Package io.jenkins.plugins.googlegroupsoauth

Class CloudIdentityDirectGroupResolver

java.lang.Object

io.jenkins.plugins.googlegroupsoauth.CloudIdentityDirectGroupResolver

All Implemented Interfaces:

GroupResolver

@Restricted(org.kohsuke.accmod.restrictions.NoExternalUse.class)
public class CloudIdentityDirectGroupResolver
extends Object
implements GroupResolver

Resolves the user's direct Google Group memberships with the user's own OAuth access token, via the Cloud Identity API GET /v1/groups/-/memberships:searchDirectGroups?query=member_key_id == '<email>'.

Constraints inherent to this mode (documented for operators in the README):

• Direct memberships only — nested groups do not resolve (the transitive API family requires premium Workspace/Cloud Identity editions). Groups used for Jenkins RBAC must be flat.
• Silent filtering — groups whose memberships the caller cannot view are silently omitted by Google. Mitigated operationally by login-time authority logging and Jenkins' built-in /whoAmI page.

Constructor Summary

Constructors

Constructor	Description
CloudIdentityDirectGroupResolver(com.google.api.client.http.HttpTransport transport, Pattern includePattern)

Method Summary

Modifier and Type	Method	Description
List<String>	resolveGroups(String email, String accessToken)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CloudIdentityDirectGroupResolver

public CloudIdentityDirectGroupResolver(@NonNull
 com.google.api.client.http.HttpTransport transport,
 @CheckForNull
 Pattern includePattern)

Method Details

resolveGroups

@NonNull
public List<String> resolveGroups(@NonNull
 String email,
 @NonNull
 String accessToken)
                           throws IOException

Specified by:

resolveGroups in interface GroupResolver

Parameters:

email - the logged-in user's primary email (lowercase)

accessToken - an OAuth access token authorized to look up the user's groups

Returns:

group emails (lowercase), possibly empty; never null

Throws:

IOException - on any lookup failure (network, HTTP 4xx/5xx, malformed response)