Skip to main content
← Back to list
01Issue
FeatureClosedExtensionsPublic
AssigneesNone

Relationships

#2207 Resource Manager: recursive caller-visible organisation hierarchy inventory with full pagination

Opened by swamp_lord · 9/16/2026

The official organisations model can read one organisation but has no single fan-out method to enumerate nested folders and projects. Please add inventory_hierarchy that traverses folders recursively, follows all folder/project pages, preserves project labels and parent links, and persists a typed hierarchy snapshot. It should fail on permissions, repeated pagination tokens or an explicit maxNodes limit rather than marking partial data complete, and describe coverage as caller-visible. We are extending the official organisations type locally with this method for an organisation management workflow.

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

  • Extension: @swamp/gcp/cloudresourcemanager@2026.09.09.1
  • swamp: 20260911.215321.0-sha.d18f2d86
  • OS: darwin (aarch64)
  • Deno: 2.9.6
  • Shell: /bin/zsh
02Bog Flow
✓OPEN○TRIAGED○IN PROGRESS◉CLOSED

Closed

9/17/2026, 11:25:36 PM

No activity in this phase yet.

03Sludge Pulse
Editable. Press Enter to edit.

swamp_lord commented 9/16/2026, 10:07:03 PM

Related hierarchy-management gap: add a fan-out direct-IAM inventory method over explicit organisation/folder/project names. It should request policy version 3, preserve conditional bindings and etags, and persist one complete current-run snapshot suitable for reports. Any inaccessible policy should fail rather than become an empty policy. Local implementation extends the organisations type with inventory_iam.

swamp_lord commented 9/16/2026, 10:12:09 PM

A further hierarchy-level method gap: targeted add/remove-member changes for organisation/folder/project IAM policies with policy version 3, exact role/condition selection, mandatory etag on mutation, preservation of other bindings/audit configuration, and read-back verification. Project-only helpers exist, but the cross-hierarchy verified operation is missing. Local organisations extension now provides change_hierarchy_binding.

swamp_lord commented 9/16/2026, 11:30:53 PM

Offboarding exposed another lifecycle distinction: GCP projects.delete initially requests soft deletion, but generic swamp delete tombstones every resource on the model, including audit evidence, blocking the post-delete get. We added inspect_offboarding (live project/complete liens) and request_project_deletion on the official projects type. The request method independently validates confirmed project ID/number, retention attestation and no liens, calls DELETE, waits, and verifies DELETE_REQUESTED while retaining evidence. Permanent erasure and retention completion are not inferred.

stack72 commented 9/17/2026, 11:25:34 PM

Resolved in swamp-club/swamp-extensions#293 — the method is now available in the published extension. Upgrade to version 2026.09.17.1 (or .2 for bigquery) to pick it up.

Sign in to post a ripple.