Repository navigation
feat(integrations): Google Cloud connectors (project, folder, organization) and setup script - #1321
Open
JeremyFunk wants to merge 31 commits into
Open
JeremyFunk wants to merge 31 commits into
JeremyFunk wants to merge 31 commits into
Maple Review Bot / Maple / review
succeeded
Oct 16, 2026 in 3m 46s
Confidence 8/10 · No issues found
🟢 Confidence 8/10 · likely safe to merge
Connector lifecycle, org-admin gates and the generated scripts are exercised end to end by bash-executed tests; the only defect I can stand behind is the vacuous secret assertion left open below.
quality 98/100 · 1 note · tests covered · risk medium · 5/5 new units observable · 1 file not read
Adds the Google Cloud connector backend: an org-scoped connector per project, folder or organization, its encrypted push secret, and the converging gcloud setup and cleanup scripts, behind admin-only v2 endpoints. The lifecycle, org scoping and the scripts are covered; safe to merge.
GcpConnectorServiceinserts one connector per org+scope and stores amaple_gcp_…secret encrypted and hash-indexedrenderGcpSetupScript/renderGcpCleanupScriptbuild converging, paste-safe gcloud scripts- New
/v2/integrations/gcpgroup: status for members, admin-only create/update/scripts/delete gcp_connectorstable, migration and OrgId-scoped table registration
Before merge
- Env var · Set
MAPLE_GCP_SERVICE_ACCOUNT_EMAIL(the Google account Maple impersonates) in the prd and dev secret stores, ormetrics_enabledstays a 409 ·apps/api/src/resources/env.ts:84 - Migration · Check it is safe on production data and with the code still deployed ·
packages/db/drizzle/20261015132217_gcp_connectors/migration.sql
Still open from earlier reviews
- 🔵 Note · F1 · Secret assertion cannot fail: the test secret is shorter than the regex floor ·
packages/backend/src/services/integrations/gcp/setup-scripts.test.ts:1249
Production impact
Production traffic of the changed files (last 7 days)
| File | Calls/day | Busiest operations |
|---|---|---|
packages/backend/src/services/integrations/GcpConnectorService.ts |
192 | GcpConnectorService.status 189/day, 0.0% errGcpConnectorService.scripts 3/day, 0.0% err |
packages/domain/src/http/v2/integrations-gcp.ts |
189 | GET /v2/integrations/gcp 189/day, 0.0% err |
Telemetry this change adds and removes (3)
- ➕ span name
GcpConnectorService.create·packages/backend/src/services/integrations/GcpConnectorService.ts:192 - ➕ span name
GcpConnectorService.update·packages/backend/src/services/integrations/GcpConnectorService.ts:242 - ➕ span name
GcpConnectorService.delete·packages/backend/src/services/integrations/GcpConnectorService.ts:329
What was checked
- A disabled API on the removal path stops the script instead of reading as "gone" (
setup-scripts.ts:216,remains) - A connector with metrics on but no
MAPLE_GCP_SERVICE_ACCOUNT_EMAILasks for no metrics permissions, sets up and removes nothing (setup-scripts.ts:824-828, testsetup-scripts.test.ts:1037) - Omitted PATCH flags keep the other capability on under a row lock (
GcpConnectorService.ts:264); a duplicate scope returns 409 throughonConflictDoNothing(...).returning()(`GcpConnectorService.ts:…
Observability coverage: 5 of 5 changes observable
| Change | Kind | Observable | Evidence |
|---|---|---|---|
POST /v2/integrations/gcp/connectors (createConnector) |
inbound HTTP + DB write | yes | http.route/http.request.method spans live on maple-api; Effect.fn("GcpConnectorService.create"); effect-orm db.* attributes live |
PATCH /v2/integrations/gcp/connectors/:id (updateConnector) |
inbound HTTP + DB write | yes | same HTTP instrumentation; Effect.fn("GcpConnectorService.update") |
POST /v2/integrations/gcp/connectors/:id/setup_scripts (setupScripts) |
inbound HTTP + DB read | yes | kickoff production facts: GcpConnectorService.scripts spans on maple-api, ~3/day, p95 65 ms |
DELETE /v2/integrations/gcp/connectors/:id (deleteConnector) |
inbound HTTP + DB delete | yes | same HTTP instrumentation; Effect.fn("GcpConnectorService.delete") |
GET /v2/integrations/gcp (status) |
inbound HTTP + DB read | yes | kickoff production facts: GcpConnectorService.status spans, ~189/day, 0.0% errors |
Files not reviewed (1)
The review ended before it read these diffs, so nothing above vouches for them.
packages/backend/src/services/integrations/gcp/setup-scripts.test.ts
666e58e · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.
Loading