feat: copy over code from old mp module #1
Conversation
WalkthroughThis update introduces a comprehensive overhaul of the Terraform module, shifting its focus from a generic template using the "random" provider to a specialized module for managing Google Workspace users, groups, group settings, and memberships. The changes include detailed input variable schemas for users and groups, extensive validation logic, and the removal of all previous random resource references. New example configurations and import templates are added, along with provider setup instructions and test files to validate input correctness. The documentation and changelog are rewritten to reflect the new module purpose, and all outputs related to the old random resource are removed. Note ⚡️ AI Code Reviews for VS Code, Cursor, WindsurfCodeRabbit now has a plugin for VS Code, Cursor and Windsurf. This brings AI code reviews directly in the code editor. Each commit is reviewed immediately, finding bugs before the PR is raised. Seamless context handoff to your AI code agent ensures that you can easily incorporate review feedback. Note ⚡️ Faster reviews with cachingCodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure ✨ Finishing Touches🧪 Generate Unit Tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🔭 Outside diff range comments (3)
examples/import-existing-org/users.yaml (1)
1-19: 🛠️ Refactor suggestionAdd missing
passwordfield to user definitions.
The user variable schema enforces apasswordattribute (validated intests/variables_users.tftest.hcl). Include it in your default template or per-user entries, for example:_default_user: &default_user is_admin: false password: "ChangeMe123!" groups: team: { role: "member" }README.md (2)
99-101:⚠️ Potential issueRemove leftover module reference.
The Modules section still referencescloudposse/label/null, which appears to be boilerplate. Please update or remove this entry so it accurately reflects your module’s actual dependencies (if any).
116-127:⚠️ Potential issuePrune irrelevant input documentation.
The Inputs table includes Cloud Posse template variables (additional_tag_map,context, etc.) that aren’t part of this module. Please remove or replace these entries so only the real inputs (users,groups, provider configs, etc.) are documented.
♻️ Duplicate comments (3)
examples/complete/versions.tf (1)
5-8: Duplicate: pin to patch-level provider versions.
As above, replace the exact0.7.0lock with~> 0.7.0to permit safe patch updates while avoiding unintended breaking changes.examples/import-existing-org/providers.tf (2)
2-4: Simplify comment formatting
The double# #prefixes are redundant. Please switch to a single#for clarity and consistency across the example.
7-8: Avoid hardcoded credential paths
Embedding a local file path and email directly reduces portability and may expose sensitive details. Refer to the variables approach suggested inexamples/complete/providers.tf.
🧹 Nitpick comments (18)
outputs.tf (1)
1-2: Empty outputs file: consider removing or defining outputs.
Theoutputs.tfis now empty after removing therandom_pet_nameoutput. If you don’t need to expose any outputs from this module, delete the file to keep the repo tidy. Otherwise, consider adding outputs for key resources (e.g., user emails, group IDs) to improve module usability.versions.tf (1)
5-8: Recommend stricter version constraint for provider.
Rather thanversion = ">= 0.7.0", use a constraint like~> 0.7.0to allow safe patch-level updates while preventing unexpected breaking changes in future minor versions.examples/import-existing-org/versions.tf (1)
5-8: Pin to patch-level provider versions.
Locking exactly to0.7.0will block any patch releases. Consider using~> 0.7.0so you can receive non-breaking patch upgrades without pulling in potentially breaking changes.examples/import-existing-org/users.yaml (1)
2-6: Quote YAML scalar values to avoid parse issues.
Wrapmemberin quotes within the inline map to ensure it’s parsed as a string:groups: team: { role: "member" }examples/complete/providers.tf (2)
2-4: Simplify comment formatting
The double# #prefixes are redundant. Please switch to a single#for clarity and consistency across the example.
7-8: Avoid hardcoded credential paths
Embedding a local file path and email directly reduces portability and may expose sensitive details. Consider introducing Terraform variables and referencing them instead.provider "googleworkspace" { - credentials = "/Users/my_user/Downloads/my-google-project-credentials-1234567890.json" - impersonated_user_email = "my_impersonated_user_email@my_domain.com" + credentials = var.credentials_path + impersonated_user_email = var.impersonated_user_email oauth_scopes = [ ... ] }And at the top of your example (e.g., in
variables.tf):variable "credentials_path" { description = "Path to Google service account credentials JSON file." type = string } variable "impersonated_user_email" { description = "Admin user email to impersonate for Google Workspace operations." type = string }examples/import-existing-org/main.tf (1)
5-7: Consider naming clarity for locals
Leading underscores inlocal._all_groupsandlocal._all_usersare fine, but using more descriptive names (e.g.,all_groups_raw,all_users_raw) can improve readability for new users.examples/import-existing-org/groups.yaml (1)
15-22: Use a more descriptive key for the group
The keyteamis generic; renaming it to something likeengineering_teamor matching the email alias makes the mapping clearer in Terraform.examples/complete/main.tf (2)
43-47: Redundant merge for empty overrides
Theplatformgroup usesmerge(local.default_group_settings, {}). You can simplify by directly assigninglocal.default_group_settingswhen there are no overrides:- "platform" = { - name = "Platform" - email = "platform@example.com" - settings = merge(local.default_group_settings, {}) - }, + "platform" = { + name = "Platform" + email = "platform@example.com" + settings = local.default_group_settings + },
18-26: Module name clarity
Usingmodule "googleworkspace"can be confused with the provider name. Consider renaming tomodule "users_groups"ormodule "googleworkspace_users_groups"to better reflect its purpose.tests/variables_groups.tftest.hcl (1)
49-89: Consider extending group settings tests with negative scenarios.
The current tests verify a valid specific block and default omission. It would be helpful to add a test case that injects an invalid or unsupported settings attribute (e.g., a typo inallow_web_postinggor wrong type) to ensure your variable schema or custom validations catch unsupported keys early.variables.tf (1)
5-6: Update variable description to reflect map type.
The description"List of users"may mislead readers sinceusersis declared as amap(object(...)), not a list. Consider changing it to"Map of user objects"for clarity.tests/variables_users.tftest.hcl (1)
94-114: Ensure test string truly exceeds 100 characters.
The hard-coded long string may or may not be >100 characters, leading to flaky tests. It’s more reliable to generate it programmatically, for example:password = repeat("a", 101)This guarantees the length requirement is correctly tested.
README.md (1)
7-14: Fix potentially broken Unicode anchor.
The “Learn more about Masterpoint below” link uses a Unicode anchor that might not resolve reliably. Consider simplifying the section title and anchor to plain ASCII, e.g.,[below](#who-we-are).main.tf (4)
6-9: Improve naming for locals
Leading underscores in local names suggest internal/private usage, but all locals are module-scoped. Renamelocal._user_with_groupstolocal.users_with_groupsfor clarity and consistency.
45-49: Remove unmanaged attribute fromignore_changes
Theignore_changesblock includeslanguages, but this resource does not set or manage alanguagesattribute. Remove it to avoid confusion or unintended behavior.
55-56: Reevaluate explicitdepends_onon groups
Thedepends_on = [googleworkspace_group.defaults]enforces ordering, but Terraform already infers dependencies from references in locals. Remove this explicitdepends_onunless strict sequencing is required.
65-69: Consider adding adeletetimeout
If you plan to destroy groups, specifying adeletetimeout may help avoid hangs:timeouts { create = each.value.timeouts.create update = each.value.timeouts.update delete = each.value.timeouts.delete }
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (17)
CHANGELOG.md(0 hunks)README.md(5 hunks)examples/complete/main.tf(1 hunks)examples/complete/providers.tf(1 hunks)examples/complete/versions.tf(1 hunks)examples/import-existing-org/groups.yaml(1 hunks)examples/import-existing-org/imports.tf(1 hunks)examples/import-existing-org/main.tf(1 hunks)examples/import-existing-org/providers.tf(1 hunks)examples/import-existing-org/users.yaml(1 hunks)examples/import-existing-org/versions.tf(1 hunks)main.tf(1 hunks)outputs.tf(1 hunks)tests/variables_groups.tftest.hcl(1 hunks)tests/variables_users.tftest.hcl(1 hunks)variables.tf(1 hunks)versions.tf(1 hunks)
💤 Files with no reviewable changes (1)
- CHANGELOG.md
🧰 Additional context used
📓 Path-based instructions (1)
`**/*.tf`: You're a Terraform expert who has thoroughly studied all the documentation from Hashicorp https://developer.hashicorp.com/terraform/docs and OpenTofu https://opentofu.or...
**/*.tf: You're a Terraform expert who has thoroughly studied all the documentation from Hashicorp https://developer.hashicorp.com/terraform/docs and OpenTofu https://opentofu.org/docs/.
You have a strong grasp of Terraform syntax and prioritize providing accurate and insightful code suggestions.
As a fan of the Cloud Posse / SweetOps ecosystem, you incorporate many of their best practices https://docs.cloudposse.com/best-practices/terraform/ while balancing them with general Terraform guidelines.
outputs.tfversions.tfexamples/import-existing-org/versions.tfexamples/complete/versions.tfexamples/import-existing-org/main.tfexamples/complete/providers.tfexamples/complete/main.tfexamples/import-existing-org/providers.tfexamples/import-existing-org/imports.tfvariables.tfmain.tf
🔇 Additional comments (9)
examples/import-existing-org/main.tf (1)
1-8: Well-structured YAML decoding and filtering
Great use ofyamldecodewith aforexpression to drop prototype entries. This makes the example clear and maintainable.examples/import-existing-org/groups.yaml (1)
2-14: Well-defined default settings with YAML anchors
Your anchor-based defaults (_default_active_settings) are a clean way to DRY out group settings. Nicely done!examples/complete/main.tf (1)
1-15: Solid default group settings block
Defininglocal.default_group_settingsonce and merging overrides is a great pattern that keeps your example concise and DRY.main.tf (6)
11-21: Locals forgroup_membersare well-formed
The nested loops withflattencorrectly produce a map of membership objects keyed by"group_email/user_primary_email".
24-43: Resourcegoogleworkspace_user.defaultscovers all user attributes
The resource iterates overvar.usersand maps each attribute appropriately, including lifecycle rules to avoid unwanted updates on sensitive fields.
58-69: Group resource implementation is solid
Thegoogleworkspace_group.defaultsresource properly iterates overvar.groupsand appliescreateandupdatetimeouts.
71-103: Group settings resource looks comprehensive
googleworkspace_group_settings.defaultscorrectly applies merged settings per group and depends on group creation.
115-119: Lifecycleignore_changesis appropriate
Ignoringdelivery_settingsprevents unwanted drift in delivery settings made by end users.
121-122: Explicitdepends_onfor membership ordering
Specifyingdepends_on = [googleworkspace_group.defaults, googleworkspace_user.defaults]ensures memberships are created only after both groups and users exist, which is critical for a predictable apply.
| group_id = each.value.group_email | ||
| email = each.value.user_primary_email | ||
| role = upper(each.value.role) | ||
| type = upper(each.value.type) |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Validate membership role and type in variables
You convert role and type to uppercase here. Ensure you enforce allowed values in variables.tf (e.g., OWNER, MANAGER, MEMBER for roles) to prevent invalid inputs from causing apply errors.
🤖 Prompt for AI Agents
In main.tf around lines 110 to 113, you convert the membership `role` and `type`
to uppercase but do not validate their allowed values. To fix this, update
variables.tf to include validation blocks for these variables, specifying
allowed values such as `OWNER`, `MANAGER`, `MEMBER` for `role` and appropriate
values for `type`. This ensures invalid inputs are caught early and prevents
apply errors.
## Summary - trim past release notes from `CHANGELOG.md` ## Testing - `git log -1 --stat`
🤖 I have created a release *beep* *boop* --- ## 0.1.0 (2025-05-23) ### Features * copy over code from old mp module ([#1](#1)) ([ff80ced](ff80ced)) ### Bug Fixes * executed sync operation ([#5](#5)) ([655e994](655e994)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
what
references
Summary by CodeRabbit
New Features
Documentation
Bug Fixes
Tests
Chores