugins/gws mirrors kept in sync (version-stripped SKILL.md,
  identical references, agents/openai.yaml for events)
- skills tests: events added to expectedSkills, both
  servicesWithCommands lists, and the file-count inventory

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@omriariav @claude
Prepare v1.43.0 release-candidate metadata
d9d4b83 
- Makefile VERSION, Claude and Codex plugin manifests to 1.43.0
- CLAUDE.md Current Version describes service-account auth + events;
  service count/list updated to include Workspace Events
- Workspace Events added to rootCmd service list, README feature
  inventory, and both plugin manifest descriptions
- Manifest version test expectations updated to the 1.43.0 baseline

Local release-candidate only: no tag, push, PR, or release.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown

Summary

Adds service-account authentication and a new Workspace Events command suite covering subscription lifecycle and Pub/Sub notification decoding, with tests and documentation.

What looks good

  • Cobra registration, flags, printer usage, and runXxx organization follow existing patterns.
  • Includes command-structure and httptest coverage.
  • Authentication modes are validated fail-closed.
  • README and skill command references were updated.
  • git diff --check passes.

Issues found

Critical

  • internal/events/events.go:82 accepts nonexistent Meet event types. Recordings, transcripts, and smart notes only support v2.fileGenerated; their started and ended variants are invalid and will be rejected by Google. Remove those six entries and correct commands.md:171.

Warning

  • cmd/auth.go:168 reports "authenticated": true for service-account modes without verifying that the key file exists or is valid. A missing or malformed key therefore yields a misleading healthy status.

  • cmd/events.go:393 accepts --event-types ",," as an update, but parsing produces no event types and ultimately sends a PATCH with an empty update mask. Reject the flag when its parsed list is empty.

Testing note: go test ./... could not run because the read-only environment prevented creation of /home/runner/go for the module cache.

@omriariav @claude
Address PR #213 review: honest SA status, empty event-types guard
9a36527 
- auth status no longer reports authenticated:true for a merely
  configured service-account mode: it validates the key file locally
  (existence + JSON parse, no token mint, no network call) and reports
  configured/key_valid with surfaced missing/malformed-key errors
- events subscriptions update rejects --event-types values that parse
  to an empty list (e.g. ",,") as a usage error instead of sending a
  PATCH with an empty update mask; regression test added
- setup-guide wording clarified (configured != authenticated), mirror
  synced

Meet recording/transcript/smartNote started/ended event types are
intentionally retained: the official Meet events guide lists all three
actions per family.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown

Summary

Adds service-account authentication modes and a new Workspace Events command group covering subscription lifecycle and CloudEvent decoding.

What looks good

  • Follows Cobra registration and runXxx patterns.
  • Adds command-structure, httptest, auth, validation, and decoding tests.
  • README and both skill command references are updated.
  • Service-account configuration is fail-closed and avoids exposing key material.
  • git diff --check passes.

Issues found

  • Warning — cmd/events.go:282: --max accepts zero and negative values. A negative value reaches PageSize and could also cause subs[:max] to panic. Validate that max > 0 before creating the client, with a corresponding test.

  • Warning — Makefile:6: This feature PR bumps the release version to 1.43.0, including plugin manifests and CLAUDE.md. That contradicts the explicit convention at CLAUDE.md:74, which reserves version bumps for a dedicated release PR. Revert these release-only changes here.

Tests could not be executed because the read-only environment prevented Go from creating its module cache.

@omriariav
omriariav merged commit 55a961e into main Aug 4, 2026
3 checks passed
@omriariav omriariav mentioned this pull request Aug 4, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@omriariav