googleworkspaceoauthsync

Overview ¶

Package googleworkspaceoauthsync pulls Google Workspace per-user OAuth grants and upserts them into security_assets (type=OAUTH_APP, labels including 'shadow-it') and oauth_app_grants. Until this package landed, no production producer wrote to either table for Google, so the Shadow IT page showed zero OAuth apps for live tenants even after a successful Google connect.

Design notes:

• Google's Directory API exposes user-granted OAuth tokens via admin.users.tokens.list, which is per-user. The sync walks all known saas_identities for the integration (populated by googleworkspacedirectorysync) and calls tokens.list per user. If saas_identities is empty (e.g., directory sync has not run yet) the sweep returns 0 grants without errors so the cursor still surfaces a "last_synced_at" heartbeat in the connectors UI.
• Each unique OAuth app produces one security_assets row with type=OAUTH_APP and labels=['shadow-it']; one oauth_app_grants row is upserted per (app, user). The unique constraint (organization_id, integration_id, external_app_id, user_email) idempotently converges across retries.
• HTTP failures on a single user log and are surfaced on the cursor's last_error; one user with a token-list permission issue must not abort the whole sweep.