From c9894415f58f30de996b531981ec0bda4206d618 Mon Sep 17 00:00:00 2001
From: Vaibhav Pathak <vaibhav.pathak@Vaibhavs-MacBook-Air.local>
Date: Thu, 26 Feb 2026 16:21:11 +0530
Subject: [PATCH] changes for amdin -2

---
 templates/backstage-configmap.yaml     | 14 ++++++++++++++
 templates/backstage-rbac.yaml          |  3 ++-
 templates/tracked-users-configmap.yaml | 15 +++++++++++++++
 values.yaml                            | 21 +++++++++++++++++++++
 4 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 templates/tracked-users-configmap.yaml

diff --git a/templates/backstage-configmap.yaml b/templates/backstage-configmap.yaml
index 8c021b7..d0120af 100644
--- a/templates/backstage-configmap.yaml
+++ b/templates/backstage-configmap.yaml
@@ -169,3 +169,17 @@ data:
 
     argoWorkflows:
       baseUrl: {{ .Values.integrations.argoWorkflows.url }}
+
+    # Google Workspace Admin Directory API configuration
+    # Used to list all organization users in the Admin page
+    {{- if .Values.googleAdmin.enabled }}
+    googleAdmin:
+      # Service account credentials JSON from GCP Secret Manager
+      serviceAccountCredentials: ${GOOGLE_ADMIN_SA_CREDENTIALS}
+      # Admin email to impersonate (must have admin rights in Google Workspace)
+      adminEmail: {{ .Values.googleAdmin.adminEmail }}
+      # Domain to query for users
+      domain: {{ .Values.googleAdmin.domain }}
+      # Cache TTL in minutes
+      cacheTtlMinutes: {{ .Values.googleAdmin.cacheTtlMinutes | default 5 }}
+    {{- end }}
diff --git a/templates/backstage-rbac.yaml b/templates/backstage-rbac.yaml
index 5a19b32..7e4b77e 100644
--- a/templates/backstage-rbac.yaml
+++ b/templates/backstage-rbac.yaml
@@ -11,7 +11,8 @@ rules:
     resources: ["namespaces"]
     verbs: ["get", "list", "watch", "delete"]
 
-  # Read access to environment resources for display, plus ConfigMap management for allhosts
+  # Read access to environment resources for display, plus ConfigMap management
+  # Used for: allhosts ConfigMap, environment-admin-users, environment-tracked-users
   - apiGroups: [""]
     resources: ["resourcequotas", "limitranges", "pods", "services", "configmaps"]
     verbs: ["get", "list", "watch", "create", "patch", "update"]
diff --git a/templates/tracked-users-configmap.yaml b/templates/tracked-users-configmap.yaml
new file mode 100644
index 0000000..ab6bce6
--- /dev/null
+++ b/templates/tracked-users-configmap.yaml
@@ -0,0 +1,15 @@
+{{- if .Values.trackedUsers.enabled -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: environment-tracked-users
+  namespace: {{ .Values.namespaceOverride }}
+  labels:
+    {{- include "backstage.labels" . | nindent 4 }}
+    app.kubernetes.io/component: tracked-users
+data:
+  users.json: |
+    {
+      "users": []
+    }
+{{- end }}
diff --git a/values.yaml b/values.yaml
index 5e76782..a61ba07 100644
--- a/values.yaml
+++ b/values.yaml
@@ -130,6 +130,27 @@ adminUsers:
   users:
     - vaibhav.pathak
 
+# Tracked Users for Portal Sign-in Tracking
+# Automatically tracks users who sign in via Google OAuth
+trackedUsers:
+  enabled: true
+
+# Google Workspace Admin Directory API configuration
+# Used to list all organization users in the Admin page
+# Prerequisites:
+#   1. Create a Service Account in GCP Console
+#   2. Generate a JSON key and store it in GCP Secret Manager as GOOGLE_ADMIN_SA_CREDENTIALS
+#   3. Enable Domain-Wide Delegation in Google Workspace Admin Console
+#   4. Grant scope: https://www.googleapis.com/auth/admin.directory.user.readonly
+googleAdmin:
+  enabled: true
+  # Admin email to impersonate (must have admin rights in Google Workspace)
+  adminEmail: "admin@onlinesales.ai"
+  # Domain to query for users
+  domain: "onlinesales.ai"
+  # Cache TTL in minutes (default: 5)
+  cacheTtlMinutes: 5
+
 # Service accounts
 serviceAccount:
   create: true