Relationships
#2207 Resource Manager: recursive caller-visible organisation hierarchy inventory with full pagination
Opened by swamp_lord · 9/16/2026
The official organisations model can read one organisation but has no single fan-out method to enumerate nested folders and projects. Please add inventory_hierarchy that traverses folders recursively, follows all folder/project pages, preserves project labels and parent links, and persists a typed hierarchy snapshot. It should fail on permissions, repeated pagination tokens or an explicit maxNodes limit rather than marking partial data complete, and describe coverage as caller-visible. We are extending the official organisations type locally with this method for an organisation management workflow.
Upstream repository: https://github.com/swamp-club/swamp-extensions
Environment
- Extension:
@swamp/gcp/cloudresourcemanager@2026.09.09.1 - swamp:
20260911.215321.0-sha.d18f2d86 - OS:
darwin(aarch64) - Deno:
2.9.6 - Shell:
/bin/zsh
Closed
No activity in this phase yet.
swamp_lord commented 9/16/2026, 10:07:03 PM
Related hierarchy-management gap: add a fan-out direct-IAM inventory method over explicit organisation/folder/project names. It should request policy version 3, preserve conditional bindings and etags, and persist one complete current-run snapshot suitable for reports. Any inaccessible policy should fail rather than become an empty policy. Local implementation extends the organisations type with inventory_iam.
swamp_lord commented 9/16/2026, 10:12:09 PM
A further hierarchy-level method gap: targeted add/remove-member changes for organisation/folder/project IAM policies with policy version 3, exact role/condition selection, mandatory etag on mutation, preservation of other bindings/audit configuration, and read-back verification. Project-only helpers exist, but the cross-hierarchy verified operation is missing. Local organisations extension now provides change_hierarchy_binding.
swamp_lord commented 9/16/2026, 11:30:53 PM
Offboarding exposed another lifecycle distinction: GCP projects.delete initially requests soft deletion, but generic swamp delete tombstones every resource on the model, including audit evidence, blocking the post-delete get. We added inspect_offboarding (live project/complete liens) and request_project_deletion on the official projects type. The request method independently validates confirmed project ID/number, retention attestation and no liens, calls DELETE, waits, and verifies DELETE_REQUESTED while retaining evidence. Permanent erasure and retention completion are not inferred.
stack72 commented 9/17/2026, 11:25:34 PM
Resolved in swamp-club/swamp-extensions#293 — the method is now available in the published extension. Upgrade to version 2026.09.17.1 (or .2 for bigquery) to pick it up.
Sign in to post a ripple.