Add Google Workspace user account provisioning

[dsp-ant]

Summary

Adds Google Workspace user account provisioning so that members in certain roles automatically get a @modelcontextprotocol.io account, managed via Pulumi IaC.

Changes

New capabilities

• User provisioning: Members with firstName, lastName, and googleEmailPrefix in roles with provisionUser: true get a GWS user account created automatically
• Existing user import: Members with existingGWSUser: true are imported into Pulumi state (via { import: primaryEmail }) to avoid recreating accounts that already exist in Google Workspace
• Password management: New users get a random 24-char password with changePasswordAtNextLogin: true. Passwords are exported as a Pulumi secret stack output (pulumi stack output --show-secrets newGWSUserPasswords)
• Auto-licensing: All provisioned users are placed in orgUnitPath: "/Members" — configure this OU in Google Admin Console with auto-license assignment for Workspace Business
• Smart group membership: Group membership logic now prefers the provisioned GWS email over the personal email field

Roles with provisionUser: true

• LEAD_MAINTAINERS (new Google config added)
• CORE_MAINTAINERS (new Google config added)
• REGISTRY_MAINTAINERS (existing Google config updated)

Members with GWS user fields (all existing users)

domdomegg, dsp-ant, jspahrsummers, rdimitrov, tadasant, toby

Files modified

File	Change
src/config/roles.ts	Added provisionUser to GoogleConfig, set on 3 roles
src/config/utils.ts	Added firstName, lastName, googleEmailPrefix, existingGWSUser to Member
src/config/users.ts	Added profile fields for 6 existing GWS users
src/google.ts	User provisioning, import logic, password export, orgUnitPath
scripts/validate-config.ts	Validation for googleEmailPrefix uniqueness and completeness
scripts/test-config.ts	4 new tests for provisioning fields
package.json	Added @pulumi/random dependency

Deployment notes

1. Pre-requisite: Create a /Members OU in Google Admin Console and configure auto-license assignment for Workspace Business
2. First deploy: Run pulumi up — existing users will be imported, no new users created yet
3. After import: Remove existingGWSUser: true flags from members (they are only needed for the first deploy)
4. Adding new users: Add firstName, lastName, googleEmailPrefix to a member in a provisionUser role. After deploy, retrieve password with pulumi stack output --show-secrets newGWSUserPasswords

Verification

• npm run validate passes (with expected warnings for members missing profile fields)
• npm run test passes (22/22)

[github-actions]

Pulumi Preview

Click to expand preview output

Previewing update (prod):
  pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:prod::mcp-access::pulumi:pulumi:Stack::mcp-access-prod]
error: Running program '/home/runner/work/access/access/src/index.ts' failed with an unhandled exception:
TSError: ⨯ Unable to compile TypeScript:
src/google.ts(3,25): error TS2307: Cannot find module '@pulumi/random' or its corresponding type declarations.

Resources:
    233 unchanged