From 6c7a66a308614f7e592d49f0be18bc1beb55cdd7 Mon Sep 17 00:00:00 2001
From: "c1-dev-bot[bot]" <2740113+c1-dev-bot[bot]@users.noreply.github.com>
Date: Tue, 26 May 2026 13:55:27 +0000
Subject: [PATCH] feat: sync Google Group owners as C1 resource owners

Google Workspace groups have an OWNER role for members, but the
connector was ignoring the member.Role field. This adds an ownership
entitlement to groups and grants it to members with the OWNER role,
allowing ConductorOne to use Resource Owner policies for group
ownership.

Fixes: CXH-1555
---
 pkg/connector/group.go | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/pkg/connector/group.go b/pkg/connector/group.go
index ccb67377..9525d86e 100644
--- a/pkg/connector/group.go
+++ b/pkg/connector/group.go
@@ -25,6 +25,7 @@ import (
 
 const (
 	groupMemberEntitlement = "member"
+	groupOwnerEntitlement  = "owner"
 )
 
 type groupResourceType struct {
@@ -95,7 +96,12 @@ func (o *groupResourceType) Entitlements(ctx context.Context, resource *v2.Resou
 	member.Description = fmt.Sprintf("Is member of the %s group in Google Workspace", resource.DisplayName)
 	member.Annotations = annos
 	member.DisplayName = fmt.Sprintf("%s Group Member", resource.DisplayName)
-	return []*v2.Entitlement{member}, nil, nil
+
+	owner := sdkEntitlement.NewOwnershipEntitlement(resource, groupOwnerEntitlement, sdkEntitlement.WithGrantableTo(resourceTypeUser))
+	owner.Description = fmt.Sprintf("Is owner of the %s group in Google Workspace", resource.DisplayName)
+	owner.DisplayName = fmt.Sprintf("%s Group Owner", resource.DisplayName)
+
+	return []*v2.Entitlement{member, owner}, nil, nil
 }
 
 func (o *groupResourceType) Grants(ctx context.Context, resource *v2.Resource, attrs rs.SyncOpAttrs) ([]*v2.Grant, *rs.SyncOpResults, error) {
@@ -150,6 +156,11 @@ func (o *groupResourceType) Grants(ctx context.Context, resource *v2.Resource, a
 
 		grant := sdkGrant.NewGrant(resource, groupMemberEntitlement, gmID, opts...)
 		rv = append(rv, grant)
+
+		if strings.EqualFold(member.Role, "OWNER") && strings.EqualFold(member.Type, "USER") {
+			ownerGrant := sdkGrant.NewGrant(resource, groupOwnerEntitlement, gmID)
+			rv = append(rv, ownerGrant)
+		}
 	}
 
 	nextPage, err := bag.NextToken(members.NextPageToken)